@zkp2p/zkp2p-attestation 3.0.0 → 3.1.0

package/dist/index.d.ts

@@ -8,6 +8,7 @@ type SellerCredentialUploadPlatform = "venmo" | "cashapp" | "wise" | "paypal" |
 type PayeeIdSellerCredentialUploadPlatform = Exclude<SellerCredentialUploadPlatform, "wise" | "monobank">;
 type IdentityRequestPlatform = "venmo" | "paypal" | "wise" | "cashapp" | "alipay";
 type IdentityPlatform = IdentityRequestPlatform | "monobank";
+type DisputePlatform = "venmo" | "paypal";
 type BuyerTeeSessionMaterialPlatform = "venmo" | "cashapp" | "monzo" | "wise" | "revolut" | "chime" | "zelle" | "paypal" | "monobank" | "alipay";
 type BuyerTeeHeaderMap = Record<string, string>;
 type RequiredBuyerTeeHeaders<K extends string> = BuyerTeeHeaderMap & {
@@ -60,6 +61,10 @@ interface CashAppIdentitySessionMaterial {
 }
 /** Captured Alipay identity request headers; type requires `Cookie`. */
 type AlipayIdentitySessionMaterial = RequiredBuyerTeeHeaders<"Cookie">;
+/** Complete RFC 5322 dispute email, including authenticated headers and body. */
+interface DisputeEmailSessionMaterial {
+    rawEmail: string;
+}
 interface VenmoBuyerTeeParams {
     SENDER_ID: string;
     index: number;
@@ -137,6 +142,10 @@ interface IdentityActionTypeByPlatform {
     monobank: "register_monobank";
     alipay: "register_alipay";
 }
+interface DisputeActionTypeByPlatform {
+    venmo: "dispute_venmo";
+    paypal: "dispute_paypal";
+}
 interface BuyerTeeSessionMaterialByPlatform {
     venmo: VenmoBuyerTeeSessionMaterial;
     cashapp: CashAppBuyerTeeSessionMaterial;
@@ -156,6 +165,10 @@ interface IdentitySessionMaterialByPlatform {
     cashapp: CashAppIdentitySessionMaterial;
     alipay: AlipayIdentitySessionMaterial;
 }
+interface DisputeSessionMaterialByPlatform {
+    venmo: DisputeEmailSessionMaterial;
+    paypal: DisputeEmailSessionMaterial;
+}
 interface BuyerTeeParamsByPlatform {
     venmo: VenmoBuyerTeeParams;
     cashapp: CashAppBuyerTeeParams;
@@ -175,12 +188,17 @@ interface IdentityParamsByPlatform {
     cashapp: CashAppIdentityParams;
     alipay: AlipayIdentityParams;
 }
+interface DisputeParamsByPlatform {
+    venmo: Record<string, never>;
+    paypal: Record<string, never>;
+}
 /**
  * Flat buyer TEE action union. Prefer `BuyerTeeActionTypeByPlatform[P]`
  * so the action remains tied to its platform.
  */
 type BuyerTeeActionType = BuyerTeeActionTypeByPlatform[BuyerTeeSessionMaterialPlatform];
 type IdentityActionType = IdentityActionTypeByPlatform[IdentityPlatform];
+type DisputeActionType = DisputeActionTypeByPlatform[DisputePlatform];
 interface WiseSellerCredentialSessionMaterial {
     apiToken: string;
     profileId?: string;
@@ -221,12 +239,20 @@ type BuyerTeeVerifyPaymentPayloadFor<P extends BuyerTeeSessionMaterialPlatform>
 type IdentitySessionMaterialPayloadFor<P extends IdentityRequestPlatform> = {
     platform: P;
     actionType: IdentityActionTypeByPlatform[P];
-    callerAddress: string;
     sessionMaterial: IdentitySessionMaterialByPlatform[P];
 };
 type IdentityAttestationRequestPayloadFor<P extends IdentityRequestPlatform> = IdentitySessionMaterialPayloadFor<P> & {
+    callerAddress: string;
     params: IdentityParamsByPlatform[P];
 };
+type DisputeSessionMaterialPayloadFor<P extends DisputePlatform> = {
+    platform: P;
+    actionType: DisputeActionTypeByPlatform[P];
+    sessionMaterial: DisputeSessionMaterialByPlatform[P];
+};
+type DisputeVerifyPayloadFor<P extends DisputePlatform> = DisputeSessionMaterialPayloadFor<P> & {
+    params: DisputeParamsByPlatform[P];
+};
 type BuyerTeeSessionMaterialPayload = {
     [P in BuyerTeeSessionMaterialPlatform]: BuyerTeeSessionMaterialPayloadFor<P>;
 }[BuyerTeeSessionMaterialPlatform];
@@ -239,6 +265,12 @@ type IdentitySessionMaterialPayload = {
 type IdentityAttestationRequestPayload = {
     [P in IdentityRequestPlatform]: IdentityAttestationRequestPayloadFor<P>;
 }[IdentityRequestPlatform];
+type DisputeSessionMaterialPayload = {
+    [P in DisputePlatform]: DisputeSessionMaterialPayloadFor<P>;
+}[DisputePlatform];
+type DisputeVerifyPayload = {
+    [P in DisputePlatform]: DisputeVerifyPayloadFor<P>;
+}[DisputePlatform];
 type VenmoBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"venmo">;
 type CashAppBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"cashapp">;
 type MonzoBuyerTeeSessionMaterialPayload = BuyerTeeSessionMaterialPayloadFor<"monzo">;
@@ -254,6 +286,8 @@ type PayPalIdentitySessionMaterialPayload = IdentitySessionMaterialPayloadFor<"p
 type WiseIdentitySessionMaterialPayload = IdentitySessionMaterialPayloadFor<"wise">;
 type CashAppIdentitySessionMaterialPayload = IdentitySessionMaterialPayloadFor<"cashapp">;
 type AlipayIdentitySessionMaterialPayload = IdentitySessionMaterialPayloadFor<"alipay">;
+type VenmoDisputeSessionMaterialPayload = DisputeSessionMaterialPayloadFor<"venmo">;
+type PayPalDisputeSessionMaterialPayload = DisputeSessionMaterialPayloadFor<"paypal">;
 interface IntentDetails {
     intentHash: string;
     amount: string;
@@ -285,6 +319,10 @@ interface IdentityTypedDataValue {
     issuedAt: string;
     validUntil: string;
 }
+interface DisputeTypedDataValue {
+    intentHash: string;
+    dataHash: string;
+}
 interface AttestationOutput<P extends string = string, A extends string = string> {
     platform: P;
     actionType: A;
@@ -326,6 +364,28 @@ type BuyerTeeAttestationOutputFor<P extends BuyerTeeSessionMaterialPlatform> = A
 type BuyerTeeAttestationOutput = {
     [P in BuyerTeeSessionMaterialPlatform]: BuyerTeeAttestationOutputFor<P>;
 }[BuyerTeeSessionMaterialPlatform];
+interface DisputeDetails {
+    paymentMethod: string;
+    originalPaymentId: string;
+    disputeId: string;
+    paymentAmount: string;
+    paymentCurrency: string;
+}
+interface DisputeAttestationOutputFor<P extends DisputePlatform> {
+    platform: P;
+    actionType: DisputeActionTypeByPlatform[P];
+    signature: string;
+    signer: string;
+    domainSeparator: string;
+    typeHash: string;
+    typedDataSpec: TypedDataSpec;
+    typedDataValue: DisputeTypedDataValue;
+    encodedDisputeDetails: string;
+    disputeDetails: DisputeDetails;
+}
+type DisputeAttestationOutput = {
+    [P in DisputePlatform]: DisputeAttestationOutputFor<P>;
+}[DisputePlatform];
 type BuyerTeeVerifier = {
     [P in BuyerTeeSessionMaterialPlatform]: {
         key: string;
@@ -366,6 +426,7 @@ interface UnifiedPaymentVerifierDomain {
     chainId: number;
     verifyingContract: string;
 }
+type DisputeVerifierDomain = UnifiedPaymentVerifierDomain;
 interface VerifyBuyerTeePaymentAttestationOptionsFor<P extends BuyerTeeSessionMaterialPlatform> {
     trustedSigners: readonly string[];
     expectedPlatform: P;
@@ -376,6 +437,16 @@ interface VerifyBuyerTeePaymentAttestationOptionsFor<P extends BuyerTeeSessionMa
 type VerifyBuyerTeePaymentAttestationOptions = {
     [P in BuyerTeeSessionMaterialPlatform]: VerifyBuyerTeePaymentAttestationOptionsFor<P>;
 }[BuyerTeeSessionMaterialPlatform];
+interface VerifyDisputeAttestationOptionsFor<P extends DisputePlatform> {
+    trustedSigners: readonly string[];
+    expectedPlatform: P;
+    expectedActionType: DisputeActionTypeByPlatform[P];
+    expectedDomain: DisputeVerifierDomain;
+    expectedIntentHash: string;
+}
+type VerifyDisputeAttestationOptions = {
+    [P in DisputePlatform]: VerifyDisputeAttestationOptionsFor<P>;
+}[DisputePlatform];
 interface VerifyIdentityAttestationOptionsFor<P extends IdentityPlatform> {
     trustedSigners: readonly string[];
     expectedPlatform: P;
@@ -396,39 +467,42 @@ interface VerifySellerCredentialBundleOptionsFor<P extends SellerCredentialUploa
 type VerifySellerCredentialBundleOptions = {
     [P in SellerCredentialUploadPlatform]: VerifySellerCredentialBundleOptionsFor<P>;
 }[SellerCredentialUploadPlatform];
-type CreateEncryptedSellerCredentialUploadParams = CreateEncryptedSellerCredentialUploadBaseParams & SellerCredentialUploadPayload;
-type CreateEncryptedIdentitySessionMaterialParamsFor<P extends IdentityRequestPlatform> = CreateEncryptedBuyerTeeSessionMaterialBaseParams & IdentitySessionMaterialPayloadFor<P>;
+type CreateEncryptedSellerCredentialUploadParams = SellerCredentialRequestBaseParams & SellerCredentialUploadPayload;
+type CreateEncryptedIdentitySessionMaterialParamsFor<P extends IdentityRequestPlatform> = AttestationServiceRequestBaseParams & IdentitySessionMaterialPayloadFor<P>;
 type CreateEncryptedIdentitySessionMaterialParams = {
     [P in IdentityRequestPlatform]: CreateEncryptedIdentitySessionMaterialParamsFor<P>;
 }[IdentityRequestPlatform];
-type CreateEncryptedBuyerTeeSessionMaterialParamsFor<P extends BuyerTeeSessionMaterialPlatform> = CreateEncryptedBuyerTeeSessionMaterialBaseParams & BuyerTeeSessionMaterialPayloadFor<P>;
+type CreateEncryptedBuyerTeeSessionMaterialParamsFor<P extends BuyerTeeSessionMaterialPlatform> = AttestationServiceRequestBaseParams & BuyerTeeSessionMaterialPayloadFor<P>;
 type CreateEncryptedBuyerTeeSessionMaterialParams = {
     [P in BuyerTeeSessionMaterialPlatform]: CreateEncryptedBuyerTeeSessionMaterialParamsFor<P>;
 }[BuyerTeeSessionMaterialPlatform];
-type VerifyBuyerTeePaymentParamsFor<P extends BuyerTeeSessionMaterialPlatform> = CreateEncryptedBuyerTeeSessionMaterialBaseParams & BuyerTeeVerifyPaymentPayloadFor<P> & {
+type CreateEncryptedDisputeSessionMaterialParamsFor<P extends DisputePlatform> = AttestationServiceRequestBaseParams & DisputeSessionMaterialPayloadFor<P>;
+type CreateEncryptedDisputeSessionMaterialParams = {
+    [P in DisputePlatform]: CreateEncryptedDisputeSessionMaterialParamsFor<P>;
+}[DisputePlatform];
+type VerifyBuyerTeePaymentParamsFor<P extends BuyerTeeSessionMaterialPlatform> = AttestationServiceRequestBaseParams & BuyerTeeVerifyPaymentPayloadFor<P> & {
     chainId: number;
     intent: IntentDetails;
 };
 type VerifyBuyerTeePaymentParams = {
     [P in BuyerTeeSessionMaterialPlatform]: VerifyBuyerTeePaymentParamsFor<P>;
 }[BuyerTeeSessionMaterialPlatform];
-type RequestIdentityAttestationParamsFor<P extends IdentityRequestPlatform> = CreateEncryptedBuyerTeeSessionMaterialBaseParams & IdentityAttestationRequestPayloadFor<P>;
+type RequestIdentityAttestationParamsFor<P extends IdentityRequestPlatform> = AttestationServiceRequestBaseParams & IdentityAttestationRequestPayloadFor<P>;
 type RequestIdentityAttestationParams = {
     [P in IdentityRequestPlatform]: RequestIdentityAttestationParamsFor<P>;
 }[IdentityRequestPlatform];
-type UploadSellerCredentialParams = CreateEncryptedSellerCredentialUploadBaseParams & UploadSellerCredentialPayload;
-interface CreateEncryptedSellerCredentialUploadBaseParams {
-    attestationServiceUrl: string;
+type VerifyDisputeParamsFor<P extends DisputePlatform> = AttestationServiceRequestBaseParams & DisputeVerifyPayloadFor<P> & {
+    chainId: number;
+    intentHash: string;
+};
+type VerifyDisputeParams = {
+    [P in DisputePlatform]: VerifyDisputeParamsFor<P>;
+}[DisputePlatform];
+type UploadSellerCredentialParams = SellerCredentialRequestBaseParams & UploadSellerCredentialPayload;
+interface SellerCredentialRequestBaseParams extends AttestationServiceRequestBaseParams {
     callerAddress?: string;
-    trust?: TrustPins;
-    fetch?: typeof fetch;
-    subtle?: SubtleCrypto;
-    getRandomValues?: (out: Uint8Array) => Uint8Array;
-    now?: () => number;
-    onWarning?: (warning: NitroAttestationWarning) => void;
-    timeoutMs?: number;
 }
-interface CreateEncryptedBuyerTeeSessionMaterialBaseParams {
+interface AttestationServiceRequestBaseParams {
     attestationServiceUrl: string;
     trust?: TrustPins;
     fetch?: typeof fetch;
@@ -471,14 +545,18 @@ interface VerifiedAttestationPayload {
     };
 }
 type EncryptSellerCredentialUploadParams = EncryptSellerCredentialUploadBaseParams & SellerCredentialUploadPayload;
-type EncryptBuyerTeeSessionMaterialParamsFor<P extends BuyerTeeSessionMaterialPlatform> = EncryptBuyerTeeSessionMaterialBaseParams & BuyerTeeSessionMaterialPayloadFor<P>;
+type EncryptBuyerTeeSessionMaterialParamsFor<P extends BuyerTeeSessionMaterialPlatform> = EncryptTeeSessionMaterialBaseParams & BuyerTeeSessionMaterialPayloadFor<P>;
 type EncryptBuyerTeeSessionMaterialParams = {
     [P in BuyerTeeSessionMaterialPlatform]: EncryptBuyerTeeSessionMaterialParamsFor<P>;
 }[BuyerTeeSessionMaterialPlatform];
-type EncryptIdentitySessionMaterialParamsFor<P extends IdentityRequestPlatform> = EncryptBuyerTeeSessionMaterialBaseParams & IdentitySessionMaterialPayloadFor<P>;
+type EncryptIdentitySessionMaterialParamsFor<P extends IdentityRequestPlatform> = EncryptTeeSessionMaterialBaseParams & IdentitySessionMaterialPayloadFor<P>;
 type EncryptIdentitySessionMaterialParams = {
     [P in IdentityRequestPlatform]: EncryptIdentitySessionMaterialParamsFor<P>;
 }[IdentityRequestPlatform];
+type EncryptDisputeSessionMaterialParamsFor<P extends DisputePlatform> = EncryptTeeSessionMaterialBaseParams & DisputeSessionMaterialPayloadFor<P>;
+type EncryptDisputeSessionMaterialParams = {
+    [P in DisputePlatform]: EncryptDisputeSessionMaterialParamsFor<P>;
+}[DisputePlatform];
 interface EncryptSellerCredentialUploadBaseParams {
     key: AttestedSellerUploadKey;
     callerAddress?: string;
@@ -488,7 +566,7 @@ interface EncryptSellerCredentialUploadBaseParams {
     getRandomValues?: (out: Uint8Array) => Uint8Array;
     now?: () => number;
 }
-interface EncryptBuyerTeeSessionMaterialBaseParams {
+interface EncryptTeeSessionMaterialBaseParams {
     key: AttestedSellerUploadKey;
     subtle?: SubtleCrypto;
     getRandomValues?: (out: Uint8Array) => Uint8Array;
@@ -509,24 +587,30 @@ type NitroAttestationClientCreateEncryptedSellerCredentialUploadParams = WithOpt
 type NitroAttestationClientUploadSellerCredentialParams = WithOptionalAttestationServiceUrl<UploadSellerCredentialParams>;
 type NitroAttestationClientCreateEncryptedBuyerTeeSessionMaterialParams = WithOptionalAttestationServiceUrl<CreateEncryptedBuyerTeeSessionMaterialParams>;
 type NitroAttestationClientCreateEncryptedIdentitySessionMaterialParams = WithOptionalAttestationServiceUrl<CreateEncryptedIdentitySessionMaterialParams>;
+type NitroAttestationClientCreateEncryptedDisputeSessionMaterialParams = WithOptionalAttestationServiceUrl<CreateEncryptedDisputeSessionMaterialParams>;
 type NitroAttestationClientRequestIdentityAttestationParams = WithOptionalAttestationServiceUrl<RequestIdentityAttestationParams>;
 type NitroAttestationClientVerifyBuyerTeePaymentParamsFor<P extends BuyerTeeSessionMaterialPlatform> = WithOptionalAttestationServiceUrl<VerifyBuyerTeePaymentParamsFor<P>>;
 type NitroAttestationClientVerifyBuyerTeePaymentParams = WithOptionalAttestationServiceUrl<VerifyBuyerTeePaymentParams>;
+type NitroAttestationClientVerifyDisputeParamsFor<P extends DisputePlatform> = WithOptionalAttestationServiceUrl<VerifyDisputeParamsFor<P>>;
+type NitroAttestationClientVerifyDisputeParams = WithOptionalAttestationServiceUrl<VerifyDisputeParams>;
 type WithOptionalAttestationServiceUrl<T> = T extends unknown ? Omit<T, "attestationServiceUrl"> & {
     attestationServiceUrl?: string;
 } : never;
 interface NitroAttestationClient {
     createEncryptedBuyerTeeSessionMaterial(params: NitroAttestationClientCreateEncryptedBuyerTeeSessionMaterialParams): Promise<string>;
     createEncryptedIdentitySessionMaterial(params: NitroAttestationClientCreateEncryptedIdentitySessionMaterialParams): Promise<string>;
+    createEncryptedDisputeSessionMaterial(params: NitroAttestationClientCreateEncryptedDisputeSessionMaterialParams): Promise<string>;
     createEncryptedSellerCredentialUpload(params: NitroAttestationClientCreateEncryptedSellerCredentialUploadParams): Promise<string>;
     requestIdentityAttestation<P extends IdentityRequestPlatform>(params: WithOptionalAttestationServiceUrl<RequestIdentityAttestationParamsFor<P>>): Promise<IdentityAttestationOutputFor<P>>;
     uploadSellerCredential(params: NitroAttestationClientUploadSellerCredentialParams): Promise<SellerCredentialBundle>;
     verifyBuyerTeePayment<P extends BuyerTeeSessionMaterialPlatform>(params: NitroAttestationClientVerifyBuyerTeePaymentParamsFor<P>): Promise<BuyerTeeAttestationOutputFor<P>>;
+    verifyDispute<P extends DisputePlatform>(params: NitroAttestationClientVerifyDisputeParamsFor<P>): Promise<DisputeAttestationOutputFor<P>>;
     fetchAndVerifyAttestation(params?: Omit<FetchAndVerifyAttestationParams, "attestationServiceUrl"> & {
         attestationServiceUrl?: string;
     }): Promise<VerifiedAttestation>;
     encryptBuyerTeeSessionMaterial(params: EncryptBuyerTeeSessionMaterialParams): Promise<string>;
     encryptIdentitySessionMaterial(params: EncryptIdentitySessionMaterialParams): Promise<string>;
+    encryptDisputeSessionMaterial(params: EncryptDisputeSessionMaterialParams): Promise<string>;
     encryptSellerCredentialUpload(params: EncryptSellerCredentialUploadParams): Promise<string>;
 }
 
@@ -534,15 +618,20 @@ declare function createNitroAttestationClient(options: NitroAttestationClientOpt
 
 declare function createEncryptedBuyerTeeSessionMaterial<P extends BuyerTeeSessionMaterialPlatform>(params: CreateEncryptedBuyerTeeSessionMaterialParamsFor<P>): Promise<string>;
 
+declare function createEncryptedDisputeSessionMaterial<P extends DisputePlatform>(params: CreateEncryptedDisputeSessionMaterialParamsFor<P>): Promise<string>;
+
 declare function createEncryptedIdentitySessionMaterial<P extends IdentityRequestPlatform>(params: CreateEncryptedIdentitySessionMaterialParamsFor<P>): Promise<string>;
 
 declare function createEncryptedSellerCredentialUpload(params: CreateEncryptedSellerCredentialUploadParams): Promise<string>;
 
 declare function getUnifiedPaymentVerifierDomainSeparator(params: UnifiedPaymentVerifierDomain): string;
+declare function getDisputeVerifierDomainSeparator(params: DisputeVerifierDomain): string;
 declare function hashUtf8(value: string): string;
 
 declare function encryptBuyerTeeSessionMaterial<P extends BuyerTeeSessionMaterialPlatform>(params: EncryptBuyerTeeSessionMaterialParamsFor<P>): Promise<string>;
 
+declare function encryptDisputeSessionMaterial<P extends DisputePlatform>(params: EncryptDisputeSessionMaterialParamsFor<P>): Promise<string>;
+
 declare function encryptIdentitySessionMaterial<P extends IdentityRequestPlatform>(params: EncryptIdentitySessionMaterialParamsFor<P>): Promise<string>;
 
 declare function encryptSellerCredentialUpload(params: EncryptSellerCredentialUploadParams): Promise<string>;
@@ -577,8 +666,12 @@ declare function verifyBuyerTeePayment<P extends BuyerTeeSessionMaterialPlatform
 
 declare function verifyBuyerTeePaymentAttestation<P extends BuyerTeeSessionMaterialPlatform>(payload: BuyerTeeAttestationOutputFor<P>, options: VerifyBuyerTeePaymentAttestationOptionsFor<P>): BuyerTeeAttestationOutputFor<P>;
 
+declare function verifyDispute<P extends DisputePlatform>(params: VerifyDisputeParamsFor<P>): Promise<DisputeAttestationOutputFor<P>>;
+
+declare function verifyDisputeAttestation<P extends DisputePlatform>(payload: DisputeAttestationOutputFor<P>, options: VerifyDisputeAttestationOptionsFor<P>): DisputeAttestationOutputFor<P>;
+
 declare function verifyIdentityAttestation<P extends IdentityPlatform>(payload: IdentityAttestationOutputFor<P>, options: VerifyIdentityAttestationOptionsFor<P>): NormalizedIdentityDetails<P>;
 
 declare function verifySellerCredentialBundle<P extends SellerCredentialUploadPlatform>(bundle: SellerCredentialBundleFor<P>, options: VerifySellerCredentialBundleOptionsFor<P>): SellerCredentialBundleFor<P>;
 
-export { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM, type AlipayBuyerTeeParams, type AlipayBuyerTeeSessionMaterial, type AlipayBuyerTeeSessionMaterialPayload, type AlipayIdentityParams, type AlipayIdentitySessionMaterial, type AlipayIdentitySessionMaterialPayload, type AttestationOutput, type AttestedSellerUploadKey, type BankOfAmericaBuyerTeeSessionMaterial, type BuyerTeeActionType, type BuyerTeeActionTypeByPlatform, type BuyerTeeAttestationOutput, type BuyerTeeAttestationOutputFor, type BuyerTeeHeaderMap, type BuyerTeeParamsByPlatform, type BuyerTeeSessionMaterialByPlatform, type BuyerTeeSessionMaterialPayload, type BuyerTeeSessionMaterialPayloadFor, type BuyerTeeSessionMaterialPlatform, type BuyerTeeSupportedVerifiersResponse, type BuyerTeeVerifier, type BuyerTeeVerifyPaymentPayload, type BuyerTeeVerifyPaymentPayloadFor, type CashAppBuyerTeeParams, type CashAppBuyerTeeSessionMaterial, type CashAppBuyerTeeSessionMaterialPayload, type CashAppIdentityParams, type CashAppIdentitySessionMaterial, type CashAppIdentitySessionMaterialPayload, type ChaseBuyerTeeSessionMaterial, type ChimeBuyerTeeParams, type ChimeBuyerTeeSessionMaterial, type ChimeBuyerTeeSessionMaterialPayload, type CitiBuyerTeeSessionMaterial, type CreateEncryptedBuyerTeeSessionMaterialParams, type CreateEncryptedBuyerTeeSessionMaterialParamsFor, type CreateEncryptedIdentitySessionMaterialParams, type CreateEncryptedIdentitySessionMaterialParamsFor, type CreateEncryptedSellerCredentialUploadParams, type Eip712Field, type EncryptBuyerTeeSessionMaterialParams, type EncryptBuyerTeeSessionMaterialParamsFor, type EncryptIdentitySessionMaterialParams, type EncryptIdentitySessionMaterialParamsFor, type EncryptSellerCredentialUploadParams, type FetchAndVerifyAttestationParams, type IdentityActionType, type IdentityActionTypeByPlatform, type IdentityAttestationOutput, type IdentityAttestationOutputFor, type IdentityAttestationRequestPayload, type IdentityAttestationRequestPayloadFor, type IdentityParamsByPlatform, type IdentityPlatform, type IdentityRequestPlatform, type IdentitySessionMaterialByPlatform, type IdentitySessionMaterialPayload, type IdentitySessionMaterialPayloadFor, type IdentityTypedDataValue, type IntentDetails, type MonobankBuyerTeeParams, type MonobankBuyerTeeSessionMaterial, type MonobankBuyerTeeSessionMaterialPayload, type MonobankSellerCredentialSessionMaterial, type MonobankSellerCredentialUploadPayload, type MonzoBuyerTeeParams, type MonzoBuyerTeeSessionMaterial, type MonzoBuyerTeeSessionMaterialPayload, type NitroAttestationClient, type NitroAttestationClientCreateEncryptedBuyerTeeSessionMaterialParams, type NitroAttestationClientCreateEncryptedIdentitySessionMaterialParams, type NitroAttestationClientCreateEncryptedSellerCredentialUploadParams, type NitroAttestationClientOptions, type NitroAttestationClientRequestIdentityAttestationParams, type NitroAttestationClientUploadSellerCredentialParams, type NitroAttestationClientVerifyBuyerTeePaymentParams, type NitroAttestationClientVerifyBuyerTeePaymentParamsFor, type NitroAttestationEnvironment, NitroAttestationError, type NitroAttestationErrorCode, type NitroAttestationWarning, type NitroServiceResponseErrorDetails, type NormalizedIdentityDetails, type PayPalBuyerTeeParams, type PayPalBuyerTeeSessionMaterial, type PayPalBuyerTeeSessionMaterialPayload, type PayPalIdentityParams, type PayPalIdentitySessionMaterial, type PayPalIdentitySessionMaterialPayload, type PayeeIdSellerCredentialUploadPayload, type PayeeIdSellerCredentialUploadPlatform, type PayeeIdSellerCredentialUploadWithPlatformPayload, type PaymentTypedDataValue, type RequestIdentityAttestationParams, type RequestIdentityAttestationParamsFor, type RevolutBuyerTeeParams, type RevolutBuyerTeeSessionMaterial, type RevolutBuyerTeeSessionMaterialPayload, type SellerCredentialBundle, type SellerCredentialBundleFor, type SellerCredentialUploadPayload, type SellerCredentialUploadPlatform, type TrustPins, type TypedDataSpec, type UnifiedPaymentVerifierDomain, type UploadSellerCredentialParams, type UploadSellerCredentialPayload, type VenmoBuyerTeeParams, type VenmoBuyerTeeSessionMaterial, type VenmoBuyerTeeSessionMaterialPayload, type VenmoIdentityParams, type VenmoIdentitySessionMaterial, type VenmoIdentitySessionMaterialPayload, type VerifiedAttestation, type VerifiedAttestationPayload, type VerifyBuyerTeePaymentAttestationOptions, type VerifyBuyerTeePaymentAttestationOptionsFor, type VerifyBuyerTeePaymentParams, type VerifyBuyerTeePaymentParamsFor, type VerifyIdentityAttestationOptions, type VerifyIdentityAttestationOptionsFor, type VerifySellerCredentialBundleOptions, type VerifySellerCredentialBundleOptionsFor, type WiseBuyerTeeParams, type WiseBuyerTeeSessionMaterial, type WiseBuyerTeeSessionMaterialPayload, type WiseIdentityParams, type WiseIdentitySessionMaterial, type WiseIdentitySessionMaterialPayload, type WiseSellerCredentialSessionMaterial, type WiseSellerCredentialUploadPayload, type ZelleBuyerTeeActionType, type ZelleBuyerTeeParams, type ZelleBuyerTeeSessionMaterial, type ZelleBuyerTeeSessionMaterialByActionType, type ZelleBuyerTeeSessionMaterialPayload, type ZelleBuyerTeeVerifyPaymentPayload, createEncryptedBuyerTeeSessionMaterial, createEncryptedIdentitySessionMaterial, createEncryptedSellerCredentialUpload, createNitroAttestationClient, encryptBuyerTeeSessionMaterial, encryptIdentitySessionMaterial, encryptSellerCredentialUpload, fetchAndVerifyAttestation, getUnifiedPaymentVerifierDomainSeparator, hashUtf8, requestIdentityAttestation, uploadSellerCredential, verifyBuyerTeePayment, verifyBuyerTeePaymentAttestation, verifyIdentityAttestation, verifySellerCredentialBundle };
+export { AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX, AWS_NITRO_ROOT_PEM, type AlipayBuyerTeeParams, type AlipayBuyerTeeSessionMaterial, type AlipayBuyerTeeSessionMaterialPayload, type AlipayIdentityParams, type AlipayIdentitySessionMaterial, type AlipayIdentitySessionMaterialPayload, type AttestationOutput, type AttestedSellerUploadKey, type BankOfAmericaBuyerTeeSessionMaterial, type BuyerTeeActionType, type BuyerTeeActionTypeByPlatform, type BuyerTeeAttestationOutput, type BuyerTeeAttestationOutputFor, type BuyerTeeHeaderMap, type BuyerTeeParamsByPlatform, type BuyerTeeSessionMaterialByPlatform, type BuyerTeeSessionMaterialPayload, type BuyerTeeSessionMaterialPayloadFor, type BuyerTeeSessionMaterialPlatform, type BuyerTeeSupportedVerifiersResponse, type BuyerTeeVerifier, type BuyerTeeVerifyPaymentPayload, type BuyerTeeVerifyPaymentPayloadFor, type CashAppBuyerTeeParams, type CashAppBuyerTeeSessionMaterial, type CashAppBuyerTeeSessionMaterialPayload, type CashAppIdentityParams, type CashAppIdentitySessionMaterial, type CashAppIdentitySessionMaterialPayload, type ChaseBuyerTeeSessionMaterial, type ChimeBuyerTeeParams, type ChimeBuyerTeeSessionMaterial, type ChimeBuyerTeeSessionMaterialPayload, type CitiBuyerTeeSessionMaterial, type CreateEncryptedBuyerTeeSessionMaterialParams, type CreateEncryptedBuyerTeeSessionMaterialParamsFor, type CreateEncryptedDisputeSessionMaterialParams, type CreateEncryptedDisputeSessionMaterialParamsFor, type CreateEncryptedIdentitySessionMaterialParams, type CreateEncryptedIdentitySessionMaterialParamsFor, type CreateEncryptedSellerCredentialUploadParams, type DisputeActionType, type DisputeActionTypeByPlatform, type DisputeAttestationOutput, type DisputeAttestationOutputFor, type DisputeDetails, type DisputeEmailSessionMaterial, type DisputeParamsByPlatform, type DisputePlatform, type DisputeSessionMaterialByPlatform, type DisputeSessionMaterialPayload, type DisputeSessionMaterialPayloadFor, type DisputeTypedDataValue, type DisputeVerifierDomain, type DisputeVerifyPayload, type DisputeVerifyPayloadFor, type Eip712Field, type EncryptBuyerTeeSessionMaterialParams, type EncryptBuyerTeeSessionMaterialParamsFor, type EncryptDisputeSessionMaterialParams, type EncryptDisputeSessionMaterialParamsFor, type EncryptIdentitySessionMaterialParams, type EncryptIdentitySessionMaterialParamsFor, type EncryptSellerCredentialUploadParams, type FetchAndVerifyAttestationParams, type IdentityActionType, type IdentityActionTypeByPlatform, type IdentityAttestationOutput, type IdentityAttestationOutputFor, type IdentityAttestationRequestPayload, type IdentityAttestationRequestPayloadFor, type IdentityParamsByPlatform, type IdentityPlatform, type IdentityRequestPlatform, type IdentitySessionMaterialByPlatform, type IdentitySessionMaterialPayload, type IdentitySessionMaterialPayloadFor, type IdentityTypedDataValue, type IntentDetails, type MonobankBuyerTeeParams, type MonobankBuyerTeeSessionMaterial, type MonobankBuyerTeeSessionMaterialPayload, type MonobankSellerCredentialSessionMaterial, type MonobankSellerCredentialUploadPayload, type MonzoBuyerTeeParams, type MonzoBuyerTeeSessionMaterial, type MonzoBuyerTeeSessionMaterialPayload, type NitroAttestationClient, type NitroAttestationClientCreateEncryptedBuyerTeeSessionMaterialParams, type NitroAttestationClientCreateEncryptedDisputeSessionMaterialParams, type NitroAttestationClientCreateEncryptedIdentitySessionMaterialParams, type NitroAttestationClientCreateEncryptedSellerCredentialUploadParams, type NitroAttestationClientOptions, type NitroAttestationClientRequestIdentityAttestationParams, type NitroAttestationClientUploadSellerCredentialParams, type NitroAttestationClientVerifyBuyerTeePaymentParams, type NitroAttestationClientVerifyBuyerTeePaymentParamsFor, type NitroAttestationClientVerifyDisputeParams, type NitroAttestationClientVerifyDisputeParamsFor, type NitroAttestationEnvironment, NitroAttestationError, type NitroAttestationErrorCode, type NitroAttestationWarning, type NitroServiceResponseErrorDetails, type NormalizedIdentityDetails, type PayPalBuyerTeeParams, type PayPalBuyerTeeSessionMaterial, type PayPalBuyerTeeSessionMaterialPayload, type PayPalDisputeSessionMaterialPayload, type PayPalIdentityParams, type PayPalIdentitySessionMaterial, type PayPalIdentitySessionMaterialPayload, type PayeeIdSellerCredentialUploadPayload, type PayeeIdSellerCredentialUploadPlatform, type PayeeIdSellerCredentialUploadWithPlatformPayload, type PaymentTypedDataValue, type RequestIdentityAttestationParams, type RequestIdentityAttestationParamsFor, type RevolutBuyerTeeParams, type RevolutBuyerTeeSessionMaterial, type RevolutBuyerTeeSessionMaterialPayload, type SellerCredentialBundle, type SellerCredentialBundleFor, type SellerCredentialUploadPayload, type SellerCredentialUploadPlatform, type TrustPins, type TypedDataSpec, type UnifiedPaymentVerifierDomain, type UploadSellerCredentialParams, type UploadSellerCredentialPayload, type VenmoBuyerTeeParams, type VenmoBuyerTeeSessionMaterial, type VenmoBuyerTeeSessionMaterialPayload, type VenmoDisputeSessionMaterialPayload, type VenmoIdentityParams, type VenmoIdentitySessionMaterial, type VenmoIdentitySessionMaterialPayload, type VerifiedAttestation, type VerifiedAttestationPayload, type VerifyBuyerTeePaymentAttestationOptions, type VerifyBuyerTeePaymentAttestationOptionsFor, type VerifyBuyerTeePaymentParams, type VerifyBuyerTeePaymentParamsFor, type VerifyDisputeAttestationOptions, type VerifyDisputeAttestationOptionsFor, type VerifyDisputeParams, type VerifyDisputeParamsFor, type VerifyIdentityAttestationOptions, type VerifyIdentityAttestationOptionsFor, type VerifySellerCredentialBundleOptions, type VerifySellerCredentialBundleOptionsFor, type WiseBuyerTeeParams, type WiseBuyerTeeSessionMaterial, type WiseBuyerTeeSessionMaterialPayload, type WiseIdentityParams, type WiseIdentitySessionMaterial, type WiseIdentitySessionMaterialPayload, type WiseSellerCredentialSessionMaterial, type WiseSellerCredentialUploadPayload, type ZelleBuyerTeeActionType, type ZelleBuyerTeeParams, type ZelleBuyerTeeSessionMaterial, type ZelleBuyerTeeSessionMaterialByActionType, type ZelleBuyerTeeSessionMaterialPayload, type ZelleBuyerTeeVerifyPaymentPayload, createEncryptedBuyerTeeSessionMaterial, createEncryptedDisputeSessionMaterial, createEncryptedIdentitySessionMaterial, createEncryptedSellerCredentialUpload, createNitroAttestationClient, encryptBuyerTeeSessionMaterial, encryptDisputeSessionMaterial, encryptIdentitySessionMaterial, encryptSellerCredentialUpload, fetchAndVerifyAttestation, getDisputeVerifierDomainSeparator, getUnifiedPaymentVerifierDomainSeparator, hashUtf8, requestIdentityAttestation, uploadSellerCredential, verifyBuyerTeePayment, verifyBuyerTeePaymentAttestation, verifyDispute, verifyDisputeAttestation, verifyIdentityAttestation, verifySellerCredentialBundle };

package/dist/index.js

@@ -1,4 +1,4 @@
-var U=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function o(e,t,r){throw new U(e,t,r)}async function S(e,t,r){try{return await e}catch(n){o(t,r,{cause:n})}}function G(e){return e!==void 0?(typeof e!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),e):(typeof globalThis.fetch!="function"&&o("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),globalThis.fetch.bind(globalThis))}function tt(e){let t=e??globalThis.crypto?.subtle;return t||o("CRYPTO_UNAVAILABLE","SubtleCrypto is unavailable; pass params.subtle"),t}function rt(e){if(e)return e;let t=globalThis.crypto;return typeof t?.getRandomValues!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),r=>t.getRandomValues(r)}function h(e){return{subtle:tt(e.subtle),getRandomValues:rt(e.getRandomValues)}}function Ae(e,t){return typeof t!="function"&&o("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),{subtle:e,getRandomValues:t,randomUUID:()=>nt(t)}}function nt(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}var V="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",$=it(V);function it(e){let t={};for(let r=0;r<e.length;r+=1)t[e[r]]=r;return t}function g(e){let t="";for(let r of e)t+=r.toString(16).padStart(2,"0");return t}function x(e){if(typeof TextEncoder<"u")return new TextEncoder().encode(e);let t=[];for(let r=0;r<e.length;r+=1){let n=e.codePointAt(r);n>65535&&(r+=1),n<=127?t.push(n):n<=2047?t.push(192|n>>6,128|n&63):n<=65535?t.push(224|n>>12,128|n>>6&63,128|n&63):t.push(240|n>>18,128|n>>12&63,128|n>>6&63,128|n&63)}return new Uint8Array(t)}function w(e){if(typeof TextDecoder<"u")return new TextDecoder().decode(e);let t="";for(let r=0;r<e.length;r+=1){let n=e[r];n<128?t+=String.fromCodePoint(n):(n&224)===192?t+=String.fromCodePoint((n&31)<<6|e[++r]&63):(n&240)===224?t+=String.fromCodePoint((n&15)<<12|(e[++r]&63)<<6|e[++r]&63):t+=String.fromCodePoint((n&7)<<18|(e[++r]&63)<<12|(e[++r]&63)<<6|e[++r]&63)}return t}function ot(e){let t="";for(let r=0;r<e.length;r+=3){let n=e[r],i=e[r+1]??0,s=e[r+2]??0,a=n<<16|i<<8|s;t+=V[a>>18&63],t+=V[a>>12&63],t+=r+1<e.length?V[a>>6&63]:"=",t+=r+2<e.length?V[a&63]:"="}return t}function Te(e){return st(e,!1)}function O(e){return ot(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function st(e,t){let r=e.replace(/\s+/g,""),n=t?r.replaceAll("-","+").replaceAll("_","/"):r;if(n.length%4===1)throw new Error("Invalid base64 length");let i=n+"=".repeat((4-n.length%4)%4),s=[];for(let a=0;a<i.length;a+=4){let l=i.slice(a,a+4),u=l.endsWith("==")?2:l.endsWith("=")?1:0,c=q(l[0],$),d=q(l[1],$),f=l[2]==="="?0:q(l[2],$),T=l[3]==="="?0:q(l[3],$),p=c<<18|d<<12|f<<6|T;s.push(p>>16&255),u<2&&s.push(p>>8&255),u<1&&s.push(p&255)}return new Uint8Array(s)}function q(e,t){let r=t[e];if(r===void 0)throw new Error(`Invalid base64 character: ${e}`);return r}function b(e){let t=e.reduce((i,s)=>i+s.length,0),r=new Uint8Array(t),n=0;for(let i of e)r.set(i,n),n+=i.length;return r}function E(e){return new Uint8Array(e).buffer}function Se(e){let t={sessionMaterial:e.sessionMaterial,...e.callerAddress!==void 0?{callerAddress:e.callerAddress}:{},boundPubKeySha256:e.key.publicKeySha256Hex,issuedAtMs:e.issuedAtMs,jweId:e.jweId};return e.platform==="wise"||e.platform==="monobank"?t:{payeeId:e.payeeId,...t}}function ge(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function Ee(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:{callerAddress:e.callerAddress,sessionMaterial:e.sessionMaterial},boundPubKeySha256:e.key.publicKeySha256Hex}}function Ie(e){return JSON.stringify(e)}var at={alg:"RSA-OAEP-256",enc:"A256GCM"},ct=/^[A-Za-z0-9_-]{16,128}$/;async function Pe(e){let t=e.request.issuedAtMs??e.now(),r=e.request.jweId??ut(e.getRandomValues);return lt(r),J({key:e.request.key,plaintext:Se({...e.request,issuedAtMs:t,jweId:r}),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"seller credential upload"})}async function he(e){return J({key:e.request.key,plaintext:ge(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"buyer TEE session material"})}async function xe(e){return J({key:e.request.key,plaintext:Ee(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"identity session material"})}async function J(e){let t=x(Ie(e.plaintext)),r=e.getRandomValues(new Uint8Array(32)),n=await S(e.subtle.importKey("spki",E(e.key.publicKeyDer),{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import attested enclave-upload RSA public key"),i=new Uint8Array(await S(e.subtle.encrypt({name:"RSA-OAEP"},n,E(r)),"CRYPTO_UNAVAILABLE","Failed to RSA-OAEP encrypt the content encryption key")),s=e.getRandomValues(new Uint8Array(12)),a=O(x(JSON.stringify(at))),l=x(a),u=await S(e.subtle.importKey("raw",E(r),{name:"AES-GCM",length:256},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import generated AES-GCM content encryption key"),c=new Uint8Array(await S(e.subtle.encrypt({name:"AES-GCM",iv:E(s),additionalData:E(l),tagLength:128},u,E(t)),"CRYPTO_UNAVAILABLE",`Failed to AES-GCM encrypt ${e.failureContext}`)),d=c.slice(0,c.length-16),f=c.slice(c.length-16);return[a,O(i),O(s),O(d),O(f)].join(".")}function lt(e){ct.test(e)||o("INVALID_PARAMETER","jweId must be 16-128 URL-safe characters")}function ut(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}async function v(e){let t=h(e);return he({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}import{X509Certificate as dt}from"@peculiar/x509";var Z=`-----BEGIN CERTIFICATE-----
+var N=class extends Error{code;cause;details;constructor(t,r,n={}){super(r),this.name="NitroAttestationError",this.code=t,this.cause=n.cause,this.details=n.details}};function s(e,t,r){throw new N(e,t,r)}async function T(e,t,r){try{return await e}catch(n){s(t,r,{cause:n})}}function $(e){return e!==void 0?(typeof e!="function"&&s("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),e):(typeof globalThis.fetch!="function"&&s("CRYPTO_UNAVAILABLE","fetch is unavailable; pass a fetch implementation"),globalThis.fetch.bind(globalThis))}function ut(e){let t=e??globalThis.crypto?.subtle;return t||s("CRYPTO_UNAVAILABLE","SubtleCrypto is unavailable; pass params.subtle"),t}function dt(e){if(e)return e;let t=globalThis.crypto;return typeof t?.getRandomValues!="function"&&s("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),r=>t.getRandomValues(r)}function A(e){return{subtle:ut(e.subtle),getRandomValues:dt(e.getRandomValues)}}function he(e,t){return typeof t!="function"&&s("CRYPTO_UNAVAILABLE","crypto.getRandomValues is unavailable; pass params.getRandomValues"),{subtle:e,getRandomValues:t,randomUUID:()=>lt(t)}}function lt(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}var M="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",q=pt(M);function pt(e){let t={};for(let r=0;r<e.length;r+=1)t[e[r]]=r;return t}function S(e){let t="";for(let r of e)t+=r.toString(16).padStart(2,"0");return t}function I(e){if(typeof TextEncoder<"u")return new TextEncoder().encode(e);let t=[];for(let r=0;r<e.length;r+=1){let n=e.codePointAt(r);n>65535&&(r+=1),n<=127?t.push(n):n<=2047?t.push(192|n>>6,128|n&63):n<=65535?t.push(224|n>>12,128|n>>6&63,128|n&63):t.push(240|n>>18,128|n>>12&63,128|n>>6&63,128|n&63)}return new Uint8Array(t)}function _(e){if(typeof TextDecoder<"u")return new TextDecoder().decode(e);let t="";for(let r=0;r<e.length;r+=1){let n=e[r];n<128?t+=String.fromCodePoint(n):(n&224)===192?t+=String.fromCodePoint((n&31)<<6|e[++r]&63):(n&240)===224?t+=String.fromCodePoint((n&15)<<12|(e[++r]&63)<<6|e[++r]&63):t+=String.fromCodePoint((n&7)<<18|(e[++r]&63)<<12|(e[++r]&63)<<6|e[++r]&63)}return t}function ft(e){let t="";for(let r=0;r<e.length;r+=3){let n=e[r],o=e[r+1]??0,a=e[r+2]??0,i=n<<16|o<<8|a;t+=M[i>>18&63],t+=M[i>>12&63],t+=r+1<e.length?M[i>>6&63]:"=",t+=r+2<e.length?M[i&63]:"="}return t}function xe(e){return yt(e,!1)}function U(e){return ft(e).replaceAll("+","-").replaceAll("/","_").replace(/=+$/,"")}function yt(e,t){let r=e.replace(/\s+/g,""),n=t?r.replaceAll("-","+").replaceAll("_","/"):r;if(n.length%4===1)throw new Error("Invalid base64 length");let o=n+"=".repeat((4-n.length%4)%4),a=[];for(let i=0;i<o.length;i+=4){let u=o.slice(i,i+4),l=u.endsWith("==")?2:u.endsWith("=")?1:0,c=K(u[0],q),p=K(u[1],q),m=u[2]==="="?0:K(u[2],q),te=u[3]==="="?0:K(u[3],q),R=c<<18|p<<12|m<<6|te;a.push(R>>16&255),l<2&&a.push(R>>8&255),l<1&&a.push(R&255)}return new Uint8Array(a)}function K(e,t){let r=t[e];if(r===void 0)throw new Error(`Invalid base64 character: ${e}`);return r}function P(e){let t=e.reduce((o,a)=>o+a.length,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function E(e){return new Uint8Array(e).buffer}function Ce(e){let t={sessionMaterial:e.sessionMaterial,...e.callerAddress!==void 0?{callerAddress:e.callerAddress}:{},boundPubKeySha256:e.key.publicKeySha256Hex,issuedAtMs:e.issuedAtMs,jweId:e.jweId};return e.platform==="wise"||e.platform==="monobank"?t:{payeeId:e.payeeId,...t}}function be(e){return{platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,boundPubKeySha256:e.key.publicKeySha256Hex}}function De(e){return JSON.stringify(e)}var mt={alg:"RSA-OAEP-256",enc:"A256GCM"},At=/^[A-Za-z0-9_-]{16,128}$/;async function Re(e){let t=e.request.issuedAtMs??e.now(),r=e.request.jweId??St(e.getRandomValues);return Tt(r),Oe({key:e.request.key,plaintext:Ce({...e.request,issuedAtMs:t,jweId:r}),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:"seller credential upload"})}async function Ne(e){return re({...e,failureContext:"buyer TEE session material"})}async function _e(e){return re({...e,failureContext:"identity session material"})}async function Ue(e){return re({...e,failureContext:"dispute session material"})}async function re(e){return Oe({key:e.request.key,plaintext:be(e.request),subtle:e.subtle,getRandomValues:e.getRandomValues,failureContext:e.failureContext})}async function Oe(e){let t=I(De(e.plaintext)),r=e.getRandomValues(new Uint8Array(32)),n=await T(e.subtle.importKey("spki",E(e.key.publicKeyDer),{name:"RSA-OAEP",hash:"SHA-256"},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import attested enclave-upload RSA public key"),o=new Uint8Array(await T(e.subtle.encrypt({name:"RSA-OAEP"},n,E(r)),"CRYPTO_UNAVAILABLE","Failed to RSA-OAEP encrypt the content encryption key")),a=e.getRandomValues(new Uint8Array(12)),i=U(I(JSON.stringify(mt))),u=I(i),l=await T(e.subtle.importKey("raw",E(r),{name:"AES-GCM",length:256},!1,["encrypt"]),"CRYPTO_UNAVAILABLE","Failed to import generated AES-GCM content encryption key"),c=new Uint8Array(await T(e.subtle.encrypt({name:"AES-GCM",iv:E(a),additionalData:E(u),tagLength:128},l,E(t)),"CRYPTO_UNAVAILABLE",`Failed to AES-GCM encrypt ${e.failureContext}`)),p=c.slice(0,c.length-16),m=c.slice(c.length-16);return[i,U(o),U(a),U(p),U(m)].join(".")}function Tt(e){At.test(e)||s("INVALID_PARAMETER","jweId must be 16-128 URL-safe characters")}function St(e){let t=e(new Uint8Array(16));t[6]=t[6]&15|64,t[8]=t[8]&63|128;let r=Array.from(t,n=>n.toString(16).padStart(2,"0"));return`${r.slice(0,4).join("")}-${r.slice(4,6).join("")}-${r.slice(6,8).join("")}-${r.slice(8,10).join("")}-${r.slice(10).join("")}`}async function V(e){let t=A(e);return Ne({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}import{X509Certificate as Et}from"@peculiar/x509";var ne=`-----BEGIN CERTIFICATE-----
 MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
 MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
 VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
@@ -12,5 +12,5 @@ MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
 rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
 IwLz3/Y=
 -----END CERTIFICATE-----
-`,K="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var ft=10080*60*1e3;async function be(e){let t=Ae(e.subtle,e.getRandomValues),r=ee(e.rootPem??Z,"AWS Nitro root certificate"),n=await te(r,e.subtle);n!==K&&o("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:K,actual:n}});let i=ee(e.leafCertificateDer,"attestation leaf certificate"),s=e.cabundleDer.map((d,f)=>ee(d,`cabundle[${f}]`)),a=[r,...s,i];for(let d of a)pt(d,e.nowMs),mt(d,e.nowMs,e.onWarning);let l=await te(i,e.subtle),u=[];for(let d of s){let f=await te(d,e.subtle);f!==l&&f!==n&&u.push(d)}let c=[[i,...u.slice().reverse(),r],[i,...u,r]];for(let d of c)if(await yt(d,t)){let f=await S(i.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:i,leafPublicKey:f}}o("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function yt(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],i=e[r+1];if(!await n.verify({publicKey:i.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function ee(e,t){try{return new dt(e)}catch(r){o("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function te(e,t){return g(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function pt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&o("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function mt(e,t,r){e.notAfter.getTime()<t+ft&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function B(e){let t=new re(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function z(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?C(0,e):C(1,-1-e)}if(typeof e=="bigint")return e>=0n?C(0,e):C(1,-1n-e);if(typeof e=="string"){let t=x(e);return b([C(3,t.length),t])}if(e instanceof Uint8Array)return b([C(2,e.length),e]);if(Array.isArray(e))return b([C(4,e.length),...e.map(z)]);if(e instanceof Map)return b([C(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[z(t),z(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function Ce(e,t){return z(["Signature1",e,new Uint8Array,t])}function C(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var re=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let i=this.readLength(n);return typeof i=="bigint"?-1n-i:-1-i}if(r===2){let i=this.lengthAsNumber(this.readLength(n));return this.readBytes(i)}if(r===3){let i=this.lengthAsNumber(this.readLength(n));return w(this.readBytes(i))}if(r===4){let i=this.lengthAsNumber(this.readLength(n)),s=[];for(let a=0;a<i;a+=1)s.push(this.readValue());return s}if(r===5){let i=this.lengthAsNumber(this.readLength(n)),s=new Map;for(let a=0;a<i;a+=1)s.set(this.readValue(),this.readValue());return s}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return b(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Re(e){let t=e[0]===210?e.slice(1):e,r;try{r=B(t)}catch(l){o("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:l})}(!Array.isArray(r)||r.length!==4)&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,i,s,a]=r;return(!(n instanceof Uint8Array)||!(i instanceof Map)||!(s instanceof Uint8Array)||!(a instanceof Uint8Array))&&o("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),At(n),a.length!==96&&o("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${a.length} bytes`),{protectedHeadersBytes:n,payloadBytes:s,signature:a}}async function Ne(e){let t=Ce(e.protectedHeadersBytes,e.payloadBytes);await S(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||o("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function At(e){let t;try{t=B(e)}catch(r){o("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||o("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&o("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var ne=96;function I(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==ne||!/^[0-9a-f]+$/.test(r))&&o("TRUST_PIN_REQUIRED",`${t} must be ${ne} lowercase hex characters`),r}function _e(e,t){let r=I(e,t);return e!==r&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be ${ne} lowercase hex characters`),r}var Ue=256*1024,Tt=3,St=150,gt=/^0x[0-9a-fA-F]{40}$/;function Et(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function De(e){let t=Et(e.attestationServiceUrl,e.nonceHex),r=await xt(t.toString(),e.fetch,e.timeoutMs),n=await Pt(r);r.ok||o("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let i;try{i=JSON.parse(n)}catch(s){o("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:s})}return It(i)}function It(e){(!Me(e)||e.success!==!0||!Me(e.responseObject))&&o("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&o("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=Te(t.attestationDocument)}catch(n){o("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&o("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:Oe(t.verifyingContract,"verifyingContract"),expectedSigner:Oe(t.expectedSigner,"expectedSigner"),expectedPcr8:ht(t.expectedPcr8,"expectedPcr8")}}}async function Pt(e){if(!e.body){let i=await e.text();return we(x(i).length),i}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:i,value:s}=await t.read();if(i)break;s&&(n+=s.length,we(n),r.push(s))}return w(b(r))}function we(e){e>Ue&&o("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:Ue,actualBytes:e}})}function Oe(e,t){if(e!==void 0)return(typeof e!="string"||!gt.test(e))&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function ht(e,t){if(e!==void 0){typeof e!="string"&&o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return _e(e,t)}catch(r){o("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function xt(e,t,r){let n=1;for(;;)try{return await bt(e,t,r)}catch(i){if(!Ct(i)||n>=Tt)throw i;await Rt(St*n),n+=1}}async function bt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,i,s=new Promise((a,l)=>{i=setTimeout(()=>{n?.abort(),l(new Error("timeout"))},r)});try{let a=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),s]);return i!==void 0&&clearTimeout(i),a}catch(a){i!==void 0&&clearTimeout(i),a instanceof Error&&(a.name==="AbortError"||a.message==="timeout")&&o("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:a}),o("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:a,details:{layer:"network"}})}}function Ct(e){return e instanceof U&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Rt(e){return new Promise(t=>setTimeout(t,e))}function Me(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var Nt=32;function Ve(e){return g(e(new Uint8Array(Nt)))}function ve(e,t){e.toLowerCase()!==t&&o("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function He(e){let t;try{t=B(e)}catch(s){o("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:s})}let r=Be(t,"payload"),n=Be(r.get("pcrs"),"pcrs"),i=H(r.get("user_data"),"user_data");return{timestampMs:_t(r.get("timestamp")),nonceHex:w(i),pcr0Hex:ie(n,0),pcr1Hex:ie(n,1),pcr2Hex:ie(n,2),pcr8Hex:g(H(n.get(8),"pcrs[8]")),certificateDer:H(r.get("certificate"),"certificate"),cabundleDer:Ut(r.get("cabundle"),"cabundle").map((s,a)=>H(s,`cabundle[${a}]`)),publicKeyDer:H(r.get("public_key"),"public_key")}}function ie(e,t){let r=e.get(t);return r instanceof Uint8Array?g(r):""}function _t(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;o("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function Be(e,t){if(e instanceof Map)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function H(e,t){if(e instanceof Uint8Array)return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function Ut(e,t){if(Array.isArray(e))return e;o("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var wt="https://attestation-service-staging.zkp2p.xyz",Ot="https://attestation-service.zkp2p.xyz";var Le="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",Fe="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",Mt="5453c5bfb7d040285be5ba9af142f4fbdd9685d082f244b66c62bf7b22d8d02a638fa2e02b9a6fe8877953a9429209e0",ke={"attestation-service-staging.zkp2p.xyz":I(Le,"bundled staging PCR8"),"attestation-service-preprod.zkp2p.xyz":I(Mt,"bundled preprod PCR8"),"attestation-service.zkp2p.xyz":I(Fe,"bundled production PCR8")},We={staging:{attestationServiceUrl:wt,expectedPcr8Hex:Le},production:{attestationServiceUrl:Ot,expectedPcr8Hex:Fe}};function Ye(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,i=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return I(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let s=t?.expectedPcr8ByHost,a=s?Dt(s,i):void 0;if(a)return I(a,`trust.expectedPcr8ByHost[${i}]`);let l=ke[i];if(l)return l;if(t?.strictPin===!0&&o("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${i}`),r){let u=I(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${i}; falling back to service-advertised expectedPcr8`,details:{hostname:i,expectedPcr8:u}}),u}o("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${i}`)}function Dt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var Vt=300*1e3;async function P(e){let t=G(e.fetch),r=h(e),n=e.now??Date.now,i=Ve(r.getRandomValues),s=await De({attestationServiceUrl:e.attestationServiceUrl,nonceHex:i,fetch:t,timeoutMs:e.timeoutMs??1e4});ve(s.nonce,i);let{protectedHeadersBytes:a,payloadBytes:l,signature:u}=Re(s.attestationDocument),c=He(l);c.nonceHex!==i&&o("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:i,payloadNonce:c.nonceHex}});let d=e.trust?.freshnessWindowMs??Vt,f=n();Math.abs(f-c.timestampMs)>d&&o("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${d}ms`,{details:{timestampMs:c.timestampMs,nowMs:f,freshnessWindowMs:d}});let T=new URL(e.attestationServiceUrl).hostname,p=Ye({trust:e.trust,hostname:T,advertisedExpectedPcr8:s.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==p&&o("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:p,actualPcr8:c.pcr8Hex}});let{leafPublicKey:et}=await be({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:f,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await Ne({protectedHeadersBytes:a,payloadBytes:l,signature:u,leafPublicKey:et,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:g(new Uint8Array(await r.subtle.digest("SHA-256",E(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:s.advertised}}}async function L(e){let t=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return v({...e,key:t.attestedSellerUploadKey})}import{getAddress as vt}from"ethers";function M(e){try{return vt(e)}catch(t){o("INVALID_PARAMETER","callerAddress must be a valid Ethereum address",{cause:t})}}async function F(e){let t=M(e.callerAddress),r=h(e);return xe({request:{...e,callerAddress:t},subtle:r.subtle,getRandomValues:r.getRandomValues})}async function k(e){let t=M(e.callerAddress),r=await P({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs});return F({key:r.attestedSellerUploadKey,platform:e.platform,actionType:e.actionType,callerAddress:t,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function W(e){let t=h(e);return Pe({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function Y(e){let{attestationServiceUrl:t,trust:r,fetch:n,onWarning:i,timeoutMs:s,...a}=e,l=await P({attestationServiceUrl:t,trust:r,fetch:n,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:i,timeoutMs:s});return W({...a,key:l.attestedSellerUploadKey})}var Bt=400;async function D(e){let t=G(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,i,s=new Promise((c,d)=>{i=setTimeout(()=>{n.abort(),d(new Error("timeout"))},r)}),a,l;try{a=await Promise.race([t(kt(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),s]),l=await Promise.race([a.text(),s])}catch(c){n.signal.aborted&&o("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(i)}if(!a.ok){let c=Ht(l);c?.success===!1&&Ge(e.failureContext,a.status,c),o("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${a.status}`,{details:{status:a.status,body:l.slice(0,400)}})}let u;try{u=JSON.parse(l)}catch(c){o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return u.success!==!0&&(u.success===!1&&Ge(e.failureContext,a.status,u),o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),Lt(u.responseObject)||o("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:a.status,envelopeSnippet:Ft(u)}}),u.responseObject}function Ht(e){try{return JSON.parse(e)}catch{return}}function Ge(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};o("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function Lt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ft(e){return JSON.stringify(e).slice(0,Bt)}function kt(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function se(e){let t=M(e.callerAddress),r=await k({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,callerAddress:t,sessionMaterial:e.sessionMaterial});return D({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:t,encryptedSessionMaterial:r,params:e.params}})}async function ae(e){let t=await Y(e);return D({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function ce(e){let t=await L(e);return D({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}function Wt(e){let t=We[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=R({strictPin:!0},e.trust);return{createEncryptedBuyerTeeSessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return L({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedIdentitySessionMaterial:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return k({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},createEncryptedSellerCredentialUpload:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return Y({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},requestIdentityAttestation:i=>se({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,callerAddress:i.callerAddress,sessionMaterial:i.sessionMaterial,params:i.params}),uploadSellerCredential:i=>{let{attestationServiceUrl:s,trust:a,fetch:l,subtle:u,getRandomValues:c,now:d,onWarning:f,timeoutMs:T,...p}=i;return ae({...p,attestationServiceUrl:s??r,trust:R(n,a),fetch:l??e.fetch,subtle:u??e.subtle,getRandomValues:c??e.getRandomValues,now:d??e.now,onWarning:f??e.onWarning,timeoutMs:T??e.timeoutMs})},verifyBuyerTeePayment:i=>{let s={attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs,platform:i.platform,actionType:i.actionType,sessionMaterial:i.sessionMaterial,params:i.params,chainId:i.chainId,intent:i.intent};return ce(s)},fetchAndVerifyAttestation:(i={})=>P({attestationServiceUrl:i.attestationServiceUrl??r,trust:R(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),encryptBuyerTeeSessionMaterial:({subtle:i,getRandomValues:s,...a})=>v({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptIdentitySessionMaterial:({subtle:i,getRandomValues:s,...a})=>F({...a,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues}),encryptSellerCredentialUpload:({subtle:i,getRandomValues:s,now:a,...l})=>W({...l,subtle:i??e.subtle,getRandomValues:s??e.getRandomValues,now:a??e.now})}}function R(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}import{concat as Yt,getAddress as $e,keccak256 as le,recoverAddress as Gt,TypedDataEncoder as ue,toUtf8Bytes as $t,verifyTypedData as qt}from"ethers";var Kt={name:"UnifiedPaymentVerifier",version:"1"},de={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},zt="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",qe=m(zt),fe={name:"ZKP2PIdentityVerifier",version:"1"},ye={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},jt="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",Ke=m(jt),ze=ue.hashDomain(fe).toLowerCase(),je={name:"ZKP2P Seller Credential Bundle",version:"1"},Xe={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function Xt(e){return{...Kt,chainId:e.chainId,verifyingContract:$e(e.verifyingContract)}}function pe(e){return ue.hashDomain(Xt(e)).toLowerCase()}function m(e){return le($t(e)).toLowerCase()}function Qe(e){return le(e).toLowerCase()}function Je(e){try{let t=ue.from(e.types).hash(e.value),r=le(Yt(["0x1901",e.domainSeparator,t]));return N(Gt(r,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function j(e){try{return N(qt(e.domain,e.types,e.value,e.signature))}catch(t){o("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function me(e,t){let r=N(e),n=new Set(t.map(i=>N(i)));return n.has(r)||o("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function X(e){let t=me(e.recoveredSigner,e.trustedSigners),r=N(e.payloadSigner);return r!==t&&o("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function y(e,t,r){e.toLowerCase()!==t.toLowerCase()&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Ze(e,t,r){let n,i;try{n=N(e),i=N(t)}catch(s){o("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:s})}n!==i&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function A(e,t,r){e!==t&&o("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function Q(e,t){JSON.stringify(e)!==JSON.stringify(t)&&o("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function _(e,t){return typeof e!="string"&&o("INVALID_PARAMETER",`${t} is required`),e}function N(e){return $e(e).toLowerCase()}function Qt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),Q(e.typedDataSpec.types,de),y(e.typeHash,qe,"typeHash"),y(e.domainSeparator,pe(t.expectedDomain),"domainSeparator"),y(Qe(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),y(e.typedDataValue.intentHash,_(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=Je({domainSeparator:e.domainSeparator,types:de,value:{...e.typedDataValue},signature:e.signature});return X({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}var Jt=["platform","actionType","payeeId","username","metadata"];function Zt(e,t){A(e.platform,t.expectedPlatform,"platform"),A(e.actionType,t.expectedActionType,"actionType"),A(e.identity.platform,e.platform,"identity.platform"),A(e.identity.actionType,e.actionType,"identity.actionType"),A(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),Q(e.typedDataSpec.types,ye),y(e.domainSeparator,ze,"domainSeparator"),y(e.typeHash,Ke,"typeHash"),y(e.identity.method,m(e.identity.platform),"identity.method"),y(e.identity.payeeIdHash,m(e.identity.payeeId),"identity.payeeIdHash"),y(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),y(e.typedDataValue.actionType,m(e.identity.actionType),"typedDataValue.actionType"),Ze(e.typedDataValue.callerAddress,_(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),y(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),y(e.typedDataValue.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),y(e.typedDataValue.dataHash,er(e.identity),"typedDataValue.dataHash"),rr(e.typedDataValue.validUntil,t.now??Date.now);let r=j({domain:fe,types:ye,value:{...e.typedDataValue},signature:e.signature});return X({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function er(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:tr(e.metadata)},r=JSON.stringify(Object.fromEntries(Jt.map(n=>[n,t[n]])));return m(r)}function tr(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function rr(e,t){let r=t();BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function nr(e,t){A(e.platform,t.expectedPlatform,"platform"),y(e.payeeIdHash,_(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),or(e.credentialExpiresAt,t.now??Date.now);let r=j({domain:je,types:Xe,value:ir(e),signature:e.bundleSignature});return me(r,t.trustedSigners),e}function ir(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:m(e.encryptedBlob),encryptedDataKeyHash:m(e.encryptedDataKey),nonceHash:m(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function or(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&o("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}export{K as AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,Z as AWS_NITRO_ROOT_PEM,U as NitroAttestationError,L as createEncryptedBuyerTeeSessionMaterial,k as createEncryptedIdentitySessionMaterial,Y as createEncryptedSellerCredentialUpload,Wt as createNitroAttestationClient,v as encryptBuyerTeeSessionMaterial,F as encryptIdentitySessionMaterial,W as encryptSellerCredentialUpload,P as fetchAndVerifyAttestation,pe as getUnifiedPaymentVerifierDomainSeparator,m as hashUtf8,se as requestIdentityAttestation,ae as uploadSellerCredential,ce as verifyBuyerTeePayment,Qt as verifyBuyerTeePaymentAttestation,Zt as verifyIdentityAttestation,nr as verifySellerCredentialBundle};
+`,j="641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b";var gt=10080*60*1e3;async function we(e){let t=he(e.subtle,e.getRandomValues),r=ie(e.rootPem??ne,"AWS Nitro root certificate"),n=await oe(r,e.subtle);n!==j&&s("AWS_ROOT_FINGERPRINT_MISMATCH","Bundled AWS Nitro root certificate fingerprint mismatch",{details:{expected:j,actual:n}});let o=ie(e.leafCertificateDer,"attestation leaf certificate"),a=e.cabundleDer.map((p,m)=>ie(p,`cabundle[${m}]`)),i=[r,...a,o];for(let p of i)Pt(p,e.nowMs),ht(p,e.nowMs,e.onWarning);let u=await oe(o,e.subtle),l=[];for(let p of a){let m=await oe(p,e.subtle);m!==u&&m!==n&&l.push(p)}let c=[[o,...l.slice().reverse(),r],[o,...l,r]];for(let p of c)if(await It(p,t)){let m=await T(o.publicKey.export({name:"ECDSA",namedCurve:"P-384"},["verify"],t),"CERT_CHAIN_INVALID","Failed to export attestation leaf public key");return{leafCertificate:o,leafPublicKey:m}}s("CERT_CHAIN_INVALID","Attestation certificate chain does not verify to the pinned AWS Nitro root")}async function It(e,t){for(let r=0;r<e.length-1;r+=1){let n=e[r],o=e[r+1];if(!await n.verify({publicKey:o.publicKey,signatureOnly:!0},t))return!1}return e.length>0&&await e[e.length-1].isSelfSigned(t)}function ie(e,t){try{return new Et(e)}catch(r){s("CERT_CHAIN_INVALID",`Could not parse ${t}`,{cause:r})}}async function oe(e,t){return S(new Uint8Array(await t.digest("SHA-256",e.rawData)))}function Pt(e,t){(t<e.notBefore.getTime()||t>e.notAfter.getTime())&&s("CERT_NOT_TIME_VALID","Certificate is outside its validity window",{details:{subject:e.subject,notBefore:e.notBefore.toISOString(),notAfter:e.notAfter.toISOString()}})}function ht(e,t,r){e.notAfter.getTime()<t+gt&&r?.({code:"CERT_VALIDITY_NEAR_EXPIRY",message:"Certificate in Nitro attestation chain expires within 7 days",details:{subject:e.subject,notAfter:e.notAfter.toISOString()}})}function v(e){let t=new se(e),r=t.readValue();if(!t.done())throw new Error("Trailing CBOR bytes");return r}function z(e){if(typeof e=="number"){if(!Number.isSafeInteger(e))throw new Error("CBOR number must be a safe integer");return e>=0?h(0,e):h(1,-1-e)}if(typeof e=="bigint")return e>=0n?h(0,e):h(1,-1n-e);if(typeof e=="string"){let t=I(e);return P([h(3,t.length),t])}if(e instanceof Uint8Array)return P([h(2,e.length),e]);if(Array.isArray(e))return P([h(4,e.length),...e.map(z)]);if(e instanceof Map)return P([h(5,e.size),...Array.from(e.entries()).flatMap(([t,r])=>[z(t),z(r)])]);if(typeof e=="boolean")return new Uint8Array([e?245:244]);if(e===null)return new Uint8Array([246]);throw new Error("Unsupported CBOR value")}function Me(e,t){return z(["Signature1",e,new Uint8Array,t])}function h(e,t){let r=BigInt(t);return r<24n?new Uint8Array([e<<5|Number(r)]):r<=0xffn?new Uint8Array([e<<5|24,Number(r)]):r<=0xffffn?new Uint8Array([e<<5|25,Number(r>>8n&0xffn),Number(r&0xffn)]):r<=0xffffffffn?new Uint8Array([e<<5|26,Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)]):new Uint8Array([e<<5|27,Number(r>>56n&0xffn),Number(r>>48n&0xffn),Number(r>>40n&0xffn),Number(r>>32n&0xffn),Number(r>>24n&0xffn),Number(r>>16n&0xffn),Number(r>>8n&0xffn),Number(r&0xffn)])}var se=class{constructor(t){this.bytes=t}bytes;offset=0;done(){return this.offset===this.bytes.length}readValue(){let t=this.readByte(),r=t>>5,n=t&31;if(n===31)return this.readIndefiniteValue(r);if(r===0)return this.readLength(n);if(r===1){let o=this.readLength(n);return typeof o=="bigint"?-1n-o:-1-o}if(r===2){let o=this.lengthAsNumber(this.readLength(n));return this.readBytes(o)}if(r===3){let o=this.lengthAsNumber(this.readLength(n));return _(this.readBytes(o))}if(r===4){let o=this.lengthAsNumber(this.readLength(n)),a=[];for(let i=0;i<o;i+=1)a.push(this.readValue());return a}if(r===5){let o=this.lengthAsNumber(this.readLength(n)),a=new Map;for(let i=0;i<o;i+=1)a.set(this.readValue(),this.readValue());return a}if(r===6)return this.readLength(n),this.readValue();if(r===7){if(n===20)return!1;if(n===21)return!0;if(n===22)return null}throw new Error(`Unsupported CBOR major/additional type: ${r}/${n}`)}readIndefiniteValue(t){if(t===2){let r=[];for(;!this.consumeBreak();){let n=this.readValue();if(!(n instanceof Uint8Array))throw new Error("Indefinite CBOR byte string chunk must be a byte string");r.push(n)}return P(r)}if(t===3){let r="";for(;!this.consumeBreak();){let n=this.readValue();if(typeof n!="string")throw new Error("Indefinite CBOR text string chunk must be a text string");r+=n}return r}if(t===4){let r=[];for(;!this.consumeBreak();)r.push(this.readValue());return r}if(t===5){let r=new Map;for(;!this.consumeBreak();){let n=this.readValue();if(this.peekBreak())throw new Error("Indefinite CBOR map ended after a key");r.set(n,this.readValue())}return r}throw new Error(`Indefinite CBOR major type ${t} is not supported`)}readLength(t){if(t<24)return t;if(t===24)return this.readByte();if(t===25)return this.readByte()<<8|this.readByte();if(t===26)return this.readByte()*16777216+(this.readByte()<<16)+(this.readByte()<<8)+this.readByte()>>>0;if(t===27){let r=0n;for(let n=0;n<8;n+=1)r=r<<8n|BigInt(this.readByte());return r<=BigInt(Number.MAX_SAFE_INTEGER)?Number(r):r}throw new Error("Indefinite CBOR lengths are not supported")}readByte(){if(this.offset>=this.bytes.length)throw new Error("Unexpected end of CBOR input");return this.bytes[this.offset++]}peekBreak(){return this.offset<this.bytes.length&&this.bytes[this.offset]===255}consumeBreak(){return this.peekBreak()?(this.offset+=1,!0):!1}readBytes(t){if(this.offset+t>this.bytes.length)throw new Error("Unexpected end of CBOR byte string");let r=this.bytes.slice(this.offset,this.offset+t);return this.offset+=t,r}lengthAsNumber(t){if(typeof t=="bigint")throw new Error("CBOR length exceeds JavaScript safe integer range");return t}};function Ve(e){let t=e[0]===210?e.slice(1):e,r;try{r=v(t)}catch(u){s("COSE_STRUCTURE_INVALID","Attestation document is not a valid COSE_Sign1 CBOR value",{cause:u})}(!Array.isArray(r)||r.length!==4)&&s("COSE_STRUCTURE_INVALID","COSE_Sign1 must be [protected, unprotected, payload, signature]");let[n,o,a,i]=r;return(!(n instanceof Uint8Array)||!(o instanceof Map)||!(a instanceof Uint8Array)||!(i instanceof Uint8Array))&&s("COSE_STRUCTURE_INVALID","COSE_Sign1 fields have invalid CBOR types"),xt(n),i.length!==96&&s("COSE_SIGNATURE_INVALID_SIZE",`Expected a 96-byte ES384 signature, got ${i.length} bytes`),{protectedHeadersBytes:n,payloadBytes:a,signature:i}}async function ve(e){let t=Me(e.protectedHeadersBytes,e.payloadBytes);await T(e.subtle.verify({name:"ECDSA",hash:"SHA-384"},e.leafPublicKey,e.signature,t),"COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature verification failed")||s("COSE_SIGNATURE_VERIFY_FAILED","COSE_Sign1 signature does not verify with the attestation leaf certificate")}function xt(e){let t;try{t=v(e)}catch(r){s("COSE_STRUCTURE_INVALID","COSE protected headers are not a valid CBOR map",{cause:r})}t instanceof Map||s("COSE_STRUCTURE_INVALID","COSE protected headers must be a CBOR map"),t.get(1)!==-35&&s("COSE_ALG_UNSUPPORTED","COSE protected header alg must be -35 (ES384)")}var ae=96;function x(e,t){let r=e.replace(/^0x/i,"").toLowerCase();return(r.length!==ae||!/^[0-9a-f]+$/.test(r))&&s("TRUST_PIN_REQUIRED",`${t} must be ${ae} lowercase hex characters`),r}function Be(e,t){let r=x(e,t);return e!==r&&s("ATTESTATION_RESPONSE_INVALID",`${t} must be ${ae} lowercase hex characters`),r}var He=256*1024,Ct=3,bt=150,Dt=/^0x[0-9a-fA-F]{40}$/;function Rt(e,t){let r=new URL(e),n=r.pathname.replace(/\/+$/,"");return r.pathname=n.endsWith("/attestation")?n:`${n}/attestation`,r.search="",r.searchParams.set("nonce",t),r}async function Ye(e){let t=Rt(e.attestationServiceUrl,e.nonceHex),r=await Ot(t.toString(),e.fetch,e.timeoutMs),n=await _t(r);r.ok||s("ATTESTATION_FETCH_FAILED",`GET /attestation failed with HTTP ${r.status}`,{details:{status:r.status,body:n.slice(0,400)}});let o;try{o=JSON.parse(n)}catch(a){s("ATTESTATION_RESPONSE_INVALID","GET /attestation returned non-JSON response",{cause:a})}return Nt(o)}function Nt(e){(!ke(e)||e.success!==!0||!ke(e.responseObject))&&s("ATTESTATION_RESPONSE_INVALID","Expected { success: true, responseObject: {...} }");let t=e.responseObject;(typeof t.attestationDocument!="string"||typeof t.nonce!="string")&&s("ATTESTATION_RESPONSE_INVALID","Attestation response is missing attestationDocument or nonce");let r;try{r=xe(t.attestationDocument)}catch(n){s("ATTESTATION_RESPONSE_INVALID","attestationDocument is not valid base64",{cause:n})}return r.length===0&&s("ATTESTATION_RESPONSE_INVALID","attestationDocument decoded to empty bytes"),{attestationDocument:r,nonce:t.nonce.toLowerCase(),advertised:{chainId:typeof t.chainId=="number"?t.chainId:void 0,verifyingContract:Fe(t.verifyingContract,"verifyingContract"),expectedSigner:Fe(t.expectedSigner,"expectedSigner"),expectedPcr8:Ut(t.expectedPcr8,"expectedPcr8")}}}async function _t(e){if(!e.body){let o=await e.text();return Le(I(o).length),o}let t=e.body.getReader(),r=[],n=0;for(;;){let{done:o,value:a}=await t.read();if(o)break;a&&(n+=a.length,Le(n),r.push(a))}return _(P(r))}function Le(e){e>He&&s("ATTESTATION_RESPONSE_INVALID","GET /attestation response exceeded maximum size",{details:{maxBytes:He,actualBytes:e}})}function Fe(e,t){if(e!==void 0)return(typeof e!="string"||!Dt.test(e))&&s("ATTESTATION_RESPONSE_INVALID",`${t} must be a 0x-prefixed 20-byte hex address`),e.toLowerCase()}function Ut(e,t){if(e!==void 0){typeof e!="string"&&s("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`);try{return Be(e,t)}catch(r){s("ATTESTATION_RESPONSE_INVALID",`${t} must be a 96-character lowercase hex string`,{cause:r})}}}async function Ot(e,t,r){let n=1;for(;;)try{return await wt(e,t,r)}catch(o){if(!Mt(o)||n>=Ct)throw o;await Vt(bt*n),n+=1}}async function wt(e,t,r){let n=typeof AbortController<"u"?new AbortController:void 0,o,a=new Promise((i,u)=>{o=setTimeout(()=>{n?.abort(),u(new Error("timeout"))},r)});try{let i=await Promise.race([t(e,{headers:{accept:"application/json"},signal:n?.signal}),a]);return o!==void 0&&clearTimeout(o),i}catch(i){o!==void 0&&clearTimeout(o),i instanceof Error&&(i.name==="AbortError"||i.message==="timeout")&&s("TIMEOUT",`GET /attestation timed out after ${r}ms`,{cause:i}),s("ATTESTATION_FETCH_FAILED","GET /attestation failed at the network layer",{cause:i,details:{layer:"network"}})}}function Mt(e){return e instanceof N&&e.code==="ATTESTATION_FETCH_FAILED"&&e.details?.layer==="network"}function Vt(e){return new Promise(t=>setTimeout(t,e))}function ke(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}var vt=32;function Ge(e){return S(e(new Uint8Array(vt)))}function We(e,t){e.toLowerCase()!==t&&s("ATTESTATION_NONCE_MISMATCH","Attestation service echoed a different nonce",{details:{expectedNonce:t,echoedNonce:e}})}function qe(e){let t;try{t=v(e)}catch(a){s("PAYLOAD_FIELD_MISSING","Attestation payload is not a valid CBOR map",{cause:a})}let r=$e(t,"payload"),n=$e(r.get("pcrs"),"pcrs"),o=B(r.get("user_data"),"user_data");return{timestampMs:Bt(r.get("timestamp")),nonceHex:_(o),pcr0Hex:ce(n,0),pcr1Hex:ce(n,1),pcr2Hex:ce(n,2),pcr8Hex:S(B(n.get(8),"pcrs[8]")),certificateDer:B(r.get("certificate"),"certificate"),cabundleDer:Ht(r.get("cabundle"),"cabundle").map((a,i)=>B(a,`cabundle[${i}]`)),publicKeyDer:B(r.get("public_key"),"public_key")}}function ce(e,t){let r=e.get(t);return r instanceof Uint8Array?S(r):""}function Bt(e){if(typeof e=="number"&&Number.isSafeInteger(e)&&e>=0)return e;s("PAYLOAD_FIELD_MISSING","Attestation payload timestamp must be an unsigned safe integer")}function $e(e,t){if(e instanceof Map)return e;s("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a CBOR map`)}function B(e,t){if(e instanceof Uint8Array)return e;s("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be a byte string`)}function Ht(e,t){if(Array.isArray(e))return e;s("PAYLOAD_FIELD_MISSING",`Attestation payload field ${t} must be an array`)}var Lt="https://attestation-service-staging.zkp2p.xyz",Ft="https://attestation-service.zkp2p.xyz",Ke="5636e3bd96f847cf12cfd9de7faa8cad0e6fa00962ce16ba185f8e5ea57105abb3cc9cc34f1e1e4de3444ceabcca7485",je="41a4ae0b9b96752cab5addb7d22689b3070e564e29f90a54316fa33fa38ea51387a6e887ea4f5a4b0cc34f69cea3f40e",ze={"attestation-service-staging.zkp2p.xyz":x(Ke,"bundled staging PCR8"),"attestation-service.zkp2p.xyz":x(je,"bundled production PCR8")},Xe={staging:{attestationServiceUrl:Lt,expectedPcr8Hex:Ke},production:{attestationServiceUrl:Ft,expectedPcr8Hex:je}};function Je(e){let{trust:t,advertisedExpectedPcr8:r,onWarning:n}=e,o=e.hostname.toLowerCase();if(t?.expectedPcr8Hex)return x(t.expectedPcr8Hex,"trust.expectedPcr8Hex");let a=t?.expectedPcr8ByHost,i=a?kt(a,o):void 0;if(i)return x(i,`trust.expectedPcr8ByHost[${o}]`);let u=ze[o];if(u)return u;if(t?.strictPin===!0&&s("TRUST_PIN_REQUIRED",`No trusted PCR8 pin is configured for ${o}`),r){let l=x(r,"service-advertised expectedPcr8");return n?.({code:"TRUST_PIN_NOT_PROVIDED",message:`No caller or bundled PCR8 pin was available for ${o}; falling back to service-advertised expectedPcr8`,details:{hostname:o,expectedPcr8:l}}),l}s("TRUST_PIN_REQUIRED",`No trusted or service-advertised PCR8 pin is available for ${o}`)}function kt(e,t){for(let[r,n]of Object.entries(e))if(r.toLowerCase()===t)return n}var Yt=300*1e3;async function C(e){return(await X(e)).attestedSellerUploadKey}async function X(e){let t=$(e.fetch),r=A(e),n=e.now??Date.now,o=Ge(r.getRandomValues),a=await Ye({attestationServiceUrl:e.attestationServiceUrl,nonceHex:o,fetch:t,timeoutMs:e.timeoutMs??1e4});We(a.nonce,o);let{protectedHeadersBytes:i,payloadBytes:u,signature:l}=Ve(a.attestationDocument),c=qe(u);c.nonceHex!==o&&s("NONCE_BINDING_FAILED","Attestation payload user_data did not match the request nonce",{details:{expectedNonce:o,payloadNonce:c.nonceHex}});let p=e.trust?.freshnessWindowMs??Yt,m=n();Math.abs(m-c.timestampMs)>p&&s("FRESHNESS_CHECK_FAILED",`Attestation timestamp skew exceeds ${p}ms`,{details:{timestampMs:c.timestampMs,nowMs:m,freshnessWindowMs:p}});let te=new URL(e.attestationServiceUrl).hostname,R=Je({trust:e.trust,hostname:te,advertisedExpectedPcr8:a.advertised.expectedPcr8,onWarning:e.onWarning});c.pcr8Hex!==R&&s("PCR8_PIN_MISMATCH","Attestation PCR8 does not match the trusted pin",{details:{expectedPcr8:R,actualPcr8:c.pcr8Hex}});let{leafPublicKey:ct}=await we({leafCertificateDer:c.certificateDer,cabundleDer:c.cabundleDer,rootPem:e.trust?.awsNitroRootPem,nowMs:m,subtle:r.subtle,getRandomValues:r.getRandomValues,onWarning:e.onWarning});return await ve({protectedHeadersBytes:i,payloadBytes:u,signature:l,leafPublicKey:ct,subtle:r.subtle}),{attestedSellerUploadKey:{publicKeyDer:c.publicKeyDer,publicKeySha256Hex:S(new Uint8Array(await r.subtle.digest("SHA-256",E(c.publicKeyDer))))},payload:{timestampMs:c.timestampMs,pcr0Hex:c.pcr0Hex,pcr1Hex:c.pcr1Hex,pcr2Hex:c.pcr2Hex,pcr8Hex:c.pcr8Hex,nonceHex:c.nonceHex,advertised:a.advertised}}}async function H(e){return V({...e,key:await C(e)})}async function L(e){let t=A(e);return Ue({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}async function F(e){return L({key:await C(e),platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function k(e){let t=A(e);return _e({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues})}async function Y(e){return k({key:await C(e),platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial,subtle:e.subtle,getRandomValues:e.getRandomValues})}async function G(e){let t=A(e);return Re({request:e,subtle:t.subtle,getRandomValues:t.getRandomValues,now:e.now??Date.now})}async function W(e){return G({...e,key:await C(e)})}import{getAddress as Gt}from"ethers";function Qe(e){try{return Gt(e)}catch(t){s("INVALID_PARAMETER","callerAddress must be a valid Ethereum address",{cause:t})}}var Wt=400;async function b(e){let t=$(e.fetch),r=e.timeoutMs??1e4,n=new AbortController,o,a=new Promise((c,p)=>{o=setTimeout(()=>{n.abort(),p(new Error("timeout"))},r)}),i,u;try{i=await Promise.race([t(jt(e.attestationServiceUrl,e.path),{method:"POST",headers:{accept:"application/json","content-type":"application/json"},body:JSON.stringify(e.body),signal:n.signal}),a]),u=await Promise.race([i.text(),a])}catch(c){n.signal.aborted&&s("TIMEOUT",`${e.failureContext} timed out after ${r}ms`,{cause:c}),s("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed at the network layer`,{cause:c})}finally{clearTimeout(o)}if(!i.ok){let c=$t(u);c?.success===!1&&Ze(e.failureContext,i.status,c),s("ATTESTATION_FETCH_FAILED",`${e.failureContext} failed with HTTP ${i.status}`,{details:{status:i.status,body:u.slice(0,400)}})}let l;try{l=JSON.parse(u)}catch(c){s("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a non-JSON ServiceResponse`,{cause:c})}return l.success!==!0&&(l.success===!1&&Ze(e.failureContext,i.status,l),s("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned an unsuccessful ServiceResponse`)),qt(l.responseObject)||s("ATTESTATION_RESPONSE_INVALID",`${e.failureContext} returned a ServiceResponse without responseObject`,{details:{status:i.status,envelopeSnippet:Kt(l)}}),l.responseObject}function $t(e){try{return JSON.parse(e)}catch{return}}function Ze(e,t,r){let n={status:t,statusCode:r.statusCode,message:r.message,responseObject:r.responseObject};s("SERVICE_RESPONSE_ERROR",`${e} returned an unsuccessful ServiceResponse`,{details:n})}function qt(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Kt(e){return JSON.stringify(e).slice(0,Wt)}function jt(e,t){let r=new URL(e);return r.pathname=`${r.pathname.replace(/\/+$/u,"")}${t}`,r.search="",r.toString()}async function de(e){let t=Qe(e.callerAddress),r=await Y({attestationServiceUrl:e.attestationServiceUrl,trust:e.trust,fetch:e.fetch,subtle:e.subtle,getRandomValues:e.getRandomValues,now:e.now,onWarning:e.onWarning,timeoutMs:e.timeoutMs,platform:e.platform,actionType:e.actionType,sessionMaterial:e.sessionMaterial});return b({attestationServiceUrl:e.attestationServiceUrl,path:"/identity",fetch:e.fetch,failureContext:"POST /identity",timeoutMs:e.timeoutMs,body:{platform:e.platform,actionType:e.actionType,callerAddress:t,encryptedSessionMaterial:r,params:e.params}})}async function le(e){let t=await W(e);return b({attestationServiceUrl:e.attestationServiceUrl,path:`/seller/credentials/${encodeURIComponent(e.platform)}`,fetch:e.fetch,failureContext:"POST /seller/credentials",timeoutMs:e.timeoutMs,body:{encryptedUpload:t}})}async function pe(e){let t=await H(e);return b({attestationServiceUrl:e.attestationServiceUrl,path:`/buyer/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /buyer/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intent:e.intent}})}async function fe(e){let t=await F(e);return b({attestationServiceUrl:e.attestationServiceUrl,path:`/dispute/verify/${encodeURIComponent(e.platform)}/${encodeURIComponent(e.actionType)}`,fetch:e.fetch,failureContext:"POST /dispute/verify",timeoutMs:e.timeoutMs,body:{encryptedSessionMaterial:t,params:e.params,chainId:e.chainId,intentHash:e.intentHash}})}function zt(e){let t=Xe[e.environment],r=e.attestationServiceUrl??t.attestationServiceUrl,n=et({strictPin:!0},e.trust),o=i=>({...i,attestationServiceUrl:i.attestationServiceUrl??r,trust:et(n,i.trust),fetch:i.fetch??e.fetch,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues,now:i.now??e.now,onWarning:i.onWarning??e.onWarning,timeoutMs:i.timeoutMs??e.timeoutMs}),a=i=>({...i,subtle:i.subtle??e.subtle,getRandomValues:i.getRandomValues??e.getRandomValues});return{createEncryptedBuyerTeeSessionMaterial:i=>H(o(i)),createEncryptedIdentitySessionMaterial:i=>Y(o(i)),createEncryptedDisputeSessionMaterial:i=>F(o(i)),createEncryptedSellerCredentialUpload:i=>W(o(i)),requestIdentityAttestation:i=>de(o(i)),uploadSellerCredential:i=>le(o(i)),verifyBuyerTeePayment:i=>{let u=o(i);return pe(u)},verifyDispute:i=>fe(o(i)),fetchAndVerifyAttestation:(i={})=>X(o(i)),encryptBuyerTeeSessionMaterial:i=>V(a(i)),encryptIdentitySessionMaterial:i=>k(a(i)),encryptDisputeSessionMaterial:i=>L(a(i)),encryptSellerCredentialUpload:i=>G({...a(i),now:i.now??e.now})}}function et(e,t){return t?{...e,...t,expectedPcr8ByHost:{...e.expectedPcr8ByHost,...t.expectedPcr8ByHost}}:e}import{concat as Xt,getAddress as ye,keccak256 as me,recoverAddress as Jt,TypedDataEncoder as J,toUtf8Bytes as Qt,verifyTypedData as Zt}from"ethers";var er={name:"UnifiedPaymentVerifier",version:"1"},Ae={PaymentAttestation:[{name:"intentHash",type:"bytes32"},{name:"releaseAmount",type:"uint256"},{name:"dataHash",type:"bytes32"}]},tr="PaymentAttestation(bytes32 intentHash,uint256 releaseAmount,bytes32 dataHash)",tt=y(tr),rr={name:"ZKP2P DisputeVerifier",version:"1"},Te={DisputeAttestation:[{name:"intentHash",type:"bytes32"},{name:"dataHash",type:"bytes32"}]},nr="DisputeAttestation(bytes32 intentHash,bytes32 dataHash)",rt=y(nr),Se={name:"ZKP2PIdentityVerifier",version:"1"},Ee={IdentityAttestation:[{name:"method",type:"bytes32"},{name:"actionType",type:"bytes32"},{name:"callerAddress",type:"address"},{name:"payeeIdHash",type:"bytes32"},{name:"dataHash",type:"bytes32"},{name:"issuedAt",type:"uint256"},{name:"validUntil",type:"uint256"}]},ir="IdentityAttestation(bytes32 method,bytes32 actionType,address callerAddress,bytes32 payeeIdHash,bytes32 dataHash,uint256 issuedAt,uint256 validUntil)",nt=y(ir),it=J.hashDomain(Se).toLowerCase(),ot={name:"ZKP2P Seller Credential Bundle",version:"1"},st={SellerCredentialBundle:[{name:"platform",type:"string"},{name:"payeeIdHash",type:"bytes32"},{name:"encryptedBlobHash",type:"bytes32"},{name:"encryptedDataKeyHash",type:"bytes32"},{name:"nonceHash",type:"bytes32"},{name:"credentialType",type:"string"},{name:"credentialValidatedAt",type:"string"},{name:"credentialExpiresAt",type:"string"}]};function or(e){return{...er,chainId:e.chainId,verifyingContract:ye(e.verifyingContract)}}function ge(e){return J.hashDomain(or(e)).toLowerCase()}function sr(e){return{...rr,chainId:e.chainId,verifyingContract:ye(e.verifyingContract)}}function Ie(e){return J.hashDomain(sr(e)).toLowerCase()}function y(e){return me(Qt(e)).toLowerCase()}function Q(e){return me(e).toLowerCase()}function Z(e){try{let t=J.from(e.types).hash(e.value),r=me(Xt(["0x1901",e.domainSeparator,t]));return D(Jt(r,e.signature))}catch(t){s("ATTESTATION_SIGNATURE_INVALID","Unable to recover signer from attestation signature",{cause:t})}}function ee(e){try{return D(Zt(e.domain,e.types,e.value,e.signature))}catch(t){s("ATTESTATION_SIGNATURE_INVALID","Unable to verify attestation signature",{cause:t})}}function Pe(e,t){let r=D(e),n=new Set(t.map(o=>D(o)));return n.has(r)||s("SIGNER_NOT_TRUSTED","Recovered signer is not in trustedSigners",{details:{recoveredSigner:r,trustedSigners:Array.from(n)}}),r}function O(e){let t=Pe(e.recoveredSigner,e.trustedSigners),r=D(e.payloadSigner);return r!==t&&s("ATTESTATION_SIGNATURE_INVALID","Payload signer does not match the recovered signer",{details:{payloadSigner:r,recoveredSigner:t}}),t}function d(e,t,r){e.toLowerCase()!==t.toLowerCase()&&s("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function at(e,t,r){let n,o;try{n=D(e),o=D(t)}catch(a){s("INVALID_PARAMETER",`${r} must be a valid Ethereum address`,{cause:a})}n!==o&&s("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function f(e,t,r){e!==t&&s("ATTESTATION_BINDING_MISMATCH",`${r} did not match expected value`,{details:{actual:e,expected:t}})}function w(e,t){JSON.stringify(e)!==JSON.stringify(t)&&s("ATTESTATION_BINDING_MISMATCH","typedDataSpec.types did not match the expected EIP-712 types")}function g(e,t){return typeof e!="string"&&s("INVALID_PARAMETER",`${t} is required`),e}function D(e){return ye(e).toLowerCase()}function ar(e,t){f(e.platform,t.expectedPlatform,"platform"),f(e.actionType,t.expectedActionType,"actionType"),f(e.typedDataSpec.primaryType,"PaymentAttestation","typedDataSpec.primaryType"),w(e.typedDataSpec.types,Ae),d(e.typeHash,tt,"typeHash"),d(e.domainSeparator,ge(t.expectedDomain),"domainSeparator"),d(Q(e.encodedPaymentDetails),e.typedDataValue.dataHash,"encodedPaymentDetails"),d(e.typedDataValue.intentHash,g(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash");let r=Z({domainSeparator:e.domainSeparator,types:Ae,value:{...e.typedDataValue},signature:e.signature});return O({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}import{AbiCoder as cr}from"ethers";var ur="tuple(bytes32 paymentMethod,bytes32 originalPaymentId,bytes32 disputeId,uint256 paymentAmount,bytes32 paymentCurrency)";function dr(e,t){f(e.platform,t.expectedPlatform,"platform"),f(e.actionType,t.expectedActionType,"actionType"),f(e.typedDataSpec.primaryType,"DisputeAttestation","typedDataSpec.primaryType"),w(e.typedDataSpec.types,Te),d(e.typeHash,rt,"typeHash"),d(e.domainSeparator,Ie(t.expectedDomain),"domainSeparator"),d(e.typedDataValue.intentHash,g(t.expectedIntentHash,"expectedIntentHash"),"typedDataValue.intentHash"),d(Q(e.encodedDisputeDetails),e.typedDataValue.dataHash,"encodedDisputeDetails"),d(e.disputeDetails.paymentMethod,y(e.platform),"paymentMethod"),lr(e);let r=Z({domainSeparator:e.domainSeparator,types:Te,value:{...e.typedDataValue},signature:e.signature});return O({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e}function lr(e){let t;try{let r=e.disputeDetails;t=cr.defaultAbiCoder().encode([ur],[[r.paymentMethod,r.originalPaymentId,r.disputeId,r.paymentAmount,r.paymentCurrency]])}catch(r){s("ATTESTATION_RESPONSE_INVALID","disputeDetails could not be ABI encoded",{cause:r})}d(e.encodedDisputeDetails,t,"disputeDetails")}var pr=["platform","actionType","payeeId","username","metadata"];function fr(e,t){f(e.platform,t.expectedPlatform,"platform"),f(e.actionType,t.expectedActionType,"actionType"),f(e.identity.platform,e.platform,"identity.platform"),f(e.identity.actionType,e.actionType,"identity.actionType"),f(e.typedDataSpec.primaryType,"IdentityAttestation","typedDataSpec.primaryType"),w(e.typedDataSpec.types,Ee),d(e.domainSeparator,it,"domainSeparator"),d(e.typeHash,nt,"typeHash"),d(e.identity.method,y(e.identity.platform),"identity.method"),d(e.identity.payeeIdHash,y(e.identity.payeeId),"identity.payeeIdHash"),d(e.typedDataValue.method,e.identity.method,"typedDataValue.method"),d(e.typedDataValue.actionType,y(e.identity.actionType),"typedDataValue.actionType"),at(e.typedDataValue.callerAddress,g(t.expectedCallerAddress,"expectedCallerAddress"),"typedDataValue.callerAddress"),d(e.typedDataValue.payeeIdHash,e.identity.payeeIdHash,"typedDataValue.payeeIdHash"),d(e.typedDataValue.payeeIdHash,g(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"typedDataValue.payeeIdHash"),d(e.typedDataValue.dataHash,yr(e.identity),"typedDataValue.dataHash"),Ar(e.typedDataValue.validUntil,t.now??Date.now);let r=ee({domain:Se,types:Ee,value:{...e.typedDataValue},signature:e.signature});return O({payloadSigner:e.signer,recoveredSigner:r,trustedSigners:t.trustedSigners}),e.identity}function yr(e){let t={platform:e.platform,actionType:e.actionType,payeeId:e.payeeId,username:e.username,metadata:mr(e.metadata)},r=JSON.stringify(Object.fromEntries(pr.map(n=>[n,t[n]])));return y(r)}function mr(e){return Object.fromEntries(Object.entries(e).sort(([t],[r])=>t.localeCompare(r)))}function Ar(e,t){let r=t();BigInt(r)>BigInt(e)&&s("ATTESTATION_EXPIRED","Identity attestation validUntil is in the past",{details:{validUntil:e,nowMs:r}})}function Tr(e,t){f(e.platform,t.expectedPlatform,"platform"),d(e.payeeIdHash,g(t.expectedPayeeIdHash,"expectedPayeeIdHash"),"payeeIdHash"),Er(e.credentialExpiresAt,t.now??Date.now);let r=ee({domain:ot,types:st,value:Sr(e),signature:e.bundleSignature});return Pe(r,t.trustedSigners),e}function Sr(e){return{platform:e.platform,payeeIdHash:e.payeeIdHash,encryptedBlobHash:y(e.encryptedBlob),encryptedDataKeyHash:y(e.encryptedDataKey),nonceHash:y(e.nonce),credentialType:e.credentialType,credentialValidatedAt:e.credentialValidatedAt,credentialExpiresAt:e.credentialExpiresAt??""}}function Er(e,t){let r=t();e!==null&&BigInt(r)>BigInt(e)&&s("ATTESTATION_EXPIRED","Seller credential bundle credentialExpiresAt is in the past",{details:{credentialExpiresAt:e,nowMs:r}})}export{j as AWS_NITRO_ROOT_FINGERPRINT_SHA256_HEX,ne as AWS_NITRO_ROOT_PEM,N as NitroAttestationError,H as createEncryptedBuyerTeeSessionMaterial,F as createEncryptedDisputeSessionMaterial,Y as createEncryptedIdentitySessionMaterial,W as createEncryptedSellerCredentialUpload,zt as createNitroAttestationClient,V as encryptBuyerTeeSessionMaterial,L as encryptDisputeSessionMaterial,k as encryptIdentitySessionMaterial,G as encryptSellerCredentialUpload,X as fetchAndVerifyAttestation,Ie as getDisputeVerifierDomainSeparator,ge as getUnifiedPaymentVerifierDomainSeparator,y as hashUtf8,de as requestIdentityAttestation,le as uploadSellerCredential,pe as verifyBuyerTeePayment,ar as verifyBuyerTeePaymentAttestation,fe as verifyDispute,dr as verifyDisputeAttestation,fr as verifyIdentityAttestation,Tr as verifySellerCredentialBundle};
 //# sourceMappingURL=index.js.map