burnledger 0.4.0 → 0.6.0

package/dist/cjs/enclave-seal.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Seal a connection config to the enclave, so the BurnLedger host never reads it.
+ *
+ * WHY THIS MODULE EXISTS. Registering a system used to mean POSTing your
+ * datastore credentials to the API in the clear. The host then handed them to
+ * the enclave to be sealed, and everything after that point was ciphertext only
+ * the enclave could open — but the host held the plaintext for the length of
+ * that request, and nothing recorded that it had. This removes that step: you
+ * seal the config yourself, and the host relays bytes it cannot open.
+ *
+ * WHAT MAKES IT WORK, AND WHAT WOULD MAKE IT THEATRE. The enclave publishes an
+ * X25519 public key inside its AWS Nitro attestation document, beside the
+ * Ed25519 signing key it already published. `verifyEnclaveConfigSealKey` checks
+ * that document — the COSE signature, the certificate chain to the pinned AWS
+ * Nitro root, and the image's PCR0 — and returns the key. Sealing to a key the
+ * API simply handed over protects nothing: the host would supply its own key,
+ * read the config, and re-seal to the real enclave, and your registration would
+ * succeed exactly as it does today. So `sealConnectionConfig` takes the
+ * attestation document and the PCR0 you expect, never a bare key.
+ *
+ * WHERE `expectedPcr0` COMES FROM. Not from this API. A measurement served by
+ * the same host that serves the document pins nothing. Take BurnLedger's
+ * published measurement for the enclave image out of band and pin it in your own
+ * configuration. That is a trust-on-first-use anchor in the operator's
+ * publication — the same anchor every other claim in this product rests on.
+ *
+ * WHAT IT DOES NOT DO. It stops the host reading a config in transit. It does
+ * not stop the host composing a config of ITS own and having the enclave seal
+ * that, and it does nothing if the machine running this code is compromised.
+ *
+ * NODE ONLY. Verifying an attestation document needs X.509 chain building,
+ * which browsers do not expose, and sealing a datastore credential is not a
+ * thing a browser should be doing. This module is not part of the browser entry
+ * point.
+ */
+/**
+ * Envelope wire format (v1). Must match enclave/configsealkey.go byte for byte:
+ *
+ *   magic      8   "BLCFGSL1"
+ *   recipient 32   the X25519 key this envelope is addressed to
+ *   ephemeral 32   this sender's one-time X25519 key
+ *   nonce     12   AES-GCM nonce
+ *   sealed     n   AES-256-GCM(plaintext), tag appended
+ *
+ * The key is HKDF-SHA256 over the X25519 shared secret salted with the whole
+ * header; the same header is the GCM additional data.
+ */
+export declare const ENVELOPE_MAGIC: Uint8Array<ArrayBuffer>;
+export declare const HEADER_SIZE: number;
+/**
+ * The AWS Nitro Enclaves root CA (G1), pinned. A root fetched at runtime is not
+ * a pin; this is the anchor the whole verification hangs from.
+ */
+export declare const NITRO_ROOT_G1_PEM = "-----BEGIN CERTIFICATE-----\nMIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL\nMAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD\nVQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4\nMTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQL\nDANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEG\nBSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb\n48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZE\nh8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkF\nR+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYC\nMQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW\nrfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N\nIwLz3/Y=\n-----END CERTIFICATE-----\n";
+/** Raised when an attestation document is not one this client will seal to. */
+export declare class EnclaveAttestationError extends Error {
+    constructor(message: string);
+}
+export interface SealOptions {
+    /** Hex PCR0 of the enclave image you accept, pinned out of band. Required. */
+    expectedPcr0: string;
+    /** Further PCRs to pin, hex-encoded, by index. */
+    expectedPcrs?: Record<number, string>;
+    /** The reference time the document must describe. Defaults to now. */
+    now?: Date;
+    /**
+     * Override the pinned AWS Nitro root. Leave unset in production — a root
+     * supplied per call is not a pin.
+     */
+    rootPem?: string;
+}
+/**
+ * Seal `config` to the enclave the attestation document describes. Pass the
+ * result as `sealed_connection_config` when registering a system.
+ *
+ * Throws {@link EnclaveAttestationError} if the document is not a genuine Nitro
+ * attestation from the pinned image. Nothing is sealed in that case.
+ */
+export declare function sealConnectionConfig(config: Record<string, unknown> | string | Uint8Array, attestationDocument: Uint8Array, options: SealOptions): Promise<Uint8Array>;
+/**
+ * Seal `plaintext` to an already-verified enclave config-seal key.
+ *
+ * Prefer {@link sealConnectionConfig}, which verifies the key for you. This is
+ * the lower half, for a caller that verified the document itself.
+ */
+export declare function sealToKey(recipientPublicKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
+/**
+ * Verify an enclave attestation document and return the X25519 config-seal key
+ * bound in it.
+ *
+ * Checks, in order: the COSE_Sign1 structure and its ES384 algorithm; the
+ * certificate chain from the document's leaf through its CA bundle to the
+ * pinned AWS Nitro root; the ES384 signature over the RFC 8152 Sig_structure;
+ * the document's own AWS-signed timestamp against `now`; the PCRs; and that the
+ * bound key is 32 bytes.
+ *
+ * PCR0 must be pinned. Without it any genuinely-signed Nitro document — including
+ * one from an enclave the host itself booted — would pass.
+ */
+export declare function verifyEnclaveConfigSealKey(attestationDocument: Uint8Array, options: SealOptions): Promise<Uint8Array>;
+//# sourceMappingURL=enclave-seal.d.ts.map

package/dist/cjs/enclave-seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-seal.d.ts","sourceRoot":"","sources":["../../src/enclave-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,yBAAmE,CAAC;AAG/F,eAAO,MAAM,WAAW,QAAoD,CAAC;AAG7E;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6xBAc7B,CAAC;AAMF,+EAA+E;AAC/E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sEAAsE;IACtE,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,UAAU,EACrD,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,kBAAkB,EAAE,UAAU,EAC9B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAuCrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CA8CrB"}

package/dist/cjs/enclave-seal.js

@@ -0,0 +1,479 @@
+"use strict";
+/**
+ * Seal a connection config to the enclave, so the BurnLedger host never reads it.
+ *
+ * WHY THIS MODULE EXISTS. Registering a system used to mean POSTing your
+ * datastore credentials to the API in the clear. The host then handed them to
+ * the enclave to be sealed, and everything after that point was ciphertext only
+ * the enclave could open — but the host held the plaintext for the length of
+ * that request, and nothing recorded that it had. This removes that step: you
+ * seal the config yourself, and the host relays bytes it cannot open.
+ *
+ * WHAT MAKES IT WORK, AND WHAT WOULD MAKE IT THEATRE. The enclave publishes an
+ * X25519 public key inside its AWS Nitro attestation document, beside the
+ * Ed25519 signing key it already published. `verifyEnclaveConfigSealKey` checks
+ * that document — the COSE signature, the certificate chain to the pinned AWS
+ * Nitro root, and the image's PCR0 — and returns the key. Sealing to a key the
+ * API simply handed over protects nothing: the host would supply its own key,
+ * read the config, and re-seal to the real enclave, and your registration would
+ * succeed exactly as it does today. So `sealConnectionConfig` takes the
+ * attestation document and the PCR0 you expect, never a bare key.
+ *
+ * WHERE `expectedPcr0` COMES FROM. Not from this API. A measurement served by
+ * the same host that serves the document pins nothing. Take BurnLedger's
+ * published measurement for the enclave image out of band and pin it in your own
+ * configuration. That is a trust-on-first-use anchor in the operator's
+ * publication — the same anchor every other claim in this product rests on.
+ *
+ * WHAT IT DOES NOT DO. It stops the host reading a config in transit. It does
+ * not stop the host composing a config of ITS own and having the enclave seal
+ * that, and it does nothing if the machine running this code is compromised.
+ *
+ * NODE ONLY. Verifying an attestation document needs X.509 chain building,
+ * which browsers do not expose, and sealing a datastore credential is not a
+ * thing a browser should be doing. This module is not part of the browser entry
+ * point.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnclaveAttestationError = exports.NITRO_ROOT_G1_PEM = exports.HEADER_SIZE = exports.ENVELOPE_MAGIC = void 0;
+exports.sealConnectionConfig = sealConnectionConfig;
+exports.sealToKey = sealToKey;
+exports.verifyEnclaveConfigSealKey = verifyEnclaveConfigSealKey;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Envelope wire format (v1). Must match enclave/configsealkey.go byte for byte:
+ *
+ *   magic      8   "BLCFGSL1"
+ *   recipient 32   the X25519 key this envelope is addressed to
+ *   ephemeral 32   this sender's one-time X25519 key
+ *   nonce     12   AES-GCM nonce
+ *   sealed     n   AES-256-GCM(plaintext), tag appended
+ *
+ * The key is HKDF-SHA256 over the X25519 shared secret salted with the whole
+ * header; the same header is the GCM additional data.
+ */
+exports.ENVELOPE_MAGIC = new Uint8Array([0x42, 0x4c, 0x43, 0x46, 0x47, 0x53, 0x4c, 0x31]); // "BLCFGSL1"
+const KEY_SIZE = 32;
+const NONCE_SIZE = 12;
+exports.HEADER_SIZE = exports.ENVELOPE_MAGIC.length + 2 * KEY_SIZE + NONCE_SIZE;
+const KDF_INFO = new TextEncoder().encode("burnledger/config-seal/v1");
+/**
+ * The AWS Nitro Enclaves root CA (G1), pinned. A root fetched at runtime is not
+ * a pin; this is the anchor the whole verification hangs from.
+ */
+exports.NITRO_ROOT_G1_PEM = `-----BEGIN CERTIFICATE-----
+MIICETCCAZagAwIBAgIRAPkxdWgbkK/hHUbMtOTn+FYwCgYIKoZIzj0EAwMwSTEL
+MAkGA1UEBhMCVVMxDzANBgNVBAoMBkFtYXpvbjEMMAoGA1UECwwDQVdTMRswGQYD
+VQQDDBJhd3Mubml0cm8tZW5jbGF2ZXMwHhcNMTkxMDI4MTMyODA1WhcNNDkxMDI4
+MTQyODA1WjBJMQswCQYDVQQGEwJVUzEPMA0GA1UECgwGQW1hem9uMQwwCgYDVQQL
+DANBV1MxGzAZBgNVBAMMEmF3cy5uaXRyby1lbmNsYXZlczB2MBAGByqGSM49AgEG
+BSuBBAAiA2IABPwCVOumCMHzaHDimtqQvkY4MpJzbolL//Zy2YlES1BR5TSksfbb
+48C8WBoyt7F2Bw7eEtaaP+ohG2bnUs990d0JX28TcPQXCEPZ3BABIeTPYwEoCWZE
+h8l5YoQwTcU/9KNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUkCW1DdkF
+R+eWw5b6cp3PmanfS5YwDgYDVR0PAQH/BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYC
+MQCjfy+Rocm9Xue4YnwWmNJVA44fA0P5W2OpYow9OYCVRaEevL8uO1XYru5xtMPW
+rfMCMQCi85sWBbJwKKXdS6BptQFuZbT73o/gBh1qUxl/nNr12UO8Yfwr6wPLb+6N
+IwLz3/Y=
+-----END CERTIFICATE-----
+`;
+/** Same bound as enclave.MaxAttestationClockSkew. */
+const MAX_CLOCK_SKEW_MS = 5 * 60 * 1000;
+const COSE_ALG_ES384 = -35;
+/** Raised when an attestation document is not one this client will seal to. */
+class EnclaveAttestationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "EnclaveAttestationError";
+    }
+}
+exports.EnclaveAttestationError = EnclaveAttestationError;
+/**
+ * Seal `config` to the enclave the attestation document describes. Pass the
+ * result as `sealed_connection_config` when registering a system.
+ *
+ * Throws {@link EnclaveAttestationError} if the document is not a genuine Nitro
+ * attestation from the pinned image. Nothing is sealed in that case.
+ */
+async function sealConnectionConfig(config, attestationDocument, options) {
+    const key = await verifyEnclaveConfigSealKey(attestationDocument, options);
+    return sealToKey(key, configBytes(config));
+}
+/**
+ * Seal `plaintext` to an already-verified enclave config-seal key.
+ *
+ * Prefer {@link sealConnectionConfig}, which verifies the key for you. This is
+ * the lower half, for a caller that verified the document itself.
+ */
+async function sealToKey(recipientPublicKey, plaintext) {
+    if (recipientPublicKey.length !== KEY_SIZE) {
+        throw new EnclaveAttestationError(`config-seal recipient key is ${recipientPublicKey.length} bytes, want ${KEY_SIZE}`);
+    }
+    let peer;
+    try {
+        peer = await node_crypto_1.webcrypto.subtle.importKey("raw", bufferSource(recipientPublicKey), { name: "X25519" }, false, []);
+    }
+    catch (err) {
+        throw new EnclaveAttestationError(`config-seal recipient key: ${err.message}`);
+    }
+    const ephemeral = (await node_crypto_1.webcrypto.subtle.generateKey({ name: "X25519" }, true, [
+        "deriveBits",
+    ]));
+    const shared = new Uint8Array(await node_crypto_1.webcrypto.subtle.deriveBits({ name: "X25519", public: peer }, ephemeral.privateKey, 256));
+    const ephemeralPublic = new Uint8Array(await node_crypto_1.webcrypto.subtle.exportKey("raw", ephemeral.publicKey));
+    const nonce = node_crypto_1.webcrypto.getRandomValues(new Uint8Array(NONCE_SIZE));
+    const header = concat(exports.ENVELOPE_MAGIC, recipientPublicKey, ephemeralPublic, nonce);
+    const aesKey = await deriveEnvelopeKey(shared, header);
+    const sealed = new Uint8Array(await node_crypto_1.webcrypto.subtle.encrypt({ name: "AES-GCM", iv: nonce, additionalData: header }, aesKey, bufferSource(plaintext)));
+    return concat(header, sealed);
+}
+/**
+ * Verify an enclave attestation document and return the X25519 config-seal key
+ * bound in it.
+ *
+ * Checks, in order: the COSE_Sign1 structure and its ES384 algorithm; the
+ * certificate chain from the document's leaf through its CA bundle to the
+ * pinned AWS Nitro root; the ES384 signature over the RFC 8152 Sig_structure;
+ * the document's own AWS-signed timestamp against `now`; the PCRs; and that the
+ * bound key is 32 bytes.
+ *
+ * PCR0 must be pinned. Without it any genuinely-signed Nitro document — including
+ * one from an enclave the host itself booted — would pass.
+ */
+async function verifyEnclaveConfigSealKey(attestationDocument, options) {
+    if (!attestationDocument || attestationDocument.length === 0) {
+        throw new EnclaveAttestationError("no attestation document (nothing to verify — this is not a pass)");
+    }
+    const expected = { ...(options.expectedPcrs ?? {}) };
+    if (options.expectedPcr0)
+        expected[0] = options.expectedPcr0;
+    if (expected[0] === undefined) {
+        throw new EnclaveAttestationError("no expected PCR0; refusing to accept an unpinned enclave image");
+    }
+    const now = options.now ?? new Date();
+    const { protected: protectedBytes, payload: payloadBytes, signature } = decodeCoseSign1(attestationDocument);
+    checkAlgEs384(protectedBytes);
+    const payload = cborDecode(payloadBytes);
+    if (!(payload instanceof Map)) {
+        throw new EnclaveAttestationError("attestation payload is not a CBOR map");
+    }
+    const leafDer = payload.get("certificate");
+    if (!(leafDer instanceof Uint8Array) || leafDer.length === 0) {
+        throw new EnclaveAttestationError("attestation payload missing certificate");
+    }
+    const pcrs = payload.get("pcrs");
+    if (!(pcrs instanceof Map)) {
+        throw new EnclaveAttestationError("attestation payload missing pcrs");
+    }
+    const leaf = verifyChain(leafDer, payload.get("cabundle"), now, options.rootPem ?? exports.NITRO_ROOT_G1_PEM);
+    verifyCoseSignature(leaf, protectedBytes, payloadBytes, signature);
+    checkClock(payload.get("timestamp"), now);
+    matchPcrs(pcrs, expected);
+    const publicKey = payload.get("public_key");
+    if (!(publicKey instanceof Uint8Array) || publicKey.length !== KEY_SIZE) {
+        const got = publicKey instanceof Uint8Array ? publicKey.length : 0;
+        throw new EnclaveAttestationError(`the document binds a ${got}-byte public key, want a ${KEY_SIZE}-byte X25519 ` +
+            "config-seal key (this enclave image may not publish one)");
+    }
+    return publicKey;
+}
+// --- verification internals -------------------------------------------------
+/**
+ * Build and verify leaf -> cabundle -> pinned root, valid at `now`.
+ *
+ * The path is not general: the NSM hands over an ORDERED bundle, root first, so
+ * the chain is walked in order and every hop must check out. Nothing is
+ * searched for an alternative path — an ambiguous chain is a refusal.
+ */
+function verifyChain(leafDer, cabundle, now, rootPem) {
+    let root;
+    try {
+        root = new node_crypto_1.X509Certificate(rootPem);
+    }
+    catch (err) {
+        throw new EnclaveAttestationError(`pinned Nitro root is unreadable: ${err.message}`);
+    }
+    if (!Array.isArray(cabundle) || cabundle.length === 0) {
+        throw new EnclaveAttestationError("attestation payload carries no CA bundle");
+    }
+    const chain = [];
+    cabundle.forEach((der, i) => {
+        if (!(der instanceof Uint8Array)) {
+            throw new EnclaveAttestationError(`cabundle[${i}] is not a byte string`);
+        }
+        try {
+            chain.push(new node_crypto_1.X509Certificate(Buffer.from(der)));
+        }
+        catch (err) {
+            throw new EnclaveAttestationError(`cabundle[${i}] is not a certificate: ${err.message}`);
+        }
+    });
+    let leaf;
+    try {
+        leaf = new node_crypto_1.X509Certificate(Buffer.from(leafDer));
+    }
+    catch (err) {
+        throw new EnclaveAttestationError(`leaf certificate is unreadable: ${err.message}`);
+    }
+    if (chain[0].fingerprint256 !== root.fingerprint256) {
+        throw new EnclaveAttestationError("the document's CA bundle does not start at the pinned AWS Nitro root");
+    }
+    const ordered = [...chain, leaf];
+    for (const cert of ordered)
+        checkValidity(cert, now);
+    for (let i = 1; i < ordered.length; i++) {
+        const issuer = ordered[i - 1];
+        const subject = ordered[i];
+        if (!subject.checkIssued(issuer) || !subject.verify(issuer.publicKey)) {
+            throw new EnclaveAttestationError(`certificate chain is broken at ${subject.subject.replace(/\n/g, ", ")}`);
+        }
+    }
+    return leaf;
+}
+function checkValidity(cert, now) {
+    const from = Date.parse(cert.validFrom);
+    const to = Date.parse(cert.validTo);
+    if (Number.isNaN(from) || Number.isNaN(to)) {
+        throw new EnclaveAttestationError(`certificate ${cert.subject.replace(/\n/g, ", ")} has an unreadable validity window`);
+    }
+    const t = now.getTime();
+    if (t < from || t > to) {
+        throw new EnclaveAttestationError(`certificate ${cert.subject.replace(/\n/g, ", ")} is not valid at ${now.toISOString()} ` +
+            `(valid ${new Date(from).toISOString()} to ${new Date(to).toISOString()})`);
+    }
+}
+function verifyCoseSignature(leaf, protectedBytes, payload, signature) {
+    if (signature.length !== 96) {
+        throw new EnclaveAttestationError(`signature is ${signature.length} bytes, want 96 (P-384 r||s)`);
+    }
+    const sigStructure = cborEncode(["Signature1", protectedBytes, new Uint8Array(0), payload]);
+    // ieee-p1363 is the raw r||s pair COSE carries; the default would expect DER.
+    const ok = (0, node_crypto_1.verify)("sha384", sigStructure, { key: leaf.publicKey, dsaEncoding: "ieee-p1363" }, signature);
+    if (!ok)
+        throw new EnclaveAttestationError("the attestation COSE signature is invalid");
+}
+function checkClock(timestamp, now) {
+    if (typeof timestamp !== "number" || !Number.isFinite(timestamp) || timestamp <= 0) {
+        throw new EnclaveAttestationError("the document carries no timestamp (nothing to check the clock against)");
+    }
+    const skew = Math.abs(now.getTime() - timestamp);
+    if (skew > MAX_CLOCK_SKEW_MS) {
+        throw new EnclaveAttestationError(`the NSM signed this document at ${new Date(timestamp).toISOString()} but it is being ` +
+            `verified against ${now.toISOString()} — ${Math.round(skew / 1000)}s of clock skew ` +
+            `exceeds the ${MAX_CLOCK_SKEW_MS / 1000}s bound`);
+    }
+}
+function matchPcrs(actual, expected) {
+    for (const [key, wantHex] of Object.entries(expected)) {
+        const index = Number(key);
+        const got = actual.get(index);
+        if (!(got instanceof Uint8Array)) {
+            throw new EnclaveAttestationError(`the document carries no PCR${index}`);
+        }
+        if (toHex(got) !== wantHex.toLowerCase()) {
+            throw new EnclaveAttestationError(`PCR${index} is ${toHex(got)}, expected ${wantHex} — this is not the enclave image you pinned`);
+        }
+    }
+}
+async function deriveEnvelopeKey(shared, header) {
+    const ikm = await node_crypto_1.webcrypto.subtle.importKey("raw", bufferSource(shared), "HKDF", false, [
+        "deriveKey",
+    ]);
+    return node_crypto_1.webcrypto.subtle.deriveKey({ name: "HKDF", hash: "SHA-256", salt: header, info: KDF_INFO }, ikm, { name: "AES-GCM", length: 256 }, false, ["encrypt", "decrypt"]);
+}
+function configBytes(config) {
+    if (config instanceof Uint8Array)
+        return config;
+    if (typeof config === "string")
+        return new TextEncoder().encode(config);
+    return new TextEncoder().encode(JSON.stringify(config));
+}
+/**
+ * Copy into a view whose backing store TypeScript knows is a plain ArrayBuffer.
+ *
+ * WebCrypto's `BufferSource` excludes `SharedArrayBuffer`-backed views, and a
+ * `Uint8Array` parameter is `Uint8Array<ArrayBufferLike>`, which could be one.
+ * The copy is what makes that provably false rather than asserted away with a
+ * cast; the buffers here are a few kilobytes at most.
+ */
+function bufferSource(b) {
+    return new Uint8Array(b);
+}
+function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let offset = 0;
+    for (const p of parts) {
+        out.set(p, offset);
+        offset += p.length;
+    }
+    return out;
+}
+function toHex(b) {
+    return Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+}
+// --- a CBOR subset ----------------------------------------------------------
+//
+// Enough of RFC 8949 to read an NSM attestation document and re-encode the
+// fixed four-element Sig_structure. Hand-rolled because this SDK ships with no
+// runtime dependencies, which is a published contract. Indefinite-length items
+// are refused rather than supported: a genuine NSM document uses definite
+// lengths throughout, and accepting two encodings for one value is how
+// signature checks get bypassed.
+function decodeCoseSign1(doc) {
+    const body = doc[0] === 0xd2 ? doc.subarray(1) : doc; // CBOR tag 18
+    const value = cborDecode(body);
+    if (!Array.isArray(value) || value.length !== 4) {
+        throw new EnclaveAttestationError("COSE_Sign1 must be a 4-element array");
+    }
+    const [prot, , payload, signature] = value;
+    for (const [name, item] of [
+        ["protected header", prot],
+        ["payload", payload],
+        ["signature", signature],
+    ]) {
+        if (!(item instanceof Uint8Array)) {
+            throw new EnclaveAttestationError(`COSE_Sign1 ${name} is not a byte string`);
+        }
+    }
+    return {
+        protected: prot,
+        payload: payload,
+        signature: signature,
+    };
+}
+function checkAlgEs384(protectedBytes) {
+    if (protectedBytes.length === 0) {
+        throw new EnclaveAttestationError("empty COSE protected header (no alg)");
+    }
+    const header = cborDecode(protectedBytes);
+    if (!(header instanceof Map) || !header.has(1)) {
+        throw new EnclaveAttestationError("COSE protected header missing alg");
+    }
+    const alg = header.get(1);
+    if (alg !== COSE_ALG_ES384) {
+        throw new EnclaveAttestationError(`COSE alg is ${alg}, want ES384 (${COSE_ALG_ES384})`);
+    }
+}
+function cborDecode(data) {
+    const [value, offset] = cborRead(data, 0);
+    if (offset !== data.length) {
+        throw new EnclaveAttestationError(`${data.length - offset} trailing bytes after the CBOR value`);
+    }
+    return value;
+}
+function cborRead(data, start) {
+    if (start >= data.length)
+        throw new EnclaveAttestationError("CBOR input ended mid-value");
+    const initial = data[start];
+    const major = initial >> 5;
+    const info = initial & 0x1f;
+    let i = start + 1;
+    let arg;
+    if (info < 24) {
+        arg = info;
+    }
+    else if (info === 24)
+        [arg, i] = cborUint(data, i, 1);
+    else if (info === 25)
+        [arg, i] = cborUint(data, i, 2);
+    else if (info === 26)
+        [arg, i] = cborUint(data, i, 4);
+    else if (info === 27)
+        [arg, i] = cborUint(data, i, 8);
+    else if (info === 31) {
+        throw new EnclaveAttestationError("indefinite-length CBOR items are not accepted");
+    }
+    else
+        throw new EnclaveAttestationError(`reserved CBOR additional information ${info}`);
+    switch (major) {
+        case 0:
+            return [arg, i];
+        case 1:
+            return [-1 - arg, i];
+        case 2:
+        case 3: {
+            const end = i + arg;
+            if (end > data.length) {
+                throw new EnclaveAttestationError("CBOR string runs past the end of the input");
+            }
+            const chunk = data.subarray(i, end);
+            return [major === 2 ? chunk : new TextDecoder("utf-8", { fatal: true }).decode(chunk), end];
+        }
+        case 4: {
+            const items = [];
+            for (let n = 0; n < arg; n++) {
+                const [item, next] = cborRead(data, i);
+                items.push(item);
+                i = next;
+            }
+            return [items, i];
+        }
+        case 5: {
+            const out = new Map();
+            for (let n = 0; n < arg; n++) {
+                const [key, afterKey] = cborRead(data, i);
+                const [val, afterVal] = cborRead(data, afterKey);
+                if (out.has(key)) {
+                    // Two readers could disagree about the same document. Refuse.
+                    throw new EnclaveAttestationError(`duplicate CBOR map key ${String(key)}`);
+                }
+                out.set(key, val);
+                i = afterVal;
+            }
+            return [out, i];
+        }
+        case 6: // tag: transparent, the tagged value is what matters
+            return cborRead(data, i);
+        case 7:
+            if (info === 20)
+                return [false, i];
+            if (info === 21)
+                return [true, i];
+            if (info === 22)
+                return [null, i];
+            throw new EnclaveAttestationError(`unsupported CBOR simple value ${info}`);
+        default:
+            throw new EnclaveAttestationError(`unsupported CBOR major type ${major}`);
+    }
+}
+function cborUint(data, i, width) {
+    if (i + width > data.length) {
+        throw new EnclaveAttestationError("CBOR integer runs past the end of the input");
+    }
+    let value = 0;
+    for (let n = 0; n < width; n++)
+        value = value * 256 + data[i + n];
+    if (!Number.isSafeInteger(value)) {
+        throw new EnclaveAttestationError("CBOR integer exceeds the safe integer range");
+    }
+    return [value, i + width];
+}
+function cborEncode(value) {
+    if (Array.isArray(value)) {
+        return concat(cborHead(4, value.length), ...value.map(cborEncode));
+    }
+    if (typeof value === "string") {
+        const raw = new TextEncoder().encode(value);
+        return concat(cborHead(3, raw.length), raw);
+    }
+    if (value instanceof Uint8Array) {
+        return concat(cborHead(2, value.length), value);
+    }
+    throw new EnclaveAttestationError(`cannot CBOR-encode ${typeof value}`);
+}
+function cborHead(major, arg) {
+    const base = major << 5;
+    if (arg < 24)
+        return new Uint8Array([base | arg]);
+    if (arg < 0x100)
+        return new Uint8Array([base | 24, arg]);
+    if (arg < 0x10000)
+        return new Uint8Array([base | 25, arg >> 8, arg & 0xff]);
+    return new Uint8Array([
+        base | 26,
+        (arg >>> 24) & 0xff,
+        (arg >>> 16) & 0xff,
+        (arg >>> 8) & 0xff,
+        arg & 0xff,
+    ]);
+}
+//# sourceMappingURL=enclave-seal.js.map

package/dist/cjs/enclave-seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-seal.js","sourceRoot":"","sources":["../../src/enclave-seal.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;;;;AAEH,6CAA+E;AAE/E;;;;;;;;;;;GAWG;AACU,QAAA,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa;AAC7G,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,UAAU,GAAG,EAAE,CAAC;AACT,QAAA,WAAW,GAAG,QAAA,cAAc,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,GAAG,UAAU,CAAC;AAC7E,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAEvE;;;GAGG;AACU,QAAA,iBAAiB,GAAG;;;;;;;;;;;;;;CAchC,CAAC;AAEF,qDAAqD;AACrD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,cAAc,GAAG,CAAC,EAAE,CAAC;AAE3B,+EAA+E;AAC/E,6BAAqC,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;;AAgBD;;;;;;GAMG;AACI,KAAK,+BACV,MAAqD,EACrD,mBAA+B,EAC/B,OAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACI,KAAK,oBACV,kBAA8B,EAC9B,SAAqB;IAErB,IAAI,kBAAkB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,gCAAgC,kBAAkB,CAAC,MAAM,gBAAgB,QAAQ,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,IAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,YAAY,CAAC,kBAAkB,CAAC,EAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,EAAE,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,uBAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;QAC9E,YAAY;KACb,CAAC,CAAuC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,uBAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAC/F,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAC7D,CAAC;IAEF,MAAM,KAAK,GAAG,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAA,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,CAC3B,MAAM,uBAAS,CAAC,MAAM,CAAC,OAAO,CAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EACtD,MAAM,EACN,YAAY,CAAC,SAAS,CAAC,CACxB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,qCACV,mBAA+B,EAC/B,OAAoB;IAEpB,IAAI,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,uBAAuB,CAC/B,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA2B,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7E,IAAI,OAAO,CAAC,YAAY;QAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAC7D,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAC/B,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAEtC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,GACnE,eAAe,CAAC,mBAAmB,CAAC,CAAC;IACvC,aAAa,CAAC,cAAc,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,YAAY,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,OAAO,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,QAAA,iBAAiB,CAAC,CAAC;IACtG,mBAAmB,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACnE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,SAAS,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,GAAG,4BAA4B,QAAQ,eAAe;YAC5E,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAClB,OAAmB,EACnB,QAAiB,EACjB,GAAS,EACT,OAAe;IAEf,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,6BAAe,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,oCAAqC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,0CAA0C,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,2BAA4B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,6BAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAAC,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,IAAI,uBAAuB,CAC/B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,uBAAuB,CAC/B,kCAAkC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAqB,EAAE,GAAS;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAC/B,eAAe,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,oCAAoC,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,GAAG,CAAC,WAAW,EAAE,GAAG;YACtF,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAqB,EACrB,cAA0B,EAC1B,OAAmB,EACnB,SAAqB;IAErB,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,SAAS,CAAC,MAAM,8BAA8B,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,8EAA8E;IAC9E,MAAM,EAAE,GAAG,IAAA,oBAAU,EACnB,QAAQ,EACR,YAAY,EACZ,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,EAClD,SAAS,CACV,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,SAAkB,EAAE,GAAS;IAC/C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,uBAAuB,CAC/B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,mBAAmB;YACrF,oBAAoB,GAAG,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB;YACpF,eAAe,iBAAiB,GAAG,IAAI,SAAS,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAA6B,EAAE,QAAgC;IAChF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,uBAAuB,CAC/B,MAAM,KAAK,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,6CAA6C,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAkB,EAClB,MAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACvF,WAAW;KACZ,CAAC,CAAC;IACH,OAAO,uBAAS,CAAC,MAAM,CAAC,SAAS,CAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAC/D,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAqD;IAExE,IAAI,MAAM,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,CAAa;IACjC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,KAAmB;IACpC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,CAAa;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,0EAA0E;AAC1E,uEAAuE;AACvE,iCAAiC;AAEjC,SAAS,eAAe,CAAC,GAAe;IAKtC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,AAAD,EAAG,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;QACzB,CAAC,kBAAkB,EAAE,IAAI,CAAC;QAC1B,CAAC,SAAS,EAAE,OAAO,CAAC;QACpB,CAAC,WAAW,EAAE,SAAS,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAkB;QAC7B,OAAO,EAAE,OAAqB;QAC9B,SAAS,EAAE,SAAuB;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,cAA0B;IAC/C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,eAAe,GAAG,iBAAiB,cAAc,GAAG,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAID,SAAS,UAAU,CAAC,IAAgB;IAClC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAC/B,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,sCAAsC,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB,EAAE,KAAa;IAC/C,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,IAAI,GAAW,CAAC;IAEhB,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QACd,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;SAAM,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACnD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACjD,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,uBAAuB,CAAC,+CAA+C,CAAC,CAAC;IACrF,CAAC;;QAAM,MAAM,IAAI,uBAAuB,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;IAEzF,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,CAAC;YACJ,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClB,KAAK,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACvB,KAAK,CAAC,CAAC;QACP,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACpB,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GAAgB,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,EAAE,CAAC;YACP,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;YAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1C,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACjD,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjB,8DAA8D;oBAC9D,MAAM,IAAI,uBAAuB,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAClB,CAAC,GAAG,QAAQ,CAAC;YACf,CAAC;YACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,KAAK,CAAC,EAAE,qDAAqD;YAC3D,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3B,KAAK,CAAC;YACJ,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC7E;YACE,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAgB,EAAE,CAAS,EAAE,KAAa;IAC1D,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,KAAK,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAAC,6CAA6C,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,KAAgB;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,uBAAuB,CAAC,sBAAsB,OAAO,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IACxB,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IAClD,IAAI,GAAG,GAAG,KAAK;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,UAAU,CAAC;QACpB,IAAI,GAAG,EAAE;QACT,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;QACnB,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI;QACnB,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI;QAClB,GAAG,GAAG,IAAI;KACX,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/errors.d.ts

@@ -69,8 +69,49 @@ export declare class TimeoutError extends BurnLedgerError {
 }
 export declare class VerificationError extends BurnLedgerError {
     readonly reason: string;
-    constructor(reason: string);
+    /**
+     * A stable discriminator for the one rejection a caller must be able to tell
+     * apart from the rest: an authentic status statement that says REVOKED.
+     *
+     * Every other rejection on the status path — unknown key, revoked key, bad
+     * signature, a statement about a different certificate — means the statement
+     * could not be authenticated, which is not the same claim and must not be
+     * rendered as one. `reason` is prose and may be reworded; this is not.
+     *
+     * Undefined on every rejection that is not specifically coded.
+     */
+    readonly code?: string;
+    constructor(reason: string, code?: string);
 }
+/** {@link VerificationError.code} for a verified statement that says REVOKED. */
+export declare const CERTIFICATE_REVOKED = "CERTIFICATE_REVOKED";
+/**
+ * The record is in a format this SDK does not know how to read.
+ *
+ * This is the second rejection a caller must be able to tell apart, for the
+ * same reason as the first: it is not a claim about the document. Before this
+ * code existed, a record in a newer format fell through to the oldest payload
+ * shape, the rebuilt bytes did not match, and the SDK threw "certificate
+ * signature is invalid" - telling a holder their genuine evidence had been
+ * tampered with when the answer was "upgrade this library".
+ *
+ * A UI must render it as "cannot check", never as a failure.
+ */
+export declare const UNSUPPORTED_FORMAT_VERSION = "UNSUPPORTED_FORMAT_VERSION";
+/**
+ * The record names a signature scheme this SDK cannot check.
+ *
+ * The third rejection a caller must tell apart, for the same reason as the
+ * other two: it is not a claim about the document. Records below format 7.0
+ * name no algorithm and every verifier simply assumed Ed25519, so had Ed25519
+ * needed replacing, a record signed under the replacement would have been fed
+ * to an Ed25519 verifier, failed, and been reported as a bad signature — a
+ * genuine record accused of forgery for being signed with the algorithm it says
+ * it was signed with.
+ *
+ * A UI must render it as "cannot check", never as a failure.
+ */
+export declare const UNSUPPORTED_ALGORITHM = "UNSUPPORTED_ALGORITHM";
 /** Parse an API error envelope and throw the appropriate exception. */
 export declare function raiseForError(statusCode: number, body: Record<string, unknown>, retryAfter?: number): never;
 //# sourceMappingURL=errors.d.ts.map