burnledger 0.8.0 → 0.9.0

package/dist/esm/index.d.ts

@@ -1,28 +1,31 @@
 /** BurnLedger TypeScript SDK — public API (Node.js entry point). */
 export { BurnLedger, MAX_BATCH_REVOKE } from "./client.js";
 export type { BurnLedgerOptions } from "./client.js";
-export { BurnLedgerError, ApiError, AuthenticationError, NotFoundError, ConflictError, ValidationError, RateLimitError, ServerError, TimeoutError, VerificationError, CERTIFICATE_REVOKED, UNSUPPORTED_FORMAT_VERSION, } from "./errors.js";
+export { BurnLedgerError, ApiError, AuthenticationError, NotFoundError, ConflictError, ValidationError, RateLimitError, ServerError, TimeoutError, VerificationError, AUTHORIZATION_POLICY_FAILED, CERTIFICATE_REVOKED, UNSUPPORTED_FORMAT_VERSION, } from "./errors.js";
 export { Transport } from "./http.js";
 export type { TransportOptions } from "./http.js";
-export type { PublicKeyOptions } from "./verify.js";
-export type { ProofMode, AttestationStatus, CertificateStatus, TransparencyStatus, HealthStatus, TransportSecurity, ReadOnlyEnforcement, ConnectorType, HashScope, LogEntryType, VerificationResult, TransparencyResult, ApiKeyRole, System, SystemAttestation, Attestation, VerificationSystem, VerifyResult, CertificateResponse, RevocationStatus, Webhook, SignedTreeHead, LogEntry, InclusionProof, ConsistencyProof, BatchAttestationResponse, BatchAttestationError, BatchRevokeResponse, BatchRevokeError, MonthlyCount, CertificateStats, WebhookRotateResponse, WebhookDelivery, ApiKeyListItem, ApiKeyResponse, PlanUsage, Profile, SystemHealth, } from "./models.js";
+export type { AuthorizationPolicy, PublicKeyOptions, VerifyOptions } from "./verify.js";
+export type { ProofMode, AttestationStatus, CertificateStatus, TransparencyStatus, HealthStatus, TransportSecurity, ReadOnlyEnforcement, ConnectorType, HashScope, LogEntryType, VerificationResult, TransparencyResult, ApiKeyRole, System, SystemAttestation, Attestation, VerificationSystem, VerifyResult, CertificateResponse, RevocationStatus, Webhook, SignedTreeHead, LogEntry, InclusionProof, ConsistencyProof, BatchAttestationResponse, BatchAttestationError, BatchRevokeResponse, BatchRevokeError, MonthlyCount, CertificateStats, WebhookRotateResponse, WebhookDelivery, ApiKeyListItem, ApiKeyResponse, PlanUsage, Profile, SystemHealth, KeyEnrollmentStatement, TeamAuthorizationCertificate, SystemRegistrationCertificate, KeyEnrollmentResult, } from "./models.js";
 export { parseSystem, parseCertificateResponse, parseWebhook } from "./models.js";
 export { Paginator } from "./pagination.js";
 export type { CryptoOps } from "./crypto.js";
 export type { PublicKeyInfo } from "./verify.js";
 export { issuanceBytes, hexToBytes, bytesToHex } from "./verify.js";
-import type { PublicKeyInfo, PublicKeyOptions } from "./verify.js";
+import type { PublicKeyInfo, PublicKeyOptions, VerifyOptions } from "./verify.js";
 import type { VerificationResult, TransparencyResult } from "./models.js";
 type Cert = Record<string, unknown>;
-/** Verify all signatures on a deletion certificate offline. */
-export declare function verifyCertificate(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<VerificationResult>;
+/** Verify all signatures on a deletion certificate offline. Pass
+ * `{ requireAuthorization }` to refuse a record unless its systems are certified
+ * under a key id you name, by an enclave image that requires that key group's
+ * signature to register a system (ADR-025). */
+export declare function verifyCertificate(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, options?: VerifyOptions): Promise<VerificationResult>;
 /**
  * Verify a certificate and, separately, what a signed statement says about its
  * revocation. Returns "VALID_REVOCATION_UNKNOWN" when no fresh statement is
  * supplied — never "VALID", because "not revoked" is not something an offline
  * check can establish on its own.
  */
-export declare function verifyCertificateWithStatus(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, status?: Record<string, unknown> | null, now?: Date): Promise<string>;
+export declare function verifyCertificateWithStatus(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>, status?: Record<string, unknown> | null, now?: Date, options?: VerifyOptions): Promise<string>;
 /** Verify the transparency proof embedded in a certificate. */
 export declare function verifyTransparency(certificate: Cert, publicKeys: Map<string, PublicKeyInfo>): Promise<TransparencyResult>;
 /** Construct a PublicKeyInfo from a hex-encoded Ed25519 public key.
@@ -46,6 +49,17 @@ export { verifyWebhookSignature, isTimestampFresh } from "./webhooks.js";
  * expose, and sealing a datastore credential is not something a browser should
  * be doing.
  */
-export { EnclaveAttestationError, ENVELOPE_MAGIC, HEADER_SIZE, NITRO_ROOT_G1_PEM, sealConnectionConfig, sealToKey, verifyEnclaveConfigSealKey, } from "./enclave-seal.js";
-export type { SealOptions } from "./enclave-seal.js";
+export { EnclaveAttestationError, ENVELOPE_MAGIC, HEADER_SIZE, IDENTITY_NONCE_SIZE, NITRO_ROOT_G1_PEM, sealConnectionConfig, sealToKey, verifyEnclaveConfigSealKey, verifyEnclaveIdentity, } from "./enclave-seal.js";
+export type { EnclaveIdentity, IdentityOptions, SealOptions } from "./enclave-seal.js";
+export { CUSTOMER_KEY_ID_PREFIX, InvalidKeyGroupError, MAX_CUSTOMER_KEY_GROUP_MEMBERS, PAYLOAD_TYPE_KEY_ENROLLMENT_REQUEST, PAYLOAD_TYPE_KEY_ROTATION_REQUEST, PAYLOAD_TYPE_SYSTEM_REGISTRATION_REQUEST, buildKeyEnrollmentRequestPayload, buildKeyRotationRequestPayload, buildSystemRegistrationRequestPayload, customerKeyId, memberFingerprint, memberFingerprints, validateKeyGroup, verifyKeyEnrollmentStatement, verifySystemRegistration, verifyTeamAuthorization, } from "./customer-keys.js";
+export type { CustomerKeyGroup } from "./customer-keys.js";
+/**
+ * Customer key group members as signers (ADR-025). Node only. The SDK never
+ * holds a private key: every signature comes from a KeyGroupSigner, and
+ * InMemorySigner is the convenience for keys kept on this machine. Read the
+ * custody note in key-group.ts before generating a group.
+ */
+export { InMemorySigner, generateKeyGroup, signWithGroup } from "./key-group.js";
+export type { GeneratedKeyGroup, KeyGroupSigner } from "./key-group.js";
+export type { EnclavePinOptions, RegisteredSystem } from "./enclave-registration.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,cAAc,EACd,SAAS,EACT,OAAO,EACP,YAAY,GACb,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUpE,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE1E,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,GACT,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAExF,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,MAAM,EACN,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,cAAc,EACd,SAAS,EACT,OAAO,EACP,YAAY,EACZ,sBAAsB,EACtB,4BAA4B,EAC5B,6BAA6B,EAC7B,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUpE,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE1E,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpC;;;+CAG+C;AAC/C,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACtC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,GAAG,CAAC,EAAE,IAAI,EACV,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,IAAI,EACjB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,UAAU,EAAE,GAClB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,8BAA8B,EAC9B,mCAAmC,EACnC,iCAAiC,EACjC,wCAAwC,EACxC,gCAAgC,EAChC,8BAA8B,EAC9B,qCAAqC,EACrC,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACxE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/esm/index.js

@@ -1,6 +1,6 @@
 /** BurnLedger TypeScript SDK — public API (Node.js entry point). */
 export { BurnLedger, MAX_BATCH_REVOKE } from "./client.js";
-export { BurnLedgerError, ApiError, AuthenticationError, NotFoundError, ConflictError, ValidationError, RateLimitError, ServerError, TimeoutError, VerificationError, CERTIFICATE_REVOKED, UNSUPPORTED_FORMAT_VERSION, } from "./errors.js";
+export { BurnLedgerError, ApiError, AuthenticationError, NotFoundError, ConflictError, ValidationError, RateLimitError, ServerError, TimeoutError, VerificationError, AUTHORIZATION_POLICY_FAILED, CERTIFICATE_REVOKED, UNSUPPORTED_FORMAT_VERSION, } from "./errors.js";
 export { Transport } from "./http.js";
 // Raw-JSON → model parsers, for consumers that fetch API responses outside
 // the client (the dashboard's paginated list hooks) but render SDK types.
@@ -9,9 +9,12 @@ export { Paginator } from "./pagination.js";
 export { issuanceBytes, hexToBytes, bytesToHex } from "./verify.js";
 import { nodeCrypto } from "./crypto-node.js";
 import { verifyCertificate as _verifyCertificate, verifyCertificateWithStatus as _verifyCertificateWithStatus, verifyTransparency as _verifyTransparency, verifyConsistency as _verifyConsistency, publicKeyFromHex as _publicKeyFromHex, } from "./verify.js";
-/** Verify all signatures on a deletion certificate offline. */
-export function verifyCertificate(certificate, publicKeys) {
-    return _verifyCertificate(nodeCrypto, certificate, publicKeys);
+/** Verify all signatures on a deletion certificate offline. Pass
+ * `{ requireAuthorization }` to refuse a record unless its systems are certified
+ * under a key id you name, by an enclave image that requires that key group's
+ * signature to register a system (ADR-025). */
+export function verifyCertificate(certificate, publicKeys, options) {
+    return _verifyCertificate(nodeCrypto, certificate, publicKeys, options);
 }
 /**
  * Verify a certificate and, separately, what a signed statement says about its
@@ -19,8 +22,8 @@ export function verifyCertificate(certificate, publicKeys) {
  * supplied — never "VALID", because "not revoked" is not something an offline
  * check can establish on its own.
  */
-export function verifyCertificateWithStatus(certificate, publicKeys, status, now) {
-    return _verifyCertificateWithStatus(nodeCrypto, certificate, publicKeys, status, now);
+export function verifyCertificateWithStatus(certificate, publicKeys, status, now, options) {
+    return _verifyCertificateWithStatus(nodeCrypto, certificate, publicKeys, status, now, options);
 }
 /** Verify the transparency proof embedded in a certificate. */
 export function verifyTransparency(certificate, publicKeys) {
@@ -51,5 +54,13 @@ export { verifyWebhookSignature, isTimestampFresh } from "./webhooks.js";
  * expose, and sealing a datastore credential is not something a browser should
  * be doing.
  */
-export { EnclaveAttestationError, ENVELOPE_MAGIC, HEADER_SIZE, NITRO_ROOT_G1_PEM, sealConnectionConfig, sealToKey, verifyEnclaveConfigSealKey, } from "./enclave-seal.js";
+export { EnclaveAttestationError, ENVELOPE_MAGIC, HEADER_SIZE, IDENTITY_NONCE_SIZE, NITRO_ROOT_G1_PEM, sealConnectionConfig, sealToKey, verifyEnclaveConfigSealKey, verifyEnclaveIdentity, } from "./enclave-seal.js";
+export { CUSTOMER_KEY_ID_PREFIX, InvalidKeyGroupError, MAX_CUSTOMER_KEY_GROUP_MEMBERS, PAYLOAD_TYPE_KEY_ENROLLMENT_REQUEST, PAYLOAD_TYPE_KEY_ROTATION_REQUEST, PAYLOAD_TYPE_SYSTEM_REGISTRATION_REQUEST, buildKeyEnrollmentRequestPayload, buildKeyRotationRequestPayload, buildSystemRegistrationRequestPayload, customerKeyId, memberFingerprint, memberFingerprints, validateKeyGroup, verifyKeyEnrollmentStatement, verifySystemRegistration, verifyTeamAuthorization, } from "./customer-keys.js";
+/**
+ * Customer key group members as signers (ADR-025). Node only. The SDK never
+ * holds a private key: every signature comes from a KeyGroupSigner, and
+ * InMemorySigner is the convenience for keys kept on this machine. Read the
+ * custody note in key-group.ts before generating a group.
+ */
+export { InMemorySigner, generateKeyGroup, signWithGroup } from "./key-group.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA8CtC,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,iBAAiB,IAAI,kBAAkB,EACvC,2BAA2B,IAAI,4BAA4B,EAC3D,kBAAkB,IAAI,mBAAmB,EACzC,iBAAiB,IAAI,kBAAkB,EACvC,gBAAgB,IAAI,iBAAiB,GACtC,MAAM,aAAa,CAAC;AAMrB,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAC/B,WAAiB,EACjB,UAAsC;IAEtC,OAAO,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAiB,EACjB,UAAsC,EACtC,MAAuC,EACvC,GAAU;IAEV,OAAO,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAChC,WAAiB,EACjB,UAAsC;IAEtC,OAAO,mBAAmB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAAuB;IAEvB,OAAO,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAe,EACf,OAAmB,EACnB,OAAmB,EACnB,KAAmB;IAEnB,OAAO,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EACL,eAAe,EACf,QAAQ,EACR,mBAAmB,EACnB,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAkDtC,2EAA2E;AAC3E,0EAA0E;AAC1E,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,iBAAiB,IAAI,kBAAkB,EACvC,2BAA2B,IAAI,4BAA4B,EAC3D,kBAAkB,IAAI,mBAAmB,EACzC,iBAAiB,IAAI,kBAAkB,EACvC,gBAAgB,IAAI,iBAAiB,GACtC,MAAM,aAAa,CAAC;AAMrB;;;+CAG+C;AAC/C,MAAM,UAAU,iBAAiB,CAC/B,WAAiB,EACjB,UAAsC,EACtC,OAAuB;IAEvB,OAAO,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAiB,EACjB,UAAsC,EACtC,MAAuC,EACvC,GAAU,EACV,OAAuB;IAEvB,OAAO,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACjG,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAChC,WAAiB,EACjB,UAAsC;IAEtC,OAAO,mBAAmB,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAAuB;IAEvB,OAAO,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAAe,EACf,OAAmB,EACnB,OAAmB,EACnB,KAAmB;IAEnB,OAAO,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;GAOG;AACH,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,8BAA8B,EAC9B,mCAAmC,EACnC,iCAAiC,EACjC,wCAAwC,EACxC,gCAAgC,EAChC,8BAA8B,EAC9B,qCAAqC,EACrC,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAG5B;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/esm/key-group.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The members of a customer key group as signers (ADR-025 §2–3).
+ *
+ * Node only, like enclave-seal.ts: ADR-025 §2 makes a client the customer runs
+ * locally the only place enrolment can happen, because whoever serves a page
+ * controls the check the page would make.
+ *
+ * WHY A SIGNER AND NOT A PRIVATE KEY. Everything in this SDK that needs a
+ * member's signature takes a {@link KeyGroupSigner} — a public key and a
+ * function that signs bytes. The SDK never needs, holds or transmits a private
+ * key, so a member can live in an HSM, a cloud KMS, a hardware token or another
+ * process, and the SDK's only job is to hand it the exact canonical bytes and
+ * check what comes back. {@link InMemorySigner} is the convenience for tests and
+ * for customers who keep keys on the machine running the SDK.
+ *
+ * CUSTODY, stated plainly because nothing recovers from getting it wrong. The
+ * private halves are the customer's alone; BurnLedger never sees them and cannot
+ * reissue them. Lose enough members that the group can no longer meet its
+ * threshold and it can neither sign a registration nor authorise its own
+ * rotation — and an operator who could re-enrol on the customer's behalf is an
+ * operator who could mint, so there is no recovery path (ADR-025 §3 "Key loss").
+ * The only way back is to enrol a NEW group and re-register every system, and
+ * records issued before and after will name different `customer_key_id`s,
+ * visibly. Hedge before it happens: enrol more members than the threshold and
+ * keep at least one offline (the simplest is two members, threshold one).
+ */
+import { type CustomerKeyGroup } from "./customer-keys.js";
+/** One member of a key group, able to sign. */
+export interface KeyGroupSigner {
+    /** The member's raw 32-byte Ed25519 public key. */
+    readonly publicKey: Uint8Array;
+    /** Sign exactly `payload` with the member's Ed25519 key; return the 64-byte signature. */
+    sign(payload: Uint8Array): Promise<Uint8Array>;
+}
+/**
+ * A member whose private key is held in this process.
+ *
+ * Convenient, and exactly as safe as the memory and disk of the machine running
+ * it. `exportSeed()` is the one way the key leaves: store the seed as you would
+ * any credential that cannot be reissued.
+ */
+export declare class InMemorySigner implements KeyGroupSigner {
+    #private;
+    readonly publicKey: Uint8Array;
+    private constructor();
+    /** A fresh member, from the operating system's CSPRNG. */
+    static generate(): InMemorySigner;
+    /** The member a 32-byte seed (as returned by `exportSeed`) describes. */
+    static fromSeed(seed: Uint8Array): InMemorySigner;
+    /** The 32-byte seed. Whoever holds it IS this member. */
+    exportSeed(): Uint8Array;
+    sign(payload: Uint8Array): Promise<Uint8Array>;
+}
+/** A freshly generated group and the signers that hold its members. */
+export interface GeneratedKeyGroup {
+    readonly group: CustomerKeyGroup;
+    readonly signers: readonly InMemorySigner[];
+}
+/**
+ * Generate `members` Ed25519 keys and the group requiring `threshold` of them.
+ *
+ * The private halves are returned to the caller and go nowhere else. Read the
+ * custody note at the top of this module before choosing `members` and
+ * `threshold`: a group whose members fall below its threshold is unrecoverable.
+ */
+export declare function generateKeyGroup(opts: {
+    members: number;
+    threshold: number;
+}): Promise<GeneratedKeyGroup>;
+/**
+ * Collect member signatures over `payload`, keyed by member fingerprint — the
+ * wire form every ADR-025 request carries.
+ *
+ * Refuses before anything is sent, with a reason, where the enclave would refuse
+ * after with a bare 401: a signer that is not a member of `group`, the same
+ * member twice, a signature that does not verify under the signer's own public
+ * key, or fewer distinct members than `required`.
+ */
+export declare function signWithGroup(payload: Uint8Array, group: CustomerKeyGroup, signers: readonly KeyGroupSigner[], required: number): Promise<Record<string, string>>;
+//# sourceMappingURL=key-group.d.ts.map

package/dist/esm/key-group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-group.d.ts","sourceRoot":"","sources":["../../src/key-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAUH,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,0FAA0F;IAC1F,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD;AAMD;;;;;;GAMG;AACH,qBAAa,cAAe,YAAW,cAAc;;IACnD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAG/B,OAAO,eAIN;IAED,0DAA0D;IAC1D,MAAM,CAAC,QAAQ,IAAI,cAAc,CAEhC;IAED,yEAAyE;IACzE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAWhD;IAED,yDAAyD;IACzD,UAAU,IAAI,UAAU,CAGvB;IAEK,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAEnD;CACF;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAW7B;AAMD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,SAAS,cAAc,EAAE,EAClC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgCjC"}

package/dist/esm/key-group.js

@@ -0,0 +1,130 @@
+/**
+ * The members of a customer key group as signers (ADR-025 §2–3).
+ *
+ * Node only, like enclave-seal.ts: ADR-025 §2 makes a client the customer runs
+ * locally the only place enrolment can happen, because whoever serves a page
+ * controls the check the page would make.
+ *
+ * WHY A SIGNER AND NOT A PRIVATE KEY. Everything in this SDK that needs a
+ * member's signature takes a {@link KeyGroupSigner} — a public key and a
+ * function that signs bytes. The SDK never needs, holds or transmits a private
+ * key, so a member can live in an HSM, a cloud KMS, a hardware token or another
+ * process, and the SDK's only job is to hand it the exact canonical bytes and
+ * check what comes back. {@link InMemorySigner} is the convenience for tests and
+ * for customers who keep keys on the machine running the SDK.
+ *
+ * CUSTODY, stated plainly because nothing recovers from getting it wrong. The
+ * private halves are the customer's alone; BurnLedger never sees them and cannot
+ * reissue them. Lose enough members that the group can no longer meet its
+ * threshold and it can neither sign a registration nor authorise its own
+ * rotation — and an operator who could re-enrol on the customer's behalf is an
+ * operator who could mint, so there is no recovery path (ADR-025 §3 "Key loss").
+ * The only way back is to enrol a NEW group and re-register every system, and
+ * records issued before and after will name different `customer_key_id`s,
+ * visibly. Hedge before it happens: enrol more members than the threshold and
+ * keep at least one offline (the simplest is two members, threshold one).
+ */
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign as nodeSign, } from "node:crypto";
+import { nodeCrypto } from "./crypto-node.js";
+import { InvalidKeyGroupError, memberFingerprint, validateKeyGroup, } from "./customer-keys.js";
+// RFC 8410: an Ed25519 private key as PKCS#8 is this fixed prefix and the seed.
+const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+const SEED_SIZE = 32;
+/**
+ * A member whose private key is held in this process.
+ *
+ * Convenient, and exactly as safe as the memory and disk of the machine running
+ * it. `exportSeed()` is the one way the key leaves: store the seed as you would
+ * any credential that cannot be reissued.
+ */
+export class InMemorySigner {
+    publicKey;
+    #privateKey;
+    constructor(privateKey) {
+        this.#privateKey = privateKey;
+        const spki = createPublicKey(privateKey).export({ format: "der", type: "spki" });
+        this.publicKey = new Uint8Array(spki.subarray(spki.length - 32));
+    }
+    /** A fresh member, from the operating system's CSPRNG. */
+    static generate() {
+        return new InMemorySigner(generateKeyPairSync("ed25519").privateKey);
+    }
+    /** The member a 32-byte seed (as returned by `exportSeed`) describes. */
+    static fromSeed(seed) {
+        if (!(seed instanceof Uint8Array) || seed.length !== SEED_SIZE) {
+            throw new Error(`an Ed25519 seed is ${SEED_SIZE} bytes`);
+        }
+        return new InMemorySigner(createPrivateKey({
+            key: Buffer.concat([PKCS8_ED25519_PREFIX, Buffer.from(seed)]),
+            format: "der",
+            type: "pkcs8",
+        }));
+    }
+    /** The 32-byte seed. Whoever holds it IS this member. */
+    exportSeed() {
+        const der = this.#privateKey.export({ format: "der", type: "pkcs8" });
+        return new Uint8Array(der.subarray(der.length - SEED_SIZE));
+    }
+    async sign(payload) {
+        return new Uint8Array(nodeSign(null, payload, this.#privateKey));
+    }
+}
+/**
+ * Generate `members` Ed25519 keys and the group requiring `threshold` of them.
+ *
+ * The private halves are returned to the caller and go nowhere else. Read the
+ * custody note at the top of this module before choosing `members` and
+ * `threshold`: a group whose members fall below its threshold is unrecoverable.
+ */
+export async function generateKeyGroup(opts) {
+    if (!Number.isInteger(opts.members) || opts.members < 1) {
+        throw new InvalidKeyGroupError(`a key group needs at least one member, got ${opts.members}`);
+    }
+    const signers = Array.from({ length: opts.members }, () => InMemorySigner.generate());
+    const group = {
+        threshold: opts.threshold,
+        members: signers.map((s) => s.publicKey),
+    };
+    await validateKeyGroup(nodeCrypto, group);
+    return { group, signers };
+}
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+/**
+ * Collect member signatures over `payload`, keyed by member fingerprint — the
+ * wire form every ADR-025 request carries.
+ *
+ * Refuses before anything is sent, with a reason, where the enclave would refuse
+ * after with a bare 401: a signer that is not a member of `group`, the same
+ * member twice, a signature that does not verify under the signer's own public
+ * key, or fewer distinct members than `required`.
+ */
+export async function signWithGroup(payload, group, signers, required) {
+    const members = new Set();
+    for (const member of group.members)
+        members.add(await memberFingerprint(nodeCrypto, member));
+    const signatures = {};
+    for (const signer of signers) {
+        const fingerprint = await memberFingerprint(nodeCrypto, signer.publicKey);
+        if (!members.has(fingerprint)) {
+            throw new InvalidKeyGroupError(`signer ${fingerprint} is not a member of this key group`);
+        }
+        if (fingerprint in signatures) {
+            throw new InvalidKeyGroupError(`member ${fingerprint} is listed twice among the signers`);
+        }
+        const signature = await signer.sign(payload);
+        if (!(signature instanceof Uint8Array) ||
+            signature.length !== 64 ||
+            !(await nodeCrypto.ed25519Verify(signer.publicKey, payload, signature))) {
+            throw new Error(`the signer for member ${fingerprint} returned a signature that does not verify over the request`);
+        }
+        signatures[fingerprint] = toHex(signature);
+    }
+    const count = Object.keys(signatures).length;
+    if (count < required) {
+        throw new InvalidKeyGroupError(`this request needs signatures from ${required} distinct members, got ${count}`);
+    }
+    return signatures;
+}
+//# sourceMappingURL=key-group.js.map

package/dist/esm/key-group.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-group.js","sourceRoot":"","sources":["../../src/key-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,IAAI,IAAI,QAAQ,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAU5B,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AACpF,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IAChB,SAAS,CAAa;IACtB,WAAW,CAAY;IAEhC,YAAoB,UAAqB;QACvC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;QAC9B,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,QAAQ;QACb,OAAO,IAAI,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,QAAQ,CAAC,IAAgB;QAC9B,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,QAAQ,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,cAAc,CACvB,gBAAgB,CAAC;YACf,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CACH,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,UAAU;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB;QAC5B,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,CAAC;CACF;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAGtC;IACC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAAC,8CAA8C,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,KAAK,GAAqB;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACzC,CAAC;IACF,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAmB,EACnB,KAAuB,EACvB,OAAkC,EAClC,QAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7F,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,oBAAoB,CAAC,UAAU,WAAW,oCAAoC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,WAAW,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,oBAAoB,CAAC,UAAU,WAAW,oCAAoC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,IACE,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC;YAClC,SAAS,CAAC,MAAM,KAAK,EAAE;YACvB,CAAC,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yBAAyB,WAAW,6DAA6D,CAClG,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAC5B,sCAAsC,QAAQ,0BAA0B,KAAK,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/esm/models.d.ts

@@ -101,6 +101,17 @@ export interface CertificateResponse {
      * it can be handed straight to verifyCertificateWithStatus().
      */
     readonly statusStatement: Record<string, unknown> | undefined;
+    /**
+     * Base64 AWS Nitro NSM attestation document produced while this record was
+     * signed, exactly as the server sent it. Its PCRs identify the enclave image
+     * that held the signing key and its user_data binds this record's canonical
+     * payload. Carried so it can be archived beside the record; this SDK does NOT
+     * verify it (that needs COSE ES384 and an x509 chain to the Nitro root, which
+     * only the Go verifier implements). undefined for records issued before it
+     * was recorded and for dev-mode issuance; absence is not a verification
+     * result.
+     */
+    readonly nsmAttestation: string | undefined;
 }
 export interface RevocationStatus {
     readonly certificateId: string;
@@ -260,5 +271,54 @@ export declare function parseApiKeyListItem(d: Raw): ApiKeyListItem;
 export declare function parseApiKeyResponse(d: Raw): ApiKeyResponse;
 export declare function parseProfile(d: Raw): Profile;
 export declare function parseSystemHealth(d: Raw): SystemHealth;
+/** The enclave's statement of which key group it was told to trust for a team
+ * (core.KeyEnrollmentStatement). Trust on first use: compare `customerKeyId` —
+ * a hash over the members and threshold — against the group you hold. The SDK's
+ * enrol and rotate calls do, after verifying the enclave's signature. */
+export interface KeyEnrollmentStatement {
+    readonly assertedTeamId: string;
+    readonly customerKeyId: string;
+    readonly threshold: number;
+    readonly members: readonly Uint8Array[];
+    readonly enrolledAt: Date;
+    readonly enclavePcr0: string;
+    readonly signature: Uint8Array;
+}
+/** The bounded authority that makes an enrolled group usable
+ * (core.TeamAuthorizationCertificate). It expires rather than being revoked;
+ * renew it by enrolling the same group again before `notAfter`. */
+export interface TeamAuthorizationCertificate {
+    readonly assertedTeamId: string;
+    readonly customerKeyId: string;
+    readonly notBefore: Date;
+    readonly notAfter: Date;
+    /** The key this one replaced; undefined on a first enrolment. */
+    readonly prevKeyId: string | undefined;
+    readonly signature: Uint8Array;
+}
+/** Binds one system to the config and query it may be measured with, under a
+ * customer key (core.SystemRegistrationCertificate). No expiry: it states a
+ * fact about bytes. */
+export interface SystemRegistrationCertificate {
+    readonly systemId: string;
+    /** SHA-256 of the exact config plaintext submitted for the system. */
+    readonly configDigest: Uint8Array;
+    /** HashQuery over the NORMALIZED subject query — not the raw-template hash
+     * the registration request signs. */
+    readonly queryTemplateHash: Uint8Array;
+    readonly connectorType: string;
+    readonly customerKeyId: string;
+    readonly registeredAt: Date;
+    readonly signature: Uint8Array;
+}
+/** What enrolling or rotating a key group returns. */
+export interface KeyEnrollmentResult {
+    readonly enrollment: KeyEnrollmentStatement;
+    readonly authorization: TeamAuthorizationCertificate;
+}
+export declare function parseKeyEnrollmentStatement(d: Raw): KeyEnrollmentStatement;
+export declare function parseTeamAuthorizationCertificate(d: Raw): TeamAuthorizationCertificate;
+export declare function parseSystemRegistrationCertificate(d: Raw): SystemRegistrationCertificate;
+export declare function parseKeyEnrollmentResult(d: Raw): KeyEnrollmentResult;
 export {};
 //# sourceMappingURL=models.d.ts.map

package/dist/esm/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/models.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC3C,MAAM,MAAM,iBAAiB,GACzB,sBAAsB,GACtB,qBAAqB,GACrB,WAAW,CAAC;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,CAAC;AACrD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAC/D;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,WAAW,GACX,WAAW,GACX,UAAU,CAAC;AACf;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,2BAA2B,GAC3B,mBAAmB,GACnB,uBAAuB,CAAC;AAK5B,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,OAAO,GACP,WAAW,GACX,QAAQ,GACR,UAAU,GACV,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,OAAO,GACP,WAAW,GACX,OAAO,GACP,WAAW,GACX,eAAe,GACf,IAAI,GACJ,UAAU,GACV,KAAK,GACL,UAAU,GACV,YAAY,CAAC;AACjB,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC;AAC7C,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAExD,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,CAAC;AAErD,iDAAiD;AACjD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;AAM1E,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;CACnD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC/D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAMD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;uEACmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;CAC3C;AAMD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAMD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;uCAImC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAMD;;;8DAG8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,YAAY,EAAE,CAAC;CACnD;AAMD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,IAAI,GAAG,SAAS,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAMD,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAoBD,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAE/B,wBAAgB,WAAW,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAuB1C;AAYD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,GAAG,GAAG,WAAW,CAWpD;AAUD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,GAAG,YAAY,CAStD;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,GAAG,mBAAmB,CAapE;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,GAAG,gBAAgB,CAO9D;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAO5C;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,GAAG,GAAG,cAAc,CAO1D;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,GAAG,GAAG,QAAQ,CAQ9C;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,GAAG,GAAG,cAAc,CAO1D;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,GAAG,gBAAgB,CAM9D;AAUD,wBAAgB,6BAA6B,CAAC,CAAC,EAAE,GAAG,GAAG,wBAAwB,CAK9E;AAUD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,GAAG,mBAAmB,CAKpE;AASD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,GAAG,gBAAgB,CAW9D;AAED,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,GAAG,GAAG,qBAAqB,CAOxE;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,GAAG,GAAG,eAAe,CAU5D;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,GAAG,GAAG,cAAc,CAS1D;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,GAAG,GAAG,cAAc,CAQ1D;AAgBD,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAW5C;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,GAAG,YAAY,CAOtD"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/models.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC3C,MAAM,MAAM,iBAAiB,GACzB,sBAAsB,GACtB,qBAAqB,GACrB,WAAW,CAAC;AAChB,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,CAAC;AACrD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAC/D;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,WAAW,GACX,WAAW,GACX,UAAU,CAAC;AACf;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,2BAA2B,GAC3B,mBAAmB,GACnB,uBAAuB,CAAC;AAK5B,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,OAAO,GACP,WAAW,GACX,QAAQ,GACR,UAAU,GACV,UAAU,GACV,WAAW,GACX,YAAY,GACZ,SAAS,GACT,OAAO,GACP,OAAO,GACP,WAAW,GACX,OAAO,GACP,WAAW,GACX,eAAe,GACf,IAAI,GACJ,UAAU,GACV,KAAK,GACL,UAAU,GACV,YAAY,CAAC;AACjB,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC;AAC7C,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAExD,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,SAAS,CAAC;AAErD,iDAAiD;AACjD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;AAM1E,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;CACnD;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC9D;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAMD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;uEACmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;CAC3C;AAMD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAMD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;uCAImC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAMD;;;8DAG8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAMD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,YAAY,EAAE,CAAC;CACnD;AAMD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,IAAI,GAAG,SAAS,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,IAAI,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAMD,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAoBD,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAE/B,wBAAgB,WAAW,CAAC,CAAC,EAAE,GAAG,GAAG,MAAM,CAuB1C;AAYD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,GAAG,GAAG,WAAW,CAWpD;AAUD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,GAAG,YAAY,CAStD;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,GAAG,mBAAmB,CAcpE;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,GAAG,gBAAgB,CAO9D;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAO5C;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,GAAG,GAAG,cAAc,CAO1D;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,GAAG,GAAG,QAAQ,CAQ9C;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,GAAG,GAAG,cAAc,CAO1D;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,GAAG,gBAAgB,CAM9D;AAUD,wBAAgB,6BAA6B,CAAC,CAAC,EAAE,GAAG,GAAG,wBAAwB,CAK9E;AAUD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,GAAG,mBAAmB,CAKpE;AASD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,GAAG,GAAG,gBAAgB,CAW9D;AAED,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,GAAG,GAAG,qBAAqB,CAOxE;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,GAAG,GAAG,eAAe,CAU5D;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,GAAG,GAAG,cAAc,CAS1D;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,GAAG,GAAG,cAAc,CAQ1D;AAgBD,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAW5C;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,GAAG,GAAG,YAAY,CAOtD;AAMD;;;yEAGyE;AACzE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED;;mEAEmE;AACnE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED;;uBAEuB;AACvB,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;IAClC;yCACqC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAC;CACtD;AAuBD,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,GAAG,GAAG,sBAAsB,CAa1E;AAED,wBAAgB,iCAAiC,CAAC,CAAC,EAAE,GAAG,GAAG,4BAA4B,CAStF;AAED,wBAAgB,kCAAkC,CAAC,CAAC,EAAE,GAAG,GAAG,6BAA6B,CAUxF;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,GAAG,mBAAmB,CAKpE"}

package/dist/esm/models.js

@@ -88,6 +88,7 @@ export function parseCertificateResponse(d) {
         revocationReason: d.revocation_reason ?? undefined,
         certificate: d.certificate,
         statusStatement: d.status_statement ?? undefined,
+        nsmAttestation: d.nsm_attestation ?? undefined,
     };
 }
 export function parseRevocationStatus(d) {
@@ -252,4 +253,62 @@ export function parseSystemHealth(d) {
         healthError: d.health_error ?? undefined,
     };
 }
+/** Go encodes [N]byte as an array of numbers; anything else here is a response
+ * this SDK cannot read, and is refused rather than coerced. */
+function bytesFromInts(v, field, length) {
+    if (!Array.isArray(v) ||
+        v.length !== length ||
+        !v.every((b) => Number.isInteger(b) && b >= 0 && b <= 255)) {
+        throw new Error(`${field} is not ${length} bytes`);
+    }
+    return new Uint8Array(v);
+}
+function bytesFromBase64(v, field) {
+    if (typeof v !== "string")
+        throw new Error(`${field} is not base64`);
+    const bin = atob(v);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+export function parseKeyEnrollmentStatement(d) {
+    const group = (d.group ?? {});
+    return {
+        assertedTeamId: d.asserted_team_id,
+        customerKeyId: d.customer_key_id,
+        threshold: group.threshold,
+        members: (group.members ?? []).map((m, i) => bytesFromBase64(m, `enrollment.group.members[${i}]`)),
+        enrolledAt: parseDt(d.enrolled_at),
+        enclavePcr0: d.enclave_pcr0,
+        signature: bytesFromInts(d.signature, "enrollment.signature", 64),
+    };
+}
+export function parseTeamAuthorizationCertificate(d) {
+    return {
+        assertedTeamId: d.asserted_team_id,
+        customerKeyId: d.customer_key_id,
+        notBefore: parseDt(d.not_before),
+        notAfter: parseDt(d.not_after),
+        prevKeyId: d.prev_key_id || undefined,
+        signature: bytesFromInts(d.signature, "authorization.signature", 64),
+    };
+}
+export function parseSystemRegistrationCertificate(d) {
+    return {
+        systemId: d.system_id,
+        configDigest: bytesFromInts(d.config_digest, "registration.config_digest", 32),
+        queryTemplateHash: bytesFromInts(d.query_template_hash, "registration.query_template_hash", 32),
+        connectorType: d.connector_type,
+        customerKeyId: d.customer_key_id,
+        registeredAt: parseDt(d.registered_at),
+        signature: bytesFromInts(d.signature, "registration.signature", 64),
+    };
+}
+export function parseKeyEnrollmentResult(d) {
+    return {
+        enrollment: parseKeyEnrollmentStatement(d.enrollment ?? {}),
+        authorization: parseTeamAuthorizationCertificate(d.authorization ?? {}),
+    };
+}
 //# sourceMappingURL=models.js.map

package/dist/esm/models.js.map

@@ -1 +1 @@
-{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/models.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmVH,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,GAA8B;IAChD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AASD,MAAM,UAAU,WAAW,CAAC,CAAM;IAChC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,cAA+B;QAChD,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,SAAS,CAAiB;QAC5D,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;QACxC,yEAAyE;QACzE,kDAAkD;QAClD,iBAAiB,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,SAAS,CAAsB;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,+BAA+B;QAC/B,UAAU,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI;QACnC,mBAAmB,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,SAAS,CAAwB;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAM;IACpC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAM;IACrC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACtD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,SAAS;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAM;IACrC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAM;IACtC,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvD,WAAW,EAAE,CAAC,CAAC,WAAW;YACxB,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,CAAC;YACzC,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAM;IAC7C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,kBAAkB,EAAE,CAAC,CAAC,mBAAyC;QAC/D,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,iBAAiB,IAAI,SAAS;QAClD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAM;IAC1C,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAM;IACjC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;QAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAM;IACxC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAM;IAClC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAA0B;QACvC,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAM;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,cAAc,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;QACvC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAM;IAC1C,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,CAAM;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,iBAAiB,EAAE,CAAC,CAAC,kBAAkB,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,CAAM;IAClD,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC1D,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAM;IACnC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAM;IAC7C,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAClE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAM;IAC/B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAM;IAC1C,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,oBAAoB,EAAE,CAAC,CAAC,qBAAqB;QAC7C,mBAAmB,EAAE,CAAC,CAAC,oBAAoB;QAC3C,kBAAkB,EAAG,CAAC,CAAC,mBAA0C,IAAI,CAAC;QACtE,gBAAgB,EAAE,CAAC,CAAC,mBAAmB;QACvC,eAAe,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,CAAM;IAC/C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAM;IACzC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5C,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAM;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAkB;QAC1B,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAM;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,cAAc,CAAC,CAAM;IAC5B,OAAO;QACL,gBAAgB,EAAE,CAAC,CAAC,iBAAiB;QACrC,iBAAiB,EAAE,CAAC,CAAC,kBAAkB;QACvC,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,cAAc,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAM;IACjC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS;QAC1C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;QAC7C,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAM;IACtC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,SAAS,CAAiB;QAC5D,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/models.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA8VH,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,GAA8B;IAChD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AASD,MAAM,UAAU,WAAW,CAAC,CAAM;IAChC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,cAA+B;QAChD,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,SAAS,CAAiB;QAC5D,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;QACxC,yEAAyE;QACzE,kDAAkD;QAClD,iBAAiB,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,SAAS,CAAsB;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,+BAA+B;QAC/B,UAAU,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI;QACnC,mBAAmB,EAAE,CAAC,CAAC,CAAC,qBAAqB,IAAI,SAAS,CAAwB;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAM;IACpC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAM;IACrC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,CAAC,CAAC,UAAuB;QACpC,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACtD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,aAAa,EAAE,CAAC,CAAC,cAAc,IAAI,SAAS;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAM;IACrC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,WAAW,EAAE,CAAC,CAAC,YAAY;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAM;IACtC,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACvD,WAAW,EAAE,CAAC,CAAC,WAAW;YACxB,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,CAAC;YACzC,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAM;IAC7C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,kBAAkB,EAAE,CAAC,CAAC,mBAAyC;QAC/D,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,iBAAiB,IAAI,SAAS;QAClD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,eAAe,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;QAChD,cAAc,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAM;IAC1C,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAM;IACjC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;QAC7B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAM;IACxC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAM;IAClC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,UAA0B;QACvC,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAM;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,cAAc,EAAE,CAAC,CAAC,eAAe,IAAI,EAAE;QACvC,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAM;IAC1C,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,OAAO,EAAE,CAAC,CAAC,QAAQ;QACnB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,CAAM;IACxC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,iBAAiB,EAAE,CAAC,CAAC,kBAAkB,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,CAAM;IAClD,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC1D,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAM;IACnC,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAM;IAC7C,OAAO;QACL,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAClE,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAM;IAC/B,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAM;IAC1C,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,oBAAoB,EAAE,CAAC,CAAC,qBAAqB;QAC7C,mBAAmB,EAAE,CAAC,CAAC,oBAAoB;QAC3C,kBAAkB,EAAG,CAAC,CAAC,mBAA0C,IAAI,CAAC;QACtE,gBAAgB,EAAE,CAAC,CAAC,mBAAmB;QACvC,eAAe,EAAE,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,CAAM;IAC/C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAM;IACzC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;QAC5C,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAM;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAkB;QAC1B,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAM;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,SAAS,cAAc,CAAC,CAAM;IAC5B,OAAO;QACL,gBAAgB,EAAE,CAAC,CAAC,iBAAiB;QACrC,iBAAiB,EAAE,CAAC,CAAC,kBAAkB;QACvC,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,YAAY,EAAE,CAAC,CAAC,aAAa;QAC7B,cAAc,EAAE,CAAC,CAAC,gBAAgB,IAAI,SAAS;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAM;IACjC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,SAAS;QAC1C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,eAAe,IAAI,SAAS;QAC7C,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,CAAM;IACtC,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,SAAS,CAAiB;QAC5D,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;KACzC,CAAC;AACJ,CAAC;AAuDD;+DAC+D;AAC/D,SAAS,aAAa,CAAC,CAAU,EAAE,KAAa,EAAE,MAAc;IAC9D,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,MAAM,KAAK,MAAM;QACnB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAC1D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,MAAM,QAAQ,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAa,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,eAAe,CAAC,CAAU,EAAE,KAAa;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,CAAM;IAChD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAQ,CAAC;IACrC,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,gBAAgB;QAClC,aAAa,EAAE,CAAC,CAAC,eAAe;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzD,eAAe,CAAC,CAAC,EAAE,4BAA4B,CAAC,GAAG,CAAC,CACrD;QACD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAClC,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,sBAAsB,EAAE,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,CAAM;IACtD,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,gBAAgB;QAClC,aAAa,EAAE,CAAC,CAAC,eAAe;QAChC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QAChC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9B,SAAS,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;QACrC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,yBAAyB,EAAE,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,CAAM;IACvD,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,SAAS;QACrB,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,4BAA4B,EAAE,EAAE,CAAC;QAC9E,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC,mBAAmB,EAAE,kCAAkC,EAAE,EAAE,CAAC;QAC/F,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,aAAa,EAAE,CAAC,CAAC,eAAe;QAChC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACtC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,wBAAwB,EAAE,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,CAAM;IAC7C,OAAO;QACL,UAAU,EAAE,2BAA2B,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3D,aAAa,EAAE,iCAAiC,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/esm/status-document.d.ts

@@ -0,0 +1,25 @@
+/** Reading a status statement as the status endpoint serves it, before anything
+ * verifies it. Shared by the CLI and the /verify page's status button, so the two
+ * agree on what counts as a statement: an answer that is not one is silence
+ * about revocation, while a statement that is one and fails is a refusal. */
+type StatusStatement = Record<string, unknown>;
+/** The API wraps every response in {"data": ...}; a caller may hand over either
+ * the envelope or the document inside it. Mirrors
+ * core.ParseCertificateStatusDocument, so this CLI and the Go one cannot
+ * disagree about which shape the endpoint returns. Exported for testing.
+ *
+ * A document that does not parse THROWS, and the caller turns that into a
+ * warning and a VALID_REVOCATION_UNKNOWN verdict. That is deliberate: an answer
+ * this build cannot read is silence about revocation, not a finding about the
+ * certificate. Handing a half-read document to the verifier instead would
+ * report "status statement signature is invalid" — a claim about the issuer —
+ * when what actually happened is that something returned nonsense.
+ *
+ * `status` itself is NOT validated against a known set. A statement saying
+ * SUSPENDED is a statement this build cannot read, and the verifier already has
+ * the right answer for that: it authenticates the signature first, then reports
+ * VALID_REVOCATION_UNKNOWN. Refusing it here would discard the statement before
+ * anyone authenticated it. */
+export declare function unwrapStatusStatement(parsed: unknown): StatusStatement;
+export {};
+//# sourceMappingURL=status-document.d.ts.map

package/dist/esm/status-document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-document.d.ts","sourceRoot":"","sources":["../../src/status-document.ts"],"names":[],"mappings":"AAAA;;;6EAG6E;AAE7E,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE/C;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAoBtE"}