BuzzPushKit SwiftPM package with a hand-rolled ordered-compact-JSON
transcript encoder for all five App Attest domains (enroll / delegate /
rotate-endpoint / revoke-delegation / revoke-installation), verified
byte-for-byte + SHA-256 against the gateway-generated known-answer
vectors in crates/buzz-push-gateway/tests/vectors/app_attest_transcripts.json.
JSONSerialization is deliberately not used anywhere near these bytes:
it escapes '/' as '\/' and does not guarantee member order, either of
which silently strands every iOS client with 401 invalid_attestation.
Non-ASCII input fails closed per the NIP-PL ASCII profile.
The 'audience' member is a fixed NIP-PL protocol constant
(https://push.buzz.xyz/v1/...) hardcoded by the gateway for cross-route
domain separation — clients must never derive it from a discovered
gateway base URL or relay host.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
