@antseed/antseed-verifier 0.1.0

package/dist/caps/gpu-nvidia.js

@@ -0,0 +1,142 @@
+import { claimId } from '../shared.js';
+import { collectJsonFieldViaHttp } from '../collect/http.js';
+import { decodeTeeTdxEvidence, PROVIDER_TEE_CAP_ID } from './tee-tdx.js';
+import { getReportDataScheme } from '../report-data.js';
+import { NRAS_GPU_ATTEST_URL_DEFAULT, NRAS_JWKS_URL_DEFAULT, buildNrasRequest, defaultNrasSubmit, verifyEar, } from '../nras.js';
+/**
+ * Capability 'seller-provider-gpu-cc': proves the inference provider's GPUs run NVIDIA
+ * Confidential Computing, via NVIDIA's Remote Attestation Service (NRAS). The buyer submits
+ * the provider's per-GPU CC evidence and the buyer's nonce to NRAS, then verifies the returned
+ * EAR (signed JWT): the signature is valid against NVIDIA's JWKS, the overall result is success,
+ * the CC mode is on, and the nonce binds this round.
+ *
+ * Informational, not required: a CPU-only seller (no GPUs) must still verify, so this cap is
+ * never in the buyer's required set. The seller offers it only when it configures a provider
+ * evidence route and a GPU evidence field; otherwise it omits the cap. The buyer-side check goes
+ * through an injectable GpuVerifyFn (see below) so an offline verifier can replace it.
+ */
+export const GPU_CAP_ID = 'seller-provider-gpu-cc';
+/** Mode switch: 'nras' (default, verify via NRAS) or 'local' (offline; not implemented). */
+const GPU_MODE_ENV = 'ANTSEED_VERIFIER_GPU_MODE';
+/** Env overrides for NVIDIA's endpoints (defaults point at NRAS; useful for tests and staging). */
+const NRAS_URL_ENV = 'ANTSEED_VERIFIER_NRAS_URL';
+const NRAS_JWKS_ENV = 'ANTSEED_VERIFIER_NRAS_JWKS_URL';
+/** Decode the provider's GPU evidence bytes (JSON: { arch, evidence_list }). */
+function decodeGpuEvidence(bytes) {
+    return JSON.parse(new TextDecoder().decode(bytes));
+}
+/**
+ * Build a NRAS-backed GpuVerifyFn. It submits the provider evidence and nonce to NRAS and
+ * verifies the EAR. Network or service errors are marked transient (retryable). Anything else
+ * (malformed evidence, bad signature, failed claim, nonce mismatch) fails closed as a real
+ * verdict. jose is imported lazily (only here) so the seller half and CPU-only buyers never load it.
+ */
+export function makeNrasGpuVerify(opts = {}) {
+    return async (evidenceBytes, nonce) => {
+        const nrasUrl = opts.nrasUrl ?? process.env[NRAS_URL_ENV]?.trim() ?? NRAS_GPU_ATTEST_URL_DEFAULT;
+        let request;
+        try {
+            request = buildNrasRequest(decodeGpuEvidence(evidenceBytes), nonce);
+        }
+        catch (err) {
+            return { ok: false, detail: `invalid GPU evidence: ${msg(err)}` };
+        }
+        let response;
+        try {
+            response = await (opts.submit ?? defaultNrasSubmit)(nrasUrl, request);
+        }
+        catch (err) {
+            // NRAS unreachable or 5xx — transient, not an attestation verdict.
+            return { ok: false, transient: true, detail: `NRAS request failed: ${msg(err)}` };
+        }
+        let getKey = opts.getKey;
+        if (!getKey) {
+            const jwksUrl = opts.jwksUrl ?? process.env[NRAS_JWKS_ENV]?.trim() ?? NRAS_JWKS_URL_DEFAULT;
+            const jose = await import('jose');
+            getKey = jose.createRemoteJWKSet(new URL(jwksUrl));
+        }
+        const r = await verifyEar(response, nonce, getKey);
+        return { ok: r.ok, detail: r.reason };
+    };
+}
+/** Default NRAS verifier (production). */
+export const nrasGpuVerify = makeNrasGpuVerify();
+/**
+ * Offline GPU verifier — reserved for the nvtrust-style local path (report + device cert chain
+ * + RIM, no external service). Not implemented: it returns a clear, non-transient error so an
+ * operator who sets ANTSEED_VERIFIER_GPU_MODE=local gets an explicit "not implemented", not silence.
+ */
+export const localGpuVerify = async () => ({
+    ok: false,
+    detail: 'offline GPU verification not yet implemented (ANTSEED_VERIFIER_GPU_MODE=local)',
+});
+/** Dispatch on ANTSEED_VERIFIER_GPU_MODE: 'nras' or 'local'. An unknown mode fails closed. */
+export const defaultGpuVerify = (evidence, nonce) => {
+    const mode = (process.env[GPU_MODE_ENV]?.trim() || 'nras').toLowerCase();
+    if (mode === 'local')
+        return localGpuVerify(evidence, nonce);
+    if (mode === 'nras')
+        return nrasGpuVerify(evidence, nonce);
+    return Promise.resolve({ ok: false, detail: `unknown ${GPU_MODE_ENV} "${mode}" (expected "nras" or "local")` });
+};
+/** Config-key convention for this cap's collector settings (mirrors tee-tdx's tdxConfigKey). */
+export function gpuConfigKey(key) {
+    return `${GPU_CAP_ID}.${key}`;
+}
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * The nonce to submit to NRAS this round. A provider that binds its TDX quote with a report_data
+ * scheme (e.g. Chutes' nonce-pubkey-sha256-v1) also binds its GPU evidence to that scheme's derived
+ * nonce, not the raw round nonce — so the code asks the declared scheme for it. With no scheme, it
+ * uses the raw nonce. It reads the provider quote from the bundle; any decode issue falls back to
+ * the raw nonce (fail-open is safe here — verifyEar still enforces the eat_nonce match).
+ */
+function nrasNonceFor(nonce, bundle) {
+    const providerEvidence = bundle?.[PROVIDER_TEE_CAP_ID];
+    if (!providerEvidence)
+        return nonce;
+    try {
+        const { binding } = decodeTeeTdxEvidence(providerEvidence);
+        if (!binding)
+            return nonce;
+        const scheme = getReportDataScheme(binding.scheme);
+        return scheme ? scheme.gpuNonce(nonce, binding.ingredients) : nonce;
+    }
+    catch {
+        return nonce;
+    }
+}
+/**
+ * Mint the GPU-CC capability. `gpuVerify` is the injected buyer-side check (default: NRAS);
+ * tests pass a stub. collect fetches the provider's GPU evidence from the same provider
+ * evidence route as the TDX quote (config-supplied url and field). It throws when either is
+ * absent, so the cap is omitted.
+ */
+export function makeGpuNvidiaCap(gpuVerify = defaultGpuVerify) {
+    return {
+        id: GPU_CAP_ID,
+        async verify(input) {
+            const claim = claimId(GPU_CAP_ID);
+            // Fail-closed: no evidence means the GPUs cannot be attested.
+            if (!input.evidence)
+                return { claim, ok: false, detail: 'seller returned no GPU CC evidence' };
+            const r = await gpuVerify(input.evidence, nrasNonceFor(input.nonce, input.evidenceBundle));
+            // ClaimResult has no transient field; show retryability in the human-readable detail.
+            const detail = r.transient ? `[transient] ${r.detail}` : r.detail;
+            return { claim, ok: r.ok, detail };
+        },
+        async collect(input) {
+            const url = input.config[gpuConfigKey('url')];
+            const field = input.config[gpuConfigKey('field')];
+            if (!url || !field)
+                throw new Error('seller-provider-gpu-cc requires a provider url + gpu field; not offered');
+            // The GPU evidence is a structured JSON object ({ arch, evidence_list }), not a lone
+            // base64 blob — collect it as JSON bytes so its shape survives to the NRAS submit.
+            return collectJsonFieldViaHttp(url, input.nonce, field);
+        },
+    };
+}
+export const gpuNvidiaCapability = makeGpuNvidiaCap();
+//# sourceMappingURL=gpu-nvidia.js.map

package/dist/caps/gpu-nvidia.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gpu-nvidia.js","sourceRoot":"","sources":["../../src/caps/gpu-nvidia.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,GAGV,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,wBAAwB,CAAA;AAElD,4FAA4F;AAC5F,MAAM,YAAY,GAAG,2BAA2B,CAAA;AAChD,mGAAmG;AACnG,MAAM,YAAY,GAAG,2BAA2B,CAAA;AAChD,MAAM,aAAa,GAAG,gCAAgC,CAAA;AAiBtD,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAsB,CAAA;AACzE,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAoB,EAAE;IACtD,OAAO,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,2BAA2B,CAAA;QAEhG,IAAI,OAAO,CAAA;QACX,IAAI,CAAC;YACH,OAAO,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAA;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;QACnE,CAAC;QAED,IAAI,QAAiB,CAAA;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,wBAAwB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;QACnF,CAAC;QAED,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,qBAAqB,CAAA;YAC3F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;YACjC,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAClD,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAA;IACvC,CAAC,CAAA;AACH,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAgB,iBAAiB,EAAE,CAAA;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAgB,KAAK,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,gFAAgF;CACzF,CAAC,CAAA;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;IAC/D,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;IACxE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC5D,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC1D,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,YAAY,KAAK,IAAI,gCAAgC,EAAE,CAAC,CAAA;AACjH,CAAC,CAAA;AAED,gGAAgG;AAChG,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAA;AAC/B,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAiB,EAAE,MAA8C;IACrF,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,CAAA;IACtD,IAAI,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;QAC1D,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC1B,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAyB,gBAAgB;IACxE,OAAO;QACL,EAAE,EAAE,UAAU;QAEd,KAAK,CAAC,MAAM,CAAC,KAA4B;YACvC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;YACjC,8DAA8D;YAC9D,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAA;YAC9F,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;YAC1F,sFAAsF;YACtF,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YACjE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAA6B;YACzC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;YACjD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;YAC9G,qFAAqF;YACrF,mFAAmF;YACnF,OAAO,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,EAAE,CAAA"}

package/dist/caps/index.d.ts

@@ -0,0 +1,7 @@
+import { nodeTeeCapability, providerTeeCapability } from './tee-tdx.js';
+import { sellerBoundCapability } from './seller-bound.js';
+import { measuredImageCapability } from './measured-image.js';
+import { gpuNvidiaCapability } from './gpu-nvidia.js';
+import { providerClaimsCapability } from './provider-claims.js';
+export { nodeTeeCapability, providerTeeCapability, sellerBoundCapability, measuredImageCapability, gpuNvidiaCapability, providerClaimsCapability };
+//# sourceMappingURL=index.d.ts.map

package/dist/caps/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/caps/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAgB/D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,CAAA"}

package/dist/caps/index.js

@@ -0,0 +1,21 @@
+import { registerCapability } from '../capability.js';
+import { nodeTeeCapability, providerTeeCapability } from './tee-tdx.js';
+import { sellerBoundCapability } from './seller-bound.js';
+import { measuredImageCapability } from './measured-image.js';
+import { gpuNvidiaCapability } from './gpu-nvidia.js';
+import { providerClaimsCapability } from './provider-claims.js';
+/**
+ * Registration order defines both the advertised menu order and the seller's collect order.
+ * Invariant: seller-bound signs over the whole bundle, so every evidence-producing cap (the
+ * TDX caps, gpu-cc and provider-claims) must be registered before seller-bound. They are then
+ * already collected when it builds the digest it signs. measured-image derives from the
+ * provider quote (no own evidence), so its position does not matter.
+ */
+registerCapability(nodeTeeCapability);
+registerCapability(providerTeeCapability);
+registerCapability(gpuNvidiaCapability);
+registerCapability(providerClaimsCapability);
+registerCapability(sellerBoundCapability);
+registerCapability(measuredImageCapability);
+export { nodeTeeCapability, providerTeeCapability, sellerBoundCapability, measuredImageCapability, gpuNvidiaCapability, providerClaimsCapability };
+//# sourceMappingURL=index.js.map

package/dist/caps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/caps/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAE/D;;;;;;GAMG;AACH,kBAAkB,CAAC,iBAAiB,CAAC,CAAA;AACrC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;AACzC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;AACvC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;AAC5C,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;AACzC,kBAAkB,CAAC,uBAAuB,CAAC,CAAA;AAE3C,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,CAAA"}

package/dist/caps/measured-image.d.ts

@@ -0,0 +1,14 @@
+import type { Capability } from '../capability.js';
+/** One approved image fingerprint. Hex strings (no 0x); rtmrN optional (checked when present). */
+export interface ApprovedMeasurement {
+    mrtd: string;
+    rtmr0?: string;
+    rtmr1?: string;
+    rtmr2?: string;
+    rtmr3?: string;
+}
+export interface MeasuredImagePolicy {
+    approvedMeasurements?: ApprovedMeasurement[];
+}
+export declare const measuredImageCapability: Capability;
+//# sourceMappingURL=measured-image.d.ts.map

package/dist/caps/measured-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"measured-image.d.ts","sourceRoot":"","sources":["../../src/caps/measured-image.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAyB,MAAM,kBAAkB,CAAA;AAezE,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAC7C;AAoBD,eAAO,MAAM,uBAAuB,EAAE,UAoBrC,CAAA"}

package/dist/caps/measured-image.js

@@ -0,0 +1,46 @@
+import { claimId } from '../shared.js';
+/**
+ * Capability 'seller-provider-measured-image': proves the inference provider booted a
+ * specific, approved software image. It compares the provider TDX quote's authenticated
+ * measurements (MRTD + RTMR0-3) to a buyer-supplied allow-list. The approved measurements
+ * are pure data passed in via policy — never fetched, never hardcoded — so the SDK stays
+ * provider-agnostic. With no policy it returns ok:false; it never passes by default. It
+ * derives from the provider quote, so it has no own evidence.
+ */
+const CAP_ID = 'seller-provider-measured-image';
+function hex(b) {
+    return Buffer.from(b).toString('hex');
+}
+/** A measurement matches only if every field it specifies equals the quote's value. */
+function matches(m, td) {
+    if (!td)
+        return false;
+    const eq = (expected, actual) => expected === undefined || expected.toLowerCase() === hex(actual);
+    return (m.mrtd.toLowerCase() === hex(td.mrTd) &&
+        eq(m.rtmr0, td.rtMr0) &&
+        eq(m.rtmr1, td.rtMr1) &&
+        eq(m.rtmr2, td.rtMr2) &&
+        eq(m.rtmr3, td.rtMr3));
+}
+export const measuredImageCapability = {
+    id: CAP_ID,
+    verify(input) {
+        const claim = claimId(CAP_ID);
+        const p = input.parsedQuote;
+        if (!p || !p.td)
+            return { claim, ok: false, detail: 'no TDX measurements available (a verified tee-tdx quote is required)' };
+        const policy = input.policy;
+        const approved = policy?.approvedMeasurements;
+        if (!approved || approved.length === 0) {
+            return { claim, ok: false, detail: 'no approved measurement set configured' };
+        }
+        if (!approved.some((m) => matches(m, p.td))) {
+            return { claim, ok: false, detail: `MRTD ${hex(p.td.mrTd).slice(0, 16)}… matches no approved measurement` };
+        }
+        // A matching measurement alone says nothing about freshness. Without a report_data scheme
+        // that binds this quote to the round, it could be a genuine but replayed or borrowed quote.
+        const caveat = p.binding ? '' : ' (freshness/instance binding NOT verified — no report_data scheme declared)';
+        return { claim, ok: true, detail: `measurements match an approved image (MRTD ${hex(p.td.mrTd).slice(0, 16)}…)${caveat}` };
+    },
+};
+//# sourceMappingURL=measured-image.js.map

package/dist/caps/measured-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"measured-image.js","sourceRoot":"","sources":["../../src/caps/measured-image.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC;;;;;;;GAOG;AAEH,MAAM,MAAM,GAAG,gCAAgC,CAAA;AAe/C,SAAS,GAAG,CAAC,CAAa;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED,uFAAuF;AACvF,SAAS,OAAO,CAAC,CAAsB,EAAE,EAAwB;IAC/D,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IACrB,MAAM,EAAE,GAAG,CAAC,QAA4B,EAAE,MAAkB,EAAW,EAAE,CACvE,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,CACL,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;QACrC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC;QACrB,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC;QACrB,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC;QACrB,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CACtB,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAe;IACjD,EAAE,EAAE,MAAM;IAEV,MAAM,CAAC,KAA4B;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAyC,CAAA;QACzD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sEAAsE,EAAE,CAAA;QAC5H,MAAM,MAAM,GAAG,KAAK,CAAC,MAAyC,CAAA;QAC9D,MAAM,QAAQ,GAAG,MAAM,EAAE,oBAAoB,CAAA;QAC7C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mCAAmC,EAAE,CAAA;QAC7G,CAAC;QACD,0FAA0F;QAC1F,4FAA4F;QAC5F,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6EAA6E,CAAA;QAC7G,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,8CAA8C,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,EAAE,CAAA;IAC5H,CAAC;CACF,CAAA"}

package/dist/caps/provider-claims.d.ts

@@ -0,0 +1,52 @@
+import type { Capability } from '../capability.js';
+/**
+ * Capability 'seller-provider-claims': carries the inference provider's claims into the
+ * protocol with per-claim granularity — one ClaimResult per claim, namespaced
+ * '<verifier>:seller-provider-claims/<name>'. The claims menu is frozen in the SDK
+ * (PROVIDER_CLAIMS_MENU below), never supplied by the seller or provider; the provider's
+ * document supplies values only ({ "<name>": <value> }).
+ *
+ * Frozen proof levels:
+ *   'asserted'  the claim may pass on bundle integrity alone: the document rides in the
+ *               evidence bundle that seller-bound signs (freshness + seller identity).
+ *   'tdx-quote' the claim passes only when the provider's TDX quote (verified this round
+ *               with DCAP as seller-provider-tee-genuine) commits to this exact document
+ *               and nonce in its report_data (see claimsReportData). The provider's TEE
+ *               then attests the claim; it is not merely asserted.
+ * When the quote binding holds, asserted-level claims are reported TEE-attested too.
+ *
+ * The document is provider-authored bytes carried verbatim (base64 field on the same
+ * config-driven evidence route as the provider quote). The binding hashes the exact
+ * bytes, so no re-encoding is allowed anywhere. No provider specifics live here.
+ */
+export declare const PROVIDER_CLAIMS_CAP_ID = "seller-provider-claims";
+/** Config-key convention for this cap's collector; mirrors tdxConfigKey. */
+export declare function claimsConfigKey(key: string): string;
+/**
+ * Provider quote report_data layout for TEE-attested claims:
+ *
+ *   report_data[ 0:32] = SHA-256( DOMAIN ‖ nonce(32) ‖ SHA-256(claimsDocBytes) )
+ *   report_data[32:64] = reserved   // gpu-cc binds the GPU via the NRAS nonce, not this half
+ *
+ * `claimsReportData` returns the 32-byte [0:32] commitment; the verifier compares it against
+ * the provider quote's first half.
+ */
+export declare const PROVIDER_REPORT_DATA_DOMAIN = "antseed-provider-report-data-v1";
+export declare function claimsReportData(nonce: Uint8Array, docBytes: Uint8Array): Uint8Array;
+/** One frozen menu entry: what the claim means, how its value must look, what proves it. */
+export interface ProviderClaimDefinition {
+    /** Human meaning of the claim, frozen with its verification semantics. */
+    description: string;
+    /** Minimum proof required to pass: 'asserted' (bundle-bound) or 'tdx-quote' (TEE-bound). */
+    proof: 'asserted' | 'tdx-quote';
+    /** Frozen value check; returns a failure reason, or null when the value is acceptable. */
+    validate(value: unknown): string | null;
+}
+/**
+ * The frozen claims menu for this SDK version. Buyers verify only against these
+ * definitions; a document name outside this menu can never pass. Add entries only with
+ * an SDK version bump (the CLI trust registry pins the exact version network-wide).
+ */
+export declare const PROVIDER_CLAIMS_MENU: Record<string, ProviderClaimDefinition>;
+export declare const providerClaimsCapability: Capability;
+//# sourceMappingURL=provider-claims.d.ts.map

package/dist/caps/provider-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-claims.d.ts","sourceRoot":"","sources":["../../src/caps/provider-claims.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAiD,MAAM,kBAAkB,CAAA;AAKjG;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,eAAO,MAAM,sBAAsB,2BAA2B,CAAA;AAE9D,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,oCAAoC,CAAA;AAE5E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,GAAG,UAAU,CAOpF;AAED,4FAA4F;AAC5F,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAA;IACnB,4FAA4F;IAC5F,KAAK,EAAE,UAAU,GAAG,WAAW,CAAA;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAA;CACxC;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAiBxE,CAAA;AAwED,eAAO,MAAM,wBAAwB,EAAE,UA0DtC,CAAA"}

package/dist/caps/provider-claims.js

@@ -0,0 +1,195 @@
+import { createHash } from 'node:crypto';
+import { claimId } from '../shared.js';
+import { collectViaHttp } from '../collect/http.js';
+import { isTcbAcceptable } from './tee-tdx.js';
+/**
+ * Capability 'seller-provider-claims': carries the inference provider's claims into the
+ * protocol with per-claim granularity — one ClaimResult per claim, namespaced
+ * '<verifier>:seller-provider-claims/<name>'. The claims menu is frozen in the SDK
+ * (PROVIDER_CLAIMS_MENU below), never supplied by the seller or provider; the provider's
+ * document supplies values only ({ "<name>": <value> }).
+ *
+ * Frozen proof levels:
+ *   'asserted'  the claim may pass on bundle integrity alone: the document rides in the
+ *               evidence bundle that seller-bound signs (freshness + seller identity).
+ *   'tdx-quote' the claim passes only when the provider's TDX quote (verified this round
+ *               with DCAP as seller-provider-tee-genuine) commits to this exact document
+ *               and nonce in its report_data (see claimsReportData). The provider's TEE
+ *               then attests the claim; it is not merely asserted.
+ * When the quote binding holds, asserted-level claims are reported TEE-attested too.
+ *
+ * The document is provider-authored bytes carried verbatim (base64 field on the same
+ * config-driven evidence route as the provider quote). The binding hashes the exact
+ * bytes, so no re-encoding is allowed anywhere. No provider specifics live here.
+ */
+export const PROVIDER_CLAIMS_CAP_ID = 'seller-provider-claims';
+/** Config-key convention for this cap's collector; mirrors tdxConfigKey. */
+export function claimsConfigKey(key) {
+    return `${PROVIDER_CLAIMS_CAP_ID}.${key}`;
+}
+/**
+ * Provider quote report_data layout for TEE-attested claims:
+ *
+ *   report_data[ 0:32] = SHA-256( DOMAIN ‖ nonce(32) ‖ SHA-256(claimsDocBytes) )
+ *   report_data[32:64] = reserved   // gpu-cc binds the GPU via the NRAS nonce, not this half
+ *
+ * `claimsReportData` returns the 32-byte [0:32] commitment; the verifier compares it against
+ * the provider quote's first half.
+ */
+export const PROVIDER_REPORT_DATA_DOMAIN = 'antseed-provider-report-data-v1';
+export function claimsReportData(nonce, docBytes) {
+    const docHash = createHash('sha256').update(Buffer.from(docBytes)).digest();
+    const h = createHash('sha256');
+    h.update(Buffer.from(PROVIDER_REPORT_DATA_DOMAIN, 'utf8'));
+    h.update(Buffer.from(nonce));
+    h.update(docHash);
+    return new Uint8Array(h.digest());
+}
+/**
+ * The frozen claims menu for this SDK version. Buyers verify only against these
+ * definitions; a document name outside this menu can never pass. Add entries only with
+ * an SDK version bump (the CLI trust registry pins the exact version network-wide).
+ */
+export const PROVIDER_CLAIMS_MENU = {
+    'model-id': {
+        description: 'the model identifier this provider serves for the routed requests',
+        proof: 'asserted',
+        validate: (v) => typeof v === 'string' && v.length > 0 && v.length <= 200
+            ? null
+            : 'expected a non-empty string (max 200 chars)',
+    },
+    'serving-image-digest': {
+        description: 'digest of the serving-stack image handling requests inside the provider TEE',
+        proof: 'tdx-quote',
+        validate: (v) => typeof v === 'string' && /^sha256:[0-9a-f]{64}$/.test(v)
+            ? null
+            : 'expected "sha256:<64 lowercase hex>"',
+    },
+};
+/** Claim names become protocol claim-id path segments; keep them id-safe and bounded. */
+const CLAIM_NAME_RE = /^[a-z0-9][a-z0-9.-]{0,63}$/;
+/** Hard bound on claims per document, so a provider cannot flood the buyer's report. */
+const MAX_CLAIMS = 64;
+/** Hard bound on the claims document size before JSON.parse (a hostile seller must not force an unbounded parse). */
+const MAX_DOC_BYTES = 64 * 1024;
+/** Parse + validate a claims document envelope. Throws with a doc-level reason. */
+function parseClaimsDoc(bytes) {
+    if (bytes.length > MAX_DOC_BYTES) {
+        throw new Error(`claims document exceeds ${MAX_DOC_BYTES} bytes (${bytes.length})`);
+    }
+    let root;
+    try {
+        root = JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch (err) {
+        throw new Error(`malformed claims document: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (root === null || typeof root !== 'object' || Array.isArray(root)) {
+        throw new Error('malformed claims document: not a JSON object');
+    }
+    const { version, claims } = root;
+    if (version !== undefined && version !== 1) {
+        throw new Error(`unsupported claims document version ${JSON.stringify(version)} (expected 1)`);
+    }
+    if (claims === null || typeof claims !== 'object' || Array.isArray(claims)) {
+        throw new Error('malformed claims document: "claims" is not an object');
+    }
+    const entries = Object.entries(claims);
+    if (entries.length === 0)
+        throw new Error('claims document declares no claims');
+    if (entries.length > MAX_CLAIMS) {
+        throw new Error(`claims document has too many claims (${entries.length} > ${MAX_CLAIMS})`);
+    }
+    for (const [name] of entries) {
+        if (!CLAIM_NAME_RE.test(name)) {
+            throw new Error(`invalid claim name "${name}": use lowercase letters, digits, hyphen or dot (max 64 chars)`);
+        }
+    }
+    return new Map(entries);
+}
+/** Compact human summary of a claim's value for ClaimResult.detail. */
+function summarize(value) {
+    const s = JSON.stringify(value) ?? 'undefined';
+    return s.length > 80 ? `${s.slice(0, 77)}…` : s;
+}
+/**
+ * One binding verdict per document: is the provider quote genuine and committed to these
+ * exact document bytes? Every claim in the document shares it.
+ */
+function quoteBinding(p, nonce, docBytes) {
+    if (!p)
+        return 'no verified provider TDX quote in this round (this claim requires seller-provider-tee-genuine evidence)';
+    if (p.error)
+        return p.error;
+    if (!isTcbAcceptable(p.status))
+        return `provider TCB status not acceptable: ${p.status || 'unknown'}`;
+    if (!p.td)
+        return 'provider quote is not an Intel TDX quote';
+    if (p.td.debug === true)
+        return 'provider TDX debug mode is enabled';
+    // Compare the canonical [0:32] commitment; [32:64] is reserved (gpu-cc binds via NRAS).
+    const expected = claimsReportData(nonce, docBytes);
+    const rd = p.td.reportData;
+    if (rd.length < 32 || !Buffer.from(rd.subarray(0, 32)).equals(Buffer.from(expected))) {
+        return 'provider quote report_data does not commit to this claims document';
+    }
+    return null;
+}
+export const providerClaimsCapability = {
+    id: PROVIDER_CLAIMS_CAP_ID,
+    verify(input) {
+        const parent = claimId(PROVIDER_CLAIMS_CAP_ID);
+        if (!input.evidence) {
+            return [{ claim: parent, ok: false, detail: 'seller returned no claims document' }];
+        }
+        let values;
+        try {
+            values = parseClaimsDoc(input.evidence);
+        }
+        catch (err) {
+            return [{ claim: parent, ok: false, detail: err instanceof Error ? err.message : String(err) }];
+        }
+        // Bind once per document; every claim shares the verdict.
+        const p = input.parsedQuote;
+        const bindingFailure = quoteBinding(p, input.nonce, input.evidence);
+        const results = [];
+        for (const [name, value] of values) {
+            const claim = `${parent}/${name}`;
+            const def = PROVIDER_CLAIMS_MENU[name];
+            if (!def) {
+                results.push({ claim, ok: false, detail: `unknown claim "${name}": not in this SDK version's frozen claims menu` });
+                continue;
+            }
+            const invalid = def.validate(value);
+            if (invalid) {
+                results.push({ claim, ok: false, detail: `invalid value: ${invalid}` });
+                continue;
+            }
+            if (def.proof === 'tdx-quote' && bindingFailure) {
+                results.push({ claim, ok: false, detail: bindingFailure });
+                continue;
+            }
+            // An asserted-level pass is a signed self-assertion, not an independent measurement.
+            // Label it so buyer UIs and policy cannot render it as "verified".
+            results.push({
+                claim,
+                ok: true,
+                detail: bindingFailure
+                    ? `provider-asserted only, NOT independently verified: ${summarize(value)}`
+                    : `attested by provider TEE (report_data-bound TDX quote): ${summarize(value)}`,
+            });
+        }
+        return results;
+    },
+    async collect(input) {
+        const url = input.config[claimsConfigKey('url')];
+        const field = input.config[claimsConfigKey('field')];
+        if (!url || !field) {
+            throw new Error(`${PROVIDER_CLAIMS_CAP_ID} requires an evidence url and a claims field; not offered`);
+        }
+        // collectViaHttp base64-decodes the field — the document bytes arrive verbatim, which
+        // the tdx-quote binding depends on (report_data hashes the exact bytes).
+        return collectViaHttp(url, input.nonce, field);
+    },
+};
+//# sourceMappingURL=provider-claims.js.map

package/dist/caps/provider-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-claims.js","sourceRoot":"","sources":["../../src/caps/provider-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAuB,MAAM,cAAc,CAAA;AAEnE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAA;AAE9D,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,sBAAsB,IAAI,GAAG,EAAE,CAAA;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,iCAAiC,CAAA;AAE5E,MAAM,UAAU,gBAAgB,CAAC,KAAiB,EAAE,QAAoB;IACtE,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IAC3E,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC9B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1D,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACjB,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AACnC,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA4C;IAC3E,UAAU,EAAE;QACV,WAAW,EAAE,mEAAmE;QAChF,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;YACtD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,6CAA6C;KACpD;IACD,sBAAsB,EAAE;QACtB,WAAW,EAAE,6EAA6E;QAC1F,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,OAAO,CAAC,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;YACtD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,sCAAsC;KAC7C;CACF,CAAA;AAED,yFAAyF;AACzF,MAAM,aAAa,GAAG,4BAA4B,CAAA;AAClD,wFAAwF;AACxF,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,qHAAqH;AACrH,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAA;AAE/B,mFAAmF;AACnF,SAAS,cAAc,CAAC,KAAiB;IACvC,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,aAAa,WAAW,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACnG,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAA+C,CAAA;IAC3E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,CAAA;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAA;IAC5F,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,gEAAgE,CAAC,CAAA;QAC9G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;AACzB,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,WAAW,CAAA;IAC9C,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACnB,CAA6B,EAC7B,KAAiB,EACjB,QAAoB;IAEpB,IAAI,CAAC,CAAC;QAAE,OAAO,yGAAyG,CAAA;IACxH,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,CAAA;IAC3B,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,uCAAuC,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,CAAA;IACrG,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,0CAA0C,CAAA;IAC5D,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,oCAAoC,CAAA;IACpE,wFAAwF;IACxF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAClD,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,UAAU,CAAA;IAC1B,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,oEAAoE,CAAA;IAC7E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAe;IAClD,EAAE,EAAE,sBAAsB;IAE1B,MAAM,CAAC,KAA4B;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;QAC9C,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAA;QACrF,CAAC;QACD,IAAI,MAA4B,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjG,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,WAAyC,CAAA;QACzD,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAEnE,MAAM,OAAO,GAAkB,EAAE,CAAA;QACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAA;YACjC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,IAAI,iDAAiD,EAAE,CAAC,CAAA;gBACnH,SAAQ;YACV,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,OAAO,EAAE,EAAE,CAAC,CAAA;gBACvE,SAAQ;YACV,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,IAAI,cAAc,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAA;gBAC1D,SAAQ;YACV,CAAC;YACD,qFAAqF;YACrF,mEAAmE;YACnE,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,cAAc;oBACpB,CAAC,CAAC,uDAAuD,SAAS,CAAC,KAAK,CAAC,EAAE;oBAC3E,CAAC,CAAC,2DAA2D,SAAS,CAAC,KAAK,CAAC,EAAE;aAClF,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,GAAG,sBAAsB,2DAA2D,CAAC,CAAA;QACvG,CAAC;QACD,sFAAsF;QACtF,yEAAyE;QACzE,OAAO,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC;CACF,CAAA"}

package/dist/caps/seller-bound.d.ts

@@ -0,0 +1,9 @@
+import type { Capability } from '../capability.js';
+/** Recover the 40-hex (lowercase, no 0x) EVM address that produced an r‖s‖v signature. */
+export declare function recoverEvmAddress(digest: Uint8Array, sig: Uint8Array): string;
+/** Build a signer over 32-byte digests from a hex private key; it emits r‖s‖v (v = 27/28). */
+export declare function signerFromPrivateKey(privHex: string): (msg: Uint8Array) => Promise<Uint8Array>;
+/** The 40-hex EVM address a private key corresponds to (for seller-side consistency checks). */
+export declare function evmAddressFromPrivateKey(privHex: string): string;
+export declare const sellerBoundCapability: Capability;
+//# sourceMappingURL=seller-bound.d.ts.map

package/dist/caps/seller-bound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seller-bound.d.ts","sourceRoot":"","sources":["../../src/caps/seller-bound.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAiD,MAAM,kBAAkB,CAAA;AAejG,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAW7E;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAW9F;AAED,gGAAgG;AAChG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIhE;AAED,eAAO,MAAM,qBAAqB,EAAE,UA+CnC,CAAA"}