@antseed/antseed-verifier 0.1.0

package/dist/caps/seller-bound.js

@@ -0,0 +1,104 @@
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
+import { bundleDigest, claimId, normalizePeerId, parseEvidenceConfigKey, sellerBoundPreimage } from '../shared.js';
+/**
+ * Capability 'seller-bound': turns provider verification into seller verification. The
+ * seller signs the seller-bound preimage (keccak256 over nonce ‖ bundleDigest ‖ peerId)
+ * with its AntSeed identity key, where bundleDigest covers every other cap's evidence
+ * (the node quote and the provider quote together). The buyer recovers the signer's EVM
+ * address and requires it to equal the peer id. Freshness (nonce) and identity (peerId)
+ * live here, independent of what any quote's own report_data binds. One seller signature
+ * therefore ties the whole bundle to this seller and this round.
+ */
+const CAP_ID = 'seller-bound';
+/** Recover the 40-hex (lowercase, no 0x) EVM address that produced an r‖s‖v signature. */
+export function recoverEvmAddress(digest, sig) {
+    if (sig.length !== 65)
+        throw new Error(`signature must be 65 bytes, got ${sig.length}`);
+    const recovery = sig[64] >= 27 ? sig[64] - 27 : sig[64];
+    if (recovery !== 0 && recovery !== 1)
+        throw new Error(`invalid recovery byte: ${sig[64]}`);
+    // noble's recovered format is v(1) ‖ r(32) ‖ s(32); repack our r‖s‖v into it.
+    const noble = new Uint8Array(65);
+    noble[0] = recovery;
+    noble.set(sig.subarray(0, 64), 1);
+    const compressed = secp256k1.recoverPublicKey(noble, digest, { prehash: false });
+    const uncompressed = secp256k1.Point.fromBytes(compressed).toBytes(false); // 0x04 ‖ X ‖ Y
+    return bytesToHex(keccak_256(uncompressed.subarray(1)).subarray(-20));
+}
+/** Build a signer over 32-byte digests from a hex private key; it emits r‖s‖v (v = 27/28). */
+export function signerFromPrivateKey(privHex) {
+    const priv = hexToBytes(privHex.replace(/^0x/i, ''));
+    if (priv.length !== 32)
+        throw new Error(`private key must be 32 bytes, got ${priv.length}`);
+    return async (msg) => {
+        // prehash:false — msg is already the 32-byte keccak preimage digest, sign it directly.
+        const recovered = secp256k1.sign(msg, priv, { prehash: false, format: 'recovered' });
+        const out = new Uint8Array(65);
+        out.set(recovered.subarray(1), 0); // r ‖ s
+        out[64] = recovered[0] + 27; // v
+        return out;
+    };
+}
+/** The 40-hex EVM address a private key corresponds to (for seller-side consistency checks). */
+export function evmAddressFromPrivateKey(privHex) {
+    const priv = hexToBytes(privHex.replace(/^0x/i, ''));
+    const uncompressed = secp256k1.getPublicKey(priv, false);
+    return bytesToHex(keccak_256(uncompressed.subarray(1)).subarray(-20));
+}
+export const sellerBoundCapability = {
+    id: CAP_ID,
+    verify(input) {
+        const claim = claimId(CAP_ID);
+        if (!input.evidence)
+            return { claim, ok: false, detail: 'seller returned no identity signature' };
+        const bundle = input.evidenceBundle;
+        if (!bundle)
+            return { claim, ok: false, detail: 'seller-bound requires the evidence bundle to bind to' };
+        // bundleDigest excludes seller-bound's own entry; require at least one other cap to cover.
+        if (Object.keys(bundle).filter((id) => id !== CAP_ID).length === 0) {
+            return { claim, ok: false, detail: 'seller-bound has no other evidence to bind to' };
+        }
+        let peerId;
+        try {
+            peerId = normalizePeerId(input.peerId);
+        }
+        catch (err) {
+            return { claim, ok: false, detail: err instanceof Error ? err.message : String(err) };
+        }
+        const preimage = sellerBoundPreimage(input.nonce, bundleDigest(bundle), peerId);
+        let signer;
+        try {
+            signer = recoverEvmAddress(preimage, input.evidence);
+        }
+        catch (err) {
+            return { claim, ok: false, detail: `signature recovery failed: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        if (signer !== peerId) {
+            return { claim, ok: false, detail: `signer ${signer.slice(0, 10)}… does not match peer ${peerId.slice(0, 10)}…` };
+        }
+        return { claim, ok: true, detail: `seller identity ${peerId.slice(0, 10)}… signed this bundle (fresh nonce bound)` };
+    },
+    async collect(input) {
+        if (!input.sign)
+            throw new Error('seller-bound requires a signer (seller identity key); not offered');
+        // Rebuild the bundle from every other cap's evidence the prover already collected this
+        // round (exposed as "evidence:<capId>" config entries). Collect it last, so the node and
+        // provider quotes are already present.
+        const bundle = {};
+        for (const [key, b64] of Object.entries(input.config)) {
+            const capId = parseEvidenceConfigKey(key);
+            if (capId && capId !== CAP_ID)
+                bundle[capId] = new Uint8Array(Buffer.from(b64, 'base64'));
+        }
+        if (Object.keys(bundle).length === 0)
+            throw new Error('seller-bound requires other cap evidence to bind to; collect a TEE cap first');
+        const preimage = sellerBoundPreimage(input.nonce, bundleDigest(bundle), input.peerId);
+        const sig = await input.sign(preimage);
+        if (sig.length !== 65)
+            throw new Error(`signer returned ${sig.length}-byte signature, expected 65 (r‖s‖v)`);
+        return sig;
+    },
+};
+//# sourceMappingURL=seller-bound.js.map

package/dist/caps/seller-bound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seller-bound.js","sourceRoot":"","sources":["../../src/caps/seller-bound.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElH;;;;;;;;GAQG;AAEH,MAAM,MAAM,GAAG,cAAc,CAAA;AAE7B,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,MAAkB,EAAE,GAAe;IACnE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IACvF,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAE,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAE,CAAA;IAC1D,IAAI,QAAQ,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC1F,8EAA8E;IAC9E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAA;IACnB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IAChF,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA,CAAC,eAAe;IACzF,OAAO,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAC3F,OAAO,KAAK,EAAE,GAAe,EAAuB,EAAE;QACpD,uFAAuF;QACvF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;QACpF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;QAC9B,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA,CAAC,QAAQ;QAC1C,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,GAAG,EAAE,CAAA,CAAC,IAAI;QACjC,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxD,OAAO,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAe;IAC/C,EAAE,EAAE,MAAM;IAEV,MAAM,CAAC,KAA4B;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAA;QACjG,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CAAA;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAA;QACxG,2FAA2F;QAC3F,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAA;QACtF,CAAC;QACD,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;QACvF,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;QAC/E,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;QACvH,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,CAAA;QACnH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C,EAAE,CAAA;IACtH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;QACrG,uFAAuF;QACvF,yFAAyF;QACzF,uCAAuC;QACvC,MAAM,MAAM,GAA+B,EAAE,CAAA;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACzC,IAAI,KAAK,IAAI,KAAK,KAAK,MAAM;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;QACrI,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QACrF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,MAAM,sCAAsC,CAAC,CAAA;QAC3G,OAAO,GAAG,CAAA;IACZ,CAAC;CACF,CAAA"}

package/dist/caps/tee-tdx.d.ts

@@ -0,0 +1,107 @@
+import type { Capability } from '../capability.js';
+import { type BindingIngredients } from '../report-data.js';
+/** A provider quote's declared report_data binding: a frozen scheme id + its string ingredients. */
+export interface ReportDataBinding {
+    scheme: string;
+    ingredients: Pick<BindingIngredients, 'peerId' | 'e2ePubkey' | 'keysetDigest'>;
+}
+/**
+ * A genuine-Intel-TDX capability: proves a party runs in a genuine Intel TDX enclave.
+ * It DCAP-verifies the quote (ECDSA sig + PCK chain to Intel's root + TCB), requires an
+ * acceptable TCB, requires a TDX (TD10) quote, and requires TDX debug off. It also parses
+ * the authenticated measurements (MRTD, RTMR0-3, report_data) into a shared ParsedTdxQuote,
+ * so dependent caps (measured-image) reuse the same verified quote instead of re-parsing
+ * untrusted bytes.
+ *
+ * The one factory below (makeTdxCap) mints two instances. They differ only by id, collector
+ * source, and evidence key: the AntSeed seller node's own TEE (configfs), and the downstream
+ * inference provider's TEE (http). Same verify logic; independent evidence.
+ */
+/** The AntSeed seller node's own TEE (mints its quote locally via configfs). */
+export declare const NODE_TEE_CAP_ID = "seller-node-tee-genuine";
+/** The downstream inference provider's TEE (quote fetched from the provider's evidence route). */
+export declare const PROVIDER_TEE_CAP_ID = "seller-provider-tee-genuine";
+/**
+ * Config-key convention: each TDX cap reads its own collector settings from `<capId>.<key>`
+ * in the shared config map, so the node cap and the provider cap never collide. It lives in
+ * one place, so the prover writes the same keys the factory reads.
+ */
+export declare function tdxConfigKey(id: string, key: string): string;
+/**
+ * TCB acceptance. UpToDate is always genuine hardware. SWHardeningNeeded flags guest-side
+ * software mitigations only — not a hardware compromise — and is accepted by default (real
+ * GCP TDX quotes often report it). Set ANTSEED_VERIFIER_STRICT_TCB=true to require UpToDate
+ * exactly. Anything else (OutOfDate, Revoked, Unknown, ...) is rejected.
+ */
+export declare function isTcbAcceptable(status: string): boolean;
+/** Authenticated TD10 measurements, extracted from a verified quote. */
+export interface TdMeasurements {
+    mrTd: Uint8Array;
+    rtMr0: Uint8Array;
+    rtMr1: Uint8Array;
+    rtMr2: Uint8Array;
+    rtMr3: Uint8Array;
+    reportData: Uint8Array;
+    /** TUD.DEBUG (tdAttributes bit 0); null if not determinable. */
+    debug: boolean | null;
+}
+/** Raw output of a DCAP check — status + measurements (td null when not a TDX quote). */
+export interface RawTdxVerification {
+    status: string;
+    td: TdMeasurements | null;
+}
+/** Injectable DCAP check — the default verifies for real; tests inject a stub. */
+export type VerifyQuoteFn = (quote: Uint8Array, collateral: unknown | undefined, nowSecs: number) => Promise<RawTdxVerification>;
+/**
+ * The shared, verified quote given to every capability for this attestation round.
+ * `quoteEvidence` is always the exact tee-tdx evidence bytes the seller returned (so
+ * seller-bound can hash the same bytes). `td` is present only when DCAP parsing yields
+ * a TDX report.
+ */
+export interface ParsedTdxQuote {
+    quoteEvidence: Uint8Array;
+    status: string;
+    td: TdMeasurements | null;
+    /** The provider-declared report_data binding, if the evidence carried one. */
+    binding?: ReportDataBinding;
+    /** Set when DCAP verification or evidence decoding threw. */
+    error?: string;
+}
+export declare function encodeTeeTdxEvidence(quote: Uint8Array, collateral?: unknown, binding?: ReportDataBinding): Uint8Array;
+export declare function decodeTeeTdxEvidence(bytes: Uint8Array): {
+    quote: Uint8Array;
+    collateral?: unknown;
+    binding?: ReportDataBinding;
+};
+/**
+ * Default DCAP verifier: it validates the quote's ECDSA signature + PCK cert chain to
+ * Intel's production root CA + TCB, and reads the TD10 measurements. It uses the seller's
+ * collateral when supplied; otherwise it fetches collateral from a public PCCS. @phala/dcap-qvl
+ * is imported lazily so the seller/prover half never loads it.
+ */
+export declare const defaultVerifyQuote: VerifyQuoteFn;
+/**
+ * DCAP-verify the tee-tdx evidence and build the shared ParsedTdxQuote. It never throws:
+ * decode or verify errors are captured in `error`, so dependent caps still see the raw
+ * `quoteEvidence` bytes (seller-bound only needs those to bind identity to the quote).
+ */
+export declare function verifyTdxEvidence(evidence: Uint8Array, verifyQuote: VerifyQuoteFn, nowSecs: number): Promise<ParsedTdxQuote>;
+/**
+ * Mint one TDX capability. `id` names the target (node or provider); `defaultSource`
+ * is the collector used when config supplies no `<id>.source` override:
+ *   'configfs': self-hosted TDX minted locally via configfs-tsm; report_data = antseed-rd-v1 {peerId}
+ *   'dstack'  : self-hosted TDX minted via the dstack guest-agent socket (Phala CVMs, where
+ *               configfs-tsm is absent); same antseed-rd-v1 {peerId} report_data as configfs
+ *   'http'    : a pre-made quote fetched from a config-supplied evidence route ({nonce} hex)
+ * verify reads this cap's own parsed quote (the orchestrator DCAP-verifies each cap's
+ * own evidence entry independently). collect throws when its source is unavailable
+ * (off-TEE for configfs, or no url for http), so the prover omits the cap.
+ */
+export declare function makeTdxCap(id: string, defaultSource: 'configfs' | 'http', opts?: {
+    bindNoncePeerId?: boolean;
+}): Capability;
+/** The AntSeed seller node's own TEE — mints its quote locally via configfs; report_data bound to nonce+peerId. */
+export declare const nodeTeeCapability: Capability;
+/** The downstream inference provider's TEE — quote fetched from the provider's evidence route. */
+export declare const providerTeeCapability: Capability;
+//# sourceMappingURL=tee-tdx.d.ts.map

package/dist/caps/tee-tdx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-tdx.d.ts","sourceRoot":"","sources":["../../src/caps/tee-tdx.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAiD,MAAM,kBAAkB,CAAA;AAKjG,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAE1F,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,WAAW,GAAG,cAAc,CAAC,CAAA;CAC/E;AAED;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,eAAO,MAAM,eAAe,4BAA4B,CAAA;AACxD,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,gCAAgC,CAAA;AAEhE;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,KAAK,EAAE,UAAU,CAAA;IACjB,KAAK,EAAE,UAAU,CAAA;IACjB,KAAK,EAAE,UAAU,CAAA;IACjB,KAAK,EAAE,UAAU,CAAA;IACjB,UAAU,EAAE,UAAU,CAAA;IACtB,gEAAgE;IAChE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAA;CACtB;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,cAAc,GAAG,IAAI,CAAA;CAC1B;AAED,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,CAC1B,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,OAAO,GAAG,SAAS,EAC/B,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,UAAU,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,cAAc,GAAG,IAAI,CAAA;IACzB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAC3B,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AASD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,UAAU,CAOrH;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAchI;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAqBhC,CAAA;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,UAAU,EACpB,WAAW,EAAE,aAAa,EAC1B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC,CAezB;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CACxB,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,UAAU,GAAG,MAAM,EAClC,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAE,GACnC,UAAU,CAgEZ;AAED,mHAAmH;AACnH,eAAO,MAAM,iBAAiB,YAAqE,CAAA;AACnG,kGAAkG;AAClG,eAAO,MAAM,qBAAqB,YAA0C,CAAA"}

package/dist/caps/tee-tdx.js

@@ -0,0 +1,210 @@
+import { claimId, computeReportData } from '../shared.js';
+import { generateTdxQuote } from '../collect/configfs.js';
+import { generateDstackQuote } from '../collect/dstack.js';
+import { collectViaHttp, collectTdxAndPubkey } from '../collect/http.js';
+import { antseedRdV1, verifyReportData } from '../report-data.js';
+/**
+ * A genuine-Intel-TDX capability: proves a party runs in a genuine Intel TDX enclave.
+ * It DCAP-verifies the quote (ECDSA sig + PCK chain to Intel's root + TCB), requires an
+ * acceptable TCB, requires a TDX (TD10) quote, and requires TDX debug off. It also parses
+ * the authenticated measurements (MRTD, RTMR0-3, report_data) into a shared ParsedTdxQuote,
+ * so dependent caps (measured-image) reuse the same verified quote instead of re-parsing
+ * untrusted bytes.
+ *
+ * The one factory below (makeTdxCap) mints two instances. They differ only by id, collector
+ * source, and evidence key: the AntSeed seller node's own TEE (configfs), and the downstream
+ * inference provider's TEE (http). Same verify logic; independent evidence.
+ */
+/** The AntSeed seller node's own TEE (mints its quote locally via configfs). */
+export const NODE_TEE_CAP_ID = 'seller-node-tee-genuine';
+/** The downstream inference provider's TEE (quote fetched from the provider's evidence route). */
+export const PROVIDER_TEE_CAP_ID = 'seller-provider-tee-genuine';
+/**
+ * Config-key convention: each TDX cap reads its own collector settings from `<capId>.<key>`
+ * in the shared config map, so the node cap and the provider cap never collide. It lives in
+ * one place, so the prover writes the same keys the factory reads.
+ */
+export function tdxConfigKey(id, key) {
+    return `${id}.${key}`;
+}
+/**
+ * TCB acceptance. UpToDate is always genuine hardware. SWHardeningNeeded flags guest-side
+ * software mitigations only — not a hardware compromise — and is accepted by default (real
+ * GCP TDX quotes often report it). Set ANTSEED_VERIFIER_STRICT_TCB=true to require UpToDate
+ * exactly. Anything else (OutOfDate, Revoked, Unknown, ...) is rejected.
+ */
+export function isTcbAcceptable(status) {
+    if (status === 'UpToDate')
+        return true;
+    if (status === 'SWHardeningNeeded')
+        return process.env['ANTSEED_VERIFIER_STRICT_TCB'] !== 'true';
+    return false;
+}
+export function encodeTeeTdxEvidence(quote, collateral, binding) {
+    const blob = {
+        quote: Buffer.from(quote).toString('base64'),
+        ...(collateral !== undefined ? { collateral } : {}),
+        ...(binding !== undefined ? { binding } : {}),
+    };
+    return new TextEncoder().encode(JSON.stringify(blob));
+}
+export function decodeTeeTdxEvidence(bytes) {
+    const parsed = JSON.parse(new TextDecoder().decode(bytes));
+    if (typeof parsed.quote !== 'string' || parsed.quote.length === 0) {
+        throw new Error('tee-tdx evidence missing "quote"');
+    }
+    const quote = new Uint8Array(Buffer.from(parsed.quote, 'base64'));
+    if (quote.length === 0) {
+        throw new Error('tee-tdx evidence "quote" is not valid base64');
+    }
+    return {
+        quote,
+        ...(parsed.collateral !== undefined ? { collateral: parsed.collateral } : {}),
+        ...(parsed.binding !== undefined ? { binding: parsed.binding } : {}),
+    };
+}
+/**
+ * Default DCAP verifier: it validates the quote's ECDSA signature + PCK cert chain to
+ * Intel's production root CA + TCB, and reads the TD10 measurements. It uses the seller's
+ * collateral when supplied; otherwise it fetches collateral from a public PCCS. @phala/dcap-qvl
+ * is imported lazily so the seller/prover half never loads it.
+ */
+export const defaultVerifyQuote = async (quote, collateral, nowSecs) => {
+    const mod = (await import('@phala/dcap-qvl'));
+    const dcap = mod.default ?? mod;
+    const verified = collateral !== undefined
+        ? dcap.verify(Buffer.from(quote), collateral, nowSecs)
+        : await dcap.getCollateralAndVerify(Buffer.from(quote));
+    const td = verified.report.asTd10();
+    if (!td)
+        return { status: verified.status, td: null };
+    return {
+        status: verified.status,
+        td: {
+            mrTd: td.mrTd,
+            rtMr0: td.rtMr0,
+            rtMr1: td.rtMr1,
+            rtMr2: td.rtMr2,
+            rtMr3: td.rtMr3,
+            reportData: td.reportData,
+            debug: td.tdAttributes.length > 0 ? (td.tdAttributes[0] & 0x01) === 1 : null,
+        },
+    };
+};
+/**
+ * DCAP-verify the tee-tdx evidence and build the shared ParsedTdxQuote. It never throws:
+ * decode or verify errors are captured in `error`, so dependent caps still see the raw
+ * `quoteEvidence` bytes (seller-bound only needs those to bind identity to the quote).
+ */
+export async function verifyTdxEvidence(evidence, verifyQuote, nowSecs) {
+    let quote;
+    let collateral;
+    let binding;
+    try {
+        ;
+        ({ quote, collateral, binding } = decodeTeeTdxEvidence(evidence));
+    }
+    catch (err) {
+        return { quoteEvidence: evidence, status: '', td: null, error: `malformed tee-tdx evidence: ${msg(err)}` };
+    }
+    try {
+        const raw = await verifyQuote(quote, collateral, nowSecs);
+        return { quoteEvidence: evidence, status: raw.status, td: raw.td, ...(binding ? { binding } : {}) };
+    }
+    catch (err) {
+        return { quoteEvidence: evidence, status: '', td: null, ...(binding ? { binding } : {}), error: `quote verification failed: ${msg(err)}` };
+    }
+}
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function hex(b) {
+    return Buffer.from(b).toString('hex');
+}
+/**
+ * Mint one TDX capability. `id` names the target (node or provider); `defaultSource`
+ * is the collector used when config supplies no `<id>.source` override:
+ *   'configfs': self-hosted TDX minted locally via configfs-tsm; report_data = antseed-rd-v1 {peerId}
+ *   'dstack'  : self-hosted TDX minted via the dstack guest-agent socket (Phala CVMs, where
+ *               configfs-tsm is absent); same antseed-rd-v1 {peerId} report_data as configfs
+ *   'http'    : a pre-made quote fetched from a config-supplied evidence route ({nonce} hex)
+ * verify reads this cap's own parsed quote (the orchestrator DCAP-verifies each cap's
+ * own evidence entry independently). collect throws when its source is unavailable
+ * (off-TEE for configfs, or no url for http), so the prover omits the cap.
+ */
+export function makeTdxCap(id, defaultSource, opts) {
+    return {
+        id,
+        verify(input) {
+            const claim = claimId(id);
+            if (!input.evidence)
+                return { claim, ok: false, detail: 'seller returned no TDX quote' };
+            const p = input.parsedQuote;
+            if (!p)
+                return { claim, ok: false, detail: 'TDX quote was not verified' };
+            if (p.error)
+                return { claim, ok: false, detail: p.error };
+            if (!isTcbAcceptable(p.status))
+                return { claim, ok: false, detail: `TCB status not acceptable: ${p.status || 'unknown'}` };
+            if (!p.td)
+                return { claim, ok: false, detail: 'quote is not an Intel TDX quote' };
+            if (p.td.debug === true)
+                return { claim, ok: false, detail: 'TDX debug mode is enabled' };
+            // Bind report_data to this round: the node cap to its {peerId} identity, a provider cap
+            // to whatever frozen scheme its evidence declares. Fail-closed — a borrowed, relayed, or
+            // stale quote cannot match a fresh-nonce commitment. A provider quote with no declared
+            // scheme still passes on genuineness, but its detail must disclose that freshness was not proven.
+            const binding = opts?.bindNoncePeerId
+                ? { scheme: antseedRdV1.id, ingredients: { peerId: input.peerId } }
+                : p.binding;
+            if (binding) {
+                const bad = verifyReportData(binding.scheme, p.td.reportData, input.nonce, binding.ingredients);
+                if (bad)
+                    return { claim, ok: false, detail: bad };
+            }
+            const freshness = binding
+                ? `bound to this round (${binding.scheme})`
+                : 'freshness/instance binding NOT verified (no report_data scheme declared)';
+            return {
+                claim,
+                ok: true,
+                detail: `genuine Intel TDX quote (TCB ${p.status}); MRTD ${hex(p.td.mrTd).slice(0, 16)}…; ${freshness}`,
+            };
+        },
+        async collect(input) {
+            const source = input.config[tdxConfigKey(id, 'source')] ?? defaultSource;
+            if (source === 'configfs') {
+                const quote = generateTdxQuote(computeReportData(input.nonce, input.peerId));
+                return encodeTeeTdxEvidence(quote);
+            }
+            if (source === 'dstack') {
+                const socket = input.config[tdxConfigKey(id, 'dstack.socket')] || undefined;
+                const quote = await generateDstackQuote(computeReportData(input.nonce, input.peerId), socket);
+                return encodeTeeTdxEvidence(quote);
+            }
+            if (source === 'http') {
+                const url = input.config[tdxConfigKey(id, 'url')];
+                if (!url)
+                    throw new Error(`${id} http source requires an evidence url; not offered`);
+                const field = input.config[tdxConfigKey(id, 'field')] ?? 'quote';
+                const scheme = input.config[tdxConfigKey(id, 'binding.scheme')];
+                if (!scheme) {
+                    return encodeTeeTdxEvidence(await collectViaHttp(url, input.nonce, field));
+                }
+                // Declare the provider's frozen report_data scheme and its ingredients (e.g. the E2E
+                // pubkey) so the buyer can verify the quote is bound to this round. Both come from one
+                // fetch, so the quote and the pubkey are from the same response (no cross-fetch skew).
+                const pubkeyField = input.config[tdxConfigKey(id, 'binding.pubkeyField')];
+                const { quote, pubkey } = await collectTdxAndPubkey(url, input.nonce, field, pubkeyField);
+                const ingredients = pubkey ? { e2ePubkey: pubkey } : {};
+                return encodeTeeTdxEvidence(quote, undefined, { scheme, ingredients });
+            }
+            throw new Error(`unknown ${id} source "${source}" (expected "configfs", "dstack", or "http")`);
+        },
+    };
+}
+/** The AntSeed seller node's own TEE — mints its quote locally via configfs; report_data bound to nonce+peerId. */
+export const nodeTeeCapability = makeTdxCap(NODE_TEE_CAP_ID, 'configfs', { bindNoncePeerId: true });
+/** The downstream inference provider's TEE — quote fetched from the provider's evidence route. */
+export const providerTeeCapability = makeTdxCap(PROVIDER_TEE_CAP_ID, 'http');
+//# sourceMappingURL=tee-tdx.js.map

package/dist/caps/tee-tdx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-tdx.js","sourceRoot":"","sources":["../../src/caps/tee-tdx.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAA2B,MAAM,mBAAmB,CAAA;AAQ1F;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAA;AACxD,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAA;AAEhE;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,GAAW;IAClD,OAAO,GAAG,EAAE,IAAI,GAAG,EAAE,CAAA;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,MAAM,KAAK,mBAAmB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,KAAK,MAAM,CAAA;IAChG,OAAO,KAAK,CAAA;AACd,CAAC;AAkDD,MAAM,UAAU,oBAAoB,CAAC,KAAiB,EAAE,UAAoB,EAAE,OAA2B;IACvG,MAAM,IAAI,GAAmB;QAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAA;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAA4B,CAAA;IACrF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACrD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,OAAO;QACL,KAAK;QACL,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAkB,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;IAEpF,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAA8B,CAAA;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAA;IAC/B,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,UAAmB,EAAE,OAAO,CAAC;QAC/D,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IACnC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACrD,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,EAAE,EAAE;YACF,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;SAC9E;KACF,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAoB,EACpB,WAA0B,EAC1B,OAAe;IAEf,IAAI,KAAiB,CAAA;IACrB,IAAI,UAAmB,CAAA;IACvB,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,+BAA+B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IAC5G,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;QACzD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,8BAA8B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAA;IAC5I,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,GAAG,CAAC,CAAa;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CACxB,EAAU,EACV,aAAkC,EAClC,IAAoC;IAEpC,OAAO;QACL,EAAE;QAEF,MAAM,CAAC,KAA4B;YACjC,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAA;YACzB,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAA;YACxF,MAAM,CAAC,GAAG,KAAK,CAAC,WAAyC,CAAA;YACzD,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAA;YACzE,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;YACzD,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAA;YAC1H,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;YACjF,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAA;YACzF,wFAAwF;YACxF,yFAAyF;YACzF,uFAAuF;YACvF,kGAAkG;YAClG,MAAM,OAAO,GAAkC,IAAI,EAAE,eAAe;gBAClE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE;gBACnE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;YACb,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;gBAC/F,IAAI,GAAG;oBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;YACnD,CAAC;YACD,MAAM,SAAS,GAAG,OAAO;gBACvB,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,GAAG;gBAC3C,CAAC,CAAC,0EAA0E,CAAA;YAC9E,OAAO;gBACL,KAAK;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,gCAAgC,CAAC,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,SAAS,EAAE;aACxG,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAA6B;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,aAAa,CAAA;YACxE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC5E,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpC,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,IAAI,SAAS,CAAA;gBAC3E,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;gBAC7F,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAA;YACpC,CAAC;YACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAA;gBACjD,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAA;gBACpF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,CAAA;gBAChE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;gBAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,oBAAoB,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;gBAC5E,CAAC;gBACD,qFAAqF;gBACrF,uFAAuF;gBACvF,uFAAuF;gBACvF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAA;gBACzE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;gBACzF,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;gBACvD,OAAO,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,YAAY,MAAM,8CAA8C,CAAC,CAAA;QAChG,CAAC;KACF,CAAA;AACH,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,eAAe,EAAE,UAAU,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;AACnG,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAA"}

package/dist/collect/configfs.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Generate a raw Intel TDX quote bound to `reportData` (64 bytes) via configfs-tsm: mkdir a
+ * report entry, write REPORTDATA to `inblob`, read the assembled quote from `outblob`, rmdir.
+ */
+export declare function generateTdxQuote(reportData: Uint8Array): Uint8Array;
+//# sourceMappingURL=configfs.d.ts.map

package/dist/collect/configfs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configfs.d.ts","sourceRoot":"","sources":["../../src/collect/configfs.ts"],"names":[],"mappings":"AAYA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAoBnE"}

package/dist/collect/configfs.js

@@ -0,0 +1,38 @@
+import { mkdirSync, writeFileSync, readFileSync, rmdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+/**
+ * Self-hosted TDX collector: it mints a quote locally via the Linux configfs-TSM report
+ * interface (kernel >= 6.7). The interface is present inside a real Intel TDX guest (e.g. a
+ * GCP confidential VM) and absent elsewhere, so this throws off-TEE. The prover uses that to
+ * detect it cannot offer the tee-tdx capability via this source.
+ */
+const TSM_REPORT_DIR = '/sys/kernel/config/tsm/report';
+/**
+ * Generate a raw Intel TDX quote bound to `reportData` (64 bytes) via configfs-tsm: mkdir a
+ * report entry, write REPORTDATA to `inblob`, read the assembled quote from `outblob`, rmdir.
+ */
+export function generateTdxQuote(reportData) {
+    if (reportData.length !== 64) {
+        throw new Error(`reportData must be 64 bytes, got ${reportData.length}`);
+    }
+    const entry = join(TSM_REPORT_DIR, `antseed-${randomBytes(8).toString('hex')}`);
+    mkdirSync(entry);
+    try {
+        writeFileSync(join(entry, 'inblob'), Buffer.from(reportData));
+        const quote = readFileSync(join(entry, 'outblob'));
+        if (quote.length === 0) {
+            throw new Error('configfs-tsm outblob was empty (quote generation produced no bytes)');
+        }
+        return new Uint8Array(quote);
+    }
+    finally {
+        try {
+            rmdirSync(entry);
+        }
+        catch {
+            // best-effort cleanup; the entry is a one-shot configfs dir
+        }
+    }
+}
+//# sourceMappingURL=configfs.js.map

package/dist/collect/configfs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configfs.js","sourceRoot":"","sources":["../../src/collect/configfs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC;;;;;GAKG;AACH,MAAM,cAAc,GAAG,+BAA+B,CAAA;AAEtD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,WAAW,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC/E,SAAS,CAAC,KAAK,CAAC,CAAA;IAChB,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;QAC7D,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,SAAS,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/collect/dstack.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Generate a raw Intel TDX quote bound to `reportData` (64 bytes) via the dstack guest agent.
+ * `socketPath` overrides the default locations (e.g. a custom mount or the dstack simulator).
+ * It throws when no socket answers or the agent errors. The prover treats that as "cannot offer
+ * this source" and omits the capability, like configfs off-TEE.
+ */
+export declare function generateDstackQuote(reportData: Uint8Array, socketPath?: string): Promise<Uint8Array>;
+//# sourceMappingURL=dstack.d.ts.map

package/dist/collect/dstack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dstack.d.ts","sourceRoot":"","sources":["../../src/collect/dstack.ts"],"names":[],"mappings":"AAmDA;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAyB1G"}

package/dist/collect/dstack.js

@@ -0,0 +1,79 @@
+import { request } from 'node:http';
+/**
+ * dstack collector: it mints a TDX quote via the dstack guest-agent unix socket. This is the
+ * canonical quoting path inside dstack CVMs (e.g. Phala), where the Linux configfs-tsm
+ * interface is not exposed. It POSTs the 64-byte report_data (hex) to GetQuote, which uses it
+ * raw (no hashing, max 64 bytes). The quote's report_data is then byte-identical to the configfs
+ * path, and the buyer verifies it unchanged.
+ *
+ * Wire contract (POST http://dstack/GetQuote over the socket):
+ *   request  { "report_data": "<hex, <=64 bytes>" }
+ *   response { "quote": "<hex>", "event_log": ..., ... }
+ */
+/** Default guest-agent socket locations, tried in order (mirrors @phala/dstack-sdk). */
+const DEFAULT_DSTACK_SOCKETS = ['/var/run/dstack.sock', '/run/dstack.sock'];
+const DSTACK_TIMEOUT_MS = 20_000;
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** Connection-level failure (socket absent or refused) — try the next candidate, do not abort. */
+function isConnError(err) {
+    const code = err?.code;
+    return code === 'ENOENT' || code === 'ECONNREFUSED' || code === 'EACCES';
+}
+/** POST JSON to a unix-socket HTTP server and read the whole response body. */
+function postUnix(socketPath, path, body) {
+    return new Promise((resolve, reject) => {
+        const req = request({
+            socketPath,
+            path,
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body) },
+            timeout: DSTACK_TIMEOUT_MS,
+        }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => resolve({ status: res.statusCode ?? 0, body: Buffer.concat(chunks).toString('utf8') }));
+        });
+        req.on('error', reject);
+        req.on('timeout', () => req.destroy(new Error('dstack request timed out')));
+        req.end(body);
+    });
+}
+/**
+ * Generate a raw Intel TDX quote bound to `reportData` (64 bytes) via the dstack guest agent.
+ * `socketPath` overrides the default locations (e.g. a custom mount or the dstack simulator).
+ * It throws when no socket answers or the agent errors. The prover treats that as "cannot offer
+ * this source" and omits the capability, like configfs off-TEE.
+ */
+export async function generateDstackQuote(reportData, socketPath) {
+    if (reportData.length !== 64) {
+        throw new Error(`reportData must be 64 bytes, got ${reportData.length}`);
+    }
+    const body = JSON.stringify({ report_data: Buffer.from(reportData).toString('hex') });
+    const candidates = socketPath ? [socketPath] : DEFAULT_DSTACK_SOCKETS;
+    let lastErr;
+    for (const sock of candidates) {
+        try {
+            const { status, body: resp } = await postUnix(sock, '/GetQuote', body);
+            if (status !== 200)
+                throw new Error(`dstack GetQuote returned HTTP ${status}`);
+            const parsed = JSON.parse(resp);
+            if (typeof parsed.quote !== 'string' || parsed.quote.length === 0) {
+                throw new Error('dstack GetQuote response missing "quote"');
+            }
+            const quote = Buffer.from(parsed.quote.replace(/^0x/, ''), 'hex');
+            if (quote.length === 0)
+                throw new Error('dstack GetQuote "quote" is not valid hex');
+            return new Uint8Array(quote);
+        }
+        catch (err) {
+            lastErr = err;
+            if (isConnError(err))
+                continue; // this socket is not there — try the next candidate
+            throw new Error(`dstack quote generation failed: ${msg(err)}`);
+        }
+    }
+    throw new Error(`dstack guest agent not reachable at ${candidates.join(', ')}: ${msg(lastErr)}`);
+}
+//# sourceMappingURL=dstack.js.map

package/dist/collect/dstack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dstack.js","sourceRoot":"","sources":["../../src/collect/dstack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC;;;;;;;;;;GAUG;AAEH,wFAAwF;AACxF,MAAM,sBAAsB,GAAG,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAA;AAC3E,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEhC,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,IAAI,GAAI,GAAqC,EAAE,IAAI,CAAA;IACzD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,QAAQ,CAAA;AAC1E,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,UAAkB,EAAE,IAAY,EAAE,IAAY;IAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,UAAU;YACV,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YAC1F,OAAO,EAAE,iBAAiB;SAC3B,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC,CAAA;YAC/C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7G,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAA;QAC3E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAsB,EAAE,UAAmB;IACnF,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACrF,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAA;IACrE,IAAI,OAAgB,CAAA;IACpB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;YACtE,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAA;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAA;YACrD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAC7D,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;YACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YACnF,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,GAAG,GAAG,CAAA;YACb,IAAI,WAAW,CAAC,GAAG,CAAC;gBAAE,SAAQ,CAAC,oDAAoD;YACnF,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAClG,CAAC"}

package/dist/collect/http.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Generic HTTP collector: it fetches a TDX quote from a seller-configured attestation endpoint.
+ * Everything provider-specific (host, path, JSON location of the quote) comes from the caller
+ * — no hardcoded hosts or schemas — so any HTTP attestation service wires up through config
+ * alone. The {nonce} placeholder in `urlTemplate` is replaced with the hex nonce. `field` is a
+ * dot-path to the base64 quote in the response (e.g. "quote" or "data.quote").
+ */
+/**
+ * Fetch the provider evidence route once. It returns the base64-decoded quote and, when a pubkey
+ * field is named, the report_data-binding pubkey string. One fetch keeps the quote and the pubkey
+ * from the same response — a two-fetch split could pair a quote with a different instance's key.
+ */
+export declare function collectTdxAndPubkey(urlTemplate: string, nonce: Uint8Array, quoteField: string, pubkeyField?: string): Promise<{
+    quote: Uint8Array;
+    pubkey?: string;
+}>;
+export declare function collectViaHttp(urlTemplate: string, nonce: Uint8Array, field: string): Promise<Uint8Array>;
+/**
+ * Like collectViaHttp, but it returns the extracted field re-encoded as JSON bytes instead of
+ * base64-decoding it. Why separate: the TDX path wants a lone base64 quote decoded to raw bytes;
+ * the GPU path's field holds a structured value (e.g. { arch, evidence_list }) whose shape must
+ * survive intact to the NRAS submit, so the code keeps it as JSON rather than decode it.
+ */
+export declare function collectJsonFieldViaHttp(urlTemplate: string, nonce: Uint8Array, field: string): Promise<Uint8Array>;
+//# sourceMappingURL=http.d.ts.map

package/dist/collect/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/collect/http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA+BH;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBjD;AAED,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAOrB"}