@antseed/antseed-verifier 0.1.0

package/dist/prover.js

@@ -0,0 +1,204 @@
+import './caps/index.js'; // side-effect: register the capability menu
+import { getCapability, listCapabilities } from './capability.js';
+import { evmAddressFromPrivateKey, signerFromPrivateKey } from './caps/seller-bound.js';
+import { NODE_TEE_CAP_ID, PROVIDER_TEE_CAP_ID, encodeTeeTdxEvidence, tdxConfigKey } from './caps/tee-tdx.js';
+import { GPU_CAP_ID, gpuConfigKey } from './caps/gpu-nvidia.js';
+import { claimsConfigKey } from './caps/provider-claims.js';
+import { loadAdapter } from './adapters/index.js';
+import { VERIFIER_ID, decodeAttestRequest, encodeAttestResponse, evidenceConfigKey, normalizePeerId, } from './shared.js';
+/**
+ * Seller half — embedded prover (type:'prover'). For each requested capability the seller
+ * supports (has a collector for, and whose collection succeeds), it produces evidence and
+ * builds a per-cap evidence map. It omits unsupported caps. Config alone handles provider
+ * differences (no provider specifics live here).
+ *
+ * Env config (the seller offers each provider cap only when the evidence URL and its field are
+ * set, all off the same route):
+ *   ANTSEED_TEE_PEER_ID                    this node's peer id (EVM address, no 0x) — required
+ *   ANTSEED_VERIFIER_NODE_TEE              seller-node-tee-genuine source: "configfs" (default), "dstack", or "http"
+ *   ANTSEED_VERIFIER_DSTACK_SOCKET         override the dstack guest-agent socket path (default /var/run/dstack.sock)
+ *   ANTSEED_VERIFIER_PROVIDER_ADAPTER      in-process provider adapter id (e.g. "chutes", "aci"); fetches provider evidence directly, no separate shim
+ *   ANTSEED_VERIFIER_PROVIDER_EVIDENCE_URL provider evidence route ({nonce} hex placeholder); offers seller-provider-tee-genuine via http (alternative to an adapter)
+ *   ANTSEED_VERIFIER_PROVIDER_TEE_FIELD    JSON field that holds the base64 provider quote (default "quote")
+ *   ANTSEED_VERIFIER_PROVIDER_GPU_FIELD    JSON field that holds the provider's GPU CC evidence; offers seller-provider-gpu-cc
+ *   ANTSEED_VERIFIER_PROVIDER_CLAIMS_FIELD JSON field that holds the provider's base64 claims document; offers seller-provider-claims
+ *   ANTSEED_VERIFIER_PROVIDER_BINDING_SCHEME       frozen report_data scheme the provider quote uses (e.g. "nonce-pubkey-sha256-v1"); buyer then verifies round binding
+ *   ANTSEED_VERIFIER_PROVIDER_BINDING_PUBKEY_FIELD JSON field that holds the provider's base64 E2E pubkey (the ingredient that scheme binds)
+ *   ANTSEED_VERIFIER_SIGNING_KEY           seller identity private key (hex) for seller-bound
+ */
+const PEER_ID_KEY = 'ANTSEED_TEE_PEER_ID';
+const SIGNING_KEY = 'ANTSEED_VERIFIER_SIGNING_KEY';
+const PROVIDER_ADAPTER = 'ANTSEED_VERIFIER_PROVIDER_ADAPTER';
+const NODE_TEE_SOURCE = 'ANTSEED_VERIFIER_NODE_TEE';
+const DSTACK_SOCKET = 'ANTSEED_VERIFIER_DSTACK_SOCKET';
+const PROVIDER_EVIDENCE_URL = 'ANTSEED_VERIFIER_PROVIDER_EVIDENCE_URL';
+const PROVIDER_TEE_FIELD = 'ANTSEED_VERIFIER_PROVIDER_TEE_FIELD';
+const PROVIDER_GPU_FIELD = 'ANTSEED_VERIFIER_PROVIDER_GPU_FIELD';
+const PROVIDER_CLAIMS_FIELD = 'ANTSEED_VERIFIER_PROVIDER_CLAIMS_FIELD';
+const PROVIDER_BINDING_SCHEME = 'ANTSEED_VERIFIER_PROVIDER_BINDING_SCHEME';
+const PROVIDER_BINDING_PUBKEY_FIELD = 'ANTSEED_VERIFIER_PROVIDER_BINDING_PUBKEY_FIELD';
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Provider adapter path: when ANTSEED_VERIFIER_PROVIDER_ADAPTER names an adapter, fetch the
+ * provider's evidence in-process (the adapter handles that provider's auth and response shape)
+ * and map it onto the provider caps, instead of the generic http evidence route. The evidence
+ * is also exposed as evidence:<capId> config so seller-bound binds it. A failure omits the
+ * provider caps, like an unconfigured http route.
+ */
+async function collectViaAdapter(nonce, caps, evidence, config) {
+    const id = process.env[PROVIDER_ADAPTER]?.trim();
+    if (!id)
+        return;
+    const put = (capId, bytes) => {
+        evidence[capId] = bytes;
+        config[evidenceConfigKey(capId)] = Buffer.from(bytes).toString('base64');
+    };
+    try {
+        const adapter = await loadAdapter(id);
+        const ev = await adapter.fetchEvidence(nonce, process.env);
+        if (caps.includes(PROVIDER_TEE_CAP_ID)) {
+            const binding = ev.bindingScheme ? { scheme: ev.bindingScheme, ingredients: ev.ingredients ?? {} } : undefined;
+            put(PROVIDER_TEE_CAP_ID, encodeTeeTdxEvidence(ev.quote, undefined, binding));
+        }
+        if (ev.gpuEvidence && caps.includes(GPU_CAP_ID)) {
+            put(GPU_CAP_ID, new TextEncoder().encode(JSON.stringify(ev.gpuEvidence)));
+        }
+    }
+    catch (err) {
+        process.stderr.write(`[${VERIFIER_ID}] provider adapter "${id}" not offered: ${msg(err)}\n`);
+    }
+}
+function json(statusCode, body) {
+    return {
+        statusCode,
+        headers: { 'content-type': 'application/json' },
+        body: new TextEncoder().encode(JSON.stringify(body)),
+    };
+}
+/**
+ * Generic, provider-neutral collector config, namespaced per TDX cap so the node cap and
+ * the provider cap never collide. The node cap defaults to a local configfs quote; the
+ * seller offers the provider cap (via http) only when a provider evidence URL is configured.
+ */
+function baseConfig() {
+    const cfg = {};
+    // seller-node-tee-genuine: mint the quote locally; default to configfs when unset.
+    cfg[tdxConfigKey(NODE_TEE_CAP_ID, 'source')] = process.env[NODE_TEE_SOURCE]?.trim() || 'configfs';
+    // Optional dstack guest-agent socket override (Phala CVMs); default locations are used when unset.
+    const dstackSocket = process.env[DSTACK_SOCKET]?.trim();
+    if (dstackSocket)
+        cfg[tdxConfigKey(NODE_TEE_CAP_ID, 'dstack.socket')] = dstackSocket;
+    // seller-provider-tee-genuine: offered only when a provider evidence route is configured.
+    const provUrl = process.env[PROVIDER_EVIDENCE_URL]?.trim();
+    if (provUrl) {
+        cfg[tdxConfigKey(PROVIDER_TEE_CAP_ID, 'source')] = 'http';
+        cfg[tdxConfigKey(PROVIDER_TEE_CAP_ID, 'url')] = provUrl;
+        cfg[tdxConfigKey(PROVIDER_TEE_CAP_ID, 'field')] = process.env[PROVIDER_TEE_FIELD]?.trim() || 'quote';
+        // Optional: declare the provider's frozen report_data scheme so the buyer verifies the
+        // provider quote is bound to this round and instance (e.g. Chutes' nonce-pubkey-sha256-v1).
+        const bindingScheme = process.env[PROVIDER_BINDING_SCHEME]?.trim();
+        if (bindingScheme) {
+            cfg[tdxConfigKey(PROVIDER_TEE_CAP_ID, 'binding.scheme')] = bindingScheme;
+            const pubkeyField = process.env[PROVIDER_BINDING_PUBKEY_FIELD]?.trim();
+            if (pubkeyField)
+                cfg[tdxConfigKey(PROVIDER_TEE_CAP_ID, 'binding.pubkeyField')] = pubkeyField;
+        }
+        // seller-provider-gpu-cc: same evidence route, offered only when a GPU field is named.
+        const gpuField = process.env[PROVIDER_GPU_FIELD]?.trim();
+        if (gpuField) {
+            cfg[gpuConfigKey('url')] = provUrl;
+            cfg[gpuConfigKey('field')] = gpuField;
+        }
+        // seller-provider-claims: same evidence route, offered only when a claims field is named.
+        const claimsField = process.env[PROVIDER_CLAIMS_FIELD]?.trim();
+        if (claimsField) {
+            cfg[claimsConfigKey('url')] = provUrl;
+            cfg[claimsConfigKey('field')] = claimsField;
+        }
+    }
+    return cfg;
+}
+/**
+ * A signer for seller-bound, built from the seller's private key. It returns undefined when
+ * no key is set (cap not offered) or the key's address does not match this node's peer id
+ * (a mismatch would only fail on the buyer, so the prover disables it and logs instead).
+ */
+function buildSigner(peerId) {
+    const key = process.env[SIGNING_KEY]?.trim();
+    if (!key)
+        return undefined;
+    try {
+        if (evmAddressFromPrivateKey(key) !== peerId) {
+            process.stderr.write(`[${VERIFIER_ID}] ${SIGNING_KEY} address != ${PEER_ID_KEY}; seller-bound disabled\n`);
+            return undefined;
+        }
+        return signerFromPrivateKey(key);
+    }
+    catch (err) {
+        process.stderr.write(`[${VERIFIER_ID}] invalid ${SIGNING_KEY}; seller-bound disabled: ${msg(err)}\n`);
+        return undefined;
+    }
+}
+const prover = {
+    type: 'prover',
+    name: VERIFIER_ID,
+    displayName: 'TEE attestation prover (capability-based)',
+    version: '0.1.0',
+    description: 'Produces per-capability seller attestation evidence (Intel TDX quote, seller-identity signature) for buyers to verify.',
+    async prove(req) {
+        const rawPeer = process.env[PEER_ID_KEY]?.trim();
+        if (!rawPeer) {
+            return json(500, {
+                error: { message: `${PEER_ID_KEY} is not set; the prover must know this node's peer id (EVM address)`, type: 'tee_error' },
+            });
+        }
+        let peerId;
+        try {
+            peerId = normalizePeerId(rawPeer);
+        }
+        catch (err) {
+            return json(500, { error: { message: msg(err), type: 'tee_error' } });
+        }
+        let nonce;
+        let caps;
+        try {
+            ;
+            ({ nonce, caps } = decodeAttestRequest(req.body ?? new Uint8Array()));
+        }
+        catch (err) {
+            return json(400, { error: { message: msg(err), type: 'invalid_request_error' } });
+        }
+        const config = baseConfig();
+        const sign = buildSigner(peerId);
+        const evidence = {};
+        // A selected provider adapter pre-fills the provider caps in-process, before the collect loop.
+        await collectViaAdapter(nonce, caps, evidence, config);
+        // Registry order guarantees a dependency (tee-tdx) is collected before its dependents.
+        for (const cap of listCapabilities()) {
+            if (!caps.includes(cap.id) || !cap.collect)
+                continue;
+            if (evidence[cap.id])
+                continue; // already provided by the adapter
+            try {
+                const bytes = await cap.collect({ nonce, peerId, config, sign });
+                evidence[cap.id] = bytes;
+                // Expose to later dependent collectors (seller-bound binds to the tee-tdx evidence).
+                config[evidenceConfigKey(cap.id)] = Buffer.from(bytes).toString('base64');
+            }
+            catch (err) {
+                // Unsupported by this seller's infra (or a dependency was missing) — omit the cap.
+                process.stderr.write(`[${VERIFIER_ID}] capability "${cap.id}" not offered: ${msg(err)}\n`);
+            }
+        }
+        // One-line collection summary, so the seller sees which caps produced evidence this round.
+        const collected = Object.keys(evidence);
+        const skipped = caps.filter((id) => !evidence[id] && getCapability(id)?.collect);
+        process.stderr.write(`[${VERIFIER_ID}] attest: collected [${collected.join(', ')}]`
+            + (skipped.length ? `; skipped [${skipped.join(', ')}]` : '') + '\n');
+        return { statusCode: 200, headers: { 'content-type': 'application/json' }, body: encodeAttestResponse(evidence) };
+    },
+};
+export default prover;
+//# sourceMappingURL=prover.js.map

package/dist/prover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prover.js","sourceRoot":"","sources":["../src/prover.ts"],"names":[],"mappings":"AACA,OAAO,iBAAiB,CAAA,CAAC,4CAA4C;AACrE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC5G,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,GAAG,qBAAqB,CAAA;AACzC,MAAM,WAAW,GAAG,8BAA8B,CAAA;AAClD,MAAM,gBAAgB,GAAG,mCAAmC,CAAA;AAC5D,MAAM,eAAe,GAAG,2BAA2B,CAAA;AACnD,MAAM,aAAa,GAAG,gCAAgC,CAAA;AACtD,MAAM,qBAAqB,GAAG,wCAAwC,CAAA;AACtE,MAAM,kBAAkB,GAAG,qCAAqC,CAAA;AAChE,MAAM,kBAAkB,GAAG,qCAAqC,CAAA;AAChE,MAAM,qBAAqB,GAAG,wCAAwC,CAAA;AACtE,MAAM,uBAAuB,GAAG,0CAA0C,CAAA;AAC1E,MAAM,6BAA6B,GAAG,gDAAgD,CAAA;AAEtF,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,iBAAiB,CAC9B,KAAiB,EACjB,IAAc,EACd,QAAoC,EACpC,MAA8B;IAE9B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAA;IAChD,IAAI,CAAC,EAAE;QAAE,OAAM;IACf,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAiB,EAAQ,EAAE;QACrD,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;QACvB,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1E,CAAC,CAAA;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAA;QACrC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YAC9G,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,EAAE,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,uBAAuB,EAAE,kBAAkB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC9F,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,UAAkB,EAAE,IAAa;IAC7C,OAAO;QACL,UAAU;QACV,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;KACrD,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU;IACjB,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,mFAAmF;IACnF,GAAG,CAAC,YAAY,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,UAAU,CAAA;IACjG,mGAAmG;IACnG,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAA;IACvD,IAAI,YAAY;QAAE,GAAG,CAAC,YAAY,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,GAAG,YAAY,CAAA;IACpF,0FAA0F;IAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC1D,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,YAAY,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAA;QACzD,GAAG,CAAC,YAAY,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAA;QACvD,GAAG,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAA;QACpG,uFAAuF;QACvF,4FAA4F;QAC5F,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAA;QAClE,IAAI,aAAa,EAAE,CAAC;YAClB,GAAG,CAAC,YAAY,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,GAAG,aAAa,CAAA;YACxE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,IAAI,EAAE,CAAA;YACtE,IAAI,WAAW;gBAAE,GAAG,CAAC,YAAY,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,GAAG,WAAW,CAAA;QAC9F,CAAC;QACD,uFAAuF;QACvF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAA;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAA;YAClC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAA;QACvC,CAAC;QACD,0FAA0F;QAC1F,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAA;QAC9D,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAA;YACrC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,WAAW,CAAA;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAA;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,IAAI,CAAC;QACH,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,KAAK,WAAW,eAAe,WAAW,2BAA2B,CAAC,CAAA;YAC1G,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,aAAa,WAAW,4BAA4B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrG,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAW;IACrB,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,2CAA2C;IACxD,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,wHAAwH;IAErI,KAAK,CAAC,KAAK,CAAC,GAAkB;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAA;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,EAAE;gBACf,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,WAAW,qEAAqE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC3H,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,MAAc,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACvE,CAAC;QAED,IAAI,KAAiB,CAAA;QACrB,IAAI,IAAc,CAAA;QAClB,IAAI,CAAC;YACH,CAAC;YAAA,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAA;QACnF,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;QAEhC,MAAM,QAAQ,GAA+B,EAAE,CAAA;QAC/C,+FAA+F;QAC/F,MAAM,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;QACtD,uFAAuF;QACvF,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO;gBAAE,SAAQ;YACpD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAQ,CAAC,kCAAkC;YACjE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;gBAChE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAA;gBACxB,qFAAqF;gBACrF,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC3E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mFAAmF;gBACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,WAAW,iBAAiB,GAAG,CAAC,EAAE,kBAAkB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC5F,CAAC;QACH,CAAC;QAED,2FAA2F;QAC3F,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;QAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,WAAW,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;cAC5D,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CACrE,CAAA;QAED,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAA;IACnH,CAAC;CACF,CAAA;AAED,eAAe,MAAM,CAAA"}

package/dist/report-data.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Compositional report_data schemes. A TDX quote has one 64-byte report_data; how a
+ * provider commits this round's freshness (and any TEE-bound key or payload) into it varies by
+ * hardware stack. The SDK verifies against a closed, version-pinned registry:
+ *
+ *   - antseed-rd-v1           the canonical, compositional scheme. The nonce is always bound;
+ *                             optional fields (peerId, e2ePubkey) are included only when their
+ *                             ingredient is present, in canonical tag order, each tagged and
+ *                             length-prefixed. One rule covers every combination — the node
+ *                             cap is the {peerId} case. A new field takes a new tag and version bump.
+ *   - nonce-pubkey-sha256-v1  a foreign construction (e.g. Chutes) the SDK does not control:
+ *                             report_data[0:32] = SHA-256(nonce_hex ‖ e2ePubkey_b64). The SDK
+ *                             replicates its exact bytes only to verify a quote it minted.
+ *
+ * The same build() runs on the prover (to mint report_data) and the buyer (to recompute and
+ * compare). Determinism is the safety property, and because the nonce is always bound, a
+ * mis-declared or downgraded field set can only fail, never falsely pass. This registry is
+ * frozen per SDK version; the trust registry pins the SDK, so prover and verifier agree.
+ */
+export interface BindingIngredients {
+    /** 40-hex EVM address — identity binding (the node cap's ingredient). */
+    peerId?: string;
+    /** base64 TEE-generated public key — E2E or signing providers. */
+    e2ePubkey?: string;
+    /** ACI workload keyset digest, "sha256:<64 hex>" — the ACI ingredient. */
+    keysetDigest?: string;
+}
+export interface ReportDataScheme {
+    id: string;
+    /** Leading report_data bytes this scheme commits (the rest may be provider-defined). */
+    compareLen: 32 | 64;
+    /** Build the report_data commitment (prover mints it; buyer recomputes it). */
+    build(nonce: Uint8Array, ing: BindingIngredients): Uint8Array;
+    /** The nonce a downstream GPU (NRAS) verifier must bind to under this scheme. */
+    gpuNonce(nonce: Uint8Array, ing: BindingIngredients): Uint8Array;
+}
+export declare const antseedRdV1: ReportDataScheme;
+export declare const noncePubkeySha256V1: ReportDataScheme;
+export declare const aciKeysetV1: ReportDataScheme;
+export declare const REPORT_DATA_SCHEMES: Record<string, ReportDataScheme>;
+export declare function getReportDataScheme(id: string): ReportDataScheme | undefined;
+/**
+ * Verify a quote's report_data against a frozen scheme. It returns null on a match, else a reason.
+ * It compares only the scheme's `compareLen` leading bytes (a provider may use the rest).
+ */
+export declare function verifyReportData(schemeId: string, reportData: Uint8Array, nonce: Uint8Array, ing: BindingIngredients): string | null;
+//# sourceMappingURL=report-data.d.ts.map

package/dist/report-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-data.d.ts","sourceRoot":"","sources":["../src/report-data.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,wFAAwF;IACxF,UAAU,EAAE,EAAE,GAAG,EAAE,CAAA;IACnB,+EAA+E;IAC/E,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,kBAAkB,GAAG,UAAU,CAAA;IAC7D,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,kBAAkB,GAAG,UAAU,CAAA;CACjE;AAqBD,eAAO,MAAM,WAAW,EAAE,gBAoBzB,CAAA;AAED,eAAO,MAAM,mBAAmB,EAAE,gBAmBjC,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,gBAmBzB,CAAA;AAED,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAIhE,CAAA;AAED,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAE5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,kBAAkB,GACtB,MAAM,GAAG,IAAI,CAcf"}

package/dist/report-data.js

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto';
+const RD_DOMAIN = 'antseed-rd-v1';
+/** Prefix a value with its 4-byte big-endian length, so concatenated values stay unambiguous. */
+function lenPrefixed(b) {
+    const len = Buffer.alloc(4);
+    len.writeUInt32BE(b.length, 0);
+    return Buffer.concat([len, b]);
+}
+/**
+ * Frozen field table for antseed-rd-v1. `tag` is the canonical ordering key and a per-field
+ * domain separator. To add a field, use a new tag and an SDK version bump; never reorder or
+ * reuse a tag.
+ */
+const FIELDS = [
+    { tag: 0x01, get: (i) => (i.peerId ? Buffer.from(i.peerId.toLowerCase(), 'hex') : null) },
+    { tag: 0x02, get: (i) => (i.e2ePubkey ? Buffer.from(i.e2ePubkey, 'base64') : null) },
+];
+export const antseedRdV1 = {
+    id: RD_DOMAIN,
+    compareLen: 64,
+    build(nonce, ing) {
+        // Unambiguous TLV: fixed domain tag, then every value length-prefixed (including the nonce)
+        // in fixed ascending field order, so no two distinct inputs share a preimage.
+        const h = createHash('sha512');
+        h.update(Buffer.from(RD_DOMAIN, 'utf8'));
+        h.update(lenPrefixed(Buffer.from(nonce)));
+        for (const f of FIELDS) {
+            const b = f.get(ing);
+            if (!b)
+                continue;
+            h.update(Buffer.from([f.tag]));
+            h.update(lenPrefixed(b));
+        }
+        return new Uint8Array(h.digest());
+    },
+    gpuNonce(nonce) {
+        return nonce; // the GPU evidence binds the raw round nonce
+    },
+};
+export const noncePubkeySha256V1 = {
+    id: 'nonce-pubkey-sha256-v1',
+    compareLen: 32,
+    build(nonce, ing) {
+        if (!ing.e2ePubkey)
+            throw new Error(`${this.id} requires e2ePubkey`);
+        const commit = createHash('sha256')
+            .update(Buffer.from(nonce).toString('hex'), 'utf8') // nonce as its hex string (their choice)
+            .update(ing.e2ePubkey, 'utf8') // pubkey as its base64 string (their choice)
+            .digest();
+        const rd = Buffer.alloc(64); // [0:32] = commitment, [32:64] provider-defined
+        commit.copy(rd, 0);
+        return new Uint8Array(rd);
+    },
+    gpuNonce(nonce, ing) {
+        // The GPU evidence's NRAS eat_nonce is this derived value, SHA-256(nonce_hex ‖ pubkey_b64) —
+        // the same commitment report_data[0:32] carries. (NRAS returns overall-att-result true only
+        // for this value, not the raw nonce.)
+        return this.build(nonce, ing).subarray(0, 32);
+    },
+};
+export const aciKeysetV1 = {
+    id: 'aci-keyset-v1',
+    compareLen: 32,
+    build(nonce, ing) {
+        // ACI report_data (private-ai-gateway digest.ts): SHA-256 of a fixed statement over the
+        // workload keyset digest and the nonce, which the TEE places zero-padded to 64 in the quote.
+        const digest = ing.keysetDigest;
+        if (!digest || !/^sha256:[0-9a-f]{64}$/.test(digest)) {
+            throw new Error(`${this.id} requires keysetDigest "sha256:<64 hex>"`);
+        }
+        if (nonce.length !== 32)
+            throw new Error(`${this.id} requires a 32-byte nonce`);
+        const statement = `{"keyset_digest":"${digest}","nonce":"${Buffer.from(nonce).toString('hex')}","purpose":"aci.report_data.v1"}`;
+        const rd = Buffer.alloc(64);
+        createHash('sha256').update(statement, 'utf8').digest().copy(rd, 0);
+        return new Uint8Array(rd);
+    },
+    gpuNonce(nonce) {
+        return nonce; // ACI treats GPU CC as supplemental; bind the raw round nonce
+    },
+};
+export const REPORT_DATA_SCHEMES = {
+    [antseedRdV1.id]: antseedRdV1,
+    [noncePubkeySha256V1.id]: noncePubkeySha256V1,
+    [aciKeysetV1.id]: aciKeysetV1,
+};
+export function getReportDataScheme(id) {
+    return REPORT_DATA_SCHEMES[id];
+}
+/**
+ * Verify a quote's report_data against a frozen scheme. It returns null on a match, else a reason.
+ * It compares only the scheme's `compareLen` leading bytes (a provider may use the rest).
+ */
+export function verifyReportData(schemeId, reportData, nonce, ing) {
+    const scheme = getReportDataScheme(schemeId);
+    if (!scheme)
+        return `unknown report_data scheme "${schemeId}" (not in this SDK's frozen registry)`;
+    let want;
+    try {
+        want = scheme.build(nonce, ing);
+    }
+    catch (err) {
+        return `report_data scheme "${schemeId}": ${err instanceof Error ? err.message : String(err)}`;
+    }
+    const n = scheme.compareLen;
+    if (reportData.length < n || !Buffer.from(reportData.subarray(0, n)).equals(Buffer.from(want.subarray(0, n)))) {
+        return `report_data does not match scheme "${schemeId}" for this nonce`;
+    }
+    return null;
+}
+//# sourceMappingURL=report-data.js.map

package/dist/report-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-data.js","sourceRoot":"","sources":["../src/report-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAyCxC,MAAM,SAAS,GAAG,eAAe,CAAA;AAEjC,iGAAiG;AACjG,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAqE;IAC/E,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;IACzF,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;CACrF,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAqB;IAC3C,EAAE,EAAE,SAAS;IACb,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,KAAK,EAAE,GAAG;QACd,4FAA4F;QAC5F,8EAA8E;QAC9E,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QAC9B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;QACxC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpB,IAAI,CAAC,CAAC;gBAAE,SAAQ;YAChB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAC9B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,QAAQ,CAAC,KAAK;QACZ,OAAO,KAAK,CAAA,CAAC,6CAA6C;IAC5D,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAqB;IACnD,EAAE,EAAE,wBAAwB;IAC5B,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,KAAK,EAAE,GAAG;QACd,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,qBAAqB,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,yCAAyC;aAC5F,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,6CAA6C;aAC3E,MAAM,EAAE,CAAA;QACX,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA,CAAC,gDAAgD;QAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QAClB,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAC3B,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,GAAG;QACjB,6FAA6F;QAC7F,4FAA4F;QAC5F,sCAAsC;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/C,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAqB;IAC3C,EAAE,EAAE,eAAe;IACnB,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,KAAK,EAAE,GAAG;QACd,wFAAwF;QACxF,6FAA6F;QAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAA;QAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,0CAA0C,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,2BAA2B,CAAC,CAAA;QAC/E,MAAM,SAAS,GAAG,qBAAqB,MAAM,cAAc,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,mCAAmC,CAAA;QAChI,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC3B,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACnE,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAC3B,CAAC;IACD,QAAQ,CAAC,KAAK;QACZ,OAAO,KAAK,CAAA,CAAC,8DAA8D;IAC7E,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAqC;IACnE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,WAAW;IAC7B,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,mBAAmB;IAC7C,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,WAAW;CAC9B,CAAA;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,OAAO,mBAAmB,CAAC,EAAE,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,UAAsB,EACtB,KAAiB,EACjB,GAAuB;IAEvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,+BAA+B,QAAQ,uCAAuC,CAAA;IAClG,IAAI,IAAgB,CAAA;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,uBAAuB,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;IAChG,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAA;IAC3B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,OAAO,sCAAsC,QAAQ,kBAAkB,CAAA;IACzE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/shared.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Shared constants and wire codecs used by both halves of the SDK (buyer verifier
+ * and seller prover). The single source of truth for the attestation request and
+ * response shape and the seller-bound preimage, so both sides agree byte-for-byte.
+ */
+/**
+ * The advertised and pinned verifier id (also the seller-side prover's name).
+ * Hyphenated — no '@' or '/' — so capability strings satisfy PEER_CAPABILITY_PATTERN.
+ */
+export declare const VERIFIER_ID = "antseed-verifier";
+/**
+ * A claim id is the verifier id namespaced by the capability id, e.g.
+ * 'antseed-verifier:seller-node-tee-genuine'. One claim per capability.
+ */
+export declare function claimId(capId: string): string;
+/**
+ * Reserved control-plane path the buyer's verifier reaches the seller's prover at.
+ * The prefix must match @antseed/node's ANTSEED_ATTEST_PATH; the seller dispatches it
+ * (before provider or service matching) to the prover whose name === VERIFIER_ID.
+ */
+export declare const ATTEST_PATH = "/_antseed/attest/antseed-verifier";
+/** Freshness nonce length, in bytes. */
+export declare const NONCE_BYTES = 32;
+/**
+ * A PeerId is the canonical AntSeed identifier: 40 lowercase hex chars (the peer's
+ * EVM address, no 0x prefix). Lowercase and validate it, so bindings are symmetric on
+ * both sides regardless of input casing.
+ */
+export declare function normalizePeerId(peerId: string): string;
+/**
+ * The seller node's report_data binding: the {peerId} instance of the compositional scheme
+ * `antseed-rd-v1` (see report-data.ts). The configfs collector mints exactly this, so the
+ * buyer's node cap recomputes and enforces the same bytes.
+ */
+export declare function computeReportData(nonce: Uint8Array, peerId: string): Buffer;
+/**
+ * Canonical digest over the whole attestation bundle — every cap's evidence entry
+ * except seller-bound's own signature (it cannot sign over itself). A sort by cap id
+ * makes both halves agree regardless of map iteration order. Length-prefixing both the id
+ * and the bytes (len(id) ‖ id ‖ len(bytes) ‖ bytes) keeps the concatenation unambiguous, so
+ * no cap can shift bytes across an entry boundary. One seller signature therefore covers
+ * the node quote and the provider quote (and any later caps) together.
+ */
+export declare function bundleDigest(evidence: Record<string, Uint8Array>): Uint8Array;
+/**
+ * seller-bound preimage — the 32-byte digest the seller signs with its AntSeed
+ * identity key:
+ *
+ *   keccak256( nonce(32) || bundleDigest(32) || utf8(peerId) )
+ *
+ * It binds the seller's identity signature to the entire bundle (via bundleDigest), this
+ * nonce (freshness), and this peer id (identity), so nobody can pair a seller's signature
+ * with different evidence or replay it. Defined here so both halves compute identical bytes.
+ */
+export declare function sellerBoundPreimage(nonce: Uint8Array, digest: Uint8Array, peerId: string): Uint8Array;
+/**
+ * Config key under which a prover exposes an already-collected capability's evidence
+ * (base64) to later collectors in the same request. It lets a dependent capability
+ * (seller-bound) read the whole bundle it must bind to, without provider specifics.
+ */
+export declare function evidenceConfigKey(capId: string): string;
+/** Inverse of evidenceConfigKey: the cap id an "evidence:<capId>" config key carries, else undefined. */
+export declare function parseEvidenceConfigKey(key: string): string | undefined;
+/** Body the buyer sends to the prover: a fresh nonce and the menu of caps it wants. */
+export interface AttestRequestBody {
+    /** base64 of the 32-byte freshness nonce. */
+    nonce: string;
+    /** capability ids the buyer is asking the seller to attest. */
+    caps: string[];
+}
+/** Body the seller's prover returns: per-capability evidence (a cap may have none). */
+export interface AttestResponseBody {
+    /** capId -> base64 of that capability's opaque evidence bytes. */
+    evidence: Record<string, string>;
+}
+export declare function encodeAttestRequest(nonce: Uint8Array, caps: string[]): Uint8Array;
+/**
+ * Upper bound on an attestation request or response body before JSON.parse. Both halves
+ * parse counterparty-controlled bytes (the prover reads buyer requests; the buyer reads
+ * seller responses), so a hostile peer must not be able to force an unbounded parse.
+ */
+export declare const MAX_ATTEST_BODY_BYTES: number;
+export declare function decodeAttestRequest(body: Uint8Array): {
+    nonce: Uint8Array;
+    caps: string[];
+};
+export declare function encodeAttestResponse(evidence: Record<string, Uint8Array>): Uint8Array;
+export declare function decodeAttestResponse(body: Uint8Array): Record<string, Uint8Array>;
+//# sourceMappingURL=shared.d.ts.map

package/dist/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AAEH;;;GAGG;AACH,eAAO,MAAM,WAAW,qBAAqB,CAAA;AAE7C;;;GAGG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;;GAIG;AACH,eAAO,MAAM,WAAW,sCAAoC,CAAA;AAE5D,wCAAwC;AACxC,eAAO,MAAM,WAAW,KAAK,CAAA;AAE7B;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,UAAU,CAa7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAOrG;AAKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtE;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAA;IACb,+DAA+D;IAC/D,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAGjF;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAAa,CAAA;AAQ/C,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAc3F;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,UAAU,CAOrF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAcjF"}

package/dist/shared.js

@@ -0,0 +1,158 @@
+import { createHash } from 'node:crypto';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { antseedRdV1 } from './report-data.js';
+/**
+ * Shared constants and wire codecs used by both halves of the SDK (buyer verifier
+ * and seller prover). The single source of truth for the attestation request and
+ * response shape and the seller-bound preimage, so both sides agree byte-for-byte.
+ */
+/**
+ * The advertised and pinned verifier id (also the seller-side prover's name).
+ * Hyphenated — no '@' or '/' — so capability strings satisfy PEER_CAPABILITY_PATTERN.
+ */
+export const VERIFIER_ID = 'antseed-verifier';
+/**
+ * A claim id is the verifier id namespaced by the capability id, e.g.
+ * 'antseed-verifier:seller-node-tee-genuine'. One claim per capability.
+ */
+export function claimId(capId) {
+    return `${VERIFIER_ID}:${capId}`;
+}
+/**
+ * Reserved control-plane path the buyer's verifier reaches the seller's prover at.
+ * The prefix must match @antseed/node's ANTSEED_ATTEST_PATH; the seller dispatches it
+ * (before provider or service matching) to the prover whose name === VERIFIER_ID.
+ */
+export const ATTEST_PATH = `/_antseed/attest/${VERIFIER_ID}`;
+/** Freshness nonce length, in bytes. */
+export const NONCE_BYTES = 32;
+/**
+ * A PeerId is the canonical AntSeed identifier: 40 lowercase hex chars (the peer's
+ * EVM address, no 0x prefix). Lowercase and validate it, so bindings are symmetric on
+ * both sides regardless of input casing.
+ */
+export function normalizePeerId(peerId) {
+    const p = peerId.trim().toLowerCase();
+    if (!/^[0-9a-f]{40}$/.test(p)) {
+        throw new Error(`invalid peerId: expected 40 hex chars (EVM address, no 0x), got "${peerId.slice(0, 16)}..."`);
+    }
+    return p;
+}
+/**
+ * The seller node's report_data binding: the {peerId} instance of the compositional scheme
+ * `antseed-rd-v1` (see report-data.ts). The configfs collector mints exactly this, so the
+ * buyer's node cap recomputes and enforces the same bytes.
+ */
+export function computeReportData(nonce, peerId) {
+    return Buffer.from(antseedRdV1.build(nonce, { peerId: normalizePeerId(peerId) }));
+}
+/** The dependent capability whose own evidence is excluded from the bundle it signs over. */
+const SELLER_BOUND_CAP_ID = 'seller-bound';
+/**
+ * Canonical digest over the whole attestation bundle — every cap's evidence entry
+ * except seller-bound's own signature (it cannot sign over itself). A sort by cap id
+ * makes both halves agree regardless of map iteration order. Length-prefixing both the id
+ * and the bytes (len(id) ‖ id ‖ len(bytes) ‖ bytes) keeps the concatenation unambiguous, so
+ * no cap can shift bytes across an entry boundary. One seller signature therefore covers
+ * the node quote and the provider quote (and any later caps) together.
+ */
+export function bundleDigest(evidence) {
+    const ids = Object.keys(evidence).filter((id) => id !== SELLER_BOUND_CAP_ID).sort();
+    const h = createHash('sha256');
+    const u32 = (n) => { const b = Buffer.alloc(4); b.writeUInt32BE(n, 0); return b; };
+    for (const id of ids) {
+        const bytes = evidence[id];
+        const idBuf = Buffer.from(id, 'utf8');
+        h.update(u32(idBuf.length));
+        h.update(idBuf);
+        h.update(u32(bytes.length));
+        h.update(Buffer.from(bytes));
+    }
+    return new Uint8Array(h.digest());
+}
+/**
+ * seller-bound preimage — the 32-byte digest the seller signs with its AntSeed
+ * identity key:
+ *
+ *   keccak256( nonce(32) || bundleDigest(32) || utf8(peerId) )
+ *
+ * It binds the seller's identity signature to the entire bundle (via bundleDigest), this
+ * nonce (freshness), and this peer id (identity), so nobody can pair a seller's signature
+ * with different evidence or replay it. Defined here so both halves compute identical bytes.
+ */
+export function sellerBoundPreimage(nonce, digest, peerId) {
+    const pid = new TextEncoder().encode(normalizePeerId(peerId));
+    const preimage = new Uint8Array(nonce.length + digest.length + pid.length);
+    preimage.set(nonce, 0);
+    preimage.set(digest, nonce.length);
+    preimage.set(pid, nonce.length + digest.length);
+    return keccak_256(preimage);
+}
+/** Prefix of the config keys under which a prover exposes collected evidence to later collectors. */
+const EVIDENCE_KEY_PREFIX = 'evidence:';
+/**
+ * Config key under which a prover exposes an already-collected capability's evidence
+ * (base64) to later collectors in the same request. It lets a dependent capability
+ * (seller-bound) read the whole bundle it must bind to, without provider specifics.
+ */
+export function evidenceConfigKey(capId) {
+    return `${EVIDENCE_KEY_PREFIX}${capId}`;
+}
+/** Inverse of evidenceConfigKey: the cap id an "evidence:<capId>" config key carries, else undefined. */
+export function parseEvidenceConfigKey(key) {
+    return key.startsWith(EVIDENCE_KEY_PREFIX) ? key.slice(EVIDENCE_KEY_PREFIX.length) : undefined;
+}
+export function encodeAttestRequest(nonce, caps) {
+    const body = { nonce: Buffer.from(nonce).toString('base64'), caps };
+    return new TextEncoder().encode(JSON.stringify(body));
+}
+/**
+ * Upper bound on an attestation request or response body before JSON.parse. Both halves
+ * parse counterparty-controlled bytes (the prover reads buyer requests; the buyer reads
+ * seller responses), so a hostile peer must not be able to force an unbounded parse.
+ */
+export const MAX_ATTEST_BODY_BYTES = 512 * 1024;
+function assertBodySize(body, what) {
+    if (body.length > MAX_ATTEST_BODY_BYTES) {
+        throw new Error(`${what} exceeds ${MAX_ATTEST_BODY_BYTES} bytes (${body.length})`);
+    }
+}
+export function decodeAttestRequest(body) {
+    assertBodySize(body, 'attestation request');
+    const parsed = JSON.parse(new TextDecoder().decode(body));
+    if (typeof parsed.nonce !== 'string' || parsed.nonce.length === 0) {
+        throw new Error('attestation request missing "nonce"');
+    }
+    const nonce = Buffer.from(parsed.nonce, 'base64');
+    if (nonce.length !== NONCE_BYTES) {
+        throw new Error(`attestation nonce must be ${NONCE_BYTES} bytes, got ${nonce.length}`);
+    }
+    if (!Array.isArray(parsed.caps) || !parsed.caps.every((c) => typeof c === 'string')) {
+        throw new Error('attestation request missing "caps" (string[])');
+    }
+    return { nonce, caps: parsed.caps };
+}
+export function encodeAttestResponse(evidence) {
+    const enc = {};
+    for (const [capId, bytes] of Object.entries(evidence)) {
+        enc[capId] = Buffer.from(bytes).toString('base64');
+    }
+    const body = { evidence: enc };
+    return new TextEncoder().encode(JSON.stringify(body));
+}
+export function decodeAttestResponse(body) {
+    assertBodySize(body, 'attestation response');
+    const parsed = JSON.parse(new TextDecoder().decode(body));
+    if (parsed.evidence === null || typeof parsed.evidence !== 'object') {
+        throw new Error('attestation response missing "evidence" object');
+    }
+    const out = {};
+    for (const [capId, b64] of Object.entries(parsed.evidence)) {
+        if (typeof b64 !== 'string') {
+            throw new Error(`attestation evidence for "${capId}" is not base64`);
+        }
+        out[capId] = new Uint8Array(Buffer.from(b64, 'base64'));
+    }
+    return out;
+}
+//# sourceMappingURL=shared.js.map