@antseed/antseed-verifier 0.1.0

package/dist/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../src/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAA;AAE7C;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,GAAG,WAAW,IAAI,KAAK,EAAE,CAAA;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,WAAW,EAAE,CAAA;AAE5D,wCAAwC;AACxC,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAA;AAE7B;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oEAAoE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;IAChH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAiB,EAAE,MAAc;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,6FAA6F;AAC7F,MAAM,mBAAmB,GAAG,cAAc,CAAA;AAE1C;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,QAAoC;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAA;IACnF,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC9B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA,CAAC,CAAC,CAAA;IACjG,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAiB,EAAE,MAAkB,EAAE,MAAc;IACvF,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1E,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAA;AAC7B,CAAC;AAED,qGAAqG;AACrG,MAAM,mBAAmB,GAAG,WAAW,CAAA;AAEvC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,GAAG,mBAAmB,GAAG,KAAK,EAAE,CAAA;AACzC,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,OAAO,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAChG,CAAC;AAgBD,MAAM,UAAU,mBAAmB,CAAC,KAAiB,EAAE,IAAc;IACnE,MAAM,IAAI,GAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAA;IACtF,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAA;AAE/C,SAAS,cAAc,CAAC,IAAgB,EAAE,IAAY;IACpD,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,qBAAqB,WAAW,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;IACpF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,cAAc,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAA+B,CAAA;IACvF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,WAAW,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAoC;IACvE,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,GAAuB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAA;IAClD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAgB;IACnD,cAAc,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAgC,CAAA;IACxF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,GAAG,GAA+B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,iBAAiB,CAAC,CAAA;QACtE,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/verifier.d.ts

@@ -0,0 +1,21 @@
+import type { AntseedVerifierPlugin, VerifyContext, VerifyResult } from './antseed-node-types.js';
+import './caps/index.js';
+import { type VerifyQuoteFn } from './caps/tee-tdx.js';
+import type { MeasuredImagePolicy } from './caps/measured-image.js';
+/**
+ * Buyer's required-cap set. Reads ANTSEED_VERIFIER_REQUIRED_CAPS (comma-separated), else the
+ * default. An unknown or absent required cap never has a passing claim, so ok fails closed.
+ */
+export declare function readRequiredCaps(): string[];
+/**
+ * Buyer measured-image policy: the approved-measurement allow-list, read from
+ * ANTSEED_VERIFIER_MEASURED_IMAGE_POLICY — inline JSON, or "@/path/to/policy.json". Without it,
+ * measured-image reports ok:false ("no approved measurement set configured"). A parse failure
+ * disables the policy instead of throwing the whole verification round.
+ */
+export declare function readMeasuredImagePolicy(): MeasuredImagePolicy | undefined;
+/** Core orchestration; the DCAP check is injectable for testing. */
+export declare function runVerify(ctx: VerifyContext, verifyQuote?: VerifyQuoteFn): Promise<VerifyResult>;
+declare const verifierPlugin: AntseedVerifierPlugin;
+export default verifierPlugin;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAe,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAC9G,OAAO,iBAAiB,CAAA;AAExB,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAgCnE;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAI3C;AAiBD;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,mBAAmB,GAAG,SAAS,CAUzE;AAOD,oEAAoE;AACpE,wBAAsB,SAAS,CAC7B,GAAG,EAAE,aAAa,EAClB,WAAW,GAAE,aAAkC,GAC9C,OAAO,CAAC,YAAY,CAAC,CAiEvB;AAED,QAAA,MAAM,cAAc,EAAE,qBAQrB,CAAA;AAED,eAAe,cAAc,CAAA"}

package/dist/verifier.js

@@ -0,0 +1,149 @@
+import { randomBytes } from 'node:crypto';
+import './caps/index.js'; // side-effect: register the capability menu
+import { capabilityIds, getCapability } from './capability.js';
+import { NODE_TEE_CAP_ID, PROVIDER_TEE_CAP_ID, defaultVerifyQuote, verifyTdxEvidence, } from './caps/tee-tdx.js';
+import { PROVIDER_CLAIMS_CAP_ID } from './caps/provider-claims.js';
+import { readFileSync } from 'node:fs';
+import { NONCE_BYTES, VERIFIER_ID, claimId, decodeAttestResponse, encodeAttestRequest, normalizePeerId, } from './shared.js';
+/**
+ * Buyer half. It fetches per-capability evidence from the seller in one attestation round,
+ * verifies each requested capability, and returns one ClaimResult per capability. The
+ * overall verdict passes only when every required capability passed; extra caps the seller
+ * evidenced are reported as informational claims.
+ */
+/** measured-image derives from (targets) the provider quote; it has no own evidence. */
+const MEASURED_IMAGE_ID = 'seller-provider-measured-image';
+const SELLER_BOUND_ID = 'seller-bound';
+/**
+ * The caps that must pass for ok=true. It defaults to the seller node's genuine TDX hardware
+ * and the seller-identity binding (the provider TEE, measured-image, and gpu are then
+ * informational). A buyer can override the set via ANTSEED_VERIFIER_REQUIRED_CAPS
+ * (comma-separated cap ids) to gate on a different guarantee — e.g. a provenance-focused
+ * buyer that requires the downstream provider's TEE: "seller-provider-tee-genuine,seller-bound".
+ * Note: requiring the provider TEE proves genuine, round-bound provider hardware, not that
+ * the seller node kept the buyer's data private (a non-TEE seller node still sees plaintext).
+ */
+const DEFAULT_REQUIRED_CAPS = [NODE_TEE_CAP_ID, SELLER_BOUND_ID];
+/**
+ * Buyer's required-cap set. Reads ANTSEED_VERIFIER_REQUIRED_CAPS (comma-separated), else the
+ * default. An unknown or absent required cap never has a passing claim, so ok fails closed.
+ */
+export function readRequiredCaps() {
+    const ids = (process.env['ANTSEED_VERIFIER_REQUIRED_CAPS'] ?? '')
+        .split(',').map((s) => s.trim()).filter(Boolean);
+    return ids.length > 0 ? ids : DEFAULT_REQUIRED_CAPS;
+}
+/** The TDX caps whose own evidence is DCAP-verified independently into a per-cap parse. */
+const TDX_CAP_IDS = [NODE_TEE_CAP_ID, PROVIDER_TEE_CAP_ID];
+/** Derived cap (no own evidence): always worth reporting; verifies the provider quote. */
+const DERIVED_CAPS = [MEASURED_IMAGE_ID];
+/** Which TDX parse each cap's verify consumes (TDX caps read their own; provider-derived caps the provider's). */
+const PARSE_SOURCE = {
+    [NODE_TEE_CAP_ID]: NODE_TEE_CAP_ID,
+    [PROVIDER_TEE_CAP_ID]: PROVIDER_TEE_CAP_ID,
+    [MEASURED_IMAGE_ID]: PROVIDER_TEE_CAP_ID,
+    [PROVIDER_CLAIMS_CAP_ID]: PROVIDER_TEE_CAP_ID,
+};
+function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Buyer measured-image policy: the approved-measurement allow-list, read from
+ * ANTSEED_VERIFIER_MEASURED_IMAGE_POLICY — inline JSON, or "@/path/to/policy.json". Without it,
+ * measured-image reports ok:false ("no approved measurement set configured"). A parse failure
+ * disables the policy instead of throwing the whole verification round.
+ */
+export function readMeasuredImagePolicy() {
+    const raw = process.env['ANTSEED_VERIFIER_MEASURED_IMAGE_POLICY']?.trim();
+    if (!raw)
+        return undefined;
+    try {
+        const json = raw.startsWith('@') ? readFileSync(raw.slice(1), 'utf8') : raw;
+        return JSON.parse(json);
+    }
+    catch (err) {
+        process.stderr.write(`[verifier] ignoring ANTSEED_VERIFIER_MEASURED_IMAGE_POLICY: ${msg(err)}\n`);
+        return undefined;
+    }
+}
+/** When no evidence is available, fail every required cap with the same reason. */
+function failAll(detail, requiredCaps) {
+    return { ok: false, claims: requiredCaps.map((id) => ({ claim: claimId(id), ok: false, detail })) };
+}
+/** Core orchestration; the DCAP check is injectable for testing. */
+export async function runVerify(ctx, verifyQuote = defaultVerifyQuote) {
+    const requiredCaps = readRequiredCaps();
+    let peerId;
+    try {
+        peerId = normalizePeerId(ctx.peerId);
+    }
+    catch (err) {
+        return failAll(msg(err), requiredCaps);
+    }
+    const nonce = randomBytes(NONCE_BYTES);
+    // Offer the whole menu; the seller returns evidence only for the caps its infra supports.
+    const requested = capabilityIds();
+    let resp;
+    try {
+        resp = await ctx.fetchFromSeller({
+            method: 'POST',
+            path: ctx.attestPath,
+            headers: { 'content-type': 'application/json' },
+            body: encodeAttestRequest(nonce, requested),
+        });
+    }
+    catch (err) {
+        return failAll(`attestation request failed: ${msg(err)}`, requiredCaps);
+    }
+    if (resp.statusCode !== 200) {
+        return failAll(`attestation service returned HTTP ${resp.statusCode}`, requiredCaps);
+    }
+    let evidence;
+    try {
+        evidence = decodeAttestResponse(resp.body);
+    }
+    catch (err) {
+        return failAll(`malformed attestation response: ${msg(err)}`, requiredCaps);
+    }
+    // DCAP-verify each TDX cap's own evidence independently; share each parse with its dependents.
+    const now = Math.floor(Date.now() / 1000);
+    const parsedByCap = new Map();
+    for (const id of TDX_CAP_IDS) {
+        const ev = evidence[id];
+        if (ev)
+            parsedByCap.set(id, await verifyTdxEvidence(ev, verifyQuote, now));
+    }
+    // Verify the required caps, any cap the seller returned evidence for, and derived caps.
+    const wanted = new Set([...requiredCaps, ...Object.keys(evidence), ...DERIVED_CAPS]);
+    const measuredImagePolicy = readMeasuredImagePolicy();
+    const claims = [];
+    for (const capId of capabilityIds()) {
+        if (!wanted.has(capId))
+            continue;
+        const cap = getCapability(capId);
+        if (!cap)
+            continue;
+        const source = PARSE_SOURCE[capId];
+        const parsed = source ? parsedByCap.get(source) : undefined;
+        const policy = capId === MEASURED_IMAGE_ID ? measuredImagePolicy : undefined;
+        try {
+            const out = await cap.verify({ nonce, peerId, evidence: evidence[capId], parsedQuote: parsed, evidenceBundle: evidence, policy });
+            claims.push(...(Array.isArray(out) ? out : [out]));
+        }
+        catch (err) {
+            claims.push({ claim: claimId(capId), ok: false, detail: `verify threw: ${msg(err)}` });
+        }
+    }
+    const ok = requiredCaps.every((id) => claims.some((c) => c.claim === claimId(id) && c.ok));
+    return { ok, claims };
+}
+const verifierPlugin = {
+    type: 'verifier',
+    name: VERIFIER_ID,
+    displayName: 'TEE attestation verifier (Intel TDX / DCAP)',
+    version: '0.1.0',
+    description: 'Capability-based seller attestation: one claim per capability. Requires the seller node\'s genuine Intel TDX hardware (seller-node-tee-genuine) and a seller-identity binding over the whole bundle (seller-bound); also reports the provider TEE (seller-provider-tee-genuine), measured-image and gpu-cc when available.',
+    verify: (ctx) => runVerify(ctx),
+};
+export default verifierPlugin;
+//# sourceMappingURL=verifier.js.map

package/dist/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,iBAAiB,CAAA,CAAC,4CAA4C;AACrE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EACL,WAAW,EACX,WAAW,EACX,OAAO,EACP,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,GAChB,MAAM,aAAa,CAAA;AAEpB;;;;;GAKG;AAEH,wFAAwF;AACxF,MAAM,iBAAiB,GAAG,gCAAgC,CAAA;AAC1D,MAAM,eAAe,GAAG,cAAc,CAAA;AAEtC;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAG,CAAC,eAAe,EAAE,eAAe,CAAC,CAAA;AAEhE;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC;SAC9D,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAClD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAA;AACrD,CAAC;AACD,2FAA2F;AAC3F,MAAM,WAAW,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;AAC1D,0FAA0F;AAC1F,MAAM,YAAY,GAAG,CAAC,iBAAiB,CAAC,CAAA;AACxC,kHAAkH;AAClH,MAAM,YAAY,GAA2B;IAC3C,CAAC,eAAe,CAAC,EAAE,eAAe;IAClC,CAAC,mBAAmB,CAAC,EAAE,mBAAmB;IAC1C,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IACxC,CAAC,sBAAsB,CAAC,EAAE,mBAAmB;CAC9C,CAAA;AAED,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,EAAE,IAAI,EAAE,CAAA;IACzE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QAC3E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAA;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjG,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CAAC,MAAc,EAAE,YAAsB;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAA;AACrG,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAkB,EAClB,cAA6B,kBAAkB;IAE/C,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAA;IACvC,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;IACtC,0FAA0F;IAC1F,MAAM,SAAS,GAAG,aAAa,EAAE,CAAA;IAEjC,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC;YAC/B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,CAAC,UAAU;YACpB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC;SAC5C,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,+BAA+B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;IACzE,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,qCAAqC,IAAI,CAAC,UAAU,EAAE,EAAE,YAAY,CAAC,CAAA;IACtF,CAAC;IAED,IAAI,QAAoC,CAAA;IACxC,IAAI,CAAC;QACH,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,mCAAmC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;IAC7E,CAAC;IAED,+FAA+F;IAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAA;IACrD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACvB,IAAI,EAAE;YAAE,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,iBAAiB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5E,CAAC;IAED,wFAAwF;IACxF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,CAAA;IACpF,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAA;IACrD,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QAChC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,CAAC,GAAG;YAAE,SAAQ;QAClB,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC3D,MAAM,MAAM,GAAG,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;YACjI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QACxF,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1F,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,cAAc,GAA0B;IAC5C,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,6CAA6C;IAC1D,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,4TAA4T;IAC9T,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC;CAChC,CAAA;AAED,eAAe,cAAc,CAAA"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@antseed/antseed-verifier",
+  "version": "0.1.0",
+  "description": "AntSeed capability-based attestation SDK: buyer verifier + seller prover. A menu of independent seller capabilities (seller-node-tee-genuine, seller-provider-tee-genuine, seller-bound, seller-provider-measured-image, seller-provider-gpu-cc), one claim each.",
+  "license": "GPL-3.0-only",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "LICENSE"
+  ],
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "engines": {
+    "node": ">=20.19.0"
+  },
+  "dependencies": {
+    "@noble/curves": "^2.2.0",
+    "@noble/hashes": "^2.2.0",
+    "@phala/dcap-qvl": "^0.5.2",
+    "jose": "^6.2.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.0",
+    "typescript": "^5.5.0",
+    "vitest": "^2.0.0"
+  },
+  "scripts": {
+    "prebuild": "node ../../scripts/remove-paths.mjs dist",
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}