@antseed/cli 0.1.158 → 0.1.159

package/dist/proxy/tee-control.js

@@ -0,0 +1,100 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { teeControlFileName } from '@antseed/node/tee-status';
+export class TeeControl {
+    sessionId;
+    token = randomBytes(32).toString('hex');
+    file;
+    ready = false;
+    lastCheck = 0;
+    constructor(sessionId) {
+        this.sessionId = sessionId;
+    }
+    async publish(directory, port) {
+        await mkdir(directory, { recursive: true });
+        this.file = join(directory, teeControlFileName(port));
+        const temporary = `${this.file}.${this.sessionId}.tmp`;
+        try {
+            await writeFile(temporary, JSON.stringify({ token: this.token, sessionId: this.sessionId, port }), { mode: 0o600, flag: 'wx' });
+            await chmod(temporary, 0o600);
+            await rename(temporary, this.file);
+            this.ready = true;
+        }
+        finally {
+            await unlink(temporary).catch(() => { });
+        }
+    }
+    async close() {
+        this.ready = false;
+        if (!this.file)
+            return;
+        try {
+            const current = JSON.parse(await readFile(this.file, 'utf8'));
+            if (current.sessionId === this.sessionId)
+                await unlink(this.file);
+        }
+        catch { }
+    }
+    async handle(req, res, method, path, snapshot, check) {
+        const reply = (status, body) => {
+            res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+            res.end(JSON.stringify(body));
+        };
+        const supplied = req.headers.authorization ?? '';
+        const expected = `Bearer ${this.token}`;
+        const remote = req.socket.remoteAddress;
+        if (!this.ready || req.headers.origin !== undefined
+            || !['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(remote ?? '')
+            || Buffer.byteLength(supplied) !== Buffer.byteLength(expected)
+            || !timingSafeEqual(Buffer.from(supplied), Buffer.from(expected))) {
+            reply(403, { error: 'Local verification authorization required' });
+            return;
+        }
+        if (method === 'GET' && path === '/_antseed/verification') {
+            reply(200, snapshot());
+            return;
+        }
+        if (method !== 'POST' || path !== '/_antseed/verification/check') {
+            reply(404, { error: 'Unknown verification endpoint' });
+            return;
+        }
+        if (Date.now() - this.lastCheck < 1000) {
+            reply(429, { error: 'Wait before checking another seller' });
+            return;
+        }
+        this.lastCheck = Date.now();
+        try {
+            const chunks = [];
+            let size = 0;
+            const timer = setTimeout(() => req.destroy(), 5000);
+            try {
+                for await (const chunk of req) {
+                    const bytes = Buffer.from(chunk);
+                    size += bytes.length;
+                    if (size > 1024) {
+                        reply(413, { error: 'Request too large' });
+                        return;
+                    }
+                    chunks.push(bytes);
+                }
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            if (!body || typeof body !== 'object' || Array.isArray(body)
+                || Object.keys(body).length !== 1 || !('peerId' in body)
+                || typeof body.peerId !== 'string' || !/^(?:0x)?[a-f0-9]{40}$/i.test(body.peerId)) {
+                reply(400, { error: 'A known seller peerId is required' });
+                return;
+            }
+            await check(body.peerId);
+            reply(200, snapshot());
+        }
+        catch (error) {
+            reply(400, { error: error instanceof Error ? error.message : 'Verification unavailable' });
+        }
+    }
+}
+//# sourceMappingURL=tee-control.js.map

package/dist/proxy/tee-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-control.js","sourceRoot":"","sources":["../../src/proxy/tee-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,kBAAkB,EAAoB,MAAM,0BAA0B,CAAA;AAE/E,MAAM,OAAO,UAAU;IAMQ;IALZ,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAChD,IAAI,CAAoB;IACxB,KAAK,GAAG,KAAK,CAAA;IACb,SAAS,GAAG,CAAC,CAAA;IAErB,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAElD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,IAAY;QAC3C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,MAAM,CAAA;QACtD,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC/H,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC7B,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;QACnB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAM;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAA2B,CAAA;YACvF,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;gBAAE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAc,EAAE,IAAY,EAClF,QAA2B,EAAE,KAAwC;QACrE,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,IAAa,EAAQ,EAAE;YACpD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;YAC1F,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/B,CAAC,CAAA;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;QAChD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAA;QACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;eAC9C,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;eAChE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;eAC3D,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpE,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAA;YAClE,OAAM;QACR,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YAC1D,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,8BAA8B,EAAE,CAAC;YACjE,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAA;YACtD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;YACvC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAA;YAC5D,OAAM;QACR,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAA;YACnD,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAA;oBAC9C,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;oBACpB,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;wBAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;wBAAC,OAAM;oBAAC,CAAC;oBACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACpB,CAAC;YACH,CAAC;oBAAS,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAA;YAAC,CAAC;YACjC,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;YACxE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;mBACvD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC;mBACrD,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpF,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAA;gBAC1D,OAAM;YACR,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACxB,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAA;QAC5F,CAAC;IACH,CAAC;CACF"}

package/dist/proxy/tee-control.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tee-control.test.d.ts.map

package/dist/proxy/tee-control.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-control.test.d.ts","sourceRoot":"","sources":["../../src/proxy/tee-control.test.ts"],"names":[],"mappings":""}

package/dist/proxy/tee-control.test.js

@@ -0,0 +1,56 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createServer } from 'node:http';
+import { mkdtemp, readFile, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { teeControlFileName } from '@antseed/node/tee-status';
+import { TeeControl } from './tee-control.js';
+test('verification control authenticates, rejects origins/targets, bounds requests and cleans credentials', async (context) => {
+    const directory = await mkdtemp(join(tmpdir(), 'tee-control-'));
+    const control = new TeeControl('session');
+    const checks = [];
+    const seller = 'a'.repeat(40);
+    const snapshot = { sessionId: 'session', verificationEnabled: true, evidence: [] };
+    const server = createServer((req, res) => {
+        void control.handle(req, res, req.method, req.url, () => snapshot, async (peerId) => {
+            if (peerId !== seller)
+                throw new Error('Unknown seller');
+            checks.push(peerId);
+        });
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const port = server.address().port;
+    context.after(async () => {
+        await control.close();
+        await new Promise((resolve) => server.close(() => resolve()));
+        await rm(directory, { recursive: true, force: true });
+    });
+    await control.publish(directory, port);
+    const file = join(directory, teeControlFileName(port));
+    assert.equal((await stat(file)).mode & 0o777, 0o600);
+    const credential = JSON.parse(await readFile(file, 'utf8'));
+    const url = `http://127.0.0.1:${port}/_antseed/verification`;
+    const headers = { authorization: `Bearer ${credential.token}` };
+    assert.equal((await fetch(url)).status, 403);
+    assert.equal((await fetch(url, { headers: { authorization: 'Bearer invalid' } })).status, 403);
+    assert.equal((await fetch(url, { headers: { ...headers, origin: 'http://127.0.0.1.evil.test' } })).status, 403);
+    assert.equal((await fetch(url, { headers: { ...headers, origin: 'http://localhost:3000' } })).status, 403);
+    const status = await (await fetch(url, { headers })).json();
+    assert.deepEqual(status, snapshot);
+    assert.equal((await fetch(`${url}/resume`, { method: 'POST', headers })).status, 404);
+    assert.ok(!JSON.stringify(status).includes(credential.token));
+    assert.equal((await fetch(`${url}/check`, { method: 'POST', headers, body: JSON.stringify({ peerId: seller, url: 'https://evil.test' }) })).status, 400);
+    await new Promise((resolve) => setTimeout(resolve, 1010));
+    assert.equal((await fetch(`${url}/check`, { method: 'POST', headers, body: JSON.stringify({ peerId: 'b'.repeat(40) }) })).status, 400);
+    await new Promise((resolve) => setTimeout(resolve, 1010));
+    assert.equal((await fetch(`${url}/check`, { method: 'POST', headers, body: JSON.stringify({ peerId: seller }) })).status, 200);
+    assert.deepEqual(checks, [seller]);
+    assert.equal((await fetch(`${url}/check`, { method: 'POST', headers, body: JSON.stringify({ peerId: seller }) })).status, 429);
+    await new Promise((resolve) => setTimeout(resolve, 1010));
+    assert.equal((await fetch(`${url}/check`, { method: 'POST', headers, body: 'x'.repeat(2048) })).status, 413);
+    await control.close();
+    await assert.rejects(readFile(file));
+    assert.equal((await fetch(url, { headers })).status, 403);
+});
+//# sourceMappingURL=tee-control.test.js.map

package/dist/proxy/tee-control.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-control.test.js","sourceRoot":"","sources":["../../src/proxy/tee-control.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,IAAI,CAAC,qGAAqG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAC5H,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,MAAO,EAAE,GAAG,CAAC,GAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACpF,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;IACjF,MAAM,GAAG,GAAG,oBAAoB,IAAI,wBAAwB,CAAC;IAC7D,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,GAAG,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzJ,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvI,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/H,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/H,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,GAAG,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7G,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC"}

package/dist/proxy/tee-verification.d.ts

@@ -0,0 +1,24 @@
+import { type TeeSnapshot } from '@antseed/node/tee-status';
+import { type VerifierPolicy, type VerifyOutcome } from '../plugins/verifier.js';
+type Peer = {
+    peerId: string;
+    capabilities?: string[];
+};
+export declare class TeeVerification {
+    readonly policy: VerifierPolicy | undefined;
+    private readonly now;
+    readonly sessionId: `${string}-${string}-${string}-${string}-${string}`;
+    private readonly queries;
+    private closed;
+    private activeChecks;
+    constructor(policy: VerifierPolicy | undefined, now?: () => number);
+    verify(peer: Peer, policy: VerifierPolicy, run: () => Promise<VerifyOutcome>, force?: boolean): Promise<VerifyOutcome>;
+    verifyForDisplay(peer: Peer, run: () => Promise<VerifyOutcome>): Promise<VerifyOutcome>;
+    private cacheExpiry;
+    private verifyCached;
+    observePeers(peers: readonly Peer[]): void;
+    snapshot(peers: readonly Peer[]): TeeSnapshot;
+    close(): void;
+}
+export {};
+//# sourceMappingURL=tee-verification.d.ts.map

package/dist/proxy/tee-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-verification.d.ts","sourceRoot":"","sources":["../../src/proxy/tee-verification.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2E,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAEpI,OAAO,EAA8C,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE5H,KAAK,IAAI,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAGvD,qBAAa,eAAe;IAQd,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS;IAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;IAP7E,QAAQ,CAAC,SAAS,sDAAe;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAEtB;IACF,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,YAAY,CAAI;gBAEH,MAAM,EAAE,cAAc,GAAG,SAAS,EAAmB,GAAG,eAAW;IAElF,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;IAIpH,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAK7F,OAAO,CAAC,WAAW;YAKL,YAAY;IAmD1B,YAAY,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,IAAI;IAO1C,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,WAAW;IA2B7C,KAAK,IAAI,IAAI;CAId"}

package/dist/proxy/tee-verification.js

@@ -0,0 +1,128 @@
+import { randomUUID } from 'node:crypto';
+import { QueryClient } from '@tanstack/query-core';
+import { TEE_BADGE_MAX_AGE_MS, TEE_MAX_AGE_MS, TEE_VERIFIER_ID } from '@antseed/node/tee-status';
+import { parseVerifierCapabilities } from '@antseed/node/verifier-capabilities';
+import { selectVerifier, verifierSupportFingerprint } from '../plugins/verifier.js';
+export class TeeVerification {
+    policy;
+    now;
+    sessionId = randomUUID();
+    queries = new QueryClient({
+        defaultOptions: { queries: { retry: false, networkMode: 'always', gcTime: Infinity, structuralSharing: false } },
+    });
+    closed = false;
+    activeChecks = 0;
+    constructor(policy, now = Date.now) {
+        this.policy = policy;
+        this.now = now;
+    }
+    async verify(peer, policy, run, force = false) {
+        return this.verifyCached(peer, policy, run, TEE_MAX_AGE_MS, force);
+    }
+    async verifyForDisplay(peer, run) {
+        return this.verifyCached(peer, { require: true, prefer: [TEE_VERIFIER_ID] }, run, TEE_BADGE_MAX_AGE_MS, false, true);
+    }
+    cacheExpiry(entry, maxAgeMs) {
+        return entry.outcome?.sellerNodeVerified && !entry.outcome.transient
+            ? entry.checkedAt + maxAgeMs : entry.checkedAt + TEE_MAX_AGE_MS;
+    }
+    async verifyCached(peer, policy, run, maxAgeMs, force = false, requireSellerNode = false) {
+        if (this.closed)
+            return { ok: false, verified: false, reason: 'Buyer stopped', transient: true };
+        const chosen = selectVerifier(policy, parseVerifierCapabilities(peer.capabilities));
+        const fingerprint = verifierSupportFingerprint(peer.capabilities);
+        const queryKey = [peer.peerId, chosen ?? '', fingerprint];
+        const cache = this.queries.getQueryCache();
+        for (const query of cache.findAll({ queryKey: [peer.peerId] })) {
+            if (query.queryKey[2] !== fingerprint)
+                cache.remove(query);
+        }
+        const previous = cache.find({ queryKey, exact: true });
+        const pending = previous?.state.fetchStatus === 'fetching';
+        const allow = (outcome) => ({
+            ...outcome, ok: !policy.require || (requireSellerNode ? outcome.sellerNodeVerified === true : outcome.verified),
+        });
+        const entry = previous?.state.data;
+        if (!pending && !force && entry?.outcome && !entry.outcome.transient && this.cacheExpiry(entry, maxAgeMs) > this.now())
+            return allow(entry.outcome);
+        if (!pending && this.activeChecks >= 8) {
+            return { ok: !policy.require, verified: false, transient: true, code: 'busy', reason: 'Verification busy; retry shortly' };
+        }
+        if (!previous && cache.getAll().length >= 512) {
+            const oldest = cache.getAll().find((query) => query.state.fetchStatus === 'idle');
+            if (oldest)
+                cache.remove(oldest);
+        }
+        const checkedAt = pending ? Number(previous.meta?.checkedAt) : this.now();
+        const options = {
+            queryKey, staleTime: 0, meta: { checkedAt },
+            queryFn: async () => {
+                this.activeChecks += 1;
+                try {
+                    const { ok: _allowed, ...outcome } = await Promise.resolve().then(run);
+                    return { checkedAt, outcome };
+                }
+                catch (error) {
+                    return { checkedAt, outcome: {
+                            verified: false, transient: true, reason: error instanceof Error ? error.message : 'Verification unavailable',
+                        } };
+                }
+                finally {
+                    this.activeChecks -= 1;
+                }
+            },
+        };
+        const resultPromise = this.queries.fetchQuery(options);
+        const query = cache.find({ queryKey, exact: true });
+        try {
+            const result = await resultPromise;
+            if (!this.closed && cache.find({ queryKey, exact: true }) === query && result.outcome)
+                return allow(result.outcome);
+        }
+        catch {
+            return { ok: !policy.require && !this.closed, verified: false, transient: true, reason: 'Verification session or seller capabilities changed' };
+        }
+        return { ok: !policy.require && !this.closed, verified: false, transient: true, reason: 'Verification session or seller capabilities changed' };
+    }
+    observePeers(peers) {
+        const fingerprints = new Map(peers.map((peer) => [peer.peerId, verifierSupportFingerprint(peer.capabilities)]));
+        for (const query of this.queries.getQueryCache().getAll()) {
+            if (fingerprints.get(String(query.queryKey[0])) !== query.queryKey[2])
+                this.queries.getQueryCache().remove(query);
+        }
+    }
+    snapshot(peers) {
+        const evidence = [];
+        this.observePeers(peers);
+        for (const peer of peers) {
+            if (!parseVerifierCapabilities(peer.capabilities).supported.includes(TEE_VERIFIER_ID))
+                continue;
+            const fingerprint = verifierSupportFingerprint(peer.capabilities);
+            const query = this.queries.getQueryCache().find({ queryKey: [peer.peerId, TEE_VERIFIER_ID, fingerprint], exact: true });
+            if (!query)
+                continue;
+            const checking = query.state.fetchStatus === 'fetching';
+            const entry = checking ? { checkedAt: Number(query.meta?.checkedAt) } : query.state.data;
+            if (!entry)
+                continue;
+            evidence.push({
+                peerId: peer.peerId, verifierId: TEE_VERIFIER_ID, verifierVersion: entry.outcome?.version,
+                fingerprint, checkedAt: entry.checkedAt, expiresAt: checking ? 0 : this.cacheExpiry(entry, TEE_BADGE_MAX_AGE_MS),
+                sellerNodeVerified: entry.outcome?.sellerNodeVerified === true,
+                claims: entry.outcome?.claims ?? [], reason: entry.outcome?.reason,
+                checking,
+                unavailable: entry.outcome?.transient === true,
+            });
+        }
+        return {
+            sessionId: this.sessionId,
+            verificationEnabled: Boolean(this.policy),
+            evidence,
+        };
+    }
+    close() {
+        this.closed = true;
+        this.queries.clear();
+    }
+}
+//# sourceMappingURL=tee-verification.js.map

package/dist/proxy/tee-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-verification.js","sourceRoot":"","sources":["../../src/proxy/tee-verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,eAAe,EAAsC,MAAM,0BAA0B,CAAA;AACpI,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAA2C,MAAM,wBAAwB,CAAA;AAK5H,MAAM,OAAO,eAAe;IAQL;IAAqD;IAPjE,SAAS,GAAG,UAAU,EAAE,CAAA;IAChB,OAAO,GAAG,IAAI,WAAW,CAAC;QACzC,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE;KACjH,CAAC,CAAA;IACM,MAAM,GAAG,KAAK,CAAA;IACd,YAAY,GAAG,CAAC,CAAA;IAExB,YAAqB,MAAkC,EAAmB,MAAM,IAAI,CAAC,GAAG;QAAnE,WAAM,GAAN,MAAM,CAA4B;QAAmB,QAAG,GAAH,GAAG,CAAW;IAAG,CAAC;IAE5F,KAAK,CAAC,MAAM,CAAC,IAAU,EAAE,MAAsB,EAAE,GAAiC,EAAE,KAAK,GAAG,KAAK;QAC/F,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,CAAA;IACpE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAU,EAAE,GAAiC;QAClE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAC3B,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IACzF,CAAC;IAEO,WAAW,CAAC,KAAY,EAAE,QAAgB;QAChD,OAAO,KAAK,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS;YAClE,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,cAAc,CAAA;IACnE,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAU,EAAE,MAAsB,EAAE,GAAiC,EAAE,QAAgB,EAAE,KAAK,GAAG,KAAK,EAAE,iBAAiB,GAAG,KAAK;QAC1J,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;QAChG,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;QACnF,MAAM,WAAW,GAAG,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,WAAW,CAAU,CAAA;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAA;QAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW;gBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,CAAC,WAAW,KAAK,UAAU,CAAA;QAC1D,MAAM,KAAK,GAAG,CAAC,OAAkC,EAAiB,EAAE,CAAC,CAAC;YACpE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;SAChH,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAA;QAClC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACnJ,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;QAC5H,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAA;YACjF,IAAI,MAAM;gBAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAClC,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;QACzE,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE;YAC3C,OAAO,EAAE,KAAK,IAAoB,EAAE;gBAClC,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;gBACtB,IAAI,CAAC;oBACH,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACtE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;gBAC/B,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACxB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;4BAC3B,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;yBAC9G,EAAE,CAAA;gBACL,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;gBACxB,CAAC;YACH,CAAC;SACF,CAAA;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAA;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5H,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAA;QACjJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAA;IACjJ,CAAC;IAED,YAAY,CAAC,KAAsB;QACjC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;QAC/G,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1D,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACnH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,KAAsB;QAC7B,MAAM,QAAQ,GAAkB,EAAE,CAAA;QAClC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,SAAQ;YAC/F,MAAM,WAAW,GAAG,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YACjE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAQ,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9H,IAAI,CAAC,KAAK;gBAAE,SAAQ;YACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,KAAK,UAAU,CAAA;YACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAA;YACxF,IAAI,CAAC,KAAK;gBAAE,SAAQ;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO;gBACzF,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,oBAAoB,CAAC;gBAChH,kBAAkB,EAAE,KAAK,CAAC,OAAO,EAAE,kBAAkB,KAAK,IAAI;gBAC9D,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM;gBAClE,QAAQ;gBACR,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,KAAK,IAAI;aAC/C,CAAC,CAAA;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YACzC,QAAQ;SACT,CAAA;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;CACF"}

package/dist/proxy/tee-verification.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tee-verification.test.d.ts.map

package/dist/proxy/tee-verification.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-verification.test.d.ts","sourceRoot":"","sources":["../../src/proxy/tee-verification.test.ts"],"names":[],"mappings":""}

package/dist/proxy/tee-verification.test.js

@@ -0,0 +1,241 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { onlineManager } from '@tanstack/query-core';
+import { TEE_BADGE_MAX_AGE_MS, TEE_MAX_AGE_MS } from '@antseed/node/tee-status';
+import { TeeVerification } from './tee-verification.js';
+const peer = { peerId: 'a'.repeat(40), capabilities: ['verifier.antseed-verifier'] };
+const strict = { require: true, prefer: ['antseed-verifier'] };
+const pass = { ok: true, verified: true, sellerNodeVerified: true, sdk: 'antseed-verifier' };
+test('display checks reuse successful evidence for 24 hours without extending it on reads', async () => {
+    let now = 100;
+    let runs = 0;
+    const service = new TeeVerification(strict, () => now);
+    const run = async () => { runs += 1; return pass; };
+    await service.verifyForDisplay(peer, run);
+    const evidence = service.snapshot([peer]).evidence[0];
+    assert.equal(evidence.checkedAt, 100);
+    assert.equal(evidence.expiresAt, 100 + TEE_BADGE_MAX_AGE_MS);
+    now += TEE_MAX_AGE_MS;
+    await service.verifyForDisplay(peer, run);
+    now = evidence.expiresAt - 1;
+    await service.verifyForDisplay(peer, run);
+    assert.equal(runs, 1);
+    assert.deepEqual(service.snapshot([peer]).evidence[0], evidence);
+    now = evidence.expiresAt;
+    await service.verifyForDisplay(peer, run);
+    assert.equal(runs, 2);
+});
+test('a day-long badge never authorizes routing after the five-minute routing expiry', async () => {
+    let now = 100;
+    const service = new TeeVerification(strict, () => now);
+    let runs = 0;
+    await service.verifyForDisplay(peer, async () => pass);
+    now += TEE_MAX_AGE_MS;
+    assert.ok(service.snapshot([peer]).evidence[0].expiresAt > now);
+    const outcome = await service.verify(peer, strict, async () => {
+        runs += 1;
+        return { ok: false, verified: false, sellerNodeVerified: false };
+    });
+    assert.equal(runs, 1);
+    assert.equal(outcome.ok, false);
+    assert.equal(service.snapshot([peer]).evidence[0]?.sellerNodeVerified, false);
+    assert.equal(service.snapshot([peer]).evidence[0]?.expiresAt, now + TEE_MAX_AGE_MS);
+});
+test('routing and display share in-flight checks and revoke badges on unavailable results', async () => {
+    let now = 100;
+    const service = new TeeVerification(strict, () => now);
+    let finish;
+    const display = service.verifyForDisplay(peer, () => new Promise((resolve) => { finish = resolve; }));
+    const routed = service.verify(peer, strict, async () => { assert.fail('duplicate attestation'); });
+    await Promise.resolve();
+    finish(pass);
+    assert.ok((await display).sellerNodeVerified);
+    assert.ok((await routed).ok);
+    now += TEE_MAX_AGE_MS;
+    await service.verify(peer, strict, async () => ({ ok: false, verified: false, transient: true }));
+    assert.equal(service.snapshot([peer]).evidence[0]?.sellerNodeVerified, false);
+    assert.equal(service.snapshot([peer]).evidence[0]?.unavailable, true);
+    assert.ok((await service.verifyForDisplay(peer, async () => pass)).sellerNodeVerified);
+});
+test('display failures keep the short TTL and capability changes discard day-long successes', async () => {
+    let now = 100;
+    let runs = 0;
+    const service = new TeeVerification(strict, () => now);
+    await service.verifyForDisplay(peer, async () => ({ ok: false, verified: false }));
+    assert.equal(service.snapshot([peer]).evidence[0]?.expiresAt, now + TEE_MAX_AGE_MS);
+    now += TEE_MAX_AGE_MS;
+    const run = async () => { runs += 1; return pass; };
+    await service.verifyForDisplay(peer, run);
+    const changed = { ...peer, capabilities: [...peer.capabilities, 'verifier.other'] };
+    service.observePeers([changed]);
+    assert.deepEqual(service.snapshot([changed]).evidence, []);
+    await service.verifyForDisplay(changed, run);
+    assert.equal(runs, 2);
+    service.close();
+    assert.deepEqual(service.snapshot([changed]).evidence, []);
+    assert.equal((await service.verifyForDisplay(changed, run)).ok, false);
+});
+test('evidence cache never reuses an optional routing allowance as required verification', async () => {
+    const service = new TeeVerification(strict);
+    const fail = { ok: true, verified: false, reason: 'Failed' };
+    assert.equal((await service.verify(peer, { require: false }, async () => fail)).ok, true);
+    assert.equal((await service.verify(peer, strict, async () => pass)).ok, false);
+    assert.equal(service.snapshot([peer]).evidence[0]?.sellerNodeVerified, false);
+    assert.equal(service.snapshot([peer]).evidence[0]?.unavailable, false);
+});
+test('badge claim requirements do not become a new CLI routing policy', async () => {
+    const service = new TeeVerification(strict);
+    const genericPass = { ok: true, verified: true, sellerNodeVerified: false };
+    const display = await service.verifyForDisplay(peer, async () => genericPass);
+    assert.equal(display.ok, false);
+    assert.equal(service.snapshot([peer]).evidence[0]?.sellerNodeVerified, false);
+    const routed = await service.verify(peer, strict, async () => { assert.fail('should reuse generic verifier evidence'); });
+    assert.equal(routed.ok, true);
+    assert.deepEqual(service.snapshot([peer]), {
+        sessionId: service.sessionId, verificationEnabled: true, evidence: service.snapshot([peer]).evidence,
+    });
+    service.close();
+});
+test('expiry, forced failed recheck, transient retries and daemon restart revoke success', async () => {
+    let now = 100;
+    let runs = 0;
+    const service = new TeeVerification(strict, () => now);
+    const run = async () => { runs += 1; return pass; };
+    await service.verify(peer, strict, run);
+    await service.verify(peer, strict, run);
+    assert.equal(runs, 1);
+    now += TEE_MAX_AGE_MS;
+    await service.verify(peer, strict, run);
+    assert.equal(runs, 2);
+    await service.verify(peer, strict, async () => ({ ok: false, verified: false, transient: true }), true);
+    assert.equal(service.snapshot([peer]).evidence[0]?.sellerNodeVerified, false);
+    assert.equal(service.snapshot([peer]).evidence[0]?.unavailable, true);
+    await service.verify(peer, strict, run);
+    assert.equal(runs, 3);
+    const restarted = new TeeVerification(strict);
+    assert.notEqual(service.sessionId, restarted.sessionId);
+    assert.deepEqual(restarted.snapshot([peer]).evidence, []);
+});
+test('concurrent checks deduplicate; superseded advertisements cannot restore old evidence', async () => {
+    const service = new TeeVerification(strict);
+    let finish;
+    let runs = 0;
+    const run = () => { runs += 1; return new Promise((resolve) => { finish = resolve; }); };
+    const first = service.verify(peer, strict, run);
+    const second = service.verify(peer, strict, run, true);
+    await Promise.resolve();
+    assert.equal(runs, 1);
+    assert.equal(service.snapshot([peer]).evidence[0]?.checking, true);
+    const changed = { ...peer, capabilities: [...peer.capabilities, 'verifier.other'] };
+    await service.verify(changed, strict, async () => ({ ok: false, verified: false }));
+    finish(pass);
+    assert.equal((await first).ok, false);
+    assert.equal((await second).ok, false);
+    assert.equal(service.snapshot([changed]).evidence[0]?.sellerNodeVerified, false);
+    assert.deepEqual(service.snapshot([{ ...peer, capabilities: [] }]).evidence, []);
+    assert.deepEqual(service.snapshot([peer]).evidence, []);
+});
+test('discovery updates revoke evidence even without a status reader', async () => {
+    const service = new TeeVerification(strict);
+    await service.verify(peer, strict, async () => pass);
+    service.observePeers([{ ...peer, capabilities: [] }]);
+    service.observePeers([peer]);
+    assert.deepEqual(service.snapshot([peer]).evidence, []);
+});
+test('stopped sessions and exhausted concurrency fail closed', async () => {
+    const service = new TeeVerification(strict);
+    const finishers = [];
+    const pending = Array.from({ length: 8 }, (_, index) => service.verify({ ...peer, peerId: String(index) }, strict, () => new Promise((resolve) => finishers.push(resolve))));
+    assert.equal((await service.verify(peer, strict, async () => pass)).ok, false);
+    await Promise.resolve();
+    service.close();
+    finishers.forEach((finish) => finish(pass));
+    assert.ok((await Promise.all(pending)).every((outcome) => !outcome.ok));
+    assert.equal((await service.verify(peer, strict, async () => pass)).ok, false);
+});
+test('verifier exceptions revoke success without automatic retries', async () => {
+    const service = new TeeVerification(strict);
+    await service.verifyForDisplay(peer, async () => pass);
+    let runs = 0;
+    const run = async () => { runs += 1; throw new Error('Verifier unavailable'); };
+    const result = await service.verify(peer, strict, run, true);
+    assert.equal(result.ok, false);
+    assert.equal(result.transient, true);
+    assert.equal(result.reason, 'Verifier unavailable');
+    assert.equal(runs, 1);
+    assert.equal(service.snapshot([peer]).evidence[0]?.sellerNodeVerified, false);
+    await service.verifyForDisplay(peer, run);
+    assert.equal(runs, 2);
+    service.close();
+});
+test('refresh hides stale success and shares evidence, not caller routing policy', async () => {
+    const service = new TeeVerification(strict);
+    await service.verifyForDisplay(peer, async () => pass);
+    let finish;
+    const optional = service.verify(peer, { require: false }, () => new Promise((resolve) => { finish = resolve; }), true);
+    const required = service.verifyForDisplay(peer, async () => { assert.fail('duplicate attestation'); });
+    const evidence = service.snapshot([peer]).evidence[0];
+    assert.equal(evidence.checking, true);
+    assert.equal(evidence.sellerNodeVerified, false);
+    await Promise.resolve();
+    finish({ ok: true, verified: false, sellerNodeVerified: false });
+    assert.equal((await optional).ok, true);
+    assert.equal((await required).ok, false);
+    service.close();
+});
+test('invalidating pending queries releases waiters but retains the underlying concurrency limit', async () => {
+    const service = new TeeVerification(strict);
+    const finishers = [];
+    const pending = Array.from({ length: 8 }, (_, index) => service.verify({ ...peer, peerId: String(index) }, strict, () => new Promise((resolve) => finishers.push(resolve))));
+    await Promise.resolve();
+    service.observePeers([]);
+    assert.ok((await Promise.all(pending)).every((outcome) => !outcome.ok && outcome.transient));
+    const busy = await service.verifyForDisplay(peer, async () => { assert.fail('exceeded concurrency limit'); });
+    assert.equal(busy.code, 'busy');
+    finishers.forEach((finish) => finish(pass));
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.deepEqual(service.snapshot([peer]).evidence, []);
+    assert.equal((await service.verifyForDisplay(peer, async () => pass)).ok, true);
+    service.close();
+});
+test('bounded query cache evicts settled entries, not pending checks', async () => {
+    const service = new TeeVerification(strict);
+    let finish;
+    const pending = service.verifyForDisplay(peer, () => new Promise((resolve) => { finish = resolve; }));
+    const peers = Array.from({ length: 512 }, (_, index) => ({ ...peer, peerId: String(index) }));
+    for (const seller of peers)
+        await service.verifyForDisplay(seller, async () => pass);
+    const snapshot = service.snapshot([peer, ...peers]);
+    assert.equal(snapshot.evidence.length, 512);
+    assert.equal(snapshot.evidence.find((entry) => entry.peerId === peer.peerId)?.checking, true);
+    assert.equal(snapshot.evidence.some((entry) => entry.peerId === peers[0].peerId), false);
+    const duplicate = service.verifyForDisplay(peer, async () => { assert.fail('evicted pending attestation'); });
+    finish(pass);
+    assert.equal((await pending).ok, true);
+    assert.equal((await duplicate).ok, true);
+    service.close();
+});
+test('expiry is measured from check start, not query completion time', async () => {
+    let now = 100;
+    const service = new TeeVerification(strict, () => now);
+    await service.verifyForDisplay(peer, async () => { now += TEE_MAX_AGE_MS; return pass; });
+    assert.equal(service.snapshot([peer]).evidence[0]?.checkedAt, 100);
+    assert.equal(service.snapshot([peer]).evidence[0]?.expiresAt, 100 + TEE_BADGE_MAX_AGE_MS);
+    let runs = 0;
+    await service.verify(peer, strict, async () => { runs += 1; return pass; });
+    assert.equal(runs, 1);
+    service.close();
+});
+test('headless buyer checks do not pause for browser connectivity state', async () => {
+    const service = new TeeVerification(strict);
+    const wasOnline = onlineManager.isOnline();
+    onlineManager.setOnline(false);
+    try {
+        assert.equal((await service.verifyForDisplay(peer, async () => pass)).ok, true);
+    }
+    finally {
+        service.close();
+        onlineManager.setOnline(wasOnline);
+    }
+});
+//# sourceMappingURL=tee-verification.test.js.map