@aptos-labs/inference-verifier 0.0.0-stage → 0.1.0

package/dist/der.js

@@ -0,0 +1,79 @@
+import { fail } from "./error.js";
+export function parseDer(bytes, at = 0) {
+    if (at >= bytes.length)
+        fail("encoding", "truncated DER");
+    const tag = bytes[at];
+    if ((tag & 0x1f) === 0x1f)
+        fail("encoding", "long-form DER tags are not accepted");
+    let length = bytes[at + 1];
+    if (length === undefined)
+        fail("encoding", "truncated DER length");
+    let header = 2;
+    if (length === 0x80)
+        fail("encoding", "indefinite DER lengths are not accepted");
+    if (length > 0x80) {
+        const count = length & 0x7f;
+        if (count === 0 || count > 3)
+            fail("encoding", "non-minimal or oversized DER length");
+        length = 0;
+        for (let i = 0; i < count; i += 1) {
+            const byte = bytes[at + 2 + i];
+            if (byte === undefined)
+                fail("encoding", "truncated DER length");
+            length = (length << 8) | byte;
+        }
+        if (length < 128)
+            fail("encoding", "non-minimal DER length");
+        header = 2 + count;
+    }
+    const end = at + header + length;
+    if (end > bytes.length)
+        fail("encoding", "truncated DER value");
+    return { tag, start: at, header, end, value: bytes.subarray(at + header, end) };
+}
+export function sequence(der) {
+    if (der.tag !== 0x30)
+        fail("encoding", "expected a DER sequence");
+    const out = [];
+    let offset = 0;
+    while (offset < der.value.length) {
+        const child = parseDer(der.value, offset);
+        out.push(child);
+        offset = child.end;
+    }
+    return out;
+}
+export function encodeOid(oid) {
+    const parts = oid.split(".").map((part) => Number(part));
+    const first = parts[0];
+    const second = parts[1];
+    if (first === undefined || second === undefined)
+        fail("encoding", "bad OID");
+    const bytes = [first * 40 + second];
+    for (const part of parts.slice(2)) {
+        const encoded = [part & 0x7f];
+        let rest = part >> 7;
+        while (rest > 0) {
+            encoded.push((rest & 0x7f) | 0x80);
+            rest >>= 7;
+        }
+        bytes.push(...encoded.reverse());
+    }
+    return Buffer.from(bytes);
+}
+export function childByOid(items, oid) {
+    const encoded = encodeOid(oid);
+    for (const item of items) {
+        const [name, value] = sequence(item);
+        if (name !== undefined && value !== undefined && name.tag === 0x06 && name.value.equals(encoded)) {
+            return value;
+        }
+    }
+    return undefined;
+}
+export function unwrapOctet(der) {
+    if (der.tag !== 0x04)
+        fail("encoding", "expected a DER octet string");
+    return der.value;
+}
+//# sourceMappingURL=der.js.map

package/dist/der.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"der.js","sourceRoot":"","sources":["../src/der.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAUlC,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,EAAE,GAAG,CAAC;IAC5C,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAE,CAAC;IACvB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;IACnF,IAAI,MAAM,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IACnE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,KAAK,IAAI;QAAE,IAAI,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAC;IACjF,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,GAAG,IAAI,CAAC;QAC5B,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;QACtF,MAAM,GAAG,CAAC,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;YACjE,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,IAAI,MAAM,GAAG,GAAG;YAAE,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;IAChE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAQ;IAC/B,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;QAAE,IAAI,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IAClE,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,CAAC,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,CAAC;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAY,EAAE,GAAW;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAQ;IAClC,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;QAAE,IAAI,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,KAAK,CAAC;AACnB,CAAC"}

package/dist/document.d.ts

@@ -0,0 +1,27 @@
+export declare const MAX_DOCUMENT_BYTES: number;
+export declare const TDX_QUOTE_V1 = "https://tinfoil.sh/format/tdx-quote/v1";
+export declare const TLS_KEY_FORMAT = "https://tinfoil.sh/key/spki-fp-sha256/v1";
+export declare const HPKE_KEY_FORMAT = "https://tinfoil.sh/key/x25519-hpke/v1";
+export declare const INTEL_PCS_V1 = "https://tinfoil.sh/collateral/intel-pcs/v1";
+export declare const SIGSTORE_CODE_V1 = "https://tinfoil.sh/collateral/sigstore-code/v1";
+export declare const SIGSTORE_HARDWARE_V1 = "https://inference.aptoslabs.com/collateral/sigstore-hardware-measurements/v1";
+export interface CollateralEntry {
+    id: string;
+    role: string;
+    format: string;
+    subjects: string[];
+    data: Record<string, unknown>;
+}
+export interface CheckedDocument {
+    cpuFormat: string;
+    quote: Buffer;
+    cryptoMaterial: Buffer;
+    deviceEvidence: Buffer;
+    tlsPublicKey: string;
+    hpkePublicKey: string;
+    deviceCount: number;
+    collateral: CollateralEntry[];
+    reportData: Buffer;
+}
+export declare function isValidRepo(repo: string): boolean;
+export declare function checkDocument(bytes: Uint8Array, nonce: Uint8Array): CheckedDocument;

package/dist/document.js

@@ -0,0 +1,159 @@
+import { decodeCanonicalBase64, decodeLowerHex, sha256 } from "./bytes.js";
+import { fail } from "./error.js";
+import { assertJson } from "./json.js";
+export const MAX_DOCUMENT_BYTES = 4 * 1024 * 1024;
+const ATTESTATION_V3 = "https://tinfoil.sh/predicate/attestation/v3";
+const REPORT_DATA_V1 = "https://tinfoil.sh/report-data/v1";
+const CRYPTO_MATERIAL_V1 = "https://tinfoil.sh/crypto-material/v1";
+const DEVICE_EVIDENCE_V1 = "https://tinfoil.sh/device-evidence/v1";
+export const TDX_QUOTE_V1 = "https://tinfoil.sh/format/tdx-quote/v1";
+export const TLS_KEY_FORMAT = "https://tinfoil.sh/key/spki-fp-sha256/v1";
+export const HPKE_KEY_FORMAT = "https://tinfoil.sh/key/x25519-hpke/v1";
+export const INTEL_PCS_V1 = "https://tinfoil.sh/collateral/intel-pcs/v1";
+export const SIGSTORE_CODE_V1 = "https://tinfoil.sh/collateral/sigstore-code/v1";
+export const SIGSTORE_HARDWARE_V1 = "https://inference.aptoslabs.com/collateral/sigstore-hardware-measurements/v1";
+function object(value, what) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        fail("envelope", `${what} is not an object`);
+    }
+    return value;
+}
+function stringField(source, key, what) {
+    const value = source[key];
+    if (typeof value !== "string")
+        fail("envelope", `${what}.${key} is not a string`);
+    return value;
+}
+function only(source, keys, what) {
+    for (const key of Object.keys(source)) {
+        if (!keys.includes(key))
+            fail("envelope", `${what} has unknown field ${key}`);
+    }
+}
+export function isValidRepo(repo) {
+    const parts = repo.split("/");
+    if (parts.length !== 2)
+        return false;
+    return parts.every((part) => part.length > 0 && /^[A-Za-z0-9._-]+$/.test(part));
+}
+export function checkDocument(bytes, nonce) {
+    if (bytes.length > MAX_DOCUMENT_BYTES)
+        fail("envelope", "document exceeds 4 MiB");
+    if (nonce.length !== 32)
+        fail("envelope", "nonce must be 32 bytes");
+    const text = Buffer.from(bytes).toString("utf8");
+    if (!Buffer.from(text, "utf8").equals(Buffer.from(bytes))) {
+        fail("encoding", "document is not valid UTF-8");
+    }
+    const raw = object(assertJson(text, "encoding"), "document");
+    only(raw, ["format", "challenge", "cpu_evidence", "crypto_material", "device_evidence", "collateral"], "document");
+    if (raw.format !== ATTESTATION_V3)
+        fail("envelope", "unsupported attestation format");
+    const challenge = object(raw.challenge, "challenge");
+    only(challenge, ["nonce", "report_data", "report_data_algorithm"], "challenge");
+    if (challenge.report_data_algorithm !== REPORT_DATA_V1) {
+        fail("envelope", "unsupported report data algorithm");
+    }
+    const nonceHex = stringField(challenge, "nonce", "challenge");
+    if (nonceHex !== Buffer.from(nonce).toString("hex"))
+        fail("envelope", "nonce mismatch");
+    decodeLowerHex(nonceHex, "challenge.nonce", 32);
+    const claimedReport = decodeLowerHex(stringField(challenge, "report_data", "challenge"), "challenge.report_data", 64);
+    const cpu = object(raw.cpu_evidence, "cpu_evidence");
+    only(cpu, ["format", "report_base64", "endorsed"], "cpu_evidence");
+    const endorsed = object(cpu.endorsed, "cpu_evidence.endorsed");
+    only(endorsed, ["crypto_material_hash", "device_evidence_hash"], "cpu_evidence.endorsed");
+    const crypto = decodeCanonicalBase64(stringField(raw, "crypto_material", "document"), "crypto_material");
+    const devices = decodeCanonicalBase64(stringField(raw, "device_evidence", "document"), "device_evidence");
+    const cryptoHash = sha256(crypto);
+    const deviceHash = sha256(devices);
+    if (hexOf(cryptoHash) !== stringField(endorsed, "crypto_material_hash", "endorsed")) {
+        fail("envelope", "crypto_material hash mismatch");
+    }
+    if (hexOf(deviceHash) !== stringField(endorsed, "device_evidence_hash", "endorsed")) {
+        fail("envelope", "device_evidence hash mismatch");
+    }
+    const report = reportData(nonce, cryptoHash, deviceHash);
+    if (!report.equals(claimedReport))
+        fail("envelope", "report data mismatch");
+    const cryptoJson = object(assertJson(crypto.toString("utf8"), "encoding"), "crypto_material");
+    only(cryptoJson, ["format", "items"], "crypto_material");
+    if (cryptoJson.format !== CRYPTO_MATERIAL_V1)
+        fail("envelope", "unsupported crypto material format");
+    if (!Array.isArray(cryptoJson.items))
+        fail("envelope", "crypto_material.items is not an array");
+    const keys = new Map();
+    for (const item of cryptoJson.items) {
+        const record = object(item, "crypto_material item");
+        only(record, ["id", "format", "data"], "crypto_material item");
+        const id = stringField(record, "id", "crypto_material item");
+        if (keys.has(id))
+            fail("envelope", `duplicate crypto_material id ${id}`);
+        keys.set(id, {
+            format: stringField(record, "format", "crypto_material item"),
+            data: stringField(record, "data", "crypto_material item"),
+        });
+    }
+    const tls = requiredKey(keys, "tls", TLS_KEY_FORMAT);
+    const hpke = requiredKey(keys, "hpke", HPKE_KEY_FORMAT);
+    const deviceJson = object(assertJson(devices.toString("utf8"), "encoding"), "device_evidence");
+    only(deviceJson, ["format", "items"], "device_evidence");
+    if (deviceJson.format !== DEVICE_EVIDENCE_V1)
+        fail("envelope", "unsupported device evidence format");
+    if (!Array.isArray(deviceJson.items))
+        fail("envelope", "device_evidence.items is not an array");
+    const collateral = parseCollateral(raw.collateral);
+    return {
+        cpuFormat: stringField(cpu, "format", "cpu_evidence"),
+        quote: decodeCanonicalBase64(stringField(cpu, "report_base64", "cpu_evidence"), "quote"),
+        cryptoMaterial: crypto,
+        deviceEvidence: devices,
+        tlsPublicKey: tls,
+        hpkePublicKey: hpke,
+        deviceCount: deviceJson.items.length,
+        collateral,
+        reportData: report,
+    };
+}
+function requiredKey(keys, id, format) {
+    const item = keys.get(id);
+    if (item === undefined || item.format !== format)
+        fail("policy", `missing ${id} key`);
+    return decodeLowerHex(item.data, id, 32).toString("hex");
+}
+function parseCollateral(value) {
+    if (!Array.isArray(value))
+        fail("envelope", "collateral is not an array");
+    const seen = new Set();
+    return value.map((entry) => {
+        const record = object(entry, "collateral");
+        only(record, ["id", "role", "format", "subjects", "data"], "collateral");
+        const id = stringField(record, "id", "collateral");
+        if (seen.has(id))
+            fail("envelope", `duplicate collateral id ${id}`);
+        seen.add(id);
+        const role = stringField(record, "role", "collateral");
+        if (role !== "endorsement" && role !== "reference-values") {
+            fail("envelope", `unknown collateral role ${role}`);
+        }
+        const subjects = record.subjects ?? [];
+        if (!Array.isArray(subjects) || subjects.some((subject) => typeof subject !== "string")) {
+            fail("envelope", "collateral subjects are not strings");
+        }
+        return {
+            id,
+            role,
+            format: stringField(record, "format", "collateral"),
+            subjects: subjects,
+            data: object(record.data, "collateral data"),
+        };
+    });
+}
+function reportData(nonce, cryptoHash, deviceHash) {
+    const hash = sha256(Buffer.concat([Buffer.from(REPORT_DATA_V1), Buffer.from(nonce), cryptoHash, deviceHash]));
+    return Buffer.concat([hash, Buffer.alloc(32)]);
+}
+function hexOf(value) {
+    return value.toString("hex");
+}
+//# sourceMappingURL=document.js.map

package/dist/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../src/document.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,cAAc,GAAG,6CAA6C,CAAC;AACrE,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AACnE,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AACnE,MAAM,CAAC,MAAM,YAAY,GAAG,wCAAwC,CAAC;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,0CAA0C,CAAC;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,uCAAuC,CAAC;AACvE,MAAM,CAAC,MAAM,YAAY,GAAG,4CAA4C,CAAC;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,gDAAgD,CAAC;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAC/B,8EAA8E,CAAC;AAsBjF,SAAS,MAAM,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,MAA+B,EAAE,GAAW,EAAE,IAAY;IAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,GAAG,kBAAkB,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,MAA+B,EAAE,IAAc,EAAE,IAAY;IACzE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,EAAE,GAAG,IAAI,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAChB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB,EAAE,KAAiB;IAChE,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,IAAI,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;IACnH,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc;QAAE,IAAI,CAAC,UAAU,EAAE,gCAAgC,CAAC,CAAC;IAEtF,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,uBAAuB,CAAC,EAAE,WAAW,CAAC,CAAC;IAChF,IAAI,SAAS,CAAC,qBAAqB,KAAK,cAAc,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,mCAAmC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACxF,cAAc,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,cAAc,CAClC,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,CAAC,EAClD,uBAAuB,EACvB,EAAE,CACH,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,qBAAqB,CACnC,WAAW,CAAC,GAAG,EAAE,iBAAiB,EAAE,UAAU,CAAC,EAC/C,iBAAiB,CAClB,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,WAAW,CAAC,QAAQ,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE,CAAC;QACpF,IAAI,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,WAAW,CAAC,QAAQ,EAAE,sBAAsB,EAAE,UAAU,CAAC,EAAE,CAAC;QACpF,IAAI,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAAE,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;IAE5E,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC9F,IAAI,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB;QAAE,IAAI,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;IACrG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,UAAU,EAAE,uCAAuC,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4C,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,UAAU,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;YACX,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,sBAAsB,CAAC;YAC7D,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC/F,IAAI,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,MAAM,KAAK,kBAAkB;QAAE,IAAI,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;IACrG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,UAAU,EAAE,uCAAuC,CAAC,CAAC;IAEhG,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC;QACrD,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QACxF,cAAc,EAAE,MAAM;QACtB,cAAc,EAAE,OAAO;QACvB,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,IAAI;QACnB,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;QACpC,UAAU;QACV,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,IAAmD,EACnD,EAAU,EACV,MAAc;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACtF,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;QACzE,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,UAAU,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC1D,IAAI,CAAC,UAAU,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxF,IAAI,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,EAAE;YACF,IAAI;YACJ,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC;YACnD,QAAQ,EAAE,QAAoB;YAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC;SAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB,EAAE,UAAkB,EAAE,UAAkB;IAC3E,MAAM,IAAI,GAAG,MAAM,CACjB,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CACzF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/dist/error.d.ts

@@ -0,0 +1,6 @@
+export type VerificationCategory = "envelope" | "encoding" | "dcap" | "tdx" | "provenance" | "policy";
+export declare class VerificationError extends Error {
+    readonly category: VerificationCategory;
+    constructor(category: VerificationCategory, message: string);
+}
+export declare function fail(category: VerificationCategory, message: string): never;

package/dist/error.js

@@ -0,0 +1,12 @@
+export class VerificationError extends Error {
+    category;
+    constructor(category, message) {
+        super(message);
+        this.name = "VerificationError";
+        this.category = category;
+    }
+}
+export function fail(category, message) {
+    throw new VerificationError(category, message);
+}
+//# sourceMappingURL=error.js.map

package/dist/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../src/error.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,QAAQ,CAAuB;IAExC,YAAY,QAA8B,EAAE,OAAe;QACzD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,IAAI,CAAC,QAA8B,EAAE,OAAe;IAClE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+import { type RouterEvidence } from "./verify.js";
+export type { RouterEvidence };
+export { VerificationError, type VerificationCategory } from "./error.js";
+export declare function verifyRouterDocument(bytes: Uint8Array, nonce: Uint8Array, repo: string, nowSecs: number): RouterEvidence;

package/dist/index.js

@@ -0,0 +1,6 @@
+import { verifyRouterDocument as verify } from "./verify.js";
+export { VerificationError } from "./error.js";
+export function verifyRouterDocument(bytes, nonce, repo, nowSecs) {
+    return verify(bytes, nonce, repo, nowSecs);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,IAAI,MAAM,EAAuB,MAAM,aAAa,CAAC;AAGlF,OAAO,EAAE,iBAAiB,EAA6B,MAAM,YAAY,CAAC;AAE1E,MAAM,UAAU,oBAAoB,CAClC,KAAiB,EACjB,KAAiB,EACjB,IAAY,EACZ,OAAe;IAEf,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/intel-root.d.ts

@@ -0,0 +1 @@
+export declare const INTEL_SGX_ROOT_CA_DER: Buffer<ArrayBuffer>;

package/dist/intel-root.js

@@ -0,0 +1,3 @@
+// Intel SGX Root CA, the production trust anchor pinned by dcap-qvl.
+export const INTEL_SGX_ROOT_CA_DER = Buffer.from('MIICjzCCAjSgAwIBAgIUImUM1lqdNInzg7SVUr9QGzknBqwwCgYIKoZIzj0EAwIwaDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYTAlVTMB4XDTE4MDUyMTEwNDUxMFoXDTQ5MTIzMTIzNTk1OVowaDEaMBgGA1UEAwwRSW50ZWwgU0dYIFJvb3QgQ0ExGjAYBgNVBAoMEUludGVsIENvcnBvcmF0aW9uMRQwEgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExCzAJBgNVBAYTAlVTMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEC6nEwMDIYZOj/iPWsCzaEKi71OiOSLRFhWGjbnBVJfVnkY4u3IjkDYYL0MxO4mqsyYjlBalTVYxFP2sJBK5zlKOBuzCBuDAfBgNVHSMEGDAWgBQiZQzWWp00ifODtJVSv1AbOScGrDBSBgNVHR8ESzBJMEegRaBDhkFodHRwczovL2NlcnRpZmljYXRlcy50cnVzdGVkc2VydmljZXMuaW50ZWwuY29tL0ludGVsU0dYUm9vdENBLmRlcjAdBgNVHQ4EFgQUImUM1lqdNInzg7SVUr9QGzknBqwwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwCgYIKoZIzj0EAwIDSQAwRgIhAOW/5QkR+S9CiSDcNoowLuPRLsWGf/Yi7GSX94BgwTwgAiEA4J0lrHoMs+Xo5o/sX6O9QWxHRAvZUGOdRQ7cvqRXaqI=', "base64");
+//# sourceMappingURL=intel-root.js.map

package/dist/intel-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intel-root.js","sourceRoot":"","sources":["../src/intel-root.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAChD,k3BAAk3B,EAAE,QAAQ,CAAC,CAAC"}

package/dist/json.d.ts

@@ -0,0 +1,3 @@
+import { type VerificationCategory } from "./error.js";
+export declare function assertJson(text: string, category: VerificationCategory): unknown;
+export declare function rawObjectMember(text: string, key: string, category: VerificationCategory): string;

package/dist/json.js

@@ -0,0 +1,234 @@
+import { fail } from "./error.js";
+function skip(cursor) {
+    while (cursor.i < cursor.text.length && " \n\r\t".includes(cursor.text[cursor.i])) {
+        cursor.i += 1;
+    }
+}
+function failAt(category, message) {
+    fail(category, message);
+}
+function parseValue(cursor, category) {
+    skip(cursor);
+    const ch = cursor.text[cursor.i];
+    if (ch === "{")
+        parseObject(cursor, category);
+    else if (ch === "[")
+        parseArray(cursor, category);
+    else if (ch === '"')
+        parseString(cursor, category);
+    else if (ch === "t" || ch === "f" || ch === "n")
+        parseLiteral(cursor, category);
+    else if (ch === "-" || (ch !== undefined && ch >= "0" && ch <= "9"))
+        parseNumber(cursor, category);
+    else
+        failAt(category, "malformed JSON");
+}
+function parseObject(cursor, category) {
+    cursor.i += 1;
+    skip(cursor);
+    const seen = new Set();
+    if (cursor.text[cursor.i] === "}") {
+        cursor.i += 1;
+        return;
+    }
+    for (;;) {
+        if (cursor.text[cursor.i] !== '"')
+            failAt(category, "JSON object key is not a string");
+        const key = parseString(cursor, category);
+        if (seen.has(key))
+            failAt(category, `JSON object has a duplicate key ${key}`);
+        seen.add(key);
+        skip(cursor);
+        if (cursor.text[cursor.i] !== ":")
+            failAt(category, "JSON object is missing a colon");
+        cursor.i += 1;
+        parseValue(cursor, category);
+        skip(cursor);
+        const next = cursor.text[cursor.i];
+        if (next === ",") {
+            cursor.i += 1;
+            skip(cursor);
+            continue;
+        }
+        if (next === "}") {
+            cursor.i += 1;
+            return;
+        }
+        failAt(category, "JSON object is not closed");
+    }
+}
+function parseArray(cursor, category) {
+    cursor.i += 1;
+    skip(cursor);
+    if (cursor.text[cursor.i] === "]") {
+        cursor.i += 1;
+        return;
+    }
+    for (;;) {
+        parseValue(cursor, category);
+        skip(cursor);
+        const next = cursor.text[cursor.i];
+        if (next === ",") {
+            cursor.i += 1;
+            skip(cursor);
+            continue;
+        }
+        if (next === "]") {
+            cursor.i += 1;
+            return;
+        }
+        failAt(category, "JSON array is not closed");
+    }
+}
+function parseString(cursor, category) {
+    if (cursor.text[cursor.i] !== '"')
+        failAt(category, "expected a JSON string");
+    cursor.i += 1;
+    let out = "";
+    while (cursor.i < cursor.text.length) {
+        const ch = cursor.text[cursor.i];
+        if (ch === '"') {
+            cursor.i += 1;
+            return out;
+        }
+        if (ch === "\\") {
+            const esc = cursor.text[cursor.i + 1];
+            if (esc === "u") {
+                const hex = cursor.text.slice(cursor.i + 2, cursor.i + 6);
+                if (!/^[0-9a-fA-F]{4}$/.test(hex))
+                    failAt(category, "bad unicode escape");
+                const code = Number.parseInt(hex, 16);
+                cursor.i += 6;
+                if (code >= 0xd800 && code <= 0xdbff) {
+                    if (cursor.text.slice(cursor.i, cursor.i + 2) !== "\\u") {
+                        failAt(category, "lone surrogate in JSON string");
+                    }
+                    const low = cursor.text.slice(cursor.i + 2, cursor.i + 6);
+                    if (!/^[0-9a-fA-F]{4}$/.test(low))
+                        failAt(category, "bad unicode escape");
+                    const lowCode = Number.parseInt(low, 16);
+                    if (lowCode < 0xdc00 || lowCode > 0xdfff)
+                        failAt(category, "lone surrogate in JSON string");
+                    cursor.i += 6;
+                    out += String.fromCodePoint(0x10000 + ((code - 0xd800) << 10) + (lowCode - 0xdc00));
+                }
+                else if (code >= 0xdc00 && code <= 0xdfff) {
+                    failAt(category, "lone surrogate in JSON string");
+                }
+                else {
+                    out += String.fromCharCode(code);
+                }
+                continue;
+            }
+            const simple = {
+                '"': '"',
+                "\\": "\\",
+                "/": "/",
+                b: "\b",
+                f: "\f",
+                n: "\n",
+                r: "\r",
+                t: "\t",
+            };
+            if (esc === undefined || !(esc in simple))
+                failAt(category, "bad JSON escape");
+            out += simple[esc];
+            cursor.i += 2;
+            continue;
+        }
+        if (ch < " ")
+            failAt(category, "raw control character in JSON string");
+        out += ch;
+        cursor.i += 1;
+    }
+    failAt(category, "unterminated JSON string");
+}
+function parseLiteral(cursor, category) {
+    const rest = cursor.text.slice(cursor.i);
+    for (const word of ["true", "false", "null"]) {
+        if (rest.startsWith(word)) {
+            cursor.i += word.length;
+            return;
+        }
+    }
+    failAt(category, "bad JSON literal");
+}
+function parseNumber(cursor, category) {
+    const start = cursor.i;
+    if (cursor.text[cursor.i] === "-")
+        cursor.i += 1;
+    if (cursor.text[cursor.i] === "0") {
+        cursor.i += 1;
+    }
+    else if (cursor.text[cursor.i] >= "1" && cursor.text[cursor.i] <= "9") {
+        while (cursor.text[cursor.i] >= "0" && cursor.text[cursor.i] <= "9")
+            cursor.i += 1;
+    }
+    else {
+        failAt(category, "bad JSON number");
+    }
+    if (cursor.text[cursor.i] === ".") {
+        cursor.i += 1;
+        if (cursor.text[cursor.i] < "0" || cursor.text[cursor.i] > "9")
+            failAt(category, "bad JSON number");
+        while (cursor.text[cursor.i] >= "0" && cursor.text[cursor.i] <= "9")
+            cursor.i += 1;
+    }
+    if (cursor.text[cursor.i] === "e" || cursor.text[cursor.i] === "E") {
+        failAt(category, "JSON numbers with exponents are not accepted");
+    }
+    const raw = cursor.text.slice(start, cursor.i);
+    if (raw.startsWith("-0") || raw.startsWith("00"))
+        failAt(category, "non-canonical JSON number");
+    const value = Number(raw);
+    if (!Number.isFinite(value))
+        failAt(category, "JSON number is not finite");
+}
+export function assertJson(text, category) {
+    const cursor = { text, i: 0 };
+    parseValue(cursor, category);
+    skip(cursor);
+    if (cursor.i !== text.length)
+        failAt(category, "trailing data after JSON");
+    return JSON.parse(text);
+}
+export function rawObjectMember(text, key, category) {
+    const cursor = { text, i: 0 };
+    skip(cursor);
+    if (cursor.text[cursor.i] !== "{")
+        fail(category, "expected a JSON object");
+    cursor.i += 1;
+    skip(cursor);
+    let found;
+    if (cursor.text[cursor.i] === "}")
+        fail(category, `JSON object has no ${key}`);
+    for (;;) {
+        const name = parseString(cursor, category);
+        skip(cursor);
+        if (cursor.text[cursor.i] !== ":")
+            fail(category, "JSON object is missing a colon");
+        cursor.i += 1;
+        skip(cursor);
+        const start = cursor.i;
+        parseValue(cursor, category);
+        if (name === key) {
+            if (found !== undefined)
+                fail(category, `duplicate ${key}`);
+            found = text.slice(start, cursor.i);
+        }
+        skip(cursor);
+        const next = cursor.text[cursor.i];
+        if (next === ",") {
+            cursor.i += 1;
+            skip(cursor);
+            continue;
+        }
+        if (next === "}")
+            break;
+        fail(category, "JSON object is not closed");
+    }
+    if (found === undefined)
+        fail(category, `JSON object has no ${key}`);
+    return found;
+}
+//# sourceMappingURL=json.js.map

package/dist/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAA6B,MAAM,YAAY,CAAC;AAO7D,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACnF,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,QAA8B,EAAE,OAAe;IAC7D,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,QAA8B;IAChE,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,GAAG;QAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;SACzC,IAAI,EAAE,KAAK,GAAG;QAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;SAC7C,IAAI,EAAE,KAAK,GAAG;QAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;SAC9C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;QAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;SAC3E,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,IAAI,GAAG,CAAC;QAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;;QAC9F,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,QAA8B;IACjE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACd,OAAO;IACT,CAAC;IACD,SAAS,CAAC;QACR,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,CAAC,QAAQ,EAAE,iCAAiC,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,QAAQ,EAAE,mCAAmC,GAAG,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;QACtF,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACd,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,QAA8B;IAChE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACd,OAAO;IACT,CAAC;IACD,SAAS,CAAC;QACR,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,QAA8B;IACjE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAC9E,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC;QAClC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YACd,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;gBAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACtC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;gBACd,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;oBACrC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;wBACxD,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;oBACpD,CAAC;oBACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;oBAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACzC,IAAI,OAAO,GAAG,MAAM,IAAI,OAAO,GAAG,MAAM;wBAAE,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;oBAC5F,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;oBACd,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;gBACtF,CAAC;qBAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;oBAC5C,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;gBACpD,CAAC;qBAAM,CAAC;oBACN,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnC,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAA2B;gBACrC,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,GAAG;gBACR,CAAC,EAAE,IAAI;gBACP,CAAC,EAAE,IAAI;gBACP,CAAC,EAAE,IAAI;gBACP,CAAC,EAAE,IAAI;gBACP,CAAC,EAAE,IAAI;aACR,CAAC;YACF,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;gBAAE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;YAC/E,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,EAAE,GAAG,GAAG;YAAE,MAAM,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAC;QACvE,GAAG,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,QAA8B;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,QAA8B;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,GAAG,EAAE,CAAC;QAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,GAAG;YAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,GAAG,GAAG;YAAE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACtG,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,GAAG;YAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACnE,MAAM,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,QAA8B;IACrE,MAAM,MAAM,GAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACtC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,MAAM,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAW,EAAE,QAA8B;IACvF,MAAM,MAAM,GAAW,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;IAC5E,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,IAAI,KAAyB,CAAC;IAC9B,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,IAAI,CAAC,QAAQ,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAC/E,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,IAAI,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC;QACpF,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC;QACvB,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;YAC5D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACxB,IAAI,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,2 @@
+import type { TdReport } from "./quote.js";
+export declare function appraiseTdx(td: TdReport, version: number, vendor: Buffer, evalData: number): void;

package/dist/policy.js

@@ -0,0 +1,37 @@
+import { zero } from "./bytes.js";
+import { fail } from "./error.js";
+const MINIMUM_EVAL = 19;
+const MINIMUM_SVN = [3, 1, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+const TD_ATTRIBUTES = Buffer.from("0000001000000000", "hex");
+const XFAM = Buffer.from("e702060000000000", "hex");
+const MRSEAMS = new Set([
+    "476a2997c62bccc78370913d0a80b956e3721b24272bc66c4d6307ced4be2865c40e26afac75f12df3425b03eb59ea7c",
+    "7bf063280e94fb051f5dd7b1fc59ce9aac42bb961df8d44b709c9b0ff87a7b4df648657ba6d1189589feab1d5a3c9a9d",
+    "d0d80c085166ba78ccc69af268e5753cf0f3394523cb4ff7c50b08d9265c82489c099c377be6a400e4d2b57da924012c",
+    "489e585f1c54bc5a02066c8c6ec21619ff0334ec6f21e07e2a35202c59183789c8057e7d97dd591bb08314b185819e72",
+    "fca4ff221293807e3d247416299ca39a236872df4eb414567ca96072d3fde7dead740f807eefe2f7d938499c03cc8aba",
+    "aef4ed3e686fe6cf44c9a8d1cc63105443b558ac4f40c282abf78271e9a4586c50408c8584c7b43fd21edb736700ba5f",
+]);
+export function appraiseTdx(td, version, vendor, evalData) {
+    if (version !== 4)
+        fail("tdx", `unsupported TDX quote version ${version}`);
+    if (!vendor.equals(Buffer.from("939a7233f79c4ca9940a0db3957f0607", "hex"))) {
+        fail("tdx", "unexpected QE vendor ID");
+    }
+    if (evalData < MINIMUM_EVAL)
+        fail("tdx", `TCB evaluation data number ${evalData} is below ${MINIMUM_EVAL}`);
+    for (let i = 0; i < MINIMUM_SVN.length; i += 1) {
+        if (td.teeTcbSvn[i] < MINIMUM_SVN[i]) {
+            fail("tdx", `TEE TCB SVN component ${i} is below the minimum`);
+        }
+    }
+    if (!MRSEAMS.has(td.mrSeam.toString("hex")))
+        fail("tdx", "TDX module measurement is not accepted");
+    if (!td.tdAttributes.equals(TD_ATTRIBUTES))
+        fail("tdx", "TD_ATTRIBUTES mismatch");
+    if (!td.xfam.equals(XFAM))
+        fail("tdx", "XFAM mismatch");
+    if (!zero(td.rtmrs[3]))
+        fail("tdx", "RTMR3 must be zero");
+}
+//# sourceMappingURL=policy.js.map