@counterfact-labs/cli 0.1.3 → 0.2.3

package/dist/contract/messages.js

@@ -0,0 +1,252 @@
+import { z } from "zod";
+import { executionRequest } from "../analysis-core/contracts/requests.js";
+import { checkRuntimeEnvironment } from "./runtime-environment.js";
+/**
+ * The messages that cross between the customer's machine and the sealed relay. This module is the only owner of
+ * their shape: the relay, the gatekeeper and the bundle tooling all import these schemas and never redefine them.
+ * Design: docs/design/sealed-model-relay.md and docs/design/relay-contract.md.
+ */
+const compactJwtPattern = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+const hexChallenge = z.string().length(64).regex(/^[0-9a-f]+$/);
+/** The wire adds routing identity to the core's data-only execution envelope. */
+export const relayRequest = executionRequest.extend({
+    bundleVersion: z.string().min(1).max(128),
+    reservationId: z.string().min(1).max(128),
+    reservationToken: z.string().min(1).max(256),
+    /** Stable paid-call identity; required by the production delivery transport. */
+    callId: z.uuid(),
+    /** Fresh per call, echoed in the answer, so an answer cannot be replayed into another call. */
+    nonce: z.string().min(16).max(256),
+    template: z.string().min(1).max(128),
+    answerFormat: z.string().min(1).max(128),
+    limits: executionRequest.shape.limits.unwrap().extend({ maxTokens: z.number().int().positive().safe().max(64_000).optional() }).optional(),
+}).strict();
+export const relayUsage = z.object({
+    inputTokens: z.number().int().nonnegative().safe(),
+    outputTokens: z.number().int().nonnegative().safe(),
+    cacheReadTokens: z.number().int().nonnegative().safe(),
+    cacheWriteTokens: z.number().int().nonnegative().safe(),
+    cacheWrite5mTokens: z.number().int().nonnegative().safe().optional(),
+    cacheWrite1hTokens: z.number().int().nonnegative().safe().optional(),
+}).strict();
+export const relayAnswer = z.discriminatedUnion("ok", [
+    z.object({
+        ok: z.literal(true),
+        nonce: z.string().max(256),
+        /** Validated against the shared format; local parsing applies defaults, fallbacks and cleanup. */
+        answer: z.unknown(),
+        usage: relayUsage,
+        /** True when the answer quoted our instruction text and the relay removed it. */
+        redacted: z.boolean(),
+    }).strict(),
+    z.object({
+        ok: z.literal(false),
+        nonce: z.string().max(256),
+        code: z.enum(["bad_request", "unknown_template", "bundle_version", "reservation", "model_failed", "leak_refused", "call_in_progress", "call_status", "busy"]),
+    }).strict(),
+]);
+export const RELAY_TLS_EXPORTER_LABEL = "EXPORTER-counterfact-relay-v1";
+export const RELAY_MAX_FRAME_BYTES = 2 * 1024 * 1024;
+export const deliveryConfirmation = z.object({
+    callId: z.uuid(), attemptId: z.uuid(), connectionId: z.uuid(),
+    challenge: hexChallenge,
+}).strict();
+/** The challenge is released with the complete answer, never in headers or a separate preliminary frame. */
+export const relayAnswerFrame = z.object({
+    answer: relayAnswer,
+    delivery: z.object({ confirmation: deliveryConfirmation, deadlineMs: z.number().int().positive().safe() }).strict().optional(),
+}).strict().refine(frame => frame.answer.ok === (frame.delivery !== undefined));
+export const deliveryReceipt = z.object({ receiptId: z.uuid() }).strict();
+// This is the count-only server boundary; it never accepts arbitrary diagnostics or request content.
+const billingId = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/);
+const billingScope = { actionId: z.uuid(), reservationId: z.uuid(), reservationToken: z.string().min(1).max(256), callId: z.uuid() };
+const inputCount = z.number().int().nonnegative().max(200_000);
+const outputCount = z.number().int().nonnegative().max(64_000);
+/** A reservation lookup establishes the owner without reserving spend or contacting the model provider. */
+export const reservationCheck = z.object({ action: z.literal("check"), ...billingScope }).strict();
+export const reservationIdentity = z.object({ clientId: z.string().min(1).max(128) }).strict();
+export const callCounts = z.object({ inputBytes: z.number().int().positive().max(800_000),
+    inputTokens: inputCount.positive(), maxOutputTokens: outputCount.positive() }).strict();
+export const authorizationRequest = z.object({ action: z.literal("authorize"), ...billingScope,
+    routeId: billingId, templateId: billingId, answerFormatId: billingId, model: billingId, ...callCounts.shape }).strict();
+export const callAuthorization = z.object({ attemptId: z.uuid(), model: billingId, role: z.enum(["required", "optional"]),
+    /** Stable opaque owner supplied only by the authenticated authorization service. */
+    clientId: reservationIdentity.shape.clientId,
+    deadline: z.iso.datetime(), countLimits: z.object({ maxInputBytes: z.number().int().positive().max(800_000),
+        maxInputTokens: inputCount.positive(), maxOutputTokens: outputCount.positive() }).strict() }).strict();
+export const providerUsage = z.object({ kind: z.enum(["actual", "estimated", "unpaid"]),
+    outcome: z.enum(["success", "unknown", "retryable_failure", "terminal_provider_failure", "schema_refusal", "leak_refusal"]),
+    inputTokens: inputCount, outputTokens: outputCount, cacheReadTokens: inputCount, cacheWriteTokens: inputCount,
+    cacheWrite5mTokens: inputCount.optional(), cacheWrite1hTokens: inputCount.optional() }).strict();
+export const serviceTiming = z.object({ kind: z.enum(["relay", "provider"]), startedAt: z.number().int().nonnegative().safe(),
+    endedAt: z.number().int().nonnegative().safe() }).strict().refine(timing => timing.endedAt >= timing.startedAt);
+export const usageReport = z.object({ action: z.literal("usage"), ...billingScope, attemptId: z.uuid(),
+    usage: providerUsage, timing: z.array(serviceTiming).max(2) }).strict();
+export const deliveryReport = z.object({ action: z.literal("delivery"), ...billingScope, attemptId: z.uuid(),
+    delivery: z.discriminatedUnion("status", [
+        z.object({ status: z.literal("confirmed"), confirmation: deliveryConfirmation.extend({
+                challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+            }) }).strict(),
+        z.object({ status: z.enum(["unknown", "failed"]) }).strict(),
+    ]) }).strict();
+export const reservationAction = z.discriminatedUnion("action", [reservationCheck, authorizationRequest, usageReport, deliveryReport]);
+export const RELAY_HEALTH_VERSION = 2;
+export const RELAY_HEALTH_AUDIENCE = "counterfact-relay-health";
+export const RELAY_HEALTH_MAX_REQUEST_BYTES = 1024;
+/** Billing supplies a fresh random challenge; this route accepts no analysis data. */
+export const relayHealthRequest = z.object({
+    version: z.literal(RELAY_HEALTH_VERSION),
+    challenge: hexChallenge,
+}).strict();
+export const relayHealthRelease = z.object({
+    releaseId: z.string().min(1).max(128),
+    relayVersion: z.string().min(1).max(128),
+    bundleVersion: z.string().min(1).max(128),
+    workloadPolicySha256: z.string().regex(/^[0-9a-f]{64}$/),
+}).strict();
+export const relayHealthFilesystem = z.object({
+    readOnlyRootFilesystem: z.boolean(),
+    tmpFilesystemType: z.string().min(1).max(128).regex(/^[a-zA-Z0-9._-]+$/),
+}).strict();
+export const relayHealthResponse = z.discriminatedUnion("ok", [
+    z.object({
+        version: z.literal(RELAY_HEALTH_VERSION),
+        ok: z.literal(true),
+        bootId: z.uuid(),
+        challenge: hexChallenge,
+        release: relayHealthRelease,
+        filesystem: relayHealthFilesystem,
+        /** The evidence owner authenticates the audience and all three nonces before release. */
+        evidence: z.string().max(32 * 1024).regex(compactJwtPattern),
+    }).strict(),
+    z.object({
+        version: z.literal(RELAY_HEALTH_VERSION),
+        ok: z.literal(false),
+        code: z.enum(["bad_request", "unavailable"]),
+    }).strict(),
+]);
+export const PRODUCTION_EVIDENCE_VERSION = 1;
+export const RELAY_CHANNEL_AUDIENCE = "https://relay.counterfactlabs.com";
+// Passthrough forwarding keeps the non-root workload's listener port unchanged.
+export const RELAY_PORT = 8443;
+export const RELAY_URL = `${RELAY_CHANNEL_AUDIENCE}:${RELAY_PORT}`;
+export const RELAY_HEALTH_PATH = "/health";
+export const RELAY_HEALTH_URL = `${RELAY_URL}${RELAY_HEALTH_PATH}`;
+export const GOOGLE_ATTESTATION_ISSUER = "https://confidentialcomputing.googleapis.com";
+export const MAX_ATTESTATION_BYTES = 32 * 1024;
+export const attestationChallenge = z.object({
+    version: z.literal(PRODUCTION_EVIDENCE_VERSION),
+    challenge: hexChallenge,
+}).strict();
+export const productionEvidence = z.object({
+    version: z.literal(PRODUCTION_EVIDENCE_VERSION),
+    token: z.string().max(MAX_ATTESTATION_BYTES).regex(compactJwtPattern),
+}).strict();
+/** Google's launcher accepts up to six caller nonces, each at most 74 characters. */
+export const evidenceBinding = z.object({
+    audience: z.string().min(1).max(256).regex(/^[A-Za-z0-9:/._-]+$/),
+    nonces: z.array(z.string().min(1).max(74).regex(/^[A-Za-z0-9_:-]+$/)).min(1).max(6),
+}).strict();
+/** Native claims are interpreted only after the PKI chain and token signature are authenticated. */
+export const googleAttestationClaims = z.object({
+    iss: z.literal(GOOGLE_ATTESTATION_ISSUER),
+    aud: z.string(),
+    sub: z.string(),
+    iat: z.number().int(),
+    nbf: z.number().int(),
+    exp: z.number().int(),
+    eat_nonce: z.union([z.string(), z.array(z.string()).min(1).max(6)]),
+    secboot: z.literal(true),
+    dbgstat: z.literal("disabled-since-boot"),
+    oemid: z.literal(11129),
+    hwmodel: z.string(),
+    swname: z.literal("CONFIDENTIAL_SPACE"),
+    swversion: z.array(z.string()).length(1),
+    google_service_accounts: z.array(z.string()).min(1),
+    development: z.never().optional(),
+    identity: z.never().optional(),
+    submods: z.object({
+        confidential_space: z.object({
+            support_attributes: z.array(z.string()),
+            monitoring_enabled: z.object({ memory: z.literal(false) }).passthrough(),
+        }).passthrough(),
+        container: z.object({
+            image_digest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+            image_signatures: z.array(z.object({
+                key_id: z.string(), signature: z.string().min(1),
+                signature_algorithm: z.literal("RSASSA_PSS_SHA256"),
+            }).passthrough()).min(1),
+            // Google omits both override claims when nothing was overridden; when present they must still be empty.
+            cmd_override: z.array(z.unknown()).length(0).optional(),
+            env_override: z.object({}).strict().optional(),
+            // Real tokens list the container's own environment; the relay's start-up rule decides which settings are allowed.
+            env: z.record(z.string(), z.string()).refine(env => {
+                try {
+                    checkRuntimeEnvironment(env);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            }),
+        }).passthrough(),
+    }).passthrough(),
+}).passthrough();
+/** Authenticated observations describe a refused workload without granting it an admitted identity. */
+export const observedAttestationClaims = googleAttestationClaims.extend({
+    dbgstat: z.string(),
+    submods: googleAttestationClaims.shape.submods.extend({
+        container: googleAttestationClaims.shape.submods.shape.container.extend({
+            image_signatures: z.array(googleAttestationClaims.shape.submods.shape.container.shape.image_signatures.element),
+            cmd_override: z.array(z.unknown()).optional(),
+            env_override: z.record(z.string(), z.unknown()).optional(),
+        }),
+    }),
+});
+/**
+ * Local development claims. These cannot establish production identity; production uses native Google claims.
+ */
+export const attestationClaims = z.object({
+    iss: z.string().url(),
+    /** The relay image's digest. Must be one we published. */
+    imageDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    /** Hash of the relay's channel public key, so the token is bound to this connection. */
+    channelKeyHash: z.string().regex(/^[0-9a-f]{64}$/),
+    exp: z.number().int(),
+    iat: z.number().int(),
+}).passthrough();
+const assetMetadata = z.object({
+    /** HMAC-SHA256 keyed by a secret stored only in the encrypted payload. */
+    fingerprint: z.string().regex(/^[0-9a-f]{64}$/),
+    size: z.number().int().nonnegative(),
+}).strict();
+export const bundleMetadata = z.object({
+    templates: z.record(z.string().min(1), assetMetadata.extend({
+        role: z.enum(["required", "optional"]),
+        answerFormats: z.array(z.string().min(1)).min(1),
+    }).strict()),
+    includes: z.record(z.string().min(1), assetMetadata.extend({
+        expandedSize: z.number().int().nonnegative(),
+        expandedFingerprint: z.string().regex(/^[0-9a-f]{64}$/),
+    }).strict()),
+    descriptions: z.record(z.string().min(1), assetMetadata),
+    headlinePlan: assetMetadata.extend({ inputOverheadBytes: z.number().int().nonnegative(), evidenceCopies: z.number().int().nonnegative(),
+        resultVersion: z.number().int().positive().optional() }).strict().optional(),
+}).strict();
+/** The sealed instruction bundle as shipped with the CLI. Only the relay can open `sealed`. */
+export const sealedBundle = z.object({
+    version: z.string().min(1),
+    /** The relay versions able to open this bundle. */
+    relayVersions: z.array(z.string().min(1)).min(1),
+    /** Template names and answer formats are public; the wording is not (design section 9). */
+    templates: z.array(z.string().min(1)),
+    answerFormats: z.array(z.string().min(1)),
+    metadata: bundleMetadata,
+    /** AES-256-GCM over the serialised registry and private fingerprint key, base64. */
+    sealed: z.string().min(1),
+    iv: z.string().min(1),
+    /** The data key, wrapped by the key service so it is released only to an attested relay image. */
+    wrappedKey: z.string().min(1),
+    /** Ed25519 signature by our release key over every field above, base64. */
+    signature: z.string().min(1),
+}).strict();

package/dist/contract/release-key.js

@@ -0,0 +1,2 @@
+// Changing the release key requires a reviewed CLI release, independent of bundle metadata.
+export const RELEASE_KEY_SPKI_SHA256 = "470601058e910027392fca337233926b6ec38311472307b44c78c5b21d5dfc9c";

package/dist/contract/runtime-environment.js

@@ -0,0 +1,37 @@
+// The pinned distroless base image sets SSL_CERT_FILE to its bundled certificates. The relay accepts exactly that
+// value, so the image works while no operator setting can point the relay at a different trust store.
+export const BASE_CERTIFICATE_FILE = "/etc/ssl/certs/ca-certificates.crt";
+const fixedValues = Object.freeze({ SSL_CERT_FILE: BASE_CERTIFICATE_FILE });
+// Native startup consumes these data, so loader checks have the same owner as runtime checks.
+export const runtimeEnvironmentPolicy = Object.freeze({
+    fixedValues,
+    forbiddenPrefixes: ["CF_RELAY_", "ANTHROPIC_", "GOOGLE_AUTH_", "LD_"],
+    forbiddenNames: ["GOOGLE_APPLICATION_CREDENTIALS", "NODE_OPTIONS", "NODE_USE_ENV_PROXY", "NODE_EXTRA_CA_CERTS",
+        "NODE_TLS_REJECT_UNAUTHORIZED", "SSL_CERT_DIR", "GLIBC_TUNABLES", "GCONV_PATH"],
+    forbiddenNamesIgnoringCase: ["http_proxy", "https_proxy", "all_proxy"],
+});
+export const reviewedNativeImageEnvironment = Object.freeze([
+    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    `SSL_CERT_FILE=${BASE_CERTIFICATE_FILE}`, "NODE_ENV=production", "TMPDIR=/tmp",
+]);
+/** Refuses settings that could redirect credentials, trust or traffic; the image checker reads the same fixed values. */
+export function checkRuntimeEnvironment(env) {
+    for (const name of Object.keys(env)) {
+        const value = env[name];
+        if (value === undefined || value === "")
+            continue;
+        if (fixedValues[name] !== undefined) {
+            if (value !== fixedValues[name])
+                throw new Error();
+            continue;
+        }
+        if (runtimeEnvironmentPolicy.forbiddenPrefixes.some(prefix => name.startsWith(prefix)) ||
+            runtimeEnvironmentPolicy.forbiddenNamesIgnoringCase.includes(name.toLowerCase()) ||
+            runtimeEnvironmentPolicy.forbiddenNames.includes(name))
+            throw new Error();
+    }
+}
+/** True when an image configuration Env entry pins one of the fixed values the runtime accepts. */
+export function isFixedImageEnvironment(entry) {
+    return Object.entries(fixedValues).some(([name, value]) => entry === `${name}=${value}`);
+}

package/dist/core/analysis/finding-quality/config.js

@@ -0,0 +1,4 @@
+export { readLocalQualityConfig as readFindingQualityConfig } from "../../../adapters/quality.js";
+import { assertFindingQualityPrompts as assertSharedPrompts } from "../../../analysis-core/analysis/finding-quality/config.js";
+import { readableRequestTools } from "../../../adapters/instructions.js";
+export const assertFindingQualityPrompts = (config) => assertSharedPrompts(config, readableRequestTools());

package/dist/core/analysis/run-to-end.js

@@ -0,0 +1,55 @@
+import { JobError } from "../../analysis-core/errors.js";
+import { readAnalysisFlags } from "../../analysis-core/analysis/analysis-flags.js";
+import { mapStage, inspectStage, sourceNotesStage, headlinesStage, applyAnalysisDelta, buildAnalysisResult } from "../../analysis-core/index.js";
+import { readFindingQualityConfig } from "./finding-quality/config.js";
+import { buildLocalReport } from "../../adapters/report.js";
+import { runStructures } from "./structural-run.js";
+import { analysisExecution } from "../../adapters/models.js";
+/** Keep the hosted stage order while holding source files and results only in memory. */
+export async function runAnalysisToEnd(input, model, settings = {}, options = {}) {
+    const execution = await analysisExecution(model, options, settings);
+    const { model: llm, requestTools: tools } = execution;
+    const flags = readAnalysisFlags(settings);
+    const qualityConfig = readFindingQualityConfig(settings, tools);
+    if (!Object.keys(input.files).length)
+        throw new JobError("empty_folder", "No admitted source files were found.");
+    let prepared = { repos: [{ key: input.repoKey, kind: "fs", files: input.files, ...(input.root !== undefined ? { root: input.root } : {}) }],
+        warnings: input.warnings ?? [], ...(input.fragment ? { mapped: [input.fragment] } : {}) };
+    const ports = { readers: [], model: llm, instructions: execution.instructions, requestTools: async () => tools, context: {},
+        progress: { checkpoint: async () => { }, assertHeld: () => { }, elapsedMs: () => 0, log: () => { } } };
+    for (;;) {
+        const delta = await mapStage({ phase: "mapping", state: prepared, settings, execution: { scopeConcurrency: 4, forLocal: true,
+                preparation: { capUsd: 20, confirmPrice: false, qualityConfig } } }, ports);
+        prepared = applyAnalysisDelta(prepared, delta);
+        if (delta.next !== "mapping")
+            break;
+    }
+    prepared = { ...prepared, analysisFlags: { ...flags, sourceNotes: !options.findingsOnly && flags.sourceNotes },
+        findingQuality: { config: qualityConfig }, warnings: [...(prepared.warnings ?? []), ...qualityConfig.diagnostics] };
+    let phase = "inspecting";
+    ports.progress.checkpoint = async (fields, part) => {
+        prepared = { ...prepared, ...fields, ...(part ? { passResults: { ...prepared.passResults, [part.index]: part.result } } : {}) };
+    };
+    while (phase !== "structuring") {
+        const step = phase === "inspecting" ? inspectStage : sourceNotesStage;
+        const delta = await step({ phase, state: prepared, settings, execution: { scopeConcurrency: 4, passConcurrency: 4, forLocal: true } }, ports);
+        prepared = applyAnalysisDelta(prepared, delta);
+        phase = delta.next;
+    }
+    const output = () => buildAnalysisResult({ phase: "persisting", state: prepared, settings, execution: { scopeConcurrency: 4 } });
+    // Structural child references index the local display order, including optional ranking.
+    const report = buildLocalReport(input.repoKey, output(), prepared);
+    if (!options.findingsOnly) {
+        const findingsRaw = prepared.findingsRaw;
+        const structural = await runStructures(settings, llm, { repos: prepared.repos,
+            fragments: [{ repoKey: input.repoKey, fragment: prepared.mapped[0] }],
+            graph: report.graph, findings: report.findings, state: prepared }, { execution });
+        // Structural child references keep display order; wording uses the original cleaned order.
+        prepared = { ...structural.state, findingsRaw };
+    }
+    prepared = applyAnalysisDelta(prepared, await headlinesStage({ phase: "persisting", state: prepared, settings,
+        execution: { scopeConcurrency: 4, forLocal: true } }, ports));
+    const result = output();
+    await options.resultSink?.(result);
+    return buildLocalReport(input.repoKey, result, prepared);
+}

package/dist/core/analysis/structural-run.js

@@ -0,0 +1,16 @@
+import { structureStage, applyAnalysisDelta } from "../../analysis-core/index.js";
+import { analysisExecution } from "../../adapters/models.js";
+/** The local product supplies its in-memory allowance; the shared stage owns every transition. */
+export async function runStructures(settings, model, input, options = {}) {
+    const execution = await analysisExecution(model, options, settings);
+    let state = { ...input.state, repos: input.repos, mapped: input.fragments.map(({ fragment }) => fragment),
+        findingsRaw: input.findings, warnings: input.state?.warnings ?? [], splitCheckPriced: true, splitFindingsPriced: true };
+    const ports = { readers: [], model: execution.model, instructions: execution.instructions, requestTools: async () => execution.requestTools, context: {},
+        progress: { checkpoint: async () => { }, assertHeld: () => { }, elapsedMs: () => 0, log: () => { } } };
+    for (;;) {
+        const delta = await structureStage({ phase: "structuring", state, settings, execution: { scopeConcurrency: 4, forLocal: true } }, ports);
+        state = applyAnalysisDelta(state, delta);
+        if (delta.next === "persisting")
+            return { state, structures: (state.structuresRaw ?? []), warnings: state.warnings ?? [] };
+    }
+}

package/dist/gatekeeper/attestation.js

@@ -0,0 +1,67 @@
+import { createHash, verify } from "node:crypto";
+import { z } from "zod";
+import { MAX_ATTESTATION_BYTES, attestationClaims } from "../contract/messages.js";
+import { decodeBase64url } from "../transport/base64url.js";
+export function attestationPolicy(settings, trust) {
+    return { ...trust, allowDevelopment: settings.CF_RELAY_DEV === "1" };
+}
+export class AttestationError extends Error {
+    name = "AttestationError";
+}
+const tokenHeader = z.object({
+    alg: z.literal("EdDSA"), kid: z.string().min(1).optional(), typ: z.literal("JWT").optional(),
+}).strict();
+/** Local signatures never establish a production identity, even if an old RSA issuer policy is supplied. */
+export function verifyAttestation(token, channelPublicKey, policy, now = Math.floor(Date.now() / 1000)) {
+    if (!policy.allowDevelopment)
+        throw new AttestationError("Relay development issuer is disabled");
+    let payload;
+    try {
+        if (token.length > MAX_ATTESTATION_BYTES)
+            throw new Error();
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            throw new Error();
+        const [header, body, signature] = parts;
+        const parsed = tokenHeader.parse(JSON.parse(decodeBase64url(header).toString("utf8")));
+        payload = decodeBase64url(body);
+        const issuer = policy.developmentIssuer;
+        const key = issuer?.keys.find(item => parsed.kid === undefined || item.kid === parsed.kid)?.publicKey;
+        if (!key || key.type !== "public" || key.asymmetricKeyType !== "ed25519" ||
+            !verify(null, Buffer.from(`${header}.${body}`), key, decodeBase64url(signature))) {
+            throw new AttestationError("Invalid relay attestation signature");
+        }
+    }
+    catch (error) {
+        if (error instanceof AttestationError)
+            throw error;
+        throw new AttestationError("Malformed relay attestation token");
+    }
+    const result = attestationClaims.safeParse((() => {
+        try {
+            return JSON.parse(payload.toString("utf8"));
+        }
+        catch {
+            return undefined;
+        }
+    })());
+    if (!result.success)
+        throw new AttestationError("Invalid relay attestation claims");
+    const claims = result.data;
+    if (claims.iss !== policy.developmentIssuer?.issuer)
+        throw new AttestationError("Untrusted relay attestation issuer");
+    if (!policy.imageDigests.includes(claims.imageDigest))
+        throw new AttestationError("Untrusted relay image digest");
+    if (!Number.isSafeInteger(now))
+        throw new AttestationError("Invalid attestation clock");
+    if (claims.exp <= now)
+        throw new AttestationError("Relay attestation has expired");
+    if (claims.iat > now || claims.exp <= claims.iat)
+        throw new AttestationError("Invalid relay attestation lifetime");
+    if (channelPublicKey.type !== "public")
+        throw new AttestationError("Invalid relay channel key");
+    const hash = createHash("sha256").update(channelPublicKey.export({ format: "der", type: "spki" })).digest("hex");
+    if (claims.channelKeyHash !== hash)
+        throw new AttestationError("Relay attestation channel key mismatch");
+    return claims;
+}

package/dist/gatekeeper/certificate-algorithms.js

@@ -0,0 +1,18 @@
+export const RSA_PSS_SIGNATURE_ALGORITHM = "1.2.840.113549.1.1.10";
+const curves = new Set(["prime256v1", "secp384r1", "secp521r1"]);
+const signatures = new Set([
+    "1.2.840.113549.1.1.11", "1.2.840.113549.1.1.12", "1.2.840.113549.1.1.13",
+    "1.2.840.10045.4.3.2", "1.2.840.10045.4.3.3", "1.2.840.10045.4.3.4",
+    "1.3.101.112", "1.3.101.113",
+]);
+const pssHashes = new Set(["2.16.840.1.101.3.4.2.1", "2.16.840.1.101.3.4.2.2", "2.16.840.1.101.3.4.2.3"]);
+/** WebCrypto can verify obsolete algorithms; accepting a signature also requires a local strength policy. */
+export function hasStrongCertificateAlgorithms(algorithms) {
+    const { keyType, modulusLength, namedCurve, signatureAlgorithm, pssHashAlgorithm } = algorithms;
+    const strongKey = keyType === "rsa" || keyType === "rsa-pss" ? (modulusLength ?? 0) >= 2048
+        : keyType === "ec" ? curves.has(namedCurve ?? "") : keyType === "ed25519" || keyType === "ed448";
+    if (!strongKey)
+        return false;
+    return signatureAlgorithm === RSA_PSS_SIGNATURE_ALGORITHM
+        ? pssHashes.has(pssHashAlgorithm ?? "") : signatures.has(signatureAlgorithm);
+}

package/dist/gatekeeper/certificate-path.js

@@ -0,0 +1,99 @@
+import { X509Certificate, webcrypto } from "node:crypto";
+import { BitString, fromBER } from "asn1js";
+import { BasicConstraints, Certificate, CertificateChainValidationEngine, CryptoEngine, ExtensionValueFactory, RSASSAPSSParams } from "pkijs";
+import { AttestationError } from "./attestation.js";
+import { hasStrongCertificateAlgorithms, RSA_PSS_SIGNATURE_ALGORITHM } from "./certificate-algorithms.js";
+const crypto = new CryptoEngine({ name: "node", crypto: webcrypto,
+    subtle: webcrypto.subtle });
+function parseCertificate(cert) {
+    const bytes = Uint8Array.from(cert.raw);
+    const decoded = fromBER(bytes.buffer);
+    if (decoded.offset !== bytes.length)
+        throw new Error();
+    return new Certificate({ schema: decoded.result });
+}
+function checkPathConstraints(path) {
+    let intermediateCount = 0;
+    for (const [index, cert] of path.entries()) {
+        for (const extension of cert.extensions ?? []) {
+            if (!extension.critical)
+                continue;
+            // PKIjs also parses unknown extensions as generic ASN.1; parsing alone does not establish recognition.
+            // Subject key identifier, key usage and inhibit-any-policy use primitive ASN.1 rather than registered classes.
+            const recognized = ExtensionValueFactory.find(extension.extnID) || ["2.5.29.14", "2.5.29.15", "2.5.29.54"].includes(extension.extnID);
+            const value = extension.parsedValue;
+            if (!recognized || !value || "parsingError" in value)
+                throw new Error();
+        }
+        // PKIjs does not enforce pathLenConstraint. Count only non-self-issued CAs below each issuer, never the leaf.
+        const constraints = cert.extensions?.find(extension => extension.extnID === "2.5.29.19")?.parsedValue;
+        if (constraints instanceof BasicConstraints && constraints.pathLenConstraint !== undefined) {
+            const limit = constraints.pathLenConstraint;
+            if (intermediateCount > (typeof limit === "number" ? limit : limit.toBigInt()))
+                throw new Error();
+        }
+        if (index > 0 && !cert.subject.isEqual(cert.issuer))
+            intermediateCount++;
+    }
+}
+/** PKIjs owns path validation; only shipped roots are trusted, with no network or system CA discovery. */
+export async function validateCertificatePath(chain, roots, now) {
+    try {
+        if (!Number.isSafeInteger(now) || chain.length < 1 || chain.length > 5 || !roots.length || roots.length > 8)
+            throw new Error();
+        // Reviewed root rotations can overlap; an unused expired anchor must not invalidate a different valid path.
+        const current = (cert) => now * 1000 >= Date.parse(cert.validFrom) && now * 1000 < Date.parse(cert.validTo);
+        const anchors = roots.map(root => new X509Certificate(root)).filter(root => root.ca && current(root));
+        if (!anchors.length || chain.some(cert => !current(cert)))
+            throw new Error();
+        const [leaf] = chain;
+        if (leaf.ca || leaf.publicKey.asymmetricKeyType !== "rsa")
+            throw new Error();
+        // Path builders may discard extraneous certificates; the wire format requires one ordered, connected path.
+        if (new Set(chain.map(cert => cert.fingerprint256)).size !== chain.length)
+            throw new Error();
+        for (let index = 1; index < chain.length; index++) {
+            if (!chain[index].ca || !chain[index - 1].checkIssued(chain[index]))
+                throw new Error();
+        }
+        const isAnchor = (cert) => anchors.some(root => root.fingerprint256 === cert.fingerprint256);
+        const last = chain.at(-1);
+        if (last.checkIssued(last) && !isAnchor(last))
+            throw new Error();
+        const supplied = chain.map(cert => ({ cert, parsed: parseCertificate(cert) }));
+        const trusted = anchors.map(cert => ({ cert, parsed: parseCertificate(cert) }));
+        for (const { cert, parsed } of [...supplied, ...trusted]) {
+            const key = cert.publicKey;
+            const signature = parsed.signatureAlgorithm;
+            const pssHashAlgorithm = signature.algorithmId === RSA_PSS_SIGNATURE_ALGORITHM && signature.algorithmParams
+                ? new RSASSAPSSParams({ schema: signature.algorithmParams }).hashAlgorithm.algorithmId : undefined;
+            if (!hasStrongCertificateAlgorithms({ keyType: key.asymmetricKeyType,
+                modulusLength: key.asymmetricKeyDetails?.modulusLength, namedCurve: key.asymmetricKeyDetails?.namedCurve,
+                signatureAlgorithm: signature.algorithmId, pssHashAlgorithm }))
+                throw new Error();
+        }
+        // RFC 5280: a leaf without a key usage extension is unrestricted, and Google's Confidential Space leaves omit it.
+        // When the extension is present it must still allow digital signatures.
+        const usageExtension = supplied[0].parsed.extensions?.find((extension) => extension.extnID === "2.5.29.15");
+        if (usageExtension) {
+            const usage = usageExtension.parsedValue;
+            if (!(usage instanceof BitString) || !(usage.valueBlock.valueHexView[0] & 0x80))
+                throw new Error();
+        }
+        const validator = new CertificateChainValidationEngine({
+            trustedCerts: trusted.map(({ parsed }) => parsed),
+            // PKIjs takes the target certificate last, independently of the wire's leaf-first order.
+            certs: supplied.filter(({ cert }) => !isAnchor(cert)).reverse().map(({ parsed }) => parsed),
+            checkDate: new Date(now * 1000),
+        });
+        const result = await validator.verify({}, crypto);
+        if (!result.result || !result.certificatePath)
+            throw new Error();
+        checkPathConstraints(result.certificatePath);
+        return leaf.publicKey;
+    }
+    catch {
+        // Certificate and dependency diagnostics can contain token material; retain only the fixed category.
+        throw new AttestationError("Invalid production attestation certificate path");
+    }
+}