@elizaos/agent 2.0.0-beta.1 → 2.0.11-beta.5

package/services/cove-quote-x509.js

@@ -0,0 +1,424 @@
+/**
+ * Standard-format CoVE / AP-TEE evidence verifier: X.509 DER certificate chains
+ * carrying a TCG DICE `DiceTcbInfo` extension (OID 2.23.133.5.4), as emitted by
+ * real RISC-V CoVE TSMs (e.g. Salus via its `rice` DICE crate) through the
+ * COVG `get_evidence(DiceTcbInfo)` call.
+ *
+ * This is an ADDITIONAL accepted format alongside the bespoke canonical-JSON
+ * DICE path in `cove-quote.ts`; neither replaces the other. The canonical-JSON
+ * path is the reference the E1 silicon may reproduce without an ASN.1 encoder;
+ * this path is what interoperates with TSMs that already emit standard X.509.
+ *
+ * Real cryptography only. Each certificate's signature is verified with
+ * node:crypto (`X509Certificate.verify`/`createPublicKey`) — Ed25519 per the
+ * rice format (algorithm OID 1.3.101.112). The chain is anchored in a trusted
+ * RoT public key supplied out-of-band (the DeviceID / layer-0 key), exactly as
+ * a relying party must obtain a CoVE root anchor: it is not carried in the leaf.
+ *
+ * `DiceTcbInfo` FwId measurements are extracted with a minimal ASN.1 DER reader
+ * (node's `X509Certificate` does not surface custom extensions), keeping the
+ * SHA-384 (or other) digests and the optional SVN, then mapped into the
+ * normalized `TeeEvidence` shape so the same policy evaluator consumes them.
+ */
+import { createHash, createPublicKey, timingSafeEqual, X509Certificate, } from "node:crypto";
+import { normalizeTeeEvidence, } from "./tee-evidence.js";
+/** TCG DICE `DiceTcbInfo` extension OID: tcg(2.23.133) platformClass(5) 4. */
+export const TCG_DICE_TCB_INFO_OID = "2.23.133.5.4";
+/** Ed25519 signature/key algorithm OID (RFC 8410). */
+export const ED25519_OID = "1.3.101.112";
+/** SHA-384 hash algorithm OID (the digest rice's FwIds use). */
+export const SHA384_OID = "2.16.840.1.101.3.4.2.2";
+/**
+ * Verify an X.509 DICE certificate chain with real Ed25519 cryptography:
+ *   1. `chain[0]` (the highest cert provided) is verified against
+ *      `trustedRotPublicKey` — the out-of-band RoT/DeviceID anchor.
+ *   2. Each subsequent cert is verified against the previous cert's public key,
+ *      and `issuer === parent.subject`.
+ *   3. Every cert is inside its validity window.
+ *   4. The leaf's `DiceTcbInfo` extension is decoded (FwIds + SVN).
+ *   5. When `expectedNonce`/`ephemeralPublicKey` are supplied, the leaf's
+ *      vendorInfo report_data equals SHA256(nonce || epk) — the live-channel
+ *      binding that defeats replay. A leaf without vendorInfo fails closed.
+ *
+ * Never returns `verified:true` without a passing signature check at every link.
+ * A single self-signed leaf is a valid one-element chain when it verifies
+ * against the anchor (the anchor then IS the issuer key).
+ */
+export function verifyCoveX509Chain(derChain, options) {
+    if (derChain.length === 0) {
+        return fail("empty-chain", "Certificate chain is empty.");
+    }
+    const anchorKey = importAnchorKey(options.trustedRotPublicKey);
+    if (anchorKey === undefined) {
+        return fail("root-anchor-mismatch", "Trusted RoT public key is not a valid Ed25519 public key.");
+    }
+    const certs = [];
+    for (const der of derChain) {
+        const cert = parseCertificate(der);
+        if (cert === undefined) {
+            return fail("malformed-chain", "A certificate is not parseable DER.");
+        }
+        certs.push(cert);
+    }
+    const nowMs = options.nowMs ?? Date.now();
+    // The top cert is verified against the trusted RoT anchor.
+    if (!certs[0].verify(anchorKey)) {
+        return fail("root-anchor-mismatch", "Top certificate is not signed by the trusted RoT public key.");
+    }
+    const decoded = [];
+    let issuerKey = certs[0].publicKey;
+    let issuerSubject = certs[0].subject;
+    for (let i = 0; i < certs.length; i++) {
+        const cert = certs[i];
+        if (i > 0) {
+            if (cert.issuer !== issuerSubject) {
+                return fail("chain-link-broken", `Certificate issuer "${cert.issuer}" does not match parent subject "${issuerSubject}".`);
+            }
+            if (!cert.verify(issuerKey)) {
+                return fail("cert-signature-invalid", `Certificate "${cert.subject}" signature does not verify against its issuer.`);
+            }
+        }
+        const window = certWindowFailure(cert, nowMs);
+        if (window !== undefined)
+            return window;
+        const tcbInfo = extractDiceTcbInfo(cert);
+        if (tcbInfo === "malformed") {
+            return fail("tcb-info-malformed", `Certificate "${cert.subject}" has a malformed DiceTcbInfo extension.`);
+        }
+        decoded.push({
+            subject: cert.subject,
+            issuer: cert.issuer,
+            spkiSha256: spkiSha256Hex(cert.publicKey),
+            notBefore: cert.validFrom,
+            notAfter: cert.validTo,
+            ...(tcbInfo === undefined ? {} : { tcbInfo }),
+        });
+        issuerKey = cert.publicKey;
+        issuerSubject = cert.subject;
+    }
+    const chain = decoded;
+    const leaf = chain[chain.length - 1];
+    if (options.expectedNonce !== undefined &&
+        options.ephemeralPublicKey !== undefined) {
+        const presented = leaf.tcbInfo?.reportDataHex;
+        if (presented === undefined) {
+            return fail("report-data-mismatch", "Leaf DiceTcbInfo carries no vendorInfo report_data to bind the live channel.");
+        }
+        const expected = createHash("sha256")
+            .update(Buffer.from(options.expectedNonce, "utf8"))
+            .update(options.ephemeralPublicKey)
+            .digest("hex");
+        if (!constantTimeHexEquals(presented, expected)) {
+            return fail("report-data-mismatch", "Leaf report_data is not bound to the nonce/ephemeral key this verifier issued.");
+        }
+    }
+    return { verified: true, chain, leaf };
+}
+/**
+ * Map a verified X.509 DICE chain into the normalized `TeeEvidence` shape so
+ * `evaluateTeeEvidencePolicy` consumes it identically to the canonical-JSON
+ * CoVE path. The leaf's `DiceTcbInfo` FwIds populate `measurements` under the
+ * supplied register-name mapping; pass the result of a successful
+ * `verifyCoveX509Chain` — never an unverified chain.
+ *
+ * @param fwidNames Maps FwId list index -> `TeeEvidence` measurement name. CoVE
+ *   TSMs emit a fixed register layout (TCG PCR indices); the caller supplies the
+ *   platform's register-to-name map so unrelated platforms are not conflated.
+ */
+export function coveX509ToTeeEvidence(result, fwidNames) {
+    const tcb = result.leaf.tcbInfo;
+    const measurements = {};
+    if (tcb !== undefined) {
+        for (let i = 0; i < tcb.fwids.length && i < fwidNames.length; i++) {
+            const fwid = tcb.fwids[i];
+            // Skip the all-zero "unmeasured register" sentinel rice emits for unused
+            // PCR slots — a zero digest is the absence of a measurement, not a value.
+            if (/^0+$/.test(fwid.digestHex))
+                continue;
+            measurements[fwidNames[i]] =
+                `${hashPrefix(fwid.hashAlgOid)}:${fwid.digestHex}`;
+        }
+    }
+    return normalizeTeeEvidence({
+        kind: "cove",
+        provider: "eliza-riscv",
+        ...(tcb?.vendor === undefined ? {} : { hardwareVendor: tcb.vendor }),
+        ...(tcb?.version === undefined ? {} : { platformVersion: tcb.version }),
+        ...(tcb?.svn === undefined ? {} : { securityVersion: tcb.svn }),
+        ...(Object.keys(measurements).length === 0 ? {} : { measurements }),
+        freshness: { verifier: "eliza-local-verifier" },
+        certificatePem: result.leaf.subject,
+    });
+}
+/**
+ * Decode the `DiceTcbInfo` extension from a single X.509 DER certificate
+ * WITHOUT verifying its signature. Use only for inspecting a cert's measurement
+ * claims (e.g. logging, fixture assertions); trust decisions must go through
+ * `verifyCoveX509Chain`. Returns `undefined` when the cert is unparseable or has
+ * no `DiceTcbInfo` extension, `"malformed"` when the extension cannot decode.
+ */
+export function decodeDiceTcbInfoFromCert(der) {
+    const cert = parseCertificate(der);
+    if (cert === undefined)
+        return undefined;
+    return extractDiceTcbInfo(cert);
+}
+function importAnchorKey(value) {
+    try {
+        if (typeof value === "string") {
+            return createPublicKey(value);
+        }
+        const buf = Buffer.from(value);
+        // A bare 32-byte Ed25519 key is wrapped in its SPKI DER prefix.
+        if (buf.length === 32) {
+            const der = Buffer.concat([
+                Buffer.from("302a300506032b6570032100", "hex"),
+                buf,
+            ]);
+            return createPublicKey({ key: der, format: "der", type: "spki" });
+        }
+        return createPublicKey({ key: buf, format: "der", type: "spki" });
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseCertificate(der) {
+    try {
+        return new X509Certificate(Buffer.from(der));
+    }
+    catch {
+        return undefined;
+    }
+}
+function certWindowFailure(cert, nowMs) {
+    const notBefore = Date.parse(cert.validFrom);
+    const notAfter = Date.parse(cert.validTo);
+    if (!Number.isFinite(notBefore) || !Number.isFinite(notAfter)) {
+        return fail("cert-expired", `Certificate "${cert.subject}" has an unparseable validity window.`);
+    }
+    if (nowMs < notBefore || nowMs > notAfter) {
+        return fail("cert-expired", `Certificate "${cert.subject}" is outside its validity window.`);
+    }
+    return undefined;
+}
+function spkiSha256Hex(publicKey) {
+    const spki = publicKey.export({ type: "spki", format: "der" });
+    return createHash("sha256").update(spki).digest("hex");
+}
+function hashPrefix(oid) {
+    return oid === SHA384_OID ? "sha384" : "sha256";
+}
+function constantTimeHexEquals(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const left = Buffer.from(a.toLowerCase(), "utf8");
+    const right = Buffer.from(b.toLowerCase(), "utf8");
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+function readTlv(buf, offset) {
+    if (offset + 2 > buf.length)
+        return undefined;
+    const tag = buf[offset];
+    let pos = offset + 1;
+    let length = buf[pos];
+    pos += 1;
+    if (length & 0x80) {
+        const numBytes = length & 0x7f;
+        if (numBytes === 0 || numBytes > 4 || pos + numBytes > buf.length) {
+            return undefined;
+        }
+        length = 0;
+        for (let i = 0; i < numBytes; i++) {
+            length = (length << 8) | buf[pos];
+            pos += 1;
+        }
+    }
+    const end = pos + length;
+    if (end > buf.length)
+        return undefined;
+    return { tag, contentStart: pos, length, end };
+}
+/** Decode a DER OBJECT IDENTIFIER body (content bytes) into dotted form. */
+function decodeOid(content) {
+    if (content.length === 0)
+        return "";
+    const first = content[0];
+    const parts = [Math.floor(first / 40), first % 40];
+    let value = 0;
+    for (let i = 1; i < content.length; i++) {
+        value = (value << 7) | (content[i] & 0x7f);
+        if ((content[i] & 0x80) === 0) {
+            parts.push(value);
+            value = 0;
+        }
+    }
+    return parts.join(".");
+}
+/** Decode a DER INTEGER content into a JS number (small values only). */
+function decodeUint(content) {
+    if (content.length === 0 || content.length > 6)
+        return undefined;
+    let value = 0;
+    for (const byte of content)
+        value = value * 256 + byte;
+    return Number.isSafeInteger(value) ? value : undefined;
+}
+/**
+ * Locate the `DiceTcbInfo` extension in a certificate and decode it. Returns
+ * `undefined` when no such extension exists, the literal `"malformed"` when one
+ * exists but cannot be decoded.
+ */
+function extractDiceTcbInfo(cert) {
+    const der = Buffer.from(cert.raw);
+    const extnValue = findExtensionValue(der, TCG_DICE_TCB_INFO_OID);
+    if (extnValue === undefined)
+        return undefined;
+    return decodeDiceTcbInfo(extnValue);
+}
+/**
+ * Walk the certificate DER to the extensions and return the OCTET STRING value
+ * of the extension matching `oid`. Structure walked:
+ *   Certificate ::= SEQUENCE { tbsCertificate SEQUENCE, sigAlg, sig }
+ *   tbsCertificate contains [3] EXPLICIT Extensions OPTIONAL
+ *   Extensions ::= SEQUENCE OF Extension { OID, BOOLEAN OPTIONAL, OCTET STRING }
+ */
+function findExtensionValue(der, oid) {
+    const cert = readTlv(der, 0);
+    if (cert === undefined)
+        return undefined;
+    const tbs = readTlv(der, cert.contentStart);
+    if (tbs === undefined)
+        return undefined;
+    // Scan tbsCertificate children for the [3] EXPLICIT extensions wrapper (0xA3).
+    let pos = tbs.contentStart;
+    let extensions;
+    while (pos < tbs.end) {
+        const field = readTlv(der, pos);
+        if (field === undefined)
+            return undefined;
+        if (field.tag === 0xa3) {
+            extensions = readTlv(der, field.contentStart); // inner SEQUENCE OF
+            break;
+        }
+        pos = field.end;
+    }
+    if (extensions === undefined)
+        return undefined;
+    // Each Extension is a SEQUENCE { extnID OID, critical BOOLEAN?, extnValue OCTET STRING }.
+    let extPos = extensions.contentStart;
+    while (extPos < extensions.end) {
+        const ext = readTlv(der, extPos);
+        if (ext === undefined)
+            return undefined;
+        let fieldPos = ext.contentStart;
+        const idTlv = readTlv(der, fieldPos);
+        if (idTlv === undefined || idTlv.tag !== 0x06)
+            return undefined;
+        const id = decodeOid(der.subarray(idTlv.contentStart, idTlv.contentStart + idTlv.length));
+        fieldPos = idTlv.end;
+        let next = readTlv(der, fieldPos);
+        if (next === undefined)
+            return undefined;
+        if (next.tag === 0x01) {
+            // optional critical BOOLEAN
+            fieldPos = next.end;
+            next = readTlv(der, fieldPos);
+            if (next === undefined)
+                return undefined;
+        }
+        if (next.tag !== 0x04)
+            return undefined; // extnValue OCTET STRING
+        if (id === oid) {
+            return der.subarray(next.contentStart, next.contentStart + next.length);
+        }
+        extPos = ext.end;
+    }
+    return undefined;
+}
+/**
+ * Decode the `DiceTcbInfo` SEQUENCE. Fields are IMPLICIT context-tagged:
+ *   [0] vendor UTF8String, [1] model, [2] version, [3] svn INTEGER,
+ *   [6] fwids SEQUENCE OF FWID, [7] flags BIT STRING, [8] vendorInfo OCTET
+ *   STRING (report_data binding). FWID is SEQUENCE { hashAlg OID, digest OCTET
+ *   STRING }.
+ */
+function decodeDiceTcbInfo(extnValue) {
+    const seq = readTlv(extnValue, 0);
+    if (seq === undefined || seq.tag !== 0x30)
+        return "malformed";
+    const info = { fwids: [] };
+    let pos = seq.contentStart;
+    while (pos < seq.end) {
+        const field = readTlv(extnValue, pos);
+        if (field === undefined)
+            return "malformed";
+        const content = extnValue.subarray(field.contentStart, field.contentStart + field.length);
+        switch (field.tag) {
+            case 0x80: // [0] vendor
+                info.vendor = content.toString("utf8");
+                break;
+            case 0x81: // [1] model
+                info.model = content.toString("utf8");
+                break;
+            case 0x82: // [2] version
+                info.version = content.toString("utf8");
+                break;
+            case 0x83: {
+                // [3] svn INTEGER
+                const svn = decodeUint(content);
+                if (svn === undefined)
+                    return "malformed";
+                info.svn = svn;
+                break;
+            }
+            case 0xa6: {
+                // [6] fwids SEQUENCE OF FWID (IMPLICIT -> content is the list directly)
+                const fwids = decodeFwIds(content);
+                if (fwids === "malformed")
+                    return "malformed";
+                info.fwids = fwids;
+                break;
+            }
+            case 0x87: // [7] flags (single-byte operational flags after unused-bits)
+                info.flags = content.length >= 2 ? content[1] : (content[0] ?? 0);
+                break;
+            case 0x88: // [8] vendorInfo OCTET STRING (carries report_data for binding)
+                info.reportDataHex = content.toString("hex");
+                break;
+            default:
+                break; // skip layer/index/vendorInfo/type we do not consume
+        }
+        pos = field.end;
+    }
+    return info;
+}
+function decodeFwIds(list) {
+    const fwids = [];
+    let pos = 0;
+    while (pos < list.length) {
+        const fwid = readTlv(list, pos);
+        if (fwid === undefined || fwid.tag !== 0x30)
+            return "malformed";
+        const algTlv = readTlv(list, fwid.contentStart);
+        if (algTlv === undefined || algTlv.tag !== 0x06)
+            return "malformed";
+        const hashAlgOid = decodeOid(list.subarray(algTlv.contentStart, algTlv.contentStart + algTlv.length));
+        const digestTlv = readTlv(list, algTlv.end);
+        if (digestTlv === undefined || digestTlv.tag !== 0x04)
+            return "malformed";
+        const digestHex = list
+            .subarray(digestTlv.contentStart, digestTlv.contentStart + digestTlv.length)
+            .toString("hex");
+        fwids.push({ hashAlgOid, digestHex });
+        pos = fwid.end;
+    }
+    if (fwids.length === 0)
+        return "malformed";
+    return fwids;
+}
+function fail(reason, detail) {
+    return { verified: false, reason, detail };
+}

package/services/cove-quote.d.ts

@@ -0,0 +1,189 @@
+/**
+ * On-device CoVE / AP-TEE quote: typed structure, real DICE cert-chain
+ * verification, and mapping into the normalized `TeeEvidence` shape.
+ *
+ * Unlike the cloud TDX path (Phase B2), the on-device CoVE quote is rooted in
+ * OUR OpenTitan-class RoT via a DICE chain (UDS -> CDI -> Alias key; the M-mode
+ * TSM signs the quote with the DICE Alias key). Trust is self-rooted: there is
+ * no dependency on Intel PCS collateral or a cloud QE. So a real quote-and-verify
+ * is buildable and testable entirely locally with real cryptography.
+ *
+ * Format conformance. The measurement set, claim derivation, freshness shape,
+ * and `reportData` binding mirror the chip-side reference serializer
+ * (packages/chip/scripts/tee/teeevidence_quote.py): `kind:"cove"`,
+ * `provider:"eliza-riscv"`, `verifier:"eliza-local-verifier"`,
+ * `reportData = sha256(nonce_utf8 || ephemeral_pubkey)`. That model is unsigned
+ * (the silicon attestation key is BLOCKED there). This module adds the real
+ * cryptographic layer the silicon must reproduce: a DICE Ed25519 certificate
+ * chain (RoT root -> DeviceID -> per-boot Alias) and an Alias signature over the
+ * quote body. The chip DICE lane (packages/chip/fw/dice/cdi.{c,h},
+ * ed25519_sign.{c,h}) derives DeviceID/Alias as Ed25519 keypairs from
+ * CDI_monitor, so Ed25519 is the matching algorithm here (RFC 8032), not P-256.
+ *
+ * Certificates are canonical-JSON TBS bodies signed by their issuer's Ed25519
+ * key, not X.509 DER. This is a deliberate format choice: a freestanding M-mode
+ * TSM can emit byte-exact canonical JSON without an ASN.1 encoder, and the
+ * verifier here is the reference the silicon reproduces. The TBS canonical form
+ * is the documented contract (see `canonicalTbsBytes`).
+ */
+import { type TeeEvidence, type TeeMeasurementName } from "./tee-evidence.ts";
+/** Measurement registers a CoVE quote carries (RTMR-equivalents). */
+export type CoveMeasurements = {
+    /** RoT boot register: extend over rom || lifecycle || BL1 || BL2. */
+    boot: string;
+    /** M-mode TSM / security-monitor image digest. */
+    monitor: string;
+    /** Guest OS register: kernel || initramfs || DTB at TVM finalize. */
+    os: string;
+    /** TEE policy JSON digest. */
+    policy: string;
+    /** Platform identity / device-policy digest (DeviceID SPKI-bound). */
+    device: string;
+    /** Agent package / protected-agent guest digest. */
+    agent?: string;
+    /** NPU firmware + queue-policy digest (private-inference path only). */
+    npuFirmware?: string;
+    /** Sealed model-weights digest (confidential-AI binding). */
+    modelWeights?: string;
+};
+/** Boolean security conditions the quote attests. */
+export type CoveClaims = {
+    secureBoot: boolean;
+    debugDisabled: boolean;
+    productionLifecycle: boolean;
+    memoryEncrypted: boolean;
+    ioProtected: boolean;
+    npuProtected: boolean;
+    /** The M-mode TSM was measured and folded into the DICE chain. */
+    monitorMeasured: boolean;
+};
+/**
+ * A DICE certificate: a TBS body signed by the issuer's Ed25519 key. The
+ * `subjectPublicKey`/`signature` are base64url raw 32-/64-byte Ed25519 values.
+ * The chain links by `issuer === subject` of the parent cert.
+ */
+export type DiceCertificate = {
+    /** Stable identity of the certificate subject (e.g. "E1-DICE-DeviceID"). */
+    subject: string;
+    /** Identity of the issuer; the parent cert's `subject` (root self-issues). */
+    issuer: string;
+    /** base64url raw 32-byte Ed25519 public key of the subject. */
+    subjectPublicKey: string;
+    /** Stage measurements folded into this layer's CDI (sha256:hex), if any. */
+    measurements?: Partial<Record<TeeMeasurementName, string>>;
+    /** Monotonic security version of the issuing layer (anti-rollback). */
+    securityVersion: number;
+    /** RFC3339 not-before instant. */
+    notBefore: string;
+    /** RFC3339 not-after instant. */
+    notAfter: string;
+    /** base64url raw 64-byte Ed25519 signature by the issuer over the TBS bytes. */
+    signature: string;
+};
+/** The body the Alias key signs: binds measurements + report_data + freshness. */
+export type CoveQuoteBody = {
+    measurements: CoveMeasurements;
+    claims: CoveClaims;
+    securityVersion: number;
+    /** sha256:hex of (nonce_utf8 || ephemeral_pubkey). Binds the live channel. */
+    reportData: string;
+    nonce: string;
+    timestamp: string;
+    hardwareVendor: string;
+    platformVersion: string;
+};
+export type CoveQuote = {
+    body: CoveQuoteBody;
+    /**
+     * RoT root -> DeviceID -> Alias. `chain[0]` self-issues (its `issuer` equals
+     * its `subject` and it is verified against `trustedRotPublicKey`). The last
+     * cert is the Alias leaf whose key signed `body`.
+     */
+    chain: [DiceCertificate, ...DiceCertificate[]];
+    /** base64url raw 64-byte Ed25519 signature by the Alias key over the body. */
+    signature: string;
+};
+export type CoveVerifyOptions = {
+    /** The on-device RoT root public key, base64url raw 32-byte Ed25519. */
+    trustedRotPublicKey: string;
+    /** Wall-clock for validity-window checks. Defaults to Date.now(). */
+    nowMs?: number;
+    /** Reject quotes whose securityVersion is below this rollback floor. */
+    minSecurityVersion?: number;
+    /**
+     * Nonce this verifier issued for the live channel. When supplied together
+     * with `ephemeralPublicKey`, the quote's `body.reportData` MUST equal
+     * `expectedReportData(expectedNonce, ephemeralPublicKey)` or verification
+     * fails with `report-data-mismatch`. This is the anti-replay binding: a
+     * passively captured quote carries a different nonce/epk digest and is
+     * rejected. Omitting both only checks the digest is well-formed (legacy
+     * format check) and leaves the quote replayable — pass them in production.
+     */
+    expectedNonce?: string;
+    /** Ephemeral public key the verifier offered for this channel; bound with
+     * `expectedNonce` into the expected `reportData`. */
+    ephemeralPublicKey?: Buffer;
+};
+export type CoveVerifyResult = {
+    verified: true;
+    body: CoveQuoteBody;
+    aliasPublicKey: string;
+} | {
+    verified: false;
+    reason: CoveVerifyFailure;
+    detail: string;
+};
+export type CoveVerifyFailure = "malformed-quote" | "empty-chain" | "root-anchor-mismatch" | "chain-link-broken" | "cert-signature-invalid" | "cert-expired" | "alias-signature-invalid" | "report-data-malformed" | "report-data-mismatch" | "security-version-too-low";
+/**
+ * Canonical TBS bytes for a DICE certificate: UTF-8 of a JSON object with keys
+ * in fixed order and no `signature` field. This is the exact byte string the
+ * issuer signs and the verifier checks; the silicon must reproduce it byte for
+ * byte. Order is fixed here (not `JSON.stringify` insertion order) so the
+ * contract does not depend on object construction order.
+ */
+export declare function canonicalTbsBytes(cert: DiceCertificate): Buffer;
+/**
+ * Canonical body bytes the Alias key signs over: UTF-8 of the quote body with a
+ * fixed key order. Reproducible byte-for-byte by the silicon TSM.
+ */
+export declare function canonicalBodyBytes(body: CoveQuoteBody): Buffer;
+/**
+ * Verify a CoVE quote with real Ed25519 cryptography:
+ *   1. Each cert in the chain is signed by the next-up issuer; the root cert is
+ *      verified against `trustedRotPublicKey` (the self-rooted device anchor).
+ *   2. The chain links: cert[i].issuer === cert[i-1].subject and the issuer key
+ *      that verifies cert[i] is cert[i-1].subjectPublicKey.
+ *   3. The Alias leaf key signs the quote body.
+ *   4. Every cert is within its validity window.
+ *   5. securityVersion is at or above the rollback floor.
+ *   6. When `expectedNonce`/`ephemeralPublicKey` are supplied, `body.reportData`
+ *      equals `expectedReportData(expectedNonce, ephemeralPublicKey)` — the
+ *      live-channel binding that defeats quote replay.
+ *
+ * Never returns `verified:true` without a passing Ed25519 signature check at
+ * every link and over the body.
+ */
+export declare function verifyCoveQuote(quote: unknown, options: CoveVerifyOptions): CoveVerifyResult;
+/**
+ * Recompute the report_data binding the verifier expects:
+ * sha256(nonce_utf8 || ephemeral_pubkey). The caller compares this against the
+ * verified quote's `body.reportData` to prove the quote is bound to the live
+ * channel (the nonce it issued and the ephemeral key it will receive secrets on).
+ */
+export declare function expectedReportData(nonce: string, ephemeralPublicKey: Buffer): string;
+/**
+ * Map a verified CoVE quote body into the normalized `TeeEvidence` shape so
+ * `evaluateTeeEvidencePolicy` consumes it identically to dstack/TDX evidence.
+ * Pass the result of a successful `verifyCoveQuote` — never an unverified body.
+ */
+export declare function coveQuoteToTeeEvidence(result: Extract<CoveVerifyResult, {
+    verified: true;
+}>): TeeEvidence;
+/**
+ * Standard-format CoVE verifier for X.509 DER chains carrying a TCG DICE
+ * `DiceTcbInfo` extension, as emitted by real RISC-V CoVE TSMs (Salus / rice).
+ * This is an additional accepted evidence format; the canonical-JSON path above
+ * is unchanged. See `cove-quote-x509.ts`.
+ */
+export { type CoveX509Cert, type CoveX509VerifyFailure, type CoveX509VerifyOptions, type CoveX509VerifyResult, coveX509ToTeeEvidence, type DiceFwId, type DiceTcbInfo, decodeDiceTcbInfoFromCert, ED25519_OID, SHA384_OID, TCG_DICE_TCB_INFO_OID, verifyCoveX509Chain, } from "./cove-quote-x509.ts";
+//# sourceMappingURL=cove-quote.d.ts.map

package/services/cove-quote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cove-quote.d.ts","sourceRoot":"","sources":["../../src/services/cove-quote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AASH,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,kBAAkB,EAExB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,kEAAkE;IAClE,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,uEAAuE;IACvE,eAAe,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,EAAE,gBAAgB,CAAC;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,aAAa,CAAC;IACpB;;;;OAIG;IACH,KAAK,EAAE,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC;IAC/C,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;yDACqD;IACrD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,MAAM,MAAM,iBAAiB,GACzB,iBAAiB,GACjB,aAAa,GACb,sBAAsB,GACtB,mBAAmB,GACnB,wBAAwB,GACxB,cAAc,GACd,yBAAyB,GACzB,uBAAuB,GACvB,sBAAsB,GACtB,0BAA0B,CAAC;AAK/B;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAa/D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAY9D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,iBAAiB,GACzB,gBAAgB,CAuHlB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GACzB,MAAM,CAKR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,GACpD,WAAW,CA4Cb;AAuQD;;;;;GAKG;AACH,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC"}