@layr-labs/ecloud-sdk 0.4.0-dev.0 → 0.4.0-dev.2

package/VERSION

@@ -0,0 +1,2 @@
+version=0.4.0-dev.2
+commit=642294ce4a815ad45fa195ccdc4dfe09450ca97b

package/dist/attest.cjs

@@ -0,0 +1,185 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/attest.ts
+var attest_exports = {};
+__export(attest_exports, {
+  AttestClient: () => AttestClient,
+  JwtProvider: () => JwtProvider
+});
+module.exports = __toCommonJS(attest_exports);
+
+// src/client/modules/attest/attest-client.ts
+var import_node_crypto = require("crypto");
+var import_node_http = __toESM(require("http"), 1);
+var import_jose = require("jose");
+var DEFAULT_SOCKET_PATH = "/run/container_launcher/teeserver.sock";
+var CHALLENGE_PREFIX = "COMPUTE_APP_JWT_REQUEST_RSA_KEY_V1";
+var SIGNATURE_PREFIX = "COMPUTE_APP_KMS_SIGNATURE_V1";
+var NULL_BYTE = Buffer.from([0]);
+var AttestClient = class {
+  constructor(config) {
+    this.config = config;
+  }
+  async attest() {
+    const { publicKey, privateKey } = (0, import_node_crypto.generateKeyPairSync)("rsa", {
+      modulusLength: 4096,
+      publicKeyEncoding: { type: "spki", format: "pem" },
+      privateKeyEncoding: { type: "pkcs8", format: "pem" }
+    });
+    const challengeHash = (0, import_node_crypto.createHash)("sha256").update(CHALLENGE_PREFIX).update(NULL_BYTE).update(publicKey).digest();
+    const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;
+    const attestationBytes = await this.getAttestation(socketPath, challengeHash);
+    const attestResponse = await this.postAttest(attestationBytes, publicKey);
+    this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);
+    const rsaPrivateKey = await crypto.subtle.importKey(
+      "pkcs8",
+      pemToBuffer(privateKey),
+      { name: "RSA-OAEP", hash: "SHA-256" },
+      false,
+      ["decrypt"]
+    );
+    const { plaintext } = await (0, import_jose.compactDecrypt)(
+      attestResponse.data.encryptedToken,
+      rsaPrivateKey
+    );
+    const decrypted = JSON.parse(new TextDecoder().decode(plaintext));
+    return decrypted.token;
+  }
+  verifySignature(dataJson, signature) {
+    const message = Buffer.concat([
+      Buffer.from(SIGNATURE_PREFIX),
+      NULL_BYTE,
+      Buffer.from(dataJson)
+    ]);
+    const valid = (0, import_node_crypto.verify)(
+      "sha256",
+      message,
+      this.config.kmsPublicKey,
+      Buffer.from(signature, "base64")
+    );
+    if (!valid) {
+      throw new Error("KMS response signature verification failed");
+    }
+  }
+  getAttestation(socketPath, challenge) {
+    return new Promise((resolve, reject) => {
+      const body = JSON.stringify({ challenge: challenge.toString("base64") });
+      const req = import_node_http.default.request(
+        {
+          socketPath,
+          path: "/v1/bound_evidence",
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Content-Length": Buffer.byteLength(body)
+          }
+        },
+        (res) => {
+          const chunks = [];
+          res.on("data", (chunk) => chunks.push(chunk));
+          res.on("end", () => {
+            if (res.statusCode !== 200) {
+              reject(new Error(`TEE attestation failed (${res.statusCode}): ${Buffer.concat(chunks).toString()}`));
+              return;
+            }
+            resolve(Buffer.concat(chunks));
+          });
+        }
+      );
+      req.on("error", (err) => reject(new Error(`TEE attestation request failed: ${err.message}`)));
+      req.write(body);
+      req.end();
+    });
+  }
+  async postAttest(attestationBytes, rsaPublicKey) {
+    const url = `${this.config.kmsServerURL}/auth/attest`;
+    const body = JSON.stringify({
+      version: 3,
+      attestation: attestationBytes.toString("base64"),
+      rsaKey: rsaPublicKey,
+      audience: this.config.audience
+    });
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(`KMS attest failed (${response.status}): ${text}`);
+    }
+    return response.json();
+  }
+};
+function pemToBuffer(pem) {
+  const b64 = pem.replace(/-----[A-Z ]+-----/g, "").replace(/\s/g, "");
+  const buf = Buffer.from(b64, "base64");
+  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+}
+
+// src/client/modules/attest/jwt-provider.ts
+var JwtProvider = class {
+  constructor(attestClient, bufferSeconds = 30) {
+    this.attestClient = attestClient;
+    this.bufferSeconds = bufferSeconds;
+  }
+  async getToken() {
+    if (this.cachedToken && !this.isExpiringSoon()) {
+      return this.cachedToken;
+    }
+    if (this.pending) {
+      return this.pending;
+    }
+    this.pending = this.attestClient.attest().then((token) => {
+      this.cachedToken = token;
+      this.expiresAt = this.decodeJwtExp(token);
+      return token;
+    }).finally(() => {
+      this.pending = void 0;
+    });
+    return this.pending;
+  }
+  isExpiringSoon() {
+    if (!this.expiresAt) return true;
+    return Date.now() / 1e3 >= this.expiresAt - this.bufferSeconds;
+  }
+  decodeJwtExp(jwt) {
+    const payload = jwt.split(".")[1];
+    if (!payload) return void 0;
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString());
+    return decoded.exp;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AttestClient,
+  JwtProvider
+});
+//# sourceMappingURL=attest.cjs.map

package/dist/attest.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/attest.ts","../src/client/modules/attest/attest-client.ts","../src/client/modules/attest/jwt-provider.ts"],"sourcesContent":["/**\n * Attestation module entry point\n *\n * Import from \"@layr-labs/ecloud-sdk/attest\" for direct access to attest module\n */\n\nexport * from \"./client/modules/attest\";\n","import { generateKeyPairSync, createHash, verify } from 'node:crypto';\nimport http from 'node:http';\nimport { compactDecrypt } from 'jose';\n\nexport interface AttestClientConfig {\n  kmsServerURL: string;\n  kmsPublicKey: string;\n  audience: string;\n  socketPath?: string;\n}\n\nconst DEFAULT_SOCKET_PATH = '/run/container_launcher/teeserver.sock';\nconst CHALLENGE_PREFIX = 'COMPUTE_APP_JWT_REQUEST_RSA_KEY_V1';\nconst SIGNATURE_PREFIX = 'COMPUTE_APP_KMS_SIGNATURE_V1';\nconst NULL_BYTE = Buffer.from([0x00]);\n\nexport class AttestClient {\n  private config: AttestClientConfig;\n\n  constructor(config: AttestClientConfig) {\n    this.config = config;\n  }\n\n  async attest(): Promise<string> {\n    const { publicKey, privateKey } = generateKeyPairSync('rsa', {\n      modulusLength: 4096,\n      publicKeyEncoding: { type: 'spki', format: 'pem' } as const,\n      privateKeyEncoding: { type: 'pkcs8', format: 'pem' } as const,\n    });\n\n    const challengeHash = createHash('sha256')\n      .update(CHALLENGE_PREFIX)\n      .update(NULL_BYTE)\n      .update(publicKey)\n      .digest();\n\n    const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;\n    const attestationBytes = await this.getAttestation(socketPath, challengeHash);\n    const attestResponse = await this.postAttest(attestationBytes, publicKey);\n\n    this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);\n\n    const rsaPrivateKey = await crypto.subtle.importKey(\n      'pkcs8',\n      pemToBuffer(privateKey),\n      { name: 'RSA-OAEP', hash: 'SHA-256' },\n      false,\n      ['decrypt'],\n    );\n\n    const { plaintext } = await compactDecrypt(\n      attestResponse.data.encryptedToken,\n      rsaPrivateKey,\n    );\n\n    const decrypted = JSON.parse(new TextDecoder().decode(plaintext));\n    return decrypted.token;\n  }\n\n  private verifySignature(\n    dataJson: string,\n    signature: string,\n  ): void {\n    const message = Buffer.concat([\n      Buffer.from(SIGNATURE_PREFIX),\n      NULL_BYTE,\n      Buffer.from(dataJson),\n    ]);\n\n    const valid = verify(\n      'sha256',\n      message,\n      this.config.kmsPublicKey,\n      Buffer.from(signature, 'base64'),\n    );\n\n    if (!valid) {\n      throw new Error('KMS response signature verification failed');\n    }\n  }\n\n  private getAttestation(socketPath: string, challenge: Buffer): Promise<Buffer> {\n    return new Promise((resolve, reject) => {\n      const body = JSON.stringify({ challenge: challenge.toString('base64') });\n\n      const req = http.request(\n        {\n          socketPath,\n          path: '/v1/bound_evidence',\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            'Content-Length': Buffer.byteLength(body),\n          },\n        },\n        (res) => {\n          const chunks: Buffer[] = [];\n          res.on('data', (chunk: Buffer) => chunks.push(chunk));\n          res.on('end', () => {\n            if (res.statusCode !== 200) {\n              reject(new Error(`TEE attestation failed (${res.statusCode}): ${Buffer.concat(chunks).toString()}`));\n              return;\n            }\n            resolve(Buffer.concat(chunks));\n          });\n        },\n      );\n\n      req.on('error', (err) => reject(new Error(`TEE attestation request failed: ${err.message}`)));\n      req.write(body);\n      req.end();\n    });\n  }\n\n  private async postAttest(\n    attestationBytes: Buffer,\n    rsaPublicKey: string,\n  ): Promise<{ data: { encryptedToken: string }; signature: string }> {\n    const url = `${this.config.kmsServerURL}/auth/attest`;\n    const body = JSON.stringify({\n      version: 3,\n      attestation: attestationBytes.toString('base64'),\n      rsaKey: rsaPublicKey,\n      audience: this.config.audience,\n    });\n\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body,\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`KMS attest failed (${response.status}): ${text}`);\n    }\n\n    return response.json() as Promise<{ data: { encryptedToken: string }; signature: string }>;\n  }\n}\n\nfunction pemToBuffer(pem: string): ArrayBuffer {\n  const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\\s/g, '');\n  const buf = Buffer.from(b64, 'base64');\n\n  // Copy to a fresh ArrayBuffer to avoid offset issues with Buffer's shared pool\n  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);\n}\n","import type { AttestClient } from './attest-client';\n\nexport class JwtProvider {\n  private attestClient: AttestClient;\n  private bufferSeconds: number;\n  private cachedToken?: string;\n  private expiresAt?: number;\n  private pending?: Promise<string>;\n\n  constructor(attestClient: AttestClient, bufferSeconds: number = 30) {\n    this.attestClient = attestClient;\n    this.bufferSeconds = bufferSeconds;\n  }\n\n  async getToken(): Promise<string> {\n    if (this.cachedToken && !this.isExpiringSoon()) {\n      return this.cachedToken;\n    }\n\n    if (this.pending) {\n      return this.pending;\n    }\n\n    this.pending = this.attestClient\n      .attest()\n      .then((token) => {\n        this.cachedToken = token;\n        this.expiresAt = this.decodeJwtExp(token);\n        return token;\n      })\n      .finally(() => {\n        this.pending = undefined;\n      });\n\n    return this.pending;\n  }\n\n  private isExpiringSoon(): boolean {\n    if (!this.expiresAt) return true;\n    return Date.now() / 1000 >= this.expiresAt - this.bufferSeconds;\n  }\n\n  private decodeJwtExp(jwt: string): number | undefined {\n    const payload = jwt.split('.')[1];\n    if (!payload) return undefined;\n\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString());\n    return decoded.exp;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAAwD;AACxD,uBAAiB;AACjB,kBAA+B;AAS/B,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,YAAY,OAAO,KAAK,CAAC,CAAI,CAAC;AAE7B,IAAM,eAAN,MAAmB;AAAA,EAGxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,SAA0B;AAC9B,UAAM,EAAE,WAAW,WAAW,QAAI,wCAAoB,OAAO;AAAA,MAC3D,eAAe;AAAA,MACf,mBAAmB,EAAE,MAAM,QAAQ,QAAQ,MAAM;AAAA,MACjD,oBAAoB,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,IACrD,CAAC;AAED,UAAM,oBAAgB,+BAAW,QAAQ,EACtC,OAAO,gBAAgB,EACvB,OAAO,SAAS,EAChB,OAAO,SAAS,EAChB,OAAO;AAEV,UAAM,aAAa,KAAK,OAAO,cAAc;AAC7C,UAAM,mBAAmB,MAAM,KAAK,eAAe,YAAY,aAAa;AAC5E,UAAM,iBAAiB,MAAM,KAAK,WAAW,kBAAkB,SAAS;AAExE,SAAK,gBAAgB,KAAK,UAAU,eAAe,IAAI,GAAG,eAAe,SAAS;AAElF,UAAM,gBAAgB,MAAM,OAAO,OAAO;AAAA,MACxC;AAAA,MACA,YAAY,UAAU;AAAA,MACtB,EAAE,MAAM,YAAY,MAAM,UAAU;AAAA,MACpC;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,EAAE,UAAU,IAAI,UAAM;AAAA,MAC1B,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,UAAU;AAAA,EACnB;AAAA,EAEQ,gBACN,UACA,WACM;AACN,UAAM,UAAU,OAAO,OAAO;AAAA,MAC5B,OAAO,KAAK,gBAAgB;AAAA,MAC5B;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,IACtB,CAAC;AAED,UAAM,YAAQ;AAAA,MACZ;AAAA,MACA;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,OAAO,KAAK,WAAW,QAAQ;AAAA,IACjC;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAAA,EACF;AAAA,EAEQ,eAAe,YAAoB,WAAoC;AAC7E,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,OAAO,KAAK,UAAU,EAAE,WAAW,UAAU,SAAS,QAAQ,EAAE,CAAC;AAEvE,YAAM,MAAM,iBAAAA,QAAK;AAAA,QACf;AAAA,UACE;AAAA,UACA,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,CAAC,QAAQ;AACP,gBAAM,SAAmB,CAAC;AAC1B,cAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,cAAI,GAAG,OAAO,MAAM;AAClB,gBAAI,IAAI,eAAe,KAAK;AAC1B,qBAAO,IAAI,MAAM,2BAA2B,IAAI,UAAU,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;AACnG;AAAA,YACF;AACA,oBAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,UAC/B,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,GAAG,SAAS,CAAC,QAAQ,OAAO,IAAI,MAAM,mCAAmC,IAAI,OAAO,EAAE,CAAC,CAAC;AAC5F,UAAI,MAAM,IAAI;AACd,UAAI,IAAI;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,kBACA,cACkE;AAClE,UAAM,MAAM,GAAG,KAAK,OAAO,YAAY;AACvC,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,SAAS;AAAA,MACT,aAAa,iBAAiB,SAAS,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU,KAAK,OAAO;AAAA,IACxB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,IAAI,MAAM,sBAAsB,SAAS,MAAM,MAAM,IAAI,EAAE;AAAA,IACnE;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;AAEA,SAAS,YAAY,KAA0B;AAC7C,QAAM,MAAM,IAAI,QAAQ,sBAAsB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACnE,QAAM,MAAM,OAAO,KAAK,KAAK,QAAQ;AAGrC,SAAO,IAAI,OAAO,MAAM,IAAI,YAAY,IAAI,aAAa,IAAI,UAAU;AACzE;;;ACjJO,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,cAA4B,gBAAwB,IAAI;AAClE,SAAK,eAAe;AACpB,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEA,MAAM,WAA4B;AAChC,QAAI,KAAK,eAAe,CAAC,KAAK,eAAe,GAAG;AAC9C,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,KAAK,SAAS;AAChB,aAAO,KAAK;AAAA,IACd;AAEA,SAAK,UAAU,KAAK,aACjB,OAAO,EACP,KAAK,CAAC,UAAU;AACf,WAAK,cAAc;AACnB,WAAK,YAAY,KAAK,aAAa,KAAK;AACxC,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,UAAU;AAAA,IACjB,CAAC;AAEH,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,iBAA0B;AAChC,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,WAAO,KAAK,IAAI,IAAI,OAAQ,KAAK,YAAY,KAAK;AAAA,EACpD;AAAA,EAEQ,aAAa,KAAiC;AACpD,UAAM,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAChC,QAAI,CAAC,QAAS,QAAO;AAErB,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,CAAC;AACvE,WAAO,QAAQ;AAAA,EACjB;AACF;","names":["http"]}

package/dist/attest.d.cts

@@ -0,0 +1,28 @@
+interface AttestClientConfig {
+    kmsServerURL: string;
+    kmsPublicKey: string;
+    audience: string;
+    socketPath?: string;
+}
+declare class AttestClient {
+    private config;
+    constructor(config: AttestClientConfig);
+    attest(): Promise<string>;
+    private verifySignature;
+    private getAttestation;
+    private postAttest;
+}
+
+declare class JwtProvider {
+    private attestClient;
+    private bufferSeconds;
+    private cachedToken?;
+    private expiresAt?;
+    private pending?;
+    constructor(attestClient: AttestClient, bufferSeconds?: number);
+    getToken(): Promise<string>;
+    private isExpiringSoon;
+    private decodeJwtExp;
+}
+
+export { AttestClient, type AttestClientConfig, JwtProvider };

package/dist/attest.d.ts

@@ -0,0 +1,28 @@
+interface AttestClientConfig {
+    kmsServerURL: string;
+    kmsPublicKey: string;
+    audience: string;
+    socketPath?: string;
+}
+declare class AttestClient {
+    private config;
+    constructor(config: AttestClientConfig);
+    attest(): Promise<string>;
+    private verifySignature;
+    private getAttestation;
+    private postAttest;
+}
+
+declare class JwtProvider {
+    private attestClient;
+    private bufferSeconds;
+    private cachedToken?;
+    private expiresAt?;
+    private pending?;
+    constructor(attestClient: AttestClient, bufferSeconds?: number);
+    getToken(): Promise<string>;
+    private isExpiringSoon;
+    private decodeJwtExp;
+}
+
+export { AttestClient, type AttestClientConfig, JwtProvider };

package/dist/attest.js

@@ -0,0 +1,147 @@
+// src/client/modules/attest/attest-client.ts
+import { generateKeyPairSync, createHash, verify } from "crypto";
+import http from "http";
+import { compactDecrypt } from "jose";
+var DEFAULT_SOCKET_PATH = "/run/container_launcher/teeserver.sock";
+var CHALLENGE_PREFIX = "COMPUTE_APP_JWT_REQUEST_RSA_KEY_V1";
+var SIGNATURE_PREFIX = "COMPUTE_APP_KMS_SIGNATURE_V1";
+var NULL_BYTE = Buffer.from([0]);
+var AttestClient = class {
+  constructor(config) {
+    this.config = config;
+  }
+  async attest() {
+    const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+      modulusLength: 4096,
+      publicKeyEncoding: { type: "spki", format: "pem" },
+      privateKeyEncoding: { type: "pkcs8", format: "pem" }
+    });
+    const challengeHash = createHash("sha256").update(CHALLENGE_PREFIX).update(NULL_BYTE).update(publicKey).digest();
+    const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;
+    const attestationBytes = await this.getAttestation(socketPath, challengeHash);
+    const attestResponse = await this.postAttest(attestationBytes, publicKey);
+    this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);
+    const rsaPrivateKey = await crypto.subtle.importKey(
+      "pkcs8",
+      pemToBuffer(privateKey),
+      { name: "RSA-OAEP", hash: "SHA-256" },
+      false,
+      ["decrypt"]
+    );
+    const { plaintext } = await compactDecrypt(
+      attestResponse.data.encryptedToken,
+      rsaPrivateKey
+    );
+    const decrypted = JSON.parse(new TextDecoder().decode(plaintext));
+    return decrypted.token;
+  }
+  verifySignature(dataJson, signature) {
+    const message = Buffer.concat([
+      Buffer.from(SIGNATURE_PREFIX),
+      NULL_BYTE,
+      Buffer.from(dataJson)
+    ]);
+    const valid = verify(
+      "sha256",
+      message,
+      this.config.kmsPublicKey,
+      Buffer.from(signature, "base64")
+    );
+    if (!valid) {
+      throw new Error("KMS response signature verification failed");
+    }
+  }
+  getAttestation(socketPath, challenge) {
+    return new Promise((resolve, reject) => {
+      const body = JSON.stringify({ challenge: challenge.toString("base64") });
+      const req = http.request(
+        {
+          socketPath,
+          path: "/v1/bound_evidence",
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Content-Length": Buffer.byteLength(body)
+          }
+        },
+        (res) => {
+          const chunks = [];
+          res.on("data", (chunk) => chunks.push(chunk));
+          res.on("end", () => {
+            if (res.statusCode !== 200) {
+              reject(new Error(`TEE attestation failed (${res.statusCode}): ${Buffer.concat(chunks).toString()}`));
+              return;
+            }
+            resolve(Buffer.concat(chunks));
+          });
+        }
+      );
+      req.on("error", (err) => reject(new Error(`TEE attestation request failed: ${err.message}`)));
+      req.write(body);
+      req.end();
+    });
+  }
+  async postAttest(attestationBytes, rsaPublicKey) {
+    const url = `${this.config.kmsServerURL}/auth/attest`;
+    const body = JSON.stringify({
+      version: 3,
+      attestation: attestationBytes.toString("base64"),
+      rsaKey: rsaPublicKey,
+      audience: this.config.audience
+    });
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(`KMS attest failed (${response.status}): ${text}`);
+    }
+    return response.json();
+  }
+};
+function pemToBuffer(pem) {
+  const b64 = pem.replace(/-----[A-Z ]+-----/g, "").replace(/\s/g, "");
+  const buf = Buffer.from(b64, "base64");
+  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+}
+
+// src/client/modules/attest/jwt-provider.ts
+var JwtProvider = class {
+  constructor(attestClient, bufferSeconds = 30) {
+    this.attestClient = attestClient;
+    this.bufferSeconds = bufferSeconds;
+  }
+  async getToken() {
+    if (this.cachedToken && !this.isExpiringSoon()) {
+      return this.cachedToken;
+    }
+    if (this.pending) {
+      return this.pending;
+    }
+    this.pending = this.attestClient.attest().then((token) => {
+      this.cachedToken = token;
+      this.expiresAt = this.decodeJwtExp(token);
+      return token;
+    }).finally(() => {
+      this.pending = void 0;
+    });
+    return this.pending;
+  }
+  isExpiringSoon() {
+    if (!this.expiresAt) return true;
+    return Date.now() / 1e3 >= this.expiresAt - this.bufferSeconds;
+  }
+  decodeJwtExp(jwt) {
+    const payload = jwt.split(".")[1];
+    if (!payload) return void 0;
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString());
+    return decoded.exp;
+  }
+};
+export {
+  AttestClient,
+  JwtProvider
+};
+//# sourceMappingURL=attest.js.map

package/dist/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client/modules/attest/attest-client.ts","../src/client/modules/attest/jwt-provider.ts"],"sourcesContent":["import { generateKeyPairSync, createHash, verify } from 'node:crypto';\nimport http from 'node:http';\nimport { compactDecrypt } from 'jose';\n\nexport interface AttestClientConfig {\n  kmsServerURL: string;\n  kmsPublicKey: string;\n  audience: string;\n  socketPath?: string;\n}\n\nconst DEFAULT_SOCKET_PATH = '/run/container_launcher/teeserver.sock';\nconst CHALLENGE_PREFIX = 'COMPUTE_APP_JWT_REQUEST_RSA_KEY_V1';\nconst SIGNATURE_PREFIX = 'COMPUTE_APP_KMS_SIGNATURE_V1';\nconst NULL_BYTE = Buffer.from([0x00]);\n\nexport class AttestClient {\n  private config: AttestClientConfig;\n\n  constructor(config: AttestClientConfig) {\n    this.config = config;\n  }\n\n  async attest(): Promise<string> {\n    const { publicKey, privateKey } = generateKeyPairSync('rsa', {\n      modulusLength: 4096,\n      publicKeyEncoding: { type: 'spki', format: 'pem' } as const,\n      privateKeyEncoding: { type: 'pkcs8', format: 'pem' } as const,\n    });\n\n    const challengeHash = createHash('sha256')\n      .update(CHALLENGE_PREFIX)\n      .update(NULL_BYTE)\n      .update(publicKey)\n      .digest();\n\n    const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;\n    const attestationBytes = await this.getAttestation(socketPath, challengeHash);\n    const attestResponse = await this.postAttest(attestationBytes, publicKey);\n\n    this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);\n\n    const rsaPrivateKey = await crypto.subtle.importKey(\n      'pkcs8',\n      pemToBuffer(privateKey),\n      { name: 'RSA-OAEP', hash: 'SHA-256' },\n      false,\n      ['decrypt'],\n    );\n\n    const { plaintext } = await compactDecrypt(\n      attestResponse.data.encryptedToken,\n      rsaPrivateKey,\n    );\n\n    const decrypted = JSON.parse(new TextDecoder().decode(plaintext));\n    return decrypted.token;\n  }\n\n  private verifySignature(\n    dataJson: string,\n    signature: string,\n  ): void {\n    const message = Buffer.concat([\n      Buffer.from(SIGNATURE_PREFIX),\n      NULL_BYTE,\n      Buffer.from(dataJson),\n    ]);\n\n    const valid = verify(\n      'sha256',\n      message,\n      this.config.kmsPublicKey,\n      Buffer.from(signature, 'base64'),\n    );\n\n    if (!valid) {\n      throw new Error('KMS response signature verification failed');\n    }\n  }\n\n  private getAttestation(socketPath: string, challenge: Buffer): Promise<Buffer> {\n    return new Promise((resolve, reject) => {\n      const body = JSON.stringify({ challenge: challenge.toString('base64') });\n\n      const req = http.request(\n        {\n          socketPath,\n          path: '/v1/bound_evidence',\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            'Content-Length': Buffer.byteLength(body),\n          },\n        },\n        (res) => {\n          const chunks: Buffer[] = [];\n          res.on('data', (chunk: Buffer) => chunks.push(chunk));\n          res.on('end', () => {\n            if (res.statusCode !== 200) {\n              reject(new Error(`TEE attestation failed (${res.statusCode}): ${Buffer.concat(chunks).toString()}`));\n              return;\n            }\n            resolve(Buffer.concat(chunks));\n          });\n        },\n      );\n\n      req.on('error', (err) => reject(new Error(`TEE attestation request failed: ${err.message}`)));\n      req.write(body);\n      req.end();\n    });\n  }\n\n  private async postAttest(\n    attestationBytes: Buffer,\n    rsaPublicKey: string,\n  ): Promise<{ data: { encryptedToken: string }; signature: string }> {\n    const url = `${this.config.kmsServerURL}/auth/attest`;\n    const body = JSON.stringify({\n      version: 3,\n      attestation: attestationBytes.toString('base64'),\n      rsaKey: rsaPublicKey,\n      audience: this.config.audience,\n    });\n\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body,\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`KMS attest failed (${response.status}): ${text}`);\n    }\n\n    return response.json() as Promise<{ data: { encryptedToken: string }; signature: string }>;\n  }\n}\n\nfunction pemToBuffer(pem: string): ArrayBuffer {\n  const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\\s/g, '');\n  const buf = Buffer.from(b64, 'base64');\n\n  // Copy to a fresh ArrayBuffer to avoid offset issues with Buffer's shared pool\n  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);\n}\n","import type { AttestClient } from './attest-client';\n\nexport class JwtProvider {\n  private attestClient: AttestClient;\n  private bufferSeconds: number;\n  private cachedToken?: string;\n  private expiresAt?: number;\n  private pending?: Promise<string>;\n\n  constructor(attestClient: AttestClient, bufferSeconds: number = 30) {\n    this.attestClient = attestClient;\n    this.bufferSeconds = bufferSeconds;\n  }\n\n  async getToken(): Promise<string> {\n    if (this.cachedToken && !this.isExpiringSoon()) {\n      return this.cachedToken;\n    }\n\n    if (this.pending) {\n      return this.pending;\n    }\n\n    this.pending = this.attestClient\n      .attest()\n      .then((token) => {\n        this.cachedToken = token;\n        this.expiresAt = this.decodeJwtExp(token);\n        return token;\n      })\n      .finally(() => {\n        this.pending = undefined;\n      });\n\n    return this.pending;\n  }\n\n  private isExpiringSoon(): boolean {\n    if (!this.expiresAt) return true;\n    return Date.now() / 1000 >= this.expiresAt - this.bufferSeconds;\n  }\n\n  private decodeJwtExp(jwt: string): number | undefined {\n    const payload = jwt.split('.')[1];\n    if (!payload) return undefined;\n\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString());\n    return decoded.exp;\n  }\n}\n"],"mappings":";AAAA,SAAS,qBAAqB,YAAY,cAAc;AACxD,OAAO,UAAU;AACjB,SAAS,sBAAsB;AAS/B,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,YAAY,OAAO,KAAK,CAAC,CAAI,CAAC;AAE7B,IAAM,eAAN,MAAmB;AAAA,EAGxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,SAA0B;AAC9B,UAAM,EAAE,WAAW,WAAW,IAAI,oBAAoB,OAAO;AAAA,MAC3D,eAAe;AAAA,MACf,mBAAmB,EAAE,MAAM,QAAQ,QAAQ,MAAM;AAAA,MACjD,oBAAoB,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,IACrD,CAAC;AAED,UAAM,gBAAgB,WAAW,QAAQ,EACtC,OAAO,gBAAgB,EACvB,OAAO,SAAS,EAChB,OAAO,SAAS,EAChB,OAAO;AAEV,UAAM,aAAa,KAAK,OAAO,cAAc;AAC7C,UAAM,mBAAmB,MAAM,KAAK,eAAe,YAAY,aAAa;AAC5E,UAAM,iBAAiB,MAAM,KAAK,WAAW,kBAAkB,SAAS;AAExE,SAAK,gBAAgB,KAAK,UAAU,eAAe,IAAI,GAAG,eAAe,SAAS;AAElF,UAAM,gBAAgB,MAAM,OAAO,OAAO;AAAA,MACxC;AAAA,MACA,YAAY,UAAU;AAAA,MACtB,EAAE,MAAM,YAAY,MAAM,UAAU;AAAA,MACpC;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,EAAE,UAAU,IAAI,MAAM;AAAA,MAC1B,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,UAAU;AAAA,EACnB;AAAA,EAEQ,gBACN,UACA,WACM;AACN,UAAM,UAAU,OAAO,OAAO;AAAA,MAC5B,OAAO,KAAK,gBAAgB;AAAA,MAC5B;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,IACtB,CAAC;AAED,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,OAAO,KAAK,WAAW,QAAQ;AAAA,IACjC;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAAA,EACF;AAAA,EAEQ,eAAe,YAAoB,WAAoC;AAC7E,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,OAAO,KAAK,UAAU,EAAE,WAAW,UAAU,SAAS,QAAQ,EAAE,CAAC;AAEvE,YAAM,MAAM,KAAK;AAAA,QACf;AAAA,UACE;AAAA,UACA,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,CAAC,QAAQ;AACP,gBAAM,SAAmB,CAAC;AAC1B,cAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,cAAI,GAAG,OAAO,MAAM;AAClB,gBAAI,IAAI,eAAe,KAAK;AAC1B,qBAAO,IAAI,MAAM,2BAA2B,IAAI,UAAU,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;AACnG;AAAA,YACF;AACA,oBAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,UAC/B,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,GAAG,SAAS,CAAC,QAAQ,OAAO,IAAI,MAAM,mCAAmC,IAAI,OAAO,EAAE,CAAC,CAAC;AAC5F,UAAI,MAAM,IAAI;AACd,UAAI,IAAI;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,kBACA,cACkE;AAClE,UAAM,MAAM,GAAG,KAAK,OAAO,YAAY;AACvC,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,SAAS;AAAA,MACT,aAAa,iBAAiB,SAAS,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU,KAAK,OAAO;AAAA,IACxB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,IAAI,MAAM,sBAAsB,SAAS,MAAM,MAAM,IAAI,EAAE;AAAA,IACnE;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;AAEA,SAAS,YAAY,KAA0B;AAC7C,QAAM,MAAM,IAAI,QAAQ,sBAAsB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACnE,QAAM,MAAM,OAAO,KAAK,KAAK,QAAQ;AAGrC,SAAO,IAAI,OAAO,MAAM,IAAI,YAAY,IAAI,aAAa,IAAI,UAAU;AACzE;;;ACjJO,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,cAA4B,gBAAwB,IAAI;AAClE,SAAK,eAAe;AACpB,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEA,MAAM,WAA4B;AAChC,QAAI,KAAK,eAAe,CAAC,KAAK,eAAe,GAAG;AAC9C,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,KAAK,SAAS;AAChB,aAAO,KAAK;AAAA,IACd;AAEA,SAAK,UAAU,KAAK,aACjB,OAAO,EACP,KAAK,CAAC,UAAU;AACf,WAAK,cAAc;AACnB,WAAK,YAAY,KAAK,aAAa,KAAK;AACxC,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,UAAU;AAAA,IACjB,CAAC;AAEH,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,iBAA0B;AAChC,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,WAAO,KAAK,IAAI,IAAI,OAAQ,KAAK,YAAY,KAAK;AAAA,EACpD;AAAA,EAEQ,aAAa,KAAiC;AACpD,UAAM,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAChC,QAAI,CAAC,QAAS,QAAO;AAErB,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,CAAC;AACvE,WAAO,QAAQ;AAAA,EACjB;AACF;","names":[]}