@layr-labs/ecloud-sdk 0.5.0-dev.3 → 1.0.0-dev.1

package/VERSION

@@ -1,2 +1,2 @@
-version=0.5.0-dev.3
-commit=6f9c4b894157ead98ffe74ceed6052ccea589436
+version=1.0.0-dev.1
+commit=2f1f9686f28371adcd7521bfd335c15cd928f61d

package/dist/attest.cjs

@@ -47,7 +47,10 @@ var AttestClient = class {
   constructor(config) {
     this.config = config;
   }
-  async attest() {
+  async attest(extraData) {
+    if (extraData && extraData.length > 1048576) {
+      throw new Error(`extraData exceeds 1MB limit (${extraData.length} bytes)`);
+    }
     const { publicKey, privateKey } = (0, import_node_crypto.generateKeyPairSync)("rsa", {
       modulusLength: 4096,
       publicKeyEncoding: { type: "spki", format: "pem" },
@@ -55,8 +58,8 @@ var AttestClient = class {
     });
     const challengeHash = (0, import_node_crypto.createHash)("sha256").update(CHALLENGE_PREFIX).update(NULL_BYTE).update(publicKey).digest();
     const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;
-    const attestationBytes = await this.getAttestation(socketPath, challengeHash);
-    const attestResponse = await this.postAttest(attestationBytes, publicKey);
+    const attestationBytes = await this.getAttestation(socketPath, challengeHash, extraData);
+    const attestResponse = await this.postAttest(attestationBytes, publicKey, extraData);
     this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);
     const rsaPrivateKey = await crypto.subtle.importKey(
       "pkcs8",
@@ -88,9 +91,13 @@ var AttestClient = class {
       throw new Error("KMS response signature verification failed");
     }
   }
-  getAttestation(socketPath, challenge) {
+  getAttestation(socketPath, challenge, extraData) {
     return new Promise((resolve, reject) => {
-      const body = JSON.stringify({ challenge: challenge.toString("base64") });
+      const requestBody = { challenge: challenge.toString("base64") };
+      if (extraData && extraData.length > 0) {
+        requestBody.extra_data = extraData.toString("base64");
+      }
+      const body = JSON.stringify(requestBody);
       const req = import_node_http.default.request(
         {
           socketPath,
@@ -118,14 +125,18 @@ var AttestClient = class {
       req.end();
     });
   }
-  async postAttest(attestationBytes, rsaPublicKey) {
+  async postAttest(attestationBytes, rsaPublicKey, extraData) {
     const url = `${this.config.kmsServerURL}/auth/attest`;
-    const body = JSON.stringify({
+    const requestBody = {
       version: 3,
       attestation: attestationBytes.toString("base64"),
       rsaKey: rsaPublicKey,
       audience: this.config.audience
-    });
+    };
+    if (extraData && extraData.length > 0) {
+      requestBody.extra_data = extraData.toString("base64");
+    }
+    const body = JSON.stringify(requestBody);
     const response = await fetch(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -147,10 +158,21 @@ function pemToBuffer(pem) {
 // src/client/modules/attest/jwt-provider.ts
 var JwtProvider = class {
   constructor(attestClient, bufferSeconds = 30) {
+    this.pendingExtraData = /* @__PURE__ */ new Map();
     this.attestClient = attestClient;
     this.bufferSeconds = bufferSeconds;
   }
-  async getToken() {
+  async getToken(extraData) {
+    if (extraData && extraData.length > 0) {
+      const key = extraData.toString("hex");
+      const existing = this.pendingExtraData.get(key);
+      if (existing) return existing;
+      const promise = this.attestClient.attest(extraData).finally(() => {
+        this.pendingExtraData.delete(key);
+      });
+      this.pendingExtraData.set(key, promise);
+      return promise;
+    }
     if (this.cachedToken && !this.isExpiringSoon()) {
       return this.cachedToken;
     }

package/dist/attest.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/attest.ts","../src/client/modules/attest/attest-client.ts","../src/client/modules/attest/jwt-provider.ts"],"sourcesContent":["/**\n * Attestation module entry point\n *\n * Import from \"@layr-labs/ecloud-sdk/attest\" for direct access to attest module\n */\n\nexport * from \"./client/modules/attest\";\n","import { generateKeyPairSync, createHash, verify } from 'node:crypto';\nimport http from 'node:http';\nimport { compactDecrypt } from 'jose';\n\nexport interface AttestClientConfig {\n  kmsServerURL: string;\n  kmsPublicKey: string;\n  audience: string;\n  socketPath?: string;\n}\n\nconst DEFAULT_SOCKET_PATH = '/run/container_launcher/teeserver.sock';\nconst CHALLENGE_PREFIX = 'COMPUTE_APP_JWT_REQUEST_RSA_KEY_V1';\nconst SIGNATURE_PREFIX = 'COMPUTE_APP_KMS_SIGNATURE_V1';\nconst NULL_BYTE = Buffer.from([0x00]);\n\nexport class AttestClient {\n  private config: AttestClientConfig;\n\n  constructor(config: AttestClientConfig) {\n    this.config = config;\n  }\n\n  async attest(): Promise<string> {\n    const { publicKey, privateKey } = generateKeyPairSync('rsa', {\n      modulusLength: 4096,\n      publicKeyEncoding: { type: 'spki', format: 'pem' } as const,\n      privateKeyEncoding: { type: 'pkcs8', format: 'pem' } as const,\n    });\n\n    const challengeHash = createHash('sha256')\n      .update(CHALLENGE_PREFIX)\n      .update(NULL_BYTE)\n      .update(publicKey)\n      .digest();\n\n    const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;\n    const attestationBytes = await this.getAttestation(socketPath, challengeHash);\n    const attestResponse = await this.postAttest(attestationBytes, publicKey);\n\n    this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);\n\n    const rsaPrivateKey = await crypto.subtle.importKey(\n      'pkcs8',\n      pemToBuffer(privateKey),\n      { name: 'RSA-OAEP', hash: 'SHA-256' },\n      false,\n      ['decrypt'],\n    );\n\n    const { plaintext } = await compactDecrypt(\n      attestResponse.data.encryptedToken,\n      rsaPrivateKey,\n    );\n\n    const decrypted = JSON.parse(new TextDecoder().decode(plaintext));\n    return decrypted.token;\n  }\n\n  private verifySignature(\n    dataJson: string,\n    signature: string,\n  ): void {\n    const message = Buffer.concat([\n      Buffer.from(SIGNATURE_PREFIX),\n      NULL_BYTE,\n      Buffer.from(dataJson),\n    ]);\n\n    const valid = verify(\n      'sha256',\n      message,\n      this.config.kmsPublicKey,\n      Buffer.from(signature, 'base64'),\n    );\n\n    if (!valid) {\n      throw new Error('KMS response signature verification failed');\n    }\n  }\n\n  private getAttestation(socketPath: string, challenge: Buffer): Promise<Buffer> {\n    return new Promise((resolve, reject) => {\n      const body = JSON.stringify({ challenge: challenge.toString('base64') });\n\n      const req = http.request(\n        {\n          socketPath,\n          path: '/v1/bound_evidence',\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            'Content-Length': Buffer.byteLength(body),\n          },\n        },\n        (res) => {\n          const chunks: Buffer[] = [];\n          res.on('data', (chunk: Buffer) => chunks.push(chunk));\n          res.on('end', () => {\n            if (res.statusCode !== 200) {\n              reject(new Error(`TEE attestation failed (${res.statusCode}): ${Buffer.concat(chunks).toString()}`));\n              return;\n            }\n            resolve(Buffer.concat(chunks));\n          });\n        },\n      );\n\n      req.on('error', (err) => reject(new Error(`TEE attestation request failed: ${err.message}`)));\n      req.write(body);\n      req.end();\n    });\n  }\n\n  private async postAttest(\n    attestationBytes: Buffer,\n    rsaPublicKey: string,\n  ): Promise<{ data: { encryptedToken: string }; signature: string }> {\n    const url = `${this.config.kmsServerURL}/auth/attest`;\n    const body = JSON.stringify({\n      version: 3,\n      attestation: attestationBytes.toString('base64'),\n      rsaKey: rsaPublicKey,\n      audience: this.config.audience,\n    });\n\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body,\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`KMS attest failed (${response.status}): ${text}`);\n    }\n\n    return response.json() as Promise<{ data: { encryptedToken: string }; signature: string }>;\n  }\n}\n\nfunction pemToBuffer(pem: string): ArrayBuffer {\n  const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\\s/g, '');\n  const buf = Buffer.from(b64, 'base64');\n\n  // Copy to a fresh ArrayBuffer to avoid offset issues with Buffer's shared pool\n  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);\n}\n","import type { AttestClient } from './attest-client';\n\nexport class JwtProvider {\n  private attestClient: AttestClient;\n  private bufferSeconds: number;\n  private cachedToken?: string;\n  private expiresAt?: number;\n  private pending?: Promise<string>;\n\n  constructor(attestClient: AttestClient, bufferSeconds: number = 30) {\n    this.attestClient = attestClient;\n    this.bufferSeconds = bufferSeconds;\n  }\n\n  async getToken(): Promise<string> {\n    if (this.cachedToken && !this.isExpiringSoon()) {\n      return this.cachedToken;\n    }\n\n    if (this.pending) {\n      return this.pending;\n    }\n\n    this.pending = this.attestClient\n      .attest()\n      .then((token) => {\n        this.cachedToken = token;\n        this.expiresAt = this.decodeJwtExp(token);\n        return token;\n      })\n      .finally(() => {\n        this.pending = undefined;\n      });\n\n    return this.pending;\n  }\n\n  private isExpiringSoon(): boolean {\n    if (!this.expiresAt) return true;\n    return Date.now() / 1000 >= this.expiresAt - this.bufferSeconds;\n  }\n\n  private decodeJwtExp(jwt: string): number | undefined {\n    const payload = jwt.split('.')[1];\n    if (!payload) return undefined;\n\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString());\n    return decoded.exp;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAAwD;AACxD,uBAAiB;AACjB,kBAA+B;AAS/B,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,YAAY,OAAO,KAAK,CAAC,CAAI,CAAC;AAE7B,IAAM,eAAN,MAAmB;AAAA,EAGxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,SAA0B;AAC9B,UAAM,EAAE,WAAW,WAAW,QAAI,wCAAoB,OAAO;AAAA,MAC3D,eAAe;AAAA,MACf,mBAAmB,EAAE,MAAM,QAAQ,QAAQ,MAAM;AAAA,MACjD,oBAAoB,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,IACrD,CAAC;AAED,UAAM,oBAAgB,+BAAW,QAAQ,EACtC,OAAO,gBAAgB,EACvB,OAAO,SAAS,EAChB,OAAO,SAAS,EAChB,OAAO;AAEV,UAAM,aAAa,KAAK,OAAO,cAAc;AAC7C,UAAM,mBAAmB,MAAM,KAAK,eAAe,YAAY,aAAa;AAC5E,UAAM,iBAAiB,MAAM,KAAK,WAAW,kBAAkB,SAAS;AAExE,SAAK,gBAAgB,KAAK,UAAU,eAAe,IAAI,GAAG,eAAe,SAAS;AAElF,UAAM,gBAAgB,MAAM,OAAO,OAAO;AAAA,MACxC;AAAA,MACA,YAAY,UAAU;AAAA,MACtB,EAAE,MAAM,YAAY,MAAM,UAAU;AAAA,MACpC;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,EAAE,UAAU,IAAI,UAAM;AAAA,MAC1B,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,UAAU;AAAA,EACnB;AAAA,EAEQ,gBACN,UACA,WACM;AACN,UAAM,UAAU,OAAO,OAAO;AAAA,MAC5B,OAAO,KAAK,gBAAgB;AAAA,MAC5B;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,IACtB,CAAC;AAED,UAAM,YAAQ;AAAA,MACZ;AAAA,MACA;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,OAAO,KAAK,WAAW,QAAQ;AAAA,IACjC;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAAA,EACF;AAAA,EAEQ,eAAe,YAAoB,WAAoC;AAC7E,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,OAAO,KAAK,UAAU,EAAE,WAAW,UAAU,SAAS,QAAQ,EAAE,CAAC;AAEvE,YAAM,MAAM,iBAAAA,QAAK;AAAA,QACf;AAAA,UACE;AAAA,UACA,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,CAAC,QAAQ;AACP,gBAAM,SAAmB,CAAC;AAC1B,cAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,cAAI,GAAG,OAAO,MAAM;AAClB,gBAAI,IAAI,eAAe,KAAK;AAC1B,qBAAO,IAAI,MAAM,2BAA2B,IAAI,UAAU,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;AACnG;AAAA,YACF;AACA,oBAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,UAC/B,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,GAAG,SAAS,CAAC,QAAQ,OAAO,IAAI,MAAM,mCAAmC,IAAI,OAAO,EAAE,CAAC,CAAC;AAC5F,UAAI,MAAM,IAAI;AACd,UAAI,IAAI;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,kBACA,cACkE;AAClE,UAAM,MAAM,GAAG,KAAK,OAAO,YAAY;AACvC,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,SAAS;AAAA,MACT,aAAa,iBAAiB,SAAS,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU,KAAK,OAAO;AAAA,IACxB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,IAAI,MAAM,sBAAsB,SAAS,MAAM,MAAM,IAAI,EAAE;AAAA,IACnE;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;AAEA,SAAS,YAAY,KAA0B;AAC7C,QAAM,MAAM,IAAI,QAAQ,sBAAsB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACnE,QAAM,MAAM,OAAO,KAAK,KAAK,QAAQ;AAGrC,SAAO,IAAI,OAAO,MAAM,IAAI,YAAY,IAAI,aAAa,IAAI,UAAU;AACzE;;;ACjJO,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,cAA4B,gBAAwB,IAAI;AAClE,SAAK,eAAe;AACpB,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEA,MAAM,WAA4B;AAChC,QAAI,KAAK,eAAe,CAAC,KAAK,eAAe,GAAG;AAC9C,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,KAAK,SAAS;AAChB,aAAO,KAAK;AAAA,IACd;AAEA,SAAK,UAAU,KAAK,aACjB,OAAO,EACP,KAAK,CAAC,UAAU;AACf,WAAK,cAAc;AACnB,WAAK,YAAY,KAAK,aAAa,KAAK;AACxC,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,UAAU;AAAA,IACjB,CAAC;AAEH,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,iBAA0B;AAChC,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,WAAO,KAAK,IAAI,IAAI,OAAQ,KAAK,YAAY,KAAK;AAAA,EACpD;AAAA,EAEQ,aAAa,KAAiC;AACpD,UAAM,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAChC,QAAI,CAAC,QAAS,QAAO;AAErB,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,CAAC;AACvE,WAAO,QAAQ;AAAA,EACjB;AACF;","names":["http"]}
+{"version":3,"sources":["../src/attest.ts","../src/client/modules/attest/attest-client.ts","../src/client/modules/attest/jwt-provider.ts"],"sourcesContent":["/**\n * Attestation module entry point\n *\n * Import from \"@layr-labs/ecloud-sdk/attest\" for direct access to attest module\n */\n\nexport * from \"./client/modules/attest\";\n","import { generateKeyPairSync, createHash, verify } from 'node:crypto';\nimport http from 'node:http';\nimport { compactDecrypt } from 'jose';\n\nexport interface AttestClientConfig {\n  kmsServerURL: string;\n  kmsPublicKey: string;\n  audience: string;\n  socketPath?: string;\n}\n\nconst DEFAULT_SOCKET_PATH = '/run/container_launcher/teeserver.sock';\nconst CHALLENGE_PREFIX = 'COMPUTE_APP_JWT_REQUEST_RSA_KEY_V1';\nconst SIGNATURE_PREFIX = 'COMPUTE_APP_KMS_SIGNATURE_V1';\nconst NULL_BYTE = Buffer.from([0x00]);\n\nexport class AttestClient {\n  private config: AttestClientConfig;\n\n  constructor(config: AttestClientConfig) {\n    this.config = config;\n  }\n\n  async attest(extraData?: Buffer): Promise<string> {\n    // go-tpm-tools hashes extraData (SHA-256/SHA-512) before binding it into the\n    // hardware nonce, so callers can pass arbitrary data up to 1MB.\n    if (extraData && extraData.length > 1_048_576) {\n      throw new Error(`extraData exceeds 1MB limit (${extraData.length} bytes)`);\n    }\n\n    const { publicKey, privateKey } = generateKeyPairSync('rsa', {\n      modulusLength: 4096,\n      publicKeyEncoding: { type: 'spki', format: 'pem' } as const,\n      privateKeyEncoding: { type: 'pkcs8', format: 'pem' } as const,\n    });\n\n    const challengeHash = createHash('sha256')\n      .update(CHALLENGE_PREFIX)\n      .update(NULL_BYTE)\n      .update(publicKey)\n      .digest();\n\n    const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;\n    const attestationBytes = await this.getAttestation(socketPath, challengeHash, extraData);\n    const attestResponse = await this.postAttest(attestationBytes, publicKey, extraData);\n\n    this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);\n\n    const rsaPrivateKey = await crypto.subtle.importKey(\n      'pkcs8',\n      pemToBuffer(privateKey),\n      { name: 'RSA-OAEP', hash: 'SHA-256' },\n      false,\n      ['decrypt'],\n    );\n\n    const { plaintext } = await compactDecrypt(\n      attestResponse.data.encryptedToken,\n      rsaPrivateKey,\n    );\n\n    const decrypted = JSON.parse(new TextDecoder().decode(plaintext));\n    return decrypted.token;\n  }\n\n  private verifySignature(\n    dataJson: string,\n    signature: string,\n  ): void {\n    const message = Buffer.concat([\n      Buffer.from(SIGNATURE_PREFIX),\n      NULL_BYTE,\n      Buffer.from(dataJson),\n    ]);\n\n    const valid = verify(\n      'sha256',\n      message,\n      this.config.kmsPublicKey,\n      Buffer.from(signature, 'base64'),\n    );\n\n    if (!valid) {\n      throw new Error('KMS response signature verification failed');\n    }\n  }\n\n  private getAttestation(socketPath: string, challenge: Buffer, extraData?: Buffer): Promise<Buffer> {\n    return new Promise((resolve, reject) => {\n      const requestBody: Record<string, string> = { challenge: challenge.toString('base64') };\n      if (extraData && extraData.length > 0) {\n        requestBody.extra_data = extraData.toString('base64');\n      }\n      const body = JSON.stringify(requestBody);\n\n      const req = http.request(\n        {\n          socketPath,\n          path: '/v1/bound_evidence',\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            'Content-Length': Buffer.byteLength(body),\n          },\n        },\n        (res) => {\n          const chunks: Buffer[] = [];\n          res.on('data', (chunk: Buffer) => chunks.push(chunk));\n          res.on('end', () => {\n            if (res.statusCode !== 200) {\n              reject(new Error(`TEE attestation failed (${res.statusCode}): ${Buffer.concat(chunks).toString()}`));\n              return;\n            }\n            resolve(Buffer.concat(chunks));\n          });\n        },\n      );\n\n      req.on('error', (err) => reject(new Error(`TEE attestation request failed: ${err.message}`)));\n      req.write(body);\n      req.end();\n    });\n  }\n\n  private async postAttest(\n    attestationBytes: Buffer,\n    rsaPublicKey: string,\n    extraData?: Buffer,\n  ): Promise<{ data: { encryptedToken: string }; signature: string }> {\n    const url = `${this.config.kmsServerURL}/auth/attest`;\n    const requestBody: Record<string, unknown> = {\n      version: 3,\n      attestation: attestationBytes.toString('base64'),\n      rsaKey: rsaPublicKey,\n      audience: this.config.audience,\n    };\n    if (extraData && extraData.length > 0) {\n      requestBody.extra_data = extraData.toString('base64');\n    }\n    const body = JSON.stringify(requestBody);\n\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body,\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`KMS attest failed (${response.status}): ${text}`);\n    }\n\n    return response.json() as Promise<{ data: { encryptedToken: string }; signature: string }>;\n  }\n}\n\nfunction pemToBuffer(pem: string): ArrayBuffer {\n  const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\\s/g, '');\n  const buf = Buffer.from(b64, 'base64');\n\n  // Copy to a fresh ArrayBuffer to avoid offset issues with Buffer's shared pool\n  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);\n}\n","import type { AttestClient } from './attest-client';\n\nexport class JwtProvider {\n  private attestClient: AttestClient;\n  private bufferSeconds: number;\n  private cachedToken?: string;\n  private expiresAt?: number;\n  private pending?: Promise<string>;\n  private pendingExtraData = new Map<string, Promise<string>>();\n\n  constructor(attestClient: AttestClient, bufferSeconds: number = 30) {\n    this.attestClient = attestClient;\n    this.bufferSeconds = bufferSeconds;\n  }\n\n  async getToken(extraData?: Buffer): Promise<string> {\n    // When extraData is provided, bypass long-lived cache but deduplicate\n    // concurrent requests for the same extraData to avoid thundering herd\n    // on TEE hardware calls.\n    if (extraData && extraData.length > 0) {\n      const key = extraData.toString('hex');\n      const existing = this.pendingExtraData.get(key);\n      if (existing) return existing;\n      const promise = this.attestClient.attest(extraData).finally(() => {\n        this.pendingExtraData.delete(key);\n      });\n      this.pendingExtraData.set(key, promise);\n      return promise;\n    }\n\n    if (this.cachedToken && !this.isExpiringSoon()) {\n      return this.cachedToken;\n    }\n\n    if (this.pending) {\n      return this.pending;\n    }\n\n    this.pending = this.attestClient\n      .attest()\n      .then((token) => {\n        this.cachedToken = token;\n        this.expiresAt = this.decodeJwtExp(token);\n        return token;\n      })\n      .finally(() => {\n        this.pending = undefined;\n      });\n\n    return this.pending;\n  }\n\n  private isExpiringSoon(): boolean {\n    if (!this.expiresAt) return true;\n    return Date.now() / 1000 >= this.expiresAt - this.bufferSeconds;\n  }\n\n  private decodeJwtExp(jwt: string): number | undefined {\n    const payload = jwt.split('.')[1];\n    if (!payload) return undefined;\n\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString());\n    return decoded.exp;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,yBAAwD;AACxD,uBAAiB;AACjB,kBAA+B;AAS/B,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,YAAY,OAAO,KAAK,CAAC,CAAI,CAAC;AAE7B,IAAM,eAAN,MAAmB;AAAA,EAGxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,OAAO,WAAqC;AAGhD,QAAI,aAAa,UAAU,SAAS,SAAW;AAC7C,YAAM,IAAI,MAAM,gCAAgC,UAAU,MAAM,SAAS;AAAA,IAC3E;AAEA,UAAM,EAAE,WAAW,WAAW,QAAI,wCAAoB,OAAO;AAAA,MAC3D,eAAe;AAAA,MACf,mBAAmB,EAAE,MAAM,QAAQ,QAAQ,MAAM;AAAA,MACjD,oBAAoB,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,IACrD,CAAC;AAED,UAAM,oBAAgB,+BAAW,QAAQ,EACtC,OAAO,gBAAgB,EACvB,OAAO,SAAS,EAChB,OAAO,SAAS,EAChB,OAAO;AAEV,UAAM,aAAa,KAAK,OAAO,cAAc;AAC7C,UAAM,mBAAmB,MAAM,KAAK,eAAe,YAAY,eAAe,SAAS;AACvF,UAAM,iBAAiB,MAAM,KAAK,WAAW,kBAAkB,WAAW,SAAS;AAEnF,SAAK,gBAAgB,KAAK,UAAU,eAAe,IAAI,GAAG,eAAe,SAAS;AAElF,UAAM,gBAAgB,MAAM,OAAO,OAAO;AAAA,MACxC;AAAA,MACA,YAAY,UAAU;AAAA,MACtB,EAAE,MAAM,YAAY,MAAM,UAAU;AAAA,MACpC;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,EAAE,UAAU,IAAI,UAAM;AAAA,MAC1B,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,UAAU;AAAA,EACnB;AAAA,EAEQ,gBACN,UACA,WACM;AACN,UAAM,UAAU,OAAO,OAAO;AAAA,MAC5B,OAAO,KAAK,gBAAgB;AAAA,MAC5B;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,IACtB,CAAC;AAED,UAAM,YAAQ;AAAA,MACZ;AAAA,MACA;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,OAAO,KAAK,WAAW,QAAQ;AAAA,IACjC;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAAA,EACF;AAAA,EAEQ,eAAe,YAAoB,WAAmB,WAAqC;AACjG,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,cAAsC,EAAE,WAAW,UAAU,SAAS,QAAQ,EAAE;AACtF,UAAI,aAAa,UAAU,SAAS,GAAG;AACrC,oBAAY,aAAa,UAAU,SAAS,QAAQ;AAAA,MACtD;AACA,YAAM,OAAO,KAAK,UAAU,WAAW;AAEvC,YAAM,MAAM,iBAAAA,QAAK;AAAA,QACf;AAAA,UACE;AAAA,UACA,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,CAAC,QAAQ;AACP,gBAAM,SAAmB,CAAC;AAC1B,cAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,cAAI,GAAG,OAAO,MAAM;AAClB,gBAAI,IAAI,eAAe,KAAK;AAC1B,qBAAO,IAAI,MAAM,2BAA2B,IAAI,UAAU,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;AACnG;AAAA,YACF;AACA,oBAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,UAC/B,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,GAAG,SAAS,CAAC,QAAQ,OAAO,IAAI,MAAM,mCAAmC,IAAI,OAAO,EAAE,CAAC,CAAC;AAC5F,UAAI,MAAM,IAAI;AACd,UAAI,IAAI;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,kBACA,cACA,WACkE;AAClE,UAAM,MAAM,GAAG,KAAK,OAAO,YAAY;AACvC,UAAM,cAAuC;AAAA,MAC3C,SAAS;AAAA,MACT,aAAa,iBAAiB,SAAS,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU,KAAK,OAAO;AAAA,IACxB;AACA,QAAI,aAAa,UAAU,SAAS,GAAG;AACrC,kBAAY,aAAa,UAAU,SAAS,QAAQ;AAAA,IACtD;AACA,UAAM,OAAO,KAAK,UAAU,WAAW;AAEvC,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,IAAI,MAAM,sBAAsB,SAAS,MAAM,MAAM,IAAI,EAAE;AAAA,IACnE;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;AAEA,SAAS,YAAY,KAA0B;AAC7C,QAAM,MAAM,IAAI,QAAQ,sBAAsB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACnE,QAAM,MAAM,OAAO,KAAK,KAAK,QAAQ;AAGrC,SAAO,IAAI,OAAO,MAAM,IAAI,YAAY,IAAI,aAAa,IAAI,UAAU;AACzE;;;AChKO,IAAM,cAAN,MAAkB;AAAA,EAQvB,YAAY,cAA4B,gBAAwB,IAAI;AAFpE,SAAQ,mBAAmB,oBAAI,IAA6B;AAG1D,SAAK,eAAe;AACpB,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEA,MAAM,SAAS,WAAqC;AAIlD,QAAI,aAAa,UAAU,SAAS,GAAG;AACrC,YAAM,MAAM,UAAU,SAAS,KAAK;AACpC,YAAM,WAAW,KAAK,iBAAiB,IAAI,GAAG;AAC9C,UAAI,SAAU,QAAO;AACrB,YAAM,UAAU,KAAK,aAAa,OAAO,SAAS,EAAE,QAAQ,MAAM;AAChE,aAAK,iBAAiB,OAAO,GAAG;AAAA,MAClC,CAAC;AACD,WAAK,iBAAiB,IAAI,KAAK,OAAO;AACtC,aAAO;AAAA,IACT;AAEA,QAAI,KAAK,eAAe,CAAC,KAAK,eAAe,GAAG;AAC9C,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,KAAK,SAAS;AAChB,aAAO,KAAK;AAAA,IACd;AAEA,SAAK,UAAU,KAAK,aACjB,OAAO,EACP,KAAK,CAAC,UAAU;AACf,WAAK,cAAc;AACnB,WAAK,YAAY,KAAK,aAAa,KAAK;AACxC,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,UAAU;AAAA,IACjB,CAAC;AAEH,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,iBAA0B;AAChC,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,WAAO,KAAK,IAAI,IAAI,OAAQ,KAAK,YAAY,KAAK;AAAA,EACpD;AAAA,EAEQ,aAAa,KAAiC;AACpD,UAAM,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAChC,QAAI,CAAC,QAAS,QAAO;AAErB,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,CAAC;AACvE,WAAO,QAAQ;AAAA,EACjB;AACF;","names":["http"]}

package/dist/attest.d.cts

@@ -7,7 +7,7 @@ interface AttestClientConfig {
 declare class AttestClient {
     private config;
     constructor(config: AttestClientConfig);
-    attest(): Promise<string>;
+    attest(extraData?: Buffer): Promise<string>;
     private verifySignature;
     private getAttestation;
     private postAttest;
@@ -19,8 +19,9 @@ declare class JwtProvider {
     private cachedToken?;
     private expiresAt?;
     private pending?;
+    private pendingExtraData;
     constructor(attestClient: AttestClient, bufferSeconds?: number);
-    getToken(): Promise<string>;
+    getToken(extraData?: Buffer): Promise<string>;
     private isExpiringSoon;
     private decodeJwtExp;
 }

package/dist/attest.d.ts

@@ -7,7 +7,7 @@ interface AttestClientConfig {
 declare class AttestClient {
     private config;
     constructor(config: AttestClientConfig);
-    attest(): Promise<string>;
+    attest(extraData?: Buffer): Promise<string>;
     private verifySignature;
     private getAttestation;
     private postAttest;
@@ -19,8 +19,9 @@ declare class JwtProvider {
     private cachedToken?;
     private expiresAt?;
     private pending?;
+    private pendingExtraData;
     constructor(attestClient: AttestClient, bufferSeconds?: number);
-    getToken(): Promise<string>;
+    getToken(extraData?: Buffer): Promise<string>;
     private isExpiringSoon;
     private decodeJwtExp;
 }

package/dist/attest.js

@@ -10,7 +10,10 @@ var AttestClient = class {
   constructor(config) {
     this.config = config;
   }
-  async attest() {
+  async attest(extraData) {
+    if (extraData && extraData.length > 1048576) {
+      throw new Error(`extraData exceeds 1MB limit (${extraData.length} bytes)`);
+    }
     const { publicKey, privateKey } = generateKeyPairSync("rsa", {
       modulusLength: 4096,
       publicKeyEncoding: { type: "spki", format: "pem" },
@@ -18,8 +21,8 @@ var AttestClient = class {
     });
     const challengeHash = createHash("sha256").update(CHALLENGE_PREFIX).update(NULL_BYTE).update(publicKey).digest();
     const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;
-    const attestationBytes = await this.getAttestation(socketPath, challengeHash);
-    const attestResponse = await this.postAttest(attestationBytes, publicKey);
+    const attestationBytes = await this.getAttestation(socketPath, challengeHash, extraData);
+    const attestResponse = await this.postAttest(attestationBytes, publicKey, extraData);
     this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);
     const rsaPrivateKey = await crypto.subtle.importKey(
       "pkcs8",
@@ -51,9 +54,13 @@ var AttestClient = class {
       throw new Error("KMS response signature verification failed");
     }
   }
-  getAttestation(socketPath, challenge) {
+  getAttestation(socketPath, challenge, extraData) {
     return new Promise((resolve, reject) => {
-      const body = JSON.stringify({ challenge: challenge.toString("base64") });
+      const requestBody = { challenge: challenge.toString("base64") };
+      if (extraData && extraData.length > 0) {
+        requestBody.extra_data = extraData.toString("base64");
+      }
+      const body = JSON.stringify(requestBody);
       const req = http.request(
         {
           socketPath,
@@ -81,14 +88,18 @@ var AttestClient = class {
       req.end();
     });
   }
-  async postAttest(attestationBytes, rsaPublicKey) {
+  async postAttest(attestationBytes, rsaPublicKey, extraData) {
     const url = `${this.config.kmsServerURL}/auth/attest`;
-    const body = JSON.stringify({
+    const requestBody = {
       version: 3,
       attestation: attestationBytes.toString("base64"),
       rsaKey: rsaPublicKey,
       audience: this.config.audience
-    });
+    };
+    if (extraData && extraData.length > 0) {
+      requestBody.extra_data = extraData.toString("base64");
+    }
+    const body = JSON.stringify(requestBody);
     const response = await fetch(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -110,10 +121,21 @@ function pemToBuffer(pem) {
 // src/client/modules/attest/jwt-provider.ts
 var JwtProvider = class {
   constructor(attestClient, bufferSeconds = 30) {
+    this.pendingExtraData = /* @__PURE__ */ new Map();
     this.attestClient = attestClient;
     this.bufferSeconds = bufferSeconds;
   }
-  async getToken() {
+  async getToken(extraData) {
+    if (extraData && extraData.length > 0) {
+      const key = extraData.toString("hex");
+      const existing = this.pendingExtraData.get(key);
+      if (existing) return existing;
+      const promise = this.attestClient.attest(extraData).finally(() => {
+        this.pendingExtraData.delete(key);
+      });
+      this.pendingExtraData.set(key, promise);
+      return promise;
+    }
     if (this.cachedToken && !this.isExpiringSoon()) {
       return this.cachedToken;
     }

package/dist/attest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client/modules/attest/attest-client.ts","../src/client/modules/attest/jwt-provider.ts"],"sourcesContent":["import { generateKeyPairSync, createHash, verify } from 'node:crypto';\nimport http from 'node:http';\nimport { compactDecrypt } from 'jose';\n\nexport interface AttestClientConfig {\n  kmsServerURL: string;\n  kmsPublicKey: string;\n  audience: string;\n  socketPath?: string;\n}\n\nconst DEFAULT_SOCKET_PATH = '/run/container_launcher/teeserver.sock';\nconst CHALLENGE_PREFIX = 'COMPUTE_APP_JWT_REQUEST_RSA_KEY_V1';\nconst SIGNATURE_PREFIX = 'COMPUTE_APP_KMS_SIGNATURE_V1';\nconst NULL_BYTE = Buffer.from([0x00]);\n\nexport class AttestClient {\n  private config: AttestClientConfig;\n\n  constructor(config: AttestClientConfig) {\n    this.config = config;\n  }\n\n  async attest(): Promise<string> {\n    const { publicKey, privateKey } = generateKeyPairSync('rsa', {\n      modulusLength: 4096,\n      publicKeyEncoding: { type: 'spki', format: 'pem' } as const,\n      privateKeyEncoding: { type: 'pkcs8', format: 'pem' } as const,\n    });\n\n    const challengeHash = createHash('sha256')\n      .update(CHALLENGE_PREFIX)\n      .update(NULL_BYTE)\n      .update(publicKey)\n      .digest();\n\n    const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;\n    const attestationBytes = await this.getAttestation(socketPath, challengeHash);\n    const attestResponse = await this.postAttest(attestationBytes, publicKey);\n\n    this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);\n\n    const rsaPrivateKey = await crypto.subtle.importKey(\n      'pkcs8',\n      pemToBuffer(privateKey),\n      { name: 'RSA-OAEP', hash: 'SHA-256' },\n      false,\n      ['decrypt'],\n    );\n\n    const { plaintext } = await compactDecrypt(\n      attestResponse.data.encryptedToken,\n      rsaPrivateKey,\n    );\n\n    const decrypted = JSON.parse(new TextDecoder().decode(plaintext));\n    return decrypted.token;\n  }\n\n  private verifySignature(\n    dataJson: string,\n    signature: string,\n  ): void {\n    const message = Buffer.concat([\n      Buffer.from(SIGNATURE_PREFIX),\n      NULL_BYTE,\n      Buffer.from(dataJson),\n    ]);\n\n    const valid = verify(\n      'sha256',\n      message,\n      this.config.kmsPublicKey,\n      Buffer.from(signature, 'base64'),\n    );\n\n    if (!valid) {\n      throw new Error('KMS response signature verification failed');\n    }\n  }\n\n  private getAttestation(socketPath: string, challenge: Buffer): Promise<Buffer> {\n    return new Promise((resolve, reject) => {\n      const body = JSON.stringify({ challenge: challenge.toString('base64') });\n\n      const req = http.request(\n        {\n          socketPath,\n          path: '/v1/bound_evidence',\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            'Content-Length': Buffer.byteLength(body),\n          },\n        },\n        (res) => {\n          const chunks: Buffer[] = [];\n          res.on('data', (chunk: Buffer) => chunks.push(chunk));\n          res.on('end', () => {\n            if (res.statusCode !== 200) {\n              reject(new Error(`TEE attestation failed (${res.statusCode}): ${Buffer.concat(chunks).toString()}`));\n              return;\n            }\n            resolve(Buffer.concat(chunks));\n          });\n        },\n      );\n\n      req.on('error', (err) => reject(new Error(`TEE attestation request failed: ${err.message}`)));\n      req.write(body);\n      req.end();\n    });\n  }\n\n  private async postAttest(\n    attestationBytes: Buffer,\n    rsaPublicKey: string,\n  ): Promise<{ data: { encryptedToken: string }; signature: string }> {\n    const url = `${this.config.kmsServerURL}/auth/attest`;\n    const body = JSON.stringify({\n      version: 3,\n      attestation: attestationBytes.toString('base64'),\n      rsaKey: rsaPublicKey,\n      audience: this.config.audience,\n    });\n\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body,\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`KMS attest failed (${response.status}): ${text}`);\n    }\n\n    return response.json() as Promise<{ data: { encryptedToken: string }; signature: string }>;\n  }\n}\n\nfunction pemToBuffer(pem: string): ArrayBuffer {\n  const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\\s/g, '');\n  const buf = Buffer.from(b64, 'base64');\n\n  // Copy to a fresh ArrayBuffer to avoid offset issues with Buffer's shared pool\n  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);\n}\n","import type { AttestClient } from './attest-client';\n\nexport class JwtProvider {\n  private attestClient: AttestClient;\n  private bufferSeconds: number;\n  private cachedToken?: string;\n  private expiresAt?: number;\n  private pending?: Promise<string>;\n\n  constructor(attestClient: AttestClient, bufferSeconds: number = 30) {\n    this.attestClient = attestClient;\n    this.bufferSeconds = bufferSeconds;\n  }\n\n  async getToken(): Promise<string> {\n    if (this.cachedToken && !this.isExpiringSoon()) {\n      return this.cachedToken;\n    }\n\n    if (this.pending) {\n      return this.pending;\n    }\n\n    this.pending = this.attestClient\n      .attest()\n      .then((token) => {\n        this.cachedToken = token;\n        this.expiresAt = this.decodeJwtExp(token);\n        return token;\n      })\n      .finally(() => {\n        this.pending = undefined;\n      });\n\n    return this.pending;\n  }\n\n  private isExpiringSoon(): boolean {\n    if (!this.expiresAt) return true;\n    return Date.now() / 1000 >= this.expiresAt - this.bufferSeconds;\n  }\n\n  private decodeJwtExp(jwt: string): number | undefined {\n    const payload = jwt.split('.')[1];\n    if (!payload) return undefined;\n\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString());\n    return decoded.exp;\n  }\n}\n"],"mappings":";AAAA,SAAS,qBAAqB,YAAY,cAAc;AACxD,OAAO,UAAU;AACjB,SAAS,sBAAsB;AAS/B,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,YAAY,OAAO,KAAK,CAAC,CAAI,CAAC;AAE7B,IAAM,eAAN,MAAmB;AAAA,EAGxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,SAA0B;AAC9B,UAAM,EAAE,WAAW,WAAW,IAAI,oBAAoB,OAAO;AAAA,MAC3D,eAAe;AAAA,MACf,mBAAmB,EAAE,MAAM,QAAQ,QAAQ,MAAM;AAAA,MACjD,oBAAoB,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,IACrD,CAAC;AAED,UAAM,gBAAgB,WAAW,QAAQ,EACtC,OAAO,gBAAgB,EACvB,OAAO,SAAS,EAChB,OAAO,SAAS,EAChB,OAAO;AAEV,UAAM,aAAa,KAAK,OAAO,cAAc;AAC7C,UAAM,mBAAmB,MAAM,KAAK,eAAe,YAAY,aAAa;AAC5E,UAAM,iBAAiB,MAAM,KAAK,WAAW,kBAAkB,SAAS;AAExE,SAAK,gBAAgB,KAAK,UAAU,eAAe,IAAI,GAAG,eAAe,SAAS;AAElF,UAAM,gBAAgB,MAAM,OAAO,OAAO;AAAA,MACxC;AAAA,MACA,YAAY,UAAU;AAAA,MACtB,EAAE,MAAM,YAAY,MAAM,UAAU;AAAA,MACpC;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,EAAE,UAAU,IAAI,MAAM;AAAA,MAC1B,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,UAAU;AAAA,EACnB;AAAA,EAEQ,gBACN,UACA,WACM;AACN,UAAM,UAAU,OAAO,OAAO;AAAA,MAC5B,OAAO,KAAK,gBAAgB;AAAA,MAC5B;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,IACtB,CAAC;AAED,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,OAAO,KAAK,WAAW,QAAQ;AAAA,IACjC;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAAA,EACF;AAAA,EAEQ,eAAe,YAAoB,WAAoC;AAC7E,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,OAAO,KAAK,UAAU,EAAE,WAAW,UAAU,SAAS,QAAQ,EAAE,CAAC;AAEvE,YAAM,MAAM,KAAK;AAAA,QACf;AAAA,UACE;AAAA,UACA,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,CAAC,QAAQ;AACP,gBAAM,SAAmB,CAAC;AAC1B,cAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,cAAI,GAAG,OAAO,MAAM;AAClB,gBAAI,IAAI,eAAe,KAAK;AAC1B,qBAAO,IAAI,MAAM,2BAA2B,IAAI,UAAU,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;AACnG;AAAA,YACF;AACA,oBAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,UAC/B,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,GAAG,SAAS,CAAC,QAAQ,OAAO,IAAI,MAAM,mCAAmC,IAAI,OAAO,EAAE,CAAC,CAAC;AAC5F,UAAI,MAAM,IAAI;AACd,UAAI,IAAI;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,kBACA,cACkE;AAClE,UAAM,MAAM,GAAG,KAAK,OAAO,YAAY;AACvC,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,SAAS;AAAA,MACT,aAAa,iBAAiB,SAAS,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU,KAAK,OAAO;AAAA,IACxB,CAAC;AAED,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,IAAI,MAAM,sBAAsB,SAAS,MAAM,MAAM,IAAI,EAAE;AAAA,IACnE;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;AAEA,SAAS,YAAY,KAA0B;AAC7C,QAAM,MAAM,IAAI,QAAQ,sBAAsB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACnE,QAAM,MAAM,OAAO,KAAK,KAAK,QAAQ;AAGrC,SAAO,IAAI,OAAO,MAAM,IAAI,YAAY,IAAI,aAAa,IAAI,UAAU;AACzE;;;ACjJO,IAAM,cAAN,MAAkB;AAAA,EAOvB,YAAY,cAA4B,gBAAwB,IAAI;AAClE,SAAK,eAAe;AACpB,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEA,MAAM,WAA4B;AAChC,QAAI,KAAK,eAAe,CAAC,KAAK,eAAe,GAAG;AAC9C,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,KAAK,SAAS;AAChB,aAAO,KAAK;AAAA,IACd;AAEA,SAAK,UAAU,KAAK,aACjB,OAAO,EACP,KAAK,CAAC,UAAU;AACf,WAAK,cAAc;AACnB,WAAK,YAAY,KAAK,aAAa,KAAK;AACxC,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,UAAU;AAAA,IACjB,CAAC;AAEH,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,iBAA0B;AAChC,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,WAAO,KAAK,IAAI,IAAI,OAAQ,KAAK,YAAY,KAAK;AAAA,EACpD;AAAA,EAEQ,aAAa,KAAiC;AACpD,UAAM,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAChC,QAAI,CAAC,QAAS,QAAO;AAErB,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,CAAC;AACvE,WAAO,QAAQ;AAAA,EACjB;AACF;","names":[]}
+{"version":3,"sources":["../src/client/modules/attest/attest-client.ts","../src/client/modules/attest/jwt-provider.ts"],"sourcesContent":["import { generateKeyPairSync, createHash, verify } from 'node:crypto';\nimport http from 'node:http';\nimport { compactDecrypt } from 'jose';\n\nexport interface AttestClientConfig {\n  kmsServerURL: string;\n  kmsPublicKey: string;\n  audience: string;\n  socketPath?: string;\n}\n\nconst DEFAULT_SOCKET_PATH = '/run/container_launcher/teeserver.sock';\nconst CHALLENGE_PREFIX = 'COMPUTE_APP_JWT_REQUEST_RSA_KEY_V1';\nconst SIGNATURE_PREFIX = 'COMPUTE_APP_KMS_SIGNATURE_V1';\nconst NULL_BYTE = Buffer.from([0x00]);\n\nexport class AttestClient {\n  private config: AttestClientConfig;\n\n  constructor(config: AttestClientConfig) {\n    this.config = config;\n  }\n\n  async attest(extraData?: Buffer): Promise<string> {\n    // go-tpm-tools hashes extraData (SHA-256/SHA-512) before binding it into the\n    // hardware nonce, so callers can pass arbitrary data up to 1MB.\n    if (extraData && extraData.length > 1_048_576) {\n      throw new Error(`extraData exceeds 1MB limit (${extraData.length} bytes)`);\n    }\n\n    const { publicKey, privateKey } = generateKeyPairSync('rsa', {\n      modulusLength: 4096,\n      publicKeyEncoding: { type: 'spki', format: 'pem' } as const,\n      privateKeyEncoding: { type: 'pkcs8', format: 'pem' } as const,\n    });\n\n    const challengeHash = createHash('sha256')\n      .update(CHALLENGE_PREFIX)\n      .update(NULL_BYTE)\n      .update(publicKey)\n      .digest();\n\n    const socketPath = this.config.socketPath ?? DEFAULT_SOCKET_PATH;\n    const attestationBytes = await this.getAttestation(socketPath, challengeHash, extraData);\n    const attestResponse = await this.postAttest(attestationBytes, publicKey, extraData);\n\n    this.verifySignature(JSON.stringify(attestResponse.data), attestResponse.signature);\n\n    const rsaPrivateKey = await crypto.subtle.importKey(\n      'pkcs8',\n      pemToBuffer(privateKey),\n      { name: 'RSA-OAEP', hash: 'SHA-256' },\n      false,\n      ['decrypt'],\n    );\n\n    const { plaintext } = await compactDecrypt(\n      attestResponse.data.encryptedToken,\n      rsaPrivateKey,\n    );\n\n    const decrypted = JSON.parse(new TextDecoder().decode(plaintext));\n    return decrypted.token;\n  }\n\n  private verifySignature(\n    dataJson: string,\n    signature: string,\n  ): void {\n    const message = Buffer.concat([\n      Buffer.from(SIGNATURE_PREFIX),\n      NULL_BYTE,\n      Buffer.from(dataJson),\n    ]);\n\n    const valid = verify(\n      'sha256',\n      message,\n      this.config.kmsPublicKey,\n      Buffer.from(signature, 'base64'),\n    );\n\n    if (!valid) {\n      throw new Error('KMS response signature verification failed');\n    }\n  }\n\n  private getAttestation(socketPath: string, challenge: Buffer, extraData?: Buffer): Promise<Buffer> {\n    return new Promise((resolve, reject) => {\n      const requestBody: Record<string, string> = { challenge: challenge.toString('base64') };\n      if (extraData && extraData.length > 0) {\n        requestBody.extra_data = extraData.toString('base64');\n      }\n      const body = JSON.stringify(requestBody);\n\n      const req = http.request(\n        {\n          socketPath,\n          path: '/v1/bound_evidence',\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            'Content-Length': Buffer.byteLength(body),\n          },\n        },\n        (res) => {\n          const chunks: Buffer[] = [];\n          res.on('data', (chunk: Buffer) => chunks.push(chunk));\n          res.on('end', () => {\n            if (res.statusCode !== 200) {\n              reject(new Error(`TEE attestation failed (${res.statusCode}): ${Buffer.concat(chunks).toString()}`));\n              return;\n            }\n            resolve(Buffer.concat(chunks));\n          });\n        },\n      );\n\n      req.on('error', (err) => reject(new Error(`TEE attestation request failed: ${err.message}`)));\n      req.write(body);\n      req.end();\n    });\n  }\n\n  private async postAttest(\n    attestationBytes: Buffer,\n    rsaPublicKey: string,\n    extraData?: Buffer,\n  ): Promise<{ data: { encryptedToken: string }; signature: string }> {\n    const url = `${this.config.kmsServerURL}/auth/attest`;\n    const requestBody: Record<string, unknown> = {\n      version: 3,\n      attestation: attestationBytes.toString('base64'),\n      rsaKey: rsaPublicKey,\n      audience: this.config.audience,\n    };\n    if (extraData && extraData.length > 0) {\n      requestBody.extra_data = extraData.toString('base64');\n    }\n    const body = JSON.stringify(requestBody);\n\n    const response = await fetch(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body,\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`KMS attest failed (${response.status}): ${text}`);\n    }\n\n    return response.json() as Promise<{ data: { encryptedToken: string }; signature: string }>;\n  }\n}\n\nfunction pemToBuffer(pem: string): ArrayBuffer {\n  const b64 = pem.replace(/-----[A-Z ]+-----/g, '').replace(/\\s/g, '');\n  const buf = Buffer.from(b64, 'base64');\n\n  // Copy to a fresh ArrayBuffer to avoid offset issues with Buffer's shared pool\n  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);\n}\n","import type { AttestClient } from './attest-client';\n\nexport class JwtProvider {\n  private attestClient: AttestClient;\n  private bufferSeconds: number;\n  private cachedToken?: string;\n  private expiresAt?: number;\n  private pending?: Promise<string>;\n  private pendingExtraData = new Map<string, Promise<string>>();\n\n  constructor(attestClient: AttestClient, bufferSeconds: number = 30) {\n    this.attestClient = attestClient;\n    this.bufferSeconds = bufferSeconds;\n  }\n\n  async getToken(extraData?: Buffer): Promise<string> {\n    // When extraData is provided, bypass long-lived cache but deduplicate\n    // concurrent requests for the same extraData to avoid thundering herd\n    // on TEE hardware calls.\n    if (extraData && extraData.length > 0) {\n      const key = extraData.toString('hex');\n      const existing = this.pendingExtraData.get(key);\n      if (existing) return existing;\n      const promise = this.attestClient.attest(extraData).finally(() => {\n        this.pendingExtraData.delete(key);\n      });\n      this.pendingExtraData.set(key, promise);\n      return promise;\n    }\n\n    if (this.cachedToken && !this.isExpiringSoon()) {\n      return this.cachedToken;\n    }\n\n    if (this.pending) {\n      return this.pending;\n    }\n\n    this.pending = this.attestClient\n      .attest()\n      .then((token) => {\n        this.cachedToken = token;\n        this.expiresAt = this.decodeJwtExp(token);\n        return token;\n      })\n      .finally(() => {\n        this.pending = undefined;\n      });\n\n    return this.pending;\n  }\n\n  private isExpiringSoon(): boolean {\n    if (!this.expiresAt) return true;\n    return Date.now() / 1000 >= this.expiresAt - this.bufferSeconds;\n  }\n\n  private decodeJwtExp(jwt: string): number | undefined {\n    const payload = jwt.split('.')[1];\n    if (!payload) return undefined;\n\n    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString());\n    return decoded.exp;\n  }\n}\n"],"mappings":";AAAA,SAAS,qBAAqB,YAAY,cAAc;AACxD,OAAO,UAAU;AACjB,SAAS,sBAAsB;AAS/B,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AACzB,IAAM,mBAAmB;AACzB,IAAM,YAAY,OAAO,KAAK,CAAC,CAAI,CAAC;AAE7B,IAAM,eAAN,MAAmB;AAAA,EAGxB,YAAY,QAA4B;AACtC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,OAAO,WAAqC;AAGhD,QAAI,aAAa,UAAU,SAAS,SAAW;AAC7C,YAAM,IAAI,MAAM,gCAAgC,UAAU,MAAM,SAAS;AAAA,IAC3E;AAEA,UAAM,EAAE,WAAW,WAAW,IAAI,oBAAoB,OAAO;AAAA,MAC3D,eAAe;AAAA,MACf,mBAAmB,EAAE,MAAM,QAAQ,QAAQ,MAAM;AAAA,MACjD,oBAAoB,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,IACrD,CAAC;AAED,UAAM,gBAAgB,WAAW,QAAQ,EACtC,OAAO,gBAAgB,EACvB,OAAO,SAAS,EAChB,OAAO,SAAS,EAChB,OAAO;AAEV,UAAM,aAAa,KAAK,OAAO,cAAc;AAC7C,UAAM,mBAAmB,MAAM,KAAK,eAAe,YAAY,eAAe,SAAS;AACvF,UAAM,iBAAiB,MAAM,KAAK,WAAW,kBAAkB,WAAW,SAAS;AAEnF,SAAK,gBAAgB,KAAK,UAAU,eAAe,IAAI,GAAG,eAAe,SAAS;AAElF,UAAM,gBAAgB,MAAM,OAAO,OAAO;AAAA,MACxC;AAAA,MACA,YAAY,UAAU;AAAA,MACtB,EAAE,MAAM,YAAY,MAAM,UAAU;AAAA,MACpC;AAAA,MACA,CAAC,SAAS;AAAA,IACZ;AAEA,UAAM,EAAE,UAAU,IAAI,MAAM;AAAA,MAC1B,eAAe,KAAK;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,YAAY,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS,CAAC;AAChE,WAAO,UAAU;AAAA,EACnB;AAAA,EAEQ,gBACN,UACA,WACM;AACN,UAAM,UAAU,OAAO,OAAO;AAAA,MAC5B,OAAO,KAAK,gBAAgB;AAAA,MAC5B;AAAA,MACA,OAAO,KAAK,QAAQ;AAAA,IACtB,CAAC;AAED,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,OAAO,KAAK,WAAW,QAAQ;AAAA,IACjC;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAAA,EACF;AAAA,EAEQ,eAAe,YAAoB,WAAmB,WAAqC;AACjG,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,cAAsC,EAAE,WAAW,UAAU,SAAS,QAAQ,EAAE;AACtF,UAAI,aAAa,UAAU,SAAS,GAAG;AACrC,oBAAY,aAAa,UAAU,SAAS,QAAQ;AAAA,MACtD;AACA,YAAM,OAAO,KAAK,UAAU,WAAW;AAEvC,YAAM,MAAM,KAAK;AAAA,QACf;AAAA,UACE;AAAA,UACA,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,kBAAkB,OAAO,WAAW,IAAI;AAAA,UAC1C;AAAA,QACF;AAAA,QACA,CAAC,QAAQ;AACP,gBAAM,SAAmB,CAAC;AAC1B,cAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,cAAI,GAAG,OAAO,MAAM;AAClB,gBAAI,IAAI,eAAe,KAAK;AAC1B,qBAAO,IAAI,MAAM,2BAA2B,IAAI,UAAU,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;AACnG;AAAA,YACF;AACA,oBAAQ,OAAO,OAAO,MAAM,CAAC;AAAA,UAC/B,CAAC;AAAA,QACH;AAAA,MACF;AAEA,UAAI,GAAG,SAAS,CAAC,QAAQ,OAAO,IAAI,MAAM,mCAAmC,IAAI,OAAO,EAAE,CAAC,CAAC;AAC5F,UAAI,MAAM,IAAI;AACd,UAAI,IAAI;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,WACZ,kBACA,cACA,WACkE;AAClE,UAAM,MAAM,GAAG,KAAK,OAAO,YAAY;AACvC,UAAM,cAAuC;AAAA,MAC3C,SAAS;AAAA,MACT,aAAa,iBAAiB,SAAS,QAAQ;AAAA,MAC/C,QAAQ;AAAA,MACR,UAAU,KAAK,OAAO;AAAA,IACxB;AACA,QAAI,aAAa,UAAU,SAAS,GAAG;AACrC,kBAAY,aAAa,UAAU,SAAS,QAAQ;AAAA,IACtD;AACA,UAAM,OAAO,KAAK,UAAU,WAAW;AAEvC,UAAM,WAAW,MAAM,MAAM,KAAK;AAAA,MAChC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C;AAAA,IACF,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,IAAI,MAAM,sBAAsB,SAAS,MAAM,MAAM,IAAI,EAAE;AAAA,IACnE;AAEA,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;AAEA,SAAS,YAAY,KAA0B;AAC7C,QAAM,MAAM,IAAI,QAAQ,sBAAsB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACnE,QAAM,MAAM,OAAO,KAAK,KAAK,QAAQ;AAGrC,SAAO,IAAI,OAAO,MAAM,IAAI,YAAY,IAAI,aAAa,IAAI,UAAU;AACzE;;;AChKO,IAAM,cAAN,MAAkB;AAAA,EAQvB,YAAY,cAA4B,gBAAwB,IAAI;AAFpE,SAAQ,mBAAmB,oBAAI,IAA6B;AAG1D,SAAK,eAAe;AACpB,SAAK,gBAAgB;AAAA,EACvB;AAAA,EAEA,MAAM,SAAS,WAAqC;AAIlD,QAAI,aAAa,UAAU,SAAS,GAAG;AACrC,YAAM,MAAM,UAAU,SAAS,KAAK;AACpC,YAAM,WAAW,KAAK,iBAAiB,IAAI,GAAG;AAC9C,UAAI,SAAU,QAAO;AACrB,YAAM,UAAU,KAAK,aAAa,OAAO,SAAS,EAAE,QAAQ,MAAM;AAChE,aAAK,iBAAiB,OAAO,GAAG;AAAA,MAClC,CAAC;AACD,WAAK,iBAAiB,IAAI,KAAK,OAAO;AACtC,aAAO;AAAA,IACT;AAEA,QAAI,KAAK,eAAe,CAAC,KAAK,eAAe,GAAG;AAC9C,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,KAAK,SAAS;AAChB,aAAO,KAAK;AAAA,IACd;AAEA,SAAK,UAAU,KAAK,aACjB,OAAO,EACP,KAAK,CAAC,UAAU;AACf,WAAK,cAAc;AACnB,WAAK,YAAY,KAAK,aAAa,KAAK;AACxC,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,WAAK,UAAU;AAAA,IACjB,CAAC;AAEH,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,iBAA0B;AAChC,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,WAAO,KAAK,IAAI,IAAI,OAAQ,KAAK,YAAY,KAAK;AAAA,EACpD;AAAA,EAEQ,aAAa,KAAiC;AACpD,UAAM,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAChC,QAAI,CAAC,QAAS,QAAO;AAErB,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,CAAC;AACvE,WAAO,QAAQ;AAAA,EACjB;AACF;","names":[]}

package/dist/billing.cjs

@@ -317,6 +317,20 @@ var BillingApiClient = class {
     const endpoint = `${this.config.billingApiServerURL}/products/${productId}/subscription`;
     await this.makeAuthenticatedRequest(endpoint, "DELETE", productId);
   }
+  async getPaymentMethods() {
+    const endpoint = `${this.config.billingApiServerURL}/v1/payment-methods`;
+    const resp = await this.makeAuthenticatedRequest(endpoint, "GET", "compute");
+    return resp.json();
+  }
+  async purchaseCredits(amountCents, paymentMethodId) {
+    const endpoint = `${this.config.billingApiServerURL}/v1/credits/purchase`;
+    const body = { amountCents };
+    if (paymentMethodId) {
+      body.paymentMethodId = paymentMethodId;
+    }
+    const resp = await this.makeAuthenticatedRequest(endpoint, "POST", "compute", body);
+    return resp.json();
+  }
   // ==========================================================================
   // Internal Methods
   // ==========================================================================
@@ -326,10 +340,19 @@ var BillingApiClient = class {
    * Uses session auth if useSession is true, otherwise uses EIP-712 signature auth.
    */
   async makeAuthenticatedRequest(url, method, productId, body) {
-    if (this.useSession) {
-      return this.makeSessionAuthenticatedRequest(url, method, body);
+    if (this.options.verbose) {
+      console.debug(`[BillingAPI] ${method} ${url}`);
+    }
+    const resp = this.useSession ? await this.makeSessionAuthenticatedRequest(url, method, body) : await this.makeSignatureAuthenticatedRequest(url, method, productId, body);
+    if (this.options.verbose) {
+      const data = await resp.json();
+      console.debug(`[BillingAPI] Response:`, JSON.stringify(data, null, 2));
+      return {
+        json: async () => data,
+        text: async () => JSON.stringify(data)
+      };
     }
-    return this.makeSignatureAuthenticatedRequest(url, method, productId, body);
+    return resp;
   }
   /**
    * Make a request using session-based authentication (cookies)
@@ -515,7 +538,13 @@ function getEnvironmentConfig(environment, chainID) {
   const resolvedChainID = chainID || (environment === "sepolia" || environment === "sepolia-dev" ? SEPOLIA_CHAIN_ID : MAINNET_CHAIN_ID);
   return {
     ...env,
-    chainID: BigInt(resolvedChainID)
+    chainID: BigInt(resolvedChainID),
+    ...process.env.ECLOUD_USER_API_URL && {
+      userApiServerURL: process.env.ECLOUD_USER_API_URL
+    },
+    ...process.env.ECLOUD_RPC_URL && {
+      defaultRPCURL: process.env.ECLOUD_RPC_URL
+    }
   };
 }
 function getBillingEnvironmentConfig(build) {
@@ -523,7 +552,12 @@ function getBillingEnvironmentConfig(build) {
   if (!config) {
     throw new Error(`Unknown billing environment: ${build}`);
   }
-  return config;
+  return {
+    ...config,
+    ...process.env.ECLOUD_BILLING_API_URL && {
+      billingApiServerURL: process.env.ECLOUD_BILLING_API_URL
+    }
+  };
 }
 function getBuildType() {
   const buildTimeType = true ? "dev"?.toLowerCase() : void 0;
@@ -2066,7 +2100,7 @@ function createBillingModule(config) {
   const address = walletClient.account.address;
   const logger = getLogger(verbose);
   const billingEnvConfig = getBillingEnvironmentConfig(getBuildType());
-  const billingApi = new BillingApiClient(billingEnvConfig, walletClient);
+  const billingApi = new BillingApiClient(billingEnvConfig, walletClient, { verbose });
   const environmentConfig = getEnvironmentConfig(environment);
   const usdcCreditsAddress = environmentConfig.usdcCreditsAddress;
   if (!usdcCreditsAddress) {
@@ -2230,6 +2264,12 @@ function createBillingModule(config) {
           };
         }
       );
+    },
+    async getPaymentMethods() {
+      return billingApi.getPaymentMethods();
+    },
+    async purchaseCredits(amountCents, paymentMethodId) {
+      return billingApi.purchaseCredits(amountCents, paymentMethodId);
     }
   };
   return module2;