@super-protocol/pki-attestation-engine 0.0.0-nvidia-local-verifier

package/dist/challengeProvider/challengeNvidiaCCHelper.d.ts

@@ -0,0 +1,33 @@
+/// <reference types="node" />
+import { ChallengeType, NvidiaCCToken, NvidiaEvidence, Log } from '@super-protocol/pki-common';
+import { NvidiaVerifierMode } from '../challengeValidator/validatorConfig';
+export interface NvidiaChallengeOptions {
+    verifier?: NvidiaVerifierMode;
+    challengeType?: ChallengeType;
+}
+export declare class ChallengeNvidiaCCHelper {
+    private static getNvidiaToken;
+    /**
+     * Reports how the GPUs can reach each other's memory.
+     *
+     * PCIe and unidentified peer paths are reported as unverified metadata;
+     * the verifier only permits that state on an untrusted network. Whether
+     * NVLink requires a separate NVSwitch token is determined from the LS10
+     * count returned by getGPUTopology(): Hopper exposes attestable LS10
+     * switches, while Blackwell does not.
+     *
+     * @returns the metadata status to bind to the TEE challenge
+     * @throws if NVML cannot be queried
+     */
+    private static getGpuInterconnectStatus;
+    static isLocalEvidence(value: NvidiaCCToken | NvidiaEvidence): value is NvidiaEvidence;
+    static canonicalEvidenceBinding(evidence: NvidiaEvidence): string;
+    static getEvidenceHash(evidence: NvidiaEvidence): Buffer;
+    static assertLocalVerifierAllowsChallenge(verifier: NvidiaVerifierMode | undefined, challengeType: ChallengeType | undefined): void;
+    static getTokenHash(token: NvidiaCCToken): Buffer;
+    static getTokenAndCombinedChallengeData(baseUserData: Buffer, logger?: Log, options?: NvidiaChallengeOptions): Promise<{
+        nvidiaTokens: NvidiaCCToken | undefined;
+        nvidiaEvidence: NvidiaEvidence | undefined;
+        challengeData: Buffer;
+    }>;
+}

package/dist/challengeProvider/challengeNvidiaCCHelper.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeNvidiaCCHelper = void 0;
+const sp_nvtrust_wrapper_1 = require("@super-protocol/sp-nvtrust-wrapper");
+const pki_common_1 = require("@super-protocol/pki-common");
+const crypto_1 = require("crypto");
+const CLOUD_CHALLENGE_TYPES = new Set([
+    pki_common_1.ChallengeType.TDXGOOGLE,
+    pki_common_1.ChallengeType.TDXAZURE,
+    pki_common_1.ChallengeType.SEVSNPAZURE,
+]);
+class ChallengeNvidiaCCHelper {
+    static async getNvidiaToken(logger, verifier = 'remote') {
+        const log = logger?.child({
+            helper: 'ChallengeNvidiaCCHelper',
+        });
+        try {
+            const wrapper = new sp_nvtrust_wrapper_1.NvtrustWrapper();
+            log?.info('Checking for untrusted GPUs');
+            await wrapper.assertTrustedGpus();
+            log?.info('Untrusted GPUs were not detected');
+            const topology = await wrapper.getGPUTopology();
+            log?.debug('NVIDIA GPU topology detected', {
+                gpuCount: topology.gpuCount,
+                nvswitchCount: topology.nvswitchCount,
+            });
+            if (!topology.gpuCount) {
+                log?.info('Challenge NVIDIA token present: false');
+                log?.info('NVIDIA token retrieval skipped: no GPUs detected in topology');
+                return;
+            }
+            let gpuInterconnectStatus;
+            if (topology.gpuCount > 1) {
+                gpuInterconnectStatus =
+                    await ChallengeNvidiaCCHelper.getGpuInterconnectStatus(wrapper, topology.nvswitchCount, log);
+            }
+            const nonce = sp_nvtrust_wrapper_1.NvtrustWrapper.generateNonce();
+            const needsSwitch = gpuInterconnectStatus ===
+                sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED;
+            if (verifier === 'local') {
+                log?.debug('Collecting NVIDIA GPU evidence', {
+                    gpuCount: topology.gpuCount,
+                });
+                const gpuEvidence = await wrapper.collectEvidence({
+                    device: sp_nvtrust_wrapper_1.NvidiaDeviceType.GPU,
+                    nonce,
+                    ppcieMode: false,
+                });
+                let nvswitchEvidence;
+                if (needsSwitch) {
+                    log?.debug('Collecting NVIDIA NVSwitch evidence', {
+                        nvswitchCount: topology.nvswitchCount,
+                    });
+                    nvswitchEvidence = await wrapper.collectEvidence({
+                        device: sp_nvtrust_wrapper_1.NvidiaDeviceType.SWITCH,
+                        nonce,
+                        ppcieMode: false,
+                    });
+                }
+                log?.info('Challenge NVIDIA evidence present: true');
+                return {
+                    gpuEvidence,
+                    nonce,
+                    ...(gpuInterconnectStatus !== undefined
+                        ? { gpuInterconnectStatus }
+                        : {}),
+                    ...(nvswitchEvidence !== undefined
+                        ? { nvswitchEvidence }
+                        : {}),
+                };
+            }
+            log?.debug('Attempting NVIDIA token retrieval for detected GPUs', {
+                gpuCount: topology.gpuCount,
+            });
+            const gpuTokenRaw = await wrapper.getNvidiaToken({
+                device: sp_nvtrust_wrapper_1.NvidiaDeviceType.GPU,
+                nonce,
+                ppcieMode: false,
+            });
+            let nvswitchToken;
+            if (needsSwitch) {
+                log?.debug('Attempting NVIDIA NVSwitch token retrieval', {
+                    nvswitchCount: topology.nvswitchCount,
+                });
+                const nvswitchTokenRaw = await wrapper.getNvidiaToken({
+                    device: sp_nvtrust_wrapper_1.NvidiaDeviceType.SWITCH,
+                    nonce,
+                    ppcieMode: false,
+                });
+                nvswitchToken = nvswitchTokenRaw.jwt;
+                log?.info('NVIDIA NVSwitch token retrieved successfully', {
+                    nvswitchCount: topology.nvswitchCount,
+                });
+            }
+            log?.info('Challenge NVIDIA token present: true');
+            log?.info('NVIDIA token retrieved successfully', {
+                gpuCount: topology.gpuCount,
+                nvswitchCount: topology.nvswitchCount,
+            });
+            return {
+                gpuToken: gpuTokenRaw.jwt,
+                ...(gpuInterconnectStatus !== undefined
+                    ? { gpuInterconnectStatus }
+                    : {}),
+                ...(nvswitchToken !== undefined ? { nvswitchToken } : {}),
+            };
+        }
+        catch (error) {
+            if (error instanceof sp_nvtrust_wrapper_1.NvtrustWrapperCallError) {
+                log?.error(`NvtrustWrapperCallError: ${error.message}`);
+                if (error.traceback?.trim()) {
+                    log?.debug(`Traceback:\n${error.traceback}`);
+                }
+                const logEntries = Object.entries(error.logs ?? {});
+                if (logEntries.length > 0) {
+                    log?.debug('Logs from nvtrust wrapper:');
+                    for (const [fileName, logContent] of logEntries) {
+                        log?.debug(`--- ${fileName} ---`);
+                        log?.debug(String(logContent));
+                    }
+                }
+            }
+            else if (error instanceof sp_nvtrust_wrapper_1.UntrustedGpusError) {
+                log?.error('Untrusted GPUs detected', {
+                    errors: error.errors,
+                });
+            }
+            else {
+                log?.error(`Error during NVIDIA token retrieval: ${error}`);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Reports how the GPUs can reach each other's memory.
+     *
+     * PCIe and unidentified peer paths are reported as unverified metadata;
+     * the verifier only permits that state on an untrusted network. Whether
+     * NVLink requires a separate NVSwitch token is determined from the LS10
+     * count returned by getGPUTopology(): Hopper exposes attestable LS10
+     * switches, while Blackwell does not.
+     *
+     * @returns the metadata status to bind to the TEE challenge
+     * @throws if NVML cannot be queried
+     */
+    static async getGpuInterconnectStatus(wrapper, nvswitchCount, log) {
+        const links = await wrapper.getGpuInterconnect();
+        const describe = (type) => sp_nvtrust_wrapper_1.GpuInterconnectLinkType[type] ?? String(type);
+        const format = (subset) => subset
+            .map((link) => `${link.bdf1} <-> ${link.bdf2}: ${describe(link.type)}`)
+            .join('; ');
+        log?.debug('GPU interconnect checked', {
+            pairs: links.map((link) => ({
+                bdf1: link.bdf1,
+                bdf2: link.bdf2,
+                type: describe(link.type),
+            })),
+        });
+        const connected = links.filter((link) => link.type !==
+            sp_nvtrust_wrapper_1.GpuInterconnectLinkType.GPU_INTERCONNECT_LINK_TYPE_NONE);
+        if (connected.length === 0) {
+            log?.info('GPUs are isolated: no direct interconnect detected');
+            return sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_DISCONNECTED;
+        }
+        const bypassing = connected.filter((link) => link.type !==
+            sp_nvtrust_wrapper_1.GpuInterconnectLinkType.GPU_INTERCONNECT_LINK_TYPE_NVLINK);
+        if (bypassing.length > 0) {
+            const details = format(bypassing);
+            log?.warn('Unverified direct GPU interconnect detected; it is allowed only on an untrusted network', { links: details });
+            return sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_DIRECT_UNVERIFIED;
+        }
+        log?.warn('NVLink interconnect detected', { links: format(connected) });
+        if (nvswitchCount === 0) {
+            log?.warn('No attestable LS10 NVSwitch devices were found; continuing with GPU-only attestation (expected for Blackwell)');
+            return sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_NOT_APPLICABLE;
+        }
+        return sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED;
+    }
+    static isLocalEvidence(value) {
+        return 'gpuEvidence' in value;
+    }
+    static canonicalEvidenceBinding(evidence) {
+        return JSON.stringify({
+            gpuEvidence: evidence.gpuEvidence,
+            nonce: evidence.nonce,
+            ...(evidence.gpuInterconnectStatus !== undefined
+                ? { gpuInterconnectStatus: evidence.gpuInterconnectStatus }
+                : {}),
+            ...(evidence.nvswitchEvidence !== undefined
+                ? { nvswitchEvidence: evidence.nvswitchEvidence }
+                : {}),
+        });
+    }
+    static getEvidenceHash(evidence) {
+        return (0, crypto_1.createHash)('sha256')
+            .update(ChallengeNvidiaCCHelper.canonicalEvidenceBinding(evidence))
+            .digest();
+    }
+    static assertLocalVerifierAllowsChallenge(verifier, challengeType) {
+        if (verifier === 'local' &&
+            challengeType !== undefined &&
+            CLOUD_CHALLENGE_TYPES.has(challengeType)) {
+            throw new Error(`NVIDIA local verifier does not support ${challengeType}`);
+        }
+    }
+    static getTokenHash(token) {
+        const hash = (0, crypto_1.createHash)('sha256');
+        hash.update(JSON.stringify({
+            gpuToken: token.gpuToken,
+            ...(token.gpuInterconnectStatus !== undefined
+                ? {
+                    gpuInterconnectStatus: token.gpuInterconnectStatus,
+                }
+                : {}),
+            ...(token.nvswitchToken !== undefined
+                ? { nvswitchToken: token.nvswitchToken }
+                : {}),
+        }));
+        return hash.digest();
+    }
+    static async getTokenAndCombinedChallengeData(baseUserData, logger, options) {
+        const log = logger?.child({
+            helper: 'ChallengeNvidiaCCHelper',
+        });
+        const verifier = options?.verifier ?? 'remote';
+        ChallengeNvidiaCCHelper.assertLocalVerifierAllowsChallenge(verifier, options?.challengeType);
+        const material = await ChallengeNvidiaCCHelper.getNvidiaToken(logger, verifier);
+        const nvidiaEvidence = material && ChallengeNvidiaCCHelper.isLocalEvidence(material)
+            ? material
+            : undefined;
+        const nvidiaTokens = material && !ChallengeNvidiaCCHelper.isLocalEvidence(material)
+            ? material
+            : undefined;
+        const nvidiaHash = nvidiaEvidence
+            ? ChallengeNvidiaCCHelper.getEvidenceHash(nvidiaEvidence)
+            : nvidiaTokens &&
+                ChallengeNvidiaCCHelper.getTokenHash(nvidiaTokens);
+        const challengeData = nvidiaHash
+            ? Buffer.concat([baseUserData, nvidiaHash])
+            : baseUserData;
+        if (challengeData.length > 64) {
+            throw new Error('challengeData length exceeds 64 bytes');
+        }
+        log?.debug('Prepared combined challenge data', {
+            baseUserDataLength: baseUserData.length,
+            challengeDataLength: challengeData.length,
+            hasNvidiaToken: Boolean(nvidiaTokens),
+            hasNvidiaEvidence: Boolean(nvidiaEvidence),
+        });
+        return { nvidiaTokens, nvidiaEvidence, challengeData };
+    }
+}
+exports.ChallengeNvidiaCCHelper = ChallengeNvidiaCCHelper;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBTzRDO0FBQzVDLDJEQUtvQztBQUVwQyxtQ0FBb0M7QUFFcEMsTUFBTSxxQkFBcUIsR0FBRyxJQUFJLEdBQUcsQ0FBZ0I7SUFDakQsMEJBQWEsQ0FBQyxTQUFTO0lBQ3ZCLDBCQUFhLENBQUMsUUFBUTtJQUN0QiwwQkFBYSxDQUFDLFdBQVc7Q0FDNUIsQ0FBQyxDQUFDO0FBT0gsTUFBYSx1QkFBdUI7SUFDeEIsTUFBTSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQy9CLE1BQVksRUFDWixXQUErQixRQUFRO1FBRXZDLE1BQU0sR0FBRyxHQUFHLE1BQU0sRUFBRSxLQUFLLENBQUM7WUFDdEIsTUFBTSxFQUFFLHlCQUF5QjtTQUNwQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLG1DQUFjLEVBQUUsQ0FBQztZQUNyQyxHQUFHLEVBQUUsSUFBSSxDQUFDLDZCQUE2QixDQUFDLENBQUM7WUFDekMsTUFBTSxPQUFPLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUNsQyxHQUFHLEVBQUUsSUFBSSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7WUFFOUMsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDaEQsR0FBRyxFQUFFLEtBQUssQ0FBQyw4QkFBOEIsRUFBRTtnQkFDdkMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2dCQUMzQixhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7YUFDeEMsQ0FBQyxDQUFDO1lBRUgsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztnQkFDckIsR0FBRyxFQUFFLElBQUksQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO2dCQUNuRCxHQUFHLEVBQUUsSUFBSSxDQUNMLDhEQUE4RCxDQUNqRSxDQUFDO2dCQUNGLE9BQU87WUFDWCxDQUFDO1lBRUQsSUFBSSxxQkFBOEQsQ0FBQztZQUNuRSxJQUFJLFFBQVEsQ0FBQyxRQUFRLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hCLHFCQUFxQjtvQkFDakIsTUFBTSx1QkFBdUIsQ0FBQyx3QkFBd0IsQ0FDbEQsT0FBTyxFQUNQLFFBQVEsQ0FBQyxhQUFhLEVBQ3RCLEdBQUcsQ0FDTixDQUFDO1lBQ1YsQ0FBQztZQUVELE1BQU0sS0FBSyxHQUFHLG1DQUFjLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDN0MsTUFBTSxXQUFXLEdBQ2IscUJBQXFCO2dCQUNyQixnREFBMkIsQ0FBQywwREFBMEQsQ0FBQztZQUMzRixJQUFJLFFBQVEsS0FBSyxPQUFPLEVBQUUsQ0FBQztnQkFDdkIsR0FBRyxFQUFFLEtBQUssQ0FBQyxnQ0FBZ0MsRUFBRTtvQkFDekMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2lCQUM5QixDQUFDLENBQUM7Z0JBQ0gsTUFBTSxXQUFXLEdBQUcsTUFDaEIsT0FPSCxDQUFDLGVBQWUsQ0FBQztvQkFDZCxNQUFNLEVBQUUscUNBQWdCLENBQUMsR0FBRztvQkFDNUIsS0FBSztvQkFDTCxTQUFTLEVBQUUsS0FBSztpQkFDbkIsQ0FBQyxDQUFDO2dCQUNILElBQUksZ0JBQW9DLENBQUM7Z0JBQ3pDLElBQUksV0FBVyxFQUFFLENBQUM7b0JBQ2QsR0FBRyxFQUFFLEtBQUssQ0FBQyxxQ0FBcUMsRUFBRTt3QkFDOUMsYUFBYSxFQUFFLFFBQVEsQ0FBQyxhQUFhO3FCQUN4QyxDQUFDLENBQUM7b0JBQ0gsZ0JBQWdCLEdBQUcsTUFDZixPQU9ILENBQUMsZUFBZSxDQUFDO3dCQUNkLE1BQU0sRUFBRSxxQ0FBZ0IsQ0FBQyxNQUFNO3dCQUMvQixLQUFLO3dCQUNMLFNBQVMsRUFBRSxLQUFLO3FCQUNuQixDQUFDLENBQUM7Z0JBQ1AsQ0FBQztnQkFDRCxHQUFHLEVBQUUsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7Z0JBQ3JELE9BQU87b0JBQ0gsV0FBVztvQkFDWCxLQUFLO29CQUNMLEdBQUcsQ0FBQyxxQkFBcUIsS0FBSyxTQUFTO3dCQUNuQyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsRUFBRTt3QkFDM0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztvQkFDVCxHQUFHLENBQUMsZ0JBQWdCLEtBQUssU0FBUzt3QkFDOUIsQ0FBQyxDQUFDLEVBQUUsZ0JBQWdCLEVBQUU7d0JBQ3RCLENBQUMsQ0FBQyxFQUFFLENBQUM7aUJBQ1osQ0FBQztZQUNOLENBQUM7WUFFRCxHQUFHLEVBQUUsS0FBSyxDQUFDLHFEQUFxRCxFQUFFO2dCQUM5RCxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVE7YUFDOUIsQ0FBQyxDQUFDO1lBQ0gsTUFBTSxXQUFXLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxDQUFDO2dCQUM3QyxNQUFNLEVBQUUscUNBQWdCLENBQUMsR0FBRztnQkFDNUIsS0FBSztnQkFDTCxTQUFTLEVBQUUsS0FBSzthQUNuQixDQUFDLENBQUM7WUFFSCxJQUFJLGFBQWlDLENBQUM7WUFDdEMsSUFBSSxXQUFXLEVBQUUsQ0FBQztnQkFDZCxHQUFHLEVBQUUsS0FBSyxDQUFDLDRDQUE0QyxFQUFFO29CQUNyRCxhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7aUJBQ3hDLENBQUMsQ0FBQztnQkFDSCxNQUFNLGdCQUFnQixHQUFHLE1BQU0sT0FBTyxDQUFDLGNBQWMsQ0FBQztvQkFDbEQsTUFBTSxFQUFFLHFDQUFnQixDQUFDLE1BQU07b0JBQy9CLEtBQUs7b0JBQ0wsU0FBUyxFQUFFLEtBQUs7aUJBQ25CLENBQUMsQ0FBQztnQkFDSCxhQUFhLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDO2dCQUNyQyxHQUFHLEVBQUUsSUFBSSxDQUFDLDhDQUE4QyxFQUFFO29CQUN0RCxhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7aUJBQ3hDLENBQUMsQ0FBQztZQUNQLENBQUM7WUFFRCxHQUFHLEVBQUUsSUFBSSxDQUFDLHNDQUFzQyxDQUFDLENBQUM7WUFDbEQsR0FBRyxFQUFFLElBQUksQ0FBQyxxQ0FBcUMsRUFBRTtnQkFDN0MsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2dCQUMzQixhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7YUFDeEMsQ0FBQyxDQUFDO1lBQ0gsT0FBTztnQkFDSCxRQUFRLEVBQUUsV0FBVyxDQUFDLEdBQUc7Z0JBQ3pCLEdBQUcsQ0FBQyxxQkFBcUIsS0FBSyxTQUFTO29CQUNuQyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsRUFBRTtvQkFDM0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDVCxHQUFHLENBQUMsYUFBYSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQzVELENBQUM7UUFDTixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNiLElBQUksS0FBSyxZQUFZLDRDQUF1QixFQUFFLENBQUM7Z0JBQzNDLEdBQUcsRUFBRSxLQUFLLENBQUMsNEJBQTRCLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUN4RCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztvQkFDMUIsR0FBRyxFQUFFLEtBQUssQ0FBQyxlQUFlLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDcEQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN4QixHQUFHLEVBQUUsS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7b0JBQ3pDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDOUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxPQUFPLFFBQVEsTUFBTSxDQUFDLENBQUM7d0JBQ2xDLEdBQUcsRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7b0JBQ25DLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7aUJBQU0sSUFBSSxLQUFLLFlBQVksdUNBQWtCLEVBQUUsQ0FBQztnQkFDN0MsR0FBRyxFQUFFLEtBQUssQ0FBQyx5QkFBeUIsRUFBRTtvQkFDbEMsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNO2lCQUN2QixDQUFDLENBQUM7WUFDUCxDQUFDO2lCQUFNLENBQUM7Z0JBQ0osR0FBRyxFQUFFLEtBQUssQ0FBQyx3Q0FBd0MsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUNoRSxDQUFDO1lBRUQsTUFBTSxLQUFLLENBQUM7UUFDaEIsQ0FBQztJQUNMLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7T0FXRztJQUNLLE1BQU0sQ0FBQyxLQUFLLENBQUMsd0JBQXdCLENBQ3pDLE9BQXVCLEVBQ3ZCLGFBQXFCLEVBQ3JCLEdBQVM7UUFFVCxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1FBQ2pELE1BQU0sUUFBUSxHQUFHLENBQUMsSUFBNkIsRUFBVSxFQUFFLENBQ3ZELDRDQUF1QixDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNsRCxNQUFNLE1BQU0sR0FBRyxDQUFDLE1BQW9CLEVBQVUsRUFBRSxDQUM1QyxNQUFNO2FBQ0QsR0FBRyxDQUNBLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FDTCxHQUFHLElBQUksQ0FBQyxJQUFJLFFBQVEsSUFBSSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQzlEO2FBQ0EsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXBCLEdBQUcsRUFBRSxLQUFLLENBQUMsMEJBQTBCLEVBQUU7WUFDbkMsS0FBSyxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ3hCLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtnQkFDZixJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQ2YsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO2FBQzVCLENBQUMsQ0FBQztTQUNOLENBQUMsQ0FBQztRQUVILE1BQU0sU0FBUyxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQzFCLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FDTCxJQUFJLENBQUMsSUFBSTtZQUNULDRDQUF1QixDQUFDLCtCQUErQixDQUM5RCxDQUFDO1FBQ0YsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pCLEdBQUcsRUFBRSxJQUFJLENBQUMsb0RBQW9ELENBQUMsQ0FBQztZQUNoRSxPQUFPLGdEQUEyQixDQUFDLG9DQUFvQyxDQUFDO1FBQzVFLENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxTQUFTLENBQUMsTUFBTSxDQUM5QixDQUFDLElBQUksRUFBRSxFQUFFLENBQ0wsSUFBSSxDQUFDLElBQUk7WUFDVCw0Q0FBdUIsQ0FBQyxpQ0FBaUMsQ0FDaEUsQ0FBQztRQUNGLElBQUksU0FBUyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDbEMsR0FBRyxFQUFFLElBQUksQ0FDTCx5RkFBeUYsRUFDekYsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQ3JCLENBQUM7WUFDRixPQUFPLGdEQUEyQixDQUFDLHlDQUF5QyxDQUFDO1FBQ2pGLENBQUM7UUFFRCxHQUFHLEVBQUUsSUFBSSxDQUFDLDhCQUE4QixFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDeEUsSUFBSSxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEIsR0FBRyxFQUFFLElBQUksQ0FDTCwrR0FBK0csQ0FDbEgsQ0FBQztZQUNGLE9BQU8sZ0RBQTJCLENBQUMsZ0VBQWdFLENBQUM7UUFDeEcsQ0FBQztRQUVELE9BQU8sZ0RBQTJCLENBQUMsMERBQTBELENBQUM7SUFDbEcsQ0FBQztJQUVELE1BQU0sQ0FBQyxlQUFlLENBQ2xCLEtBQXFDO1FBRXJDLE9BQU8sYUFBYSxJQUFJLEtBQUssQ0FBQztJQUNsQyxDQUFDO0lBRUQsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQXdCO1FBQ3BELE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUNsQixXQUFXLEVBQUUsUUFBUSxDQUFDLFdBQVc7WUFDakMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxLQUFLO1lBQ3JCLEdBQUcsQ0FBQyxRQUFRLENBQUMscUJBQXFCLEtBQUssU0FBUztnQkFDNUMsQ0FBQyxDQUFDLEVBQUUscUJBQXFCLEVBQUUsUUFBUSxDQUFDLHFCQUFxQixFQUFFO2dCQUMzRCxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ1QsR0FBRyxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsS0FBSyxTQUFTO2dCQUN2QyxDQUFDLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxRQUFRLENBQUMsZ0JBQWdCLEVBQUU7Z0JBQ2pELENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDWixDQUFDLENBQUM7SUFDUCxDQUFDO0lBRUQsTUFBTSxDQUFDLGVBQWUsQ0FBQyxRQUF3QjtRQUMzQyxPQUFPLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUM7YUFDdEIsTUFBTSxDQUFDLHVCQUF1QixDQUFDLHdCQUF3QixDQUFDLFFBQVEsQ0FBQyxDQUFDO2FBQ2xFLE1BQU0sRUFBRSxDQUFDO0lBQ2xCLENBQUM7SUFFRCxNQUFNLENBQUMsa0NBQWtDLENBQ3JDLFFBQXdDLEVBQ3hDLGFBQXdDO1FBRXhDLElBQ0ksUUFBUSxLQUFLLE9BQU87WUFDcEIsYUFBYSxLQUFLLFNBQVM7WUFDM0IscUJBQXFCLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxFQUMxQyxDQUFDO1lBQ0MsTUFBTSxJQUFJLEtBQUssQ0FDWCwwQ0FBMEMsYUFBYSxFQUFFLENBQzVELENBQUM7UUFDTixDQUFDO0lBQ0wsQ0FBQztJQUVELE1BQU0sQ0FBQyxZQUFZLENBQUMsS0FBb0I7UUFDcEMsTUFBTSxJQUFJLEdBQUcsSUFBQSxtQkFBVSxFQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2xDLElBQUksQ0FBQyxNQUFNLENBQ1AsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUNYLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixHQUFHLENBQUMsS0FBSyxDQUFDLHFCQUFxQixLQUFLLFNBQVM7Z0JBQ3pDLENBQUMsQ0FBQztvQkFDSSxxQkFBcUIsRUFBRSxLQUFLLENBQUMscUJBQXFCO2lCQUNyRDtnQkFDSCxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ1QsR0FBRyxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssU0FBUztnQkFDakMsQ0FBQyxDQUFDLEVBQUUsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhLEVBQUU7Z0JBQ3hDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDWixDQUFDLENBQ0wsQ0FBQztRQUNGLE9BQU8sSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFRCxNQUFNLENBQUMsS0FBSyxDQUFDLGdDQUFnQyxDQUN6QyxZQUFvQixFQUNwQixNQUFZLEVBQ1osT0FBZ0M7UUFNaEMsTUFBTSxHQUFHLEdBQUcsTUFBTSxFQUFFLEtBQUssQ0FBQztZQUN0QixNQUFNLEVBQUUseUJBQXlCO1NBQ3BDLENBQUMsQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLE9BQU8sRUFBRSxRQUFRLElBQUksUUFBUSxDQUFDO1FBQy9DLHVCQUF1QixDQUFDLGtDQUFrQyxDQUN0RCxRQUFRLEVBQ1IsT0FBTyxFQUFFLGFBQWEsQ0FDekIsQ0FBQztRQUNGLE1BQU0sUUFBUSxHQUFHLE1BQU0sdUJBQXVCLENBQUMsY0FBYyxDQUN6RCxNQUFNLEVBQ04sUUFBUSxDQUNYLENBQUM7UUFDRixNQUFNLGNBQWMsR0FDaEIsUUFBUSxJQUFJLHVCQUF1QixDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUM7WUFDekQsQ0FBQyxDQUFDLFFBQVE7WUFDVixDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3BCLE1BQU0sWUFBWSxHQUNkLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUM7WUFDMUQsQ0FBQyxDQUFDLFFBQVE7WUFDVixDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3BCLE1BQU0sVUFBVSxHQUFHLGNBQWM7WUFDN0IsQ0FBQyxDQUFDLHVCQUF1QixDQUFDLGVBQWUsQ0FBQyxjQUFjLENBQUM7WUFDekQsQ0FBQyxDQUFDLFlBQVk7Z0JBQ1osdUJBQXVCLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBRXpELE1BQU0sYUFBYSxHQUFHLFVBQVU7WUFDNUIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxZQUFZLEVBQUUsVUFBVSxDQUFDLENBQUM7WUFDM0MsQ0FBQyxDQUFDLFlBQVksQ0FBQztRQUVuQixJQUFJLGFBQWEsQ0FBQyxNQUFNLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFDRCxHQUFHLEVBQUUsS0FBSyxDQUFDLGtDQUFrQyxFQUFFO1lBQzNDLGtCQUFrQixFQUFFLFlBQVksQ0FBQyxNQUFNO1lBQ3ZDLG1CQUFtQixFQUFFLGFBQWEsQ0FBQyxNQUFNO1lBQ3pDLGNBQWMsRUFBRSxPQUFPLENBQUMsWUFBWSxDQUFDO1lBQ3JDLGlCQUFpQixFQUFFLE9BQU8sQ0FBQyxjQUFjLENBQUM7U0FDN0MsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxFQUFFLFlBQVksRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLENBQUM7SUFDM0QsQ0FBQztDQUNKO0FBN1VELDBEQTZVQyJ9

package/dist/challengeProvider/challengeProvider.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="node" />
+import { Challenge, Log } from '@super-protocol/pki-common';
+export interface ChallengeProvider {
+    logger?: Log;
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProvider.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlUHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/challengeProvider/challengeProviderAzure.d.ts

@@ -0,0 +1,11 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, ChallengeType, Log } from '@super-protocol/pki-common';
+import { NvidiaVerifierMode } from '../challengeValidator/validatorConfig';
+export declare class ChallengeProviderAzure implements ChallengeProvider {
+    readonly logger: Log | undefined;
+    private readonly challengeType;
+    private readonly nvidiaVerifier?;
+    constructor(logger: Log | undefined, challengeType: ChallengeType.TDXAZURE | ChallengeType.SEVSNPAZURE, nvidiaVerifier?: NvidiaVerifierMode | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProviderAzure.js

@@ -0,0 +1,60 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderAzure = void 0;
+const challengeNvidiaCCHelper_1 = require("./challengeNvidiaCCHelper");
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeProviderAzure {
+    logger;
+    challengeType;
+    nvidiaVerifier;
+    constructor(logger, challengeType, nvidiaVerifier) {
+        this.logger = logger;
+        this.challengeType = challengeType;
+        this.nvidiaVerifier = nvidiaVerifier;
+    }
+    async generateChallenge(userData, networkID) {
+        // This module depends on native library that cannot be compiled for all architectures / operating systems.
+        // That is why we load it dynamically and use only when it's really needed.
+        const { TeeNative } = await Promise.resolve().then(() => __importStar(require('@super-protocol/addons-tee')));
+        const { challengeData, nvidiaTokens, nvidiaEvidence } = await challengeNvidiaCCHelper_1.ChallengeNvidiaCCHelper.getTokenAndCombinedChallengeData(userData, this.logger, {
+            verifier: this.nvidiaVerifier,
+            challengeType: this.challengeType,
+        });
+        const azureCvmService = new TeeNative.AzureCvmService();
+        const evidence = this.challengeType === pki_common_1.ChallengeType.TDXAZURE
+            ? await azureCvmService.generateSerializedTDXAzureEvidence(challengeData)
+            : await azureCvmService.generateSerializedAmdSevSnpAzureEvidence(challengeData);
+        return {
+            type: this.challengeType,
+            evidenceBase64: evidence.toString('base64'),
+            ...(nvidiaTokens ? { nvidiaTokens } : {}),
+            ...(nvidiaEvidence ? { nvidiaEvidence } : {}),
+            networkID,
+        };
+    }
+}
+exports.ChallengeProviderAzure = ChallengeProviderAzure;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJBenVyZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VQcm92aWRlci9jaGFsbGVuZ2VQcm92aWRlckF6dXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdUVBQW9FO0FBRXBFLDJEQUEyRTtBQUczRSxNQUFhLHNCQUFzQjtJQUVYO0lBQ0M7SUFHQTtJQUxyQixZQUNvQixNQUF1QixFQUN0QixhQUVjLEVBQ2QsY0FBbUM7UUFKcEMsV0FBTSxHQUFOLE1BQU0sQ0FBaUI7UUFDdEIsa0JBQWEsR0FBYixhQUFhLENBRUM7UUFDZCxtQkFBYyxHQUFkLGNBQWMsQ0FBcUI7SUFDckQsQ0FBQztJQUVKLEtBQUssQ0FBQyxpQkFBaUIsQ0FDbkIsUUFBZ0IsRUFDaEIsU0FBa0I7UUFFbEIsMkdBQTJHO1FBQzNHLDJFQUEyRTtRQUMzRSxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsd0RBQWEsNEJBQTRCLEdBQUMsQ0FBQztRQUVqRSxNQUFNLEVBQUUsYUFBYSxFQUFFLFlBQVksRUFBRSxjQUFjLEVBQUUsR0FDakQsTUFBTSxpREFBdUIsQ0FBQyxnQ0FBZ0MsQ0FDMUQsUUFBUSxFQUNSLElBQUksQ0FBQyxNQUFNLEVBQ1g7WUFDSSxRQUFRLEVBQUUsSUFBSSxDQUFDLGNBQWM7WUFDN0IsYUFBYSxFQUFFLElBQUksQ0FBQyxhQUFhO1NBQ3BDLENBQ0osQ0FBQztRQUVOLE1BQU0sZUFBZSxHQUFHLElBQUksU0FBUyxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBRXhELE1BQU0sUUFBUSxHQUNWLElBQUksQ0FBQyxhQUFhLEtBQUssMEJBQWEsQ0FBQyxRQUFRO1lBQ3pDLENBQUMsQ0FBQyxNQUFNLGVBQWUsQ0FBQyxrQ0FBa0MsQ0FDcEQsYUFBYSxDQUNoQjtZQUNILENBQUMsQ0FBQyxNQUFNLGVBQWUsQ0FBQyx3Q0FBd0MsQ0FDMUQsYUFBYSxDQUNoQixDQUFDO1FBRVosT0FBTztZQUNILElBQUksRUFBRSxJQUFJLENBQUMsYUFBYTtZQUN4QixjQUFjLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7WUFDM0MsR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3pDLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM3QyxTQUFTO1NBQ1osQ0FBQztJQUNOLENBQUM7Q0FDSjtBQTlDRCx3REE4Q0MifQ==

package/dist/challengeProvider/challengeProviderCertificate.d.ts

@@ -0,0 +1,15 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+export declare class ChallengeProviderCertificate implements ChallengeProvider {
+    private readonly orderCertsPath;
+    readonly logger?: Log | undefined;
+    private orderCert;
+    private orderCaBundle;
+    private orderPrivateKey;
+    private initialized;
+    constructor(orderCertsPath: string, logger?: Log | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+    private readOrderCerts;
+    private signUserData;
+}

package/dist/challengeProvider/challengeProviderCertificate.js

@@ -0,0 +1,82 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderCertificate = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+class ChallengeProviderCertificate {
+    orderCertsPath;
+    logger;
+    orderCert;
+    orderCaBundle;
+    orderPrivateKey;
+    initialized = false;
+    constructor(orderCertsPath, logger) {
+        this.orderCertsPath = orderCertsPath;
+        this.logger = logger;
+    }
+    async generateChallenge(userData, networkID) {
+        if (!this.initialized) {
+            try {
+                await this.readOrderCerts();
+                this.initialized = true;
+            }
+            catch (error) {
+                throw new Error(`Error on reading order certificate files: ${error.message}`);
+            }
+        }
+        return {
+            type: pki_common_1.ChallengeType.Certificate,
+            userDataSignatureBase64: this.signUserData(userData),
+            orderCertificate: this.orderCert,
+            orderCABundle: this.orderCaBundle,
+            networkID,
+        };
+    }
+    async readOrderCerts() {
+        this.orderCert = await fs.readFile(path.join(this.orderCertsPath, 'order_cert.crt'), 'utf8');
+        this.orderPrivateKey = await fs.readFile(path.join(this.orderCertsPath, 'order_cert.key'), 'utf8');
+        this.orderCaBundle = await fs.readFile(path.join(this.orderCertsPath, 'order_cert_ca_bundle.crt'), 'utf8');
+    }
+    signUserData(userData) {
+        const privateKeyObj = crypto_1.default.createPrivateKey({
+            key: this.orderPrivateKey,
+            format: 'pem',
+            type: 'pkcs8',
+        });
+        const signer = crypto_1.default.createSign('sha256');
+        signer.update(userData);
+        signer.end();
+        const signature = signer.sign(privateKeyObj);
+        return signature.toString('base64');
+    }
+}
+exports.ChallengeProviderCertificate = ChallengeProviderCertificate;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJDZXJ0aWZpY2F0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VQcm92aWRlci9jaGFsbGVuZ2VQcm92aWRlckNlcnRpZmljYXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQ0EsMkRBQTJFO0FBQzNFLGdEQUFrQztBQUNsQywyQ0FBNkI7QUFDN0Isb0RBQTRCO0FBRTVCLE1BQWEsNEJBQTRCO0lBT2hCO0lBQ0Q7SUFQWixTQUFTLENBQVU7SUFDbkIsYUFBYSxDQUFVO0lBQ3ZCLGVBQWUsQ0FBVTtJQUN6QixXQUFXLEdBQUcsS0FBSyxDQUFDO0lBRTVCLFlBQ3FCLGNBQXNCLEVBQ3ZCLE1BQVk7UUFEWCxtQkFBYyxHQUFkLGNBQWMsQ0FBUTtRQUN2QixXQUFNLEdBQU4sTUFBTSxDQUFNO0lBQzdCLENBQUM7SUFDSixLQUFLLENBQUMsaUJBQWlCLENBQ25CLFFBQWdCLEVBQ2hCLFNBQWtCO1FBRWxCLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDcEIsSUFBSSxDQUFDO2dCQUNELE1BQU0sSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO2dCQUM1QixJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQztZQUM1QixDQUFDO1lBQUMsT0FBTyxLQUFVLEVBQUUsQ0FBQztnQkFDbEIsTUFBTSxJQUFJLEtBQUssQ0FDWCw2Q0FBNkMsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUMvRCxDQUFDO1lBQ04sQ0FBQztRQUNMLENBQUM7UUFDRCxPQUFPO1lBQ0gsSUFBSSxFQUFFLDBCQUFhLENBQUMsV0FBVztZQUMvQix1QkFBdUIsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQztZQUNwRCxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsU0FBUztZQUNoQyxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWE7WUFDakMsU0FBUztTQUNaLENBQUM7SUFDTixDQUFDO0lBQ08sS0FBSyxDQUFDLGNBQWM7UUFDeEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQzlCLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxnQkFBZ0IsQ0FBQyxFQUNoRCxNQUFNLENBQ1QsQ0FBQztRQUNGLElBQUksQ0FBQyxlQUFlLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUNwQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsZ0JBQWdCLENBQUMsRUFDaEQsTUFBTSxDQUNULENBQUM7UUFDRixJQUFJLENBQUMsYUFBYSxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FDbEMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLDBCQUEwQixDQUFDLEVBQzFELE1BQU0sQ0FDVCxDQUFDO0lBQ04sQ0FBQztJQUVPLFlBQVksQ0FBQyxRQUFnQjtRQUNqQyxNQUFNLGFBQWEsR0FBRyxnQkFBTSxDQUFDLGdCQUFnQixDQUFDO1lBQzFDLEdBQUcsRUFBRSxJQUFJLENBQUMsZUFBZTtZQUN6QixNQUFNLEVBQUUsS0FBSztZQUNiLElBQUksRUFBRSxPQUFPO1NBQ2hCLENBQUMsQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLGdCQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzNDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDeEIsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ2IsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUM3QyxPQUFPLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDeEMsQ0FBQztDQUNKO0FBM0RELG9FQTJEQyJ9

package/dist/challengeProvider/challengeProviderSevSnp.d.ts

@@ -0,0 +1,10 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+import { NvidiaVerifierMode } from '../challengeValidator/validatorConfig';
+export declare class ChallengeProviderSevSnp implements ChallengeProvider {
+    readonly logger?: Log | undefined;
+    private readonly nvidiaVerifier?;
+    constructor(logger?: Log | undefined, nvidiaVerifier?: NvidiaVerifierMode | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProviderSevSnp.js

@@ -0,0 +1,55 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderSevSnp = void 0;
+const challengeNvidiaCCHelper_1 = require("./challengeNvidiaCCHelper");
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeProviderSevSnp {
+    logger;
+    nvidiaVerifier;
+    constructor(logger, nvidiaVerifier) {
+        this.logger = logger;
+        this.nvidiaVerifier = nvidiaVerifier;
+    }
+    async generateChallenge(userData, networkID) {
+        // This module depends on native library that cannot be compiled for all architectures / operating systems.
+        // That is why we load it dynamically and use only when it's really needed.
+        const { TeeNative } = await Promise.resolve().then(() => __importStar(require('@super-protocol/addons-tee')));
+        const { challengeData, nvidiaTokens, nvidiaEvidence } = await challengeNvidiaCCHelper_1.ChallengeNvidiaCCHelper.getTokenAndCombinedChallengeData(userData, this.logger, {
+            verifier: this.nvidiaVerifier,
+            challengeType: pki_common_1.ChallengeType.SEVSNP,
+        });
+        const evidence = await TeeNative.SevSNP.generateSerializedAmdSevSnpQemuEvidence(challengeData);
+        return {
+            type: pki_common_1.ChallengeType.SEVSNP,
+            evidenceBase64: evidence.toString('base64'),
+            ...(nvidiaTokens ? { nvidiaTokens } : {}),
+            ...(nvidiaEvidence ? { nvidiaEvidence } : {}),
+            networkID,
+        };
+    }
+}
+exports.ChallengeProviderSevSnp = ChallengeProviderSevSnp;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJTZXZTbnAuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlUHJvdmlkZXJTZXZTbnAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1RUFBb0U7QUFFcEUsMkRBQTJFO0FBRzNFLE1BQWEsdUJBQXVCO0lBRVo7SUFDQztJQUZyQixZQUNvQixNQUFZLEVBQ1gsY0FBbUM7UUFEcEMsV0FBTSxHQUFOLE1BQU0sQ0FBTTtRQUNYLG1CQUFjLEdBQWQsY0FBYyxDQUFxQjtJQUNyRCxDQUFDO0lBRUosS0FBSyxDQUFDLGlCQUFpQixDQUNuQixRQUFnQixFQUNoQixTQUFrQjtRQUVsQiwyR0FBMkc7UUFDM0csMkVBQTJFO1FBQzNFLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyx3REFBYSw0QkFBNEIsR0FBQyxDQUFDO1FBRWpFLE1BQU0sRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUFFLGNBQWMsRUFBRSxHQUNqRCxNQUFNLGlEQUF1QixDQUFDLGdDQUFnQyxDQUMxRCxRQUFRLEVBQ1IsSUFBSSxDQUFDLE1BQU0sRUFDWDtZQUNJLFFBQVEsRUFBRSxJQUFJLENBQUMsY0FBYztZQUM3QixhQUFhLEVBQUUsMEJBQWEsQ0FBQyxNQUFNO1NBQ3RDLENBQ0osQ0FBQztRQUNOLE1BQU0sUUFBUSxHQUNWLE1BQU0sU0FBUyxDQUFDLE1BQU0sQ0FBQyx1Q0FBdUMsQ0FDMUQsYUFBYSxDQUNoQixDQUFDO1FBQ04sT0FBTztZQUNILElBQUksRUFBRSwwQkFBYSxDQUFDLE1BQU07WUFDMUIsY0FBYyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1lBQzNDLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN6QyxHQUFHLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxFQUFFLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDN0MsU0FBUztTQUNaLENBQUM7SUFDTixDQUFDO0NBQ0o7QUFuQ0QsMERBbUNDIn0=

package/dist/challengeProvider/challengeProviderTdx.d.ts

@@ -0,0 +1,11 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, ChallengeType, Log } from '@super-protocol/pki-common';
+import { NvidiaVerifierMode } from '../challengeValidator/validatorConfig';
+export declare class ChallengeProviderTdx implements ChallengeProvider {
+    readonly logger?: Log | undefined;
+    private readonly challengeType;
+    private readonly nvidiaVerifier?;
+    constructor(logger?: Log | undefined, challengeType?: ChallengeType.TDX | ChallengeType.TDXGOOGLE, nvidiaVerifier?: NvidiaVerifierMode | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProviderTdx.js

@@ -0,0 +1,60 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderTdx = void 0;
+const challengeNvidiaCCHelper_1 = require("./challengeNvidiaCCHelper");
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeProviderTdx {
+    logger;
+    challengeType;
+    nvidiaVerifier;
+    constructor(logger, challengeType = pki_common_1.ChallengeType.TDX, nvidiaVerifier) {
+        this.logger = logger;
+        this.challengeType = challengeType;
+        this.nvidiaVerifier = nvidiaVerifier;
+    }
+    async generateChallenge(userData, networkID) {
+        // This module depends on native library that cannot be compiled for all architectures / operating systems.
+        // That is why we load it dynamically and use only when it's really needed.
+        const { TeeNative } = await Promise.resolve().then(() => __importStar(require('@super-protocol/addons-tee')));
+        const { challengeData, nvidiaTokens, nvidiaEvidence } = await challengeNvidiaCCHelper_1.ChallengeNvidiaCCHelper.getTokenAndCombinedChallengeData(userData, this.logger, {
+            verifier: this.nvidiaVerifier,
+            challengeType: this.challengeType,
+        });
+        const dcapVerifyService = new TeeNative.DcapQuoteVerifyService();
+        const evidence = this.challengeType === pki_common_1.ChallengeType.TDXGOOGLE
+            ? await dcapVerifyService.generateSerializedTDXGCPEvidence(challengeData)
+            : await dcapVerifyService.generateSerializedTDXQemuEvidence(challengeData);
+        return {
+            type: this.challengeType,
+            evidenceBase64: evidence.toString('base64'),
+            ...(nvidiaTokens ? { nvidiaTokens } : {}),
+            ...(nvidiaEvidence ? { nvidiaEvidence } : {}),
+            networkID,
+        };
+    }
+}
+exports.ChallengeProviderTdx = ChallengeProviderTdx;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJUZHguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlUHJvdmlkZXJUZHgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1RUFBb0U7QUFFcEUsMkRBQTJFO0FBRzNFLE1BQWEsb0JBQW9CO0lBRVQ7SUFDQztJQUdBO0lBTHJCLFlBQ29CLE1BQVksRUFDWCxnQkFFZSwwQkFBYSxDQUFDLEdBQUcsRUFDaEMsY0FBbUM7UUFKcEMsV0FBTSxHQUFOLE1BQU0sQ0FBTTtRQUNYLGtCQUFhLEdBQWIsYUFBYSxDQUVtQjtRQUNoQyxtQkFBYyxHQUFkLGNBQWMsQ0FBcUI7SUFDckQsQ0FBQztJQUVKLEtBQUssQ0FBQyxpQkFBaUIsQ0FDbkIsUUFBZ0IsRUFDaEIsU0FBa0I7UUFFbEIsMkdBQTJHO1FBQzNHLDJFQUEyRTtRQUMzRSxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsd0RBQWEsNEJBQTRCLEdBQUMsQ0FBQztRQUVqRSxNQUFNLEVBQUUsYUFBYSxFQUFFLFlBQVksRUFBRSxjQUFjLEVBQUUsR0FDakQsTUFBTSxpREFBdUIsQ0FBQyxnQ0FBZ0MsQ0FDMUQsUUFBUSxFQUNSLElBQUksQ0FBQyxNQUFNLEVBQ1g7WUFDSSxRQUFRLEVBQUUsSUFBSSxDQUFDLGNBQWM7WUFDN0IsYUFBYSxFQUFFLElBQUksQ0FBQyxhQUFhO1NBQ3BDLENBQ0osQ0FBQztRQUVOLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxTQUFTLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztRQUVqRSxNQUFNLFFBQVEsR0FDVixJQUFJLENBQUMsYUFBYSxLQUFLLDBCQUFhLENBQUMsU0FBUztZQUMxQyxDQUFDLENBQUMsTUFBTSxpQkFBaUIsQ0FBQyxnQ0FBZ0MsQ0FDcEQsYUFBYSxDQUNoQjtZQUNILENBQUMsQ0FBQyxNQUFNLGlCQUFpQixDQUFDLGlDQUFpQyxDQUNyRCxhQUFhLENBQ2hCLENBQUM7UUFFWixPQUFPO1lBQ0gsSUFBSSxFQUFFLElBQUksQ0FBQyxhQUFhO1lBQ3hCLGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztZQUMzQyxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDekMsR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsRUFBRSxjQUFjLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzdDLFNBQVM7U0FDWixDQUFDO0lBQ04sQ0FBQztDQUNKO0FBOUNELG9EQThDQyJ9

package/dist/challengeProvider/challengeProviderToken.d.ts

@@ -0,0 +1,9 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+export declare class ChallengeProviderToken implements ChallengeProvider {
+    private readonly token;
+    readonly logger?: Log | undefined;
+    constructor(token: string, logger?: Log | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}