@super-protocol/pki-attestation-engine 0.0.0-nvidia-local-verifier

package/dist/challengeValidator/challengeValidatorSevSnp.js

@@ -0,0 +1,142 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorSevSnp = void 0;
+const path = __importStar(require("path"));
+const addons_tee_1 = require("@super-protocol/addons-tee");
+const pki_common_1 = require("@super-protocol/pki-common");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const schemas_1 = require("./schemas");
+class ChallengeValidatorSevSnp {
+    log;
+    measureInstance;
+    sevTmp;
+    static instance;
+    securityPolicy;
+    static getInstance(log, config) {
+        if (!ChallengeValidatorSevSnp.instance) {
+            ChallengeValidatorSevSnp.instance = new ChallengeValidatorSevSnp(log, config);
+        }
+        return ChallengeValidatorSevSnp.instance;
+    }
+    constructor(log, config) {
+        this.log = log;
+        this.log.debug(`SEV config: ${JSON.stringify(config)}`);
+        this.sevTmp = config?.sevTmp ?? '/tmp';
+        const cacheFolder = config?.cacheFolder ??
+            path.join(this.sevTmp, 'snp-mrenclave-cache');
+        let storageAccess;
+        if (config?.storageAccess) {
+            const { isValid } = (0, sdk_js_1.validateBySchema)(config.storageAccess, schemas_1.accessCredentialsSchema);
+            if (!isValid) {
+                throw new Error(`sev storageAccess is not valid!})`);
+            }
+            storageAccess = config.storageAccess;
+        }
+        if (config?.securityPolicy) {
+            try {
+                this.securityPolicy = addons_tee_1.TeeNative.SevSNP.parsePolicySet(config.securityPolicy);
+            }
+            catch (error) {
+                this.log.error(`Failed to parse SEV-SNP security policy: ${error}`);
+                throw new Error(`Invalid SEV-SNP security policy configuration: ${error}`);
+            }
+        }
+        this.measureInstance = new addons_tee_1.TeeNative.SNPMrEnclaveCalculator({
+            cacheFolder,
+            vmRepo: config?.vmRepo,
+            vmRepoOwner: config?.vmRepoOwner,
+            releaseAsset: config?.releaseAsset,
+            storageAccess,
+            rmPrevCache: false,
+        });
+    }
+    async validate(challenge) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.SEVSNP:
+                try {
+                    let evidence;
+                    try {
+                        evidence = addons_tee_1.TeeNative.deserializeTeeEvidence(Buffer.from(challenge.evidenceBase64, 'base64'));
+                    }
+                    catch (e) {
+                        this.log.error(`deserializeTeeEvidence returned error: ${e}`);
+                        throw e;
+                    }
+                    const report = evidence.amdSevSnpQemu;
+                    if (!report) {
+                        throw new Error(`Missing SNP QEMU evidence for challenge type ${challenge.type}`);
+                    }
+                    try {
+                        await addons_tee_1.TeeNative.SevSNP.verifyReport(report, {
+                            timeoutMs: 60000,
+                            tmpDirTemplate: `${this.sevTmp}/verify-`,
+                        });
+                    }
+                    catch (e) {
+                        this.log.error(`verifyReport returned error: ${e}`);
+                        throw e;
+                    }
+                    const snpReport = report.snpReport;
+                    if (!snpReport?.rawReport) {
+                        throw new Error('Missing snpReport or rawReport');
+                    }
+                    try {
+                        if (this.securityPolicy) {
+                            await addons_tee_1.TeeNative.SevSNP.verifyPolicy(Buffer.from(snpReport.rawReport), this.securityPolicy);
+                        }
+                    }
+                    catch (e) {
+                        this.log.error(`verifyPolicy returned error: ${e}`);
+                        throw e;
+                    }
+                    const userData = await addons_tee_1.TeeNative.SevSNP.getReportData(Buffer.from(snpReport.rawReport));
+                    let mrenclave;
+                    try {
+                        mrenclave =
+                            await this.measureInstance.getSingleCoreMrEnclave(snpReport);
+                    }
+                    catch (e) {
+                        this.log.error(`getSingleCoreMrEnclave returned error: ${e}`);
+                        throw e;
+                    }
+                    return {
+                        success: true,
+                        validatedUserData: Buffer.from(userData.slice(0, 64)),
+                        validatedId: mrenclave,
+                    };
+                }
+                catch (e) {
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+}
+exports.ChallengeValidatorSevSnp = ChallengeValidatorSevSnp;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yU2V2U25wLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JTZXZTbnAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyQ0FBNkI7QUFDN0IsMkRBQXVEO0FBQ3ZELDJEQUEyRTtBQUczRSxtREFBeUU7QUFDekUsdUNBQW9EO0FBRXBELE1BQWEsd0JBQXdCO0lBcUJaO0lBcEJiLGVBQWUsQ0FBbUM7SUFDekMsTUFBTSxDQUFTO0lBQ3hCLE1BQU0sQ0FBQyxRQUFRLENBQTJCO0lBQ2pDLGNBQWMsQ0FBa0M7SUFFMUQsTUFBTSxDQUFDLFdBQVcsQ0FDckIsR0FBUSxFQUNSLE1BQTRCO1FBRTVCLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNyQyx3QkFBd0IsQ0FBQyxRQUFRLEdBQUcsSUFBSSx3QkFBd0IsQ0FDNUQsR0FBRyxFQUNILE1BQU0sQ0FDVCxDQUFDO1FBQ04sQ0FBQztRQUVELE9BQU8sd0JBQXdCLENBQUMsUUFBUSxDQUFDO0lBQzdDLENBQUM7SUFFRCxZQUNxQixHQUFRLEVBQ3pCLE1BQTRCO1FBRFgsUUFBRyxHQUFILEdBQUcsQ0FBSztRQUd6QixJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxlQUFlLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3hELElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxFQUFFLE1BQU0sSUFBSSxNQUFNLENBQUM7UUFDdkMsTUFBTSxXQUFXLEdBQ2IsTUFBTSxFQUFFLFdBQVc7WUFDbkIsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLHFCQUFxQixDQUFDLENBQUM7UUFFbEQsSUFBSSxhQUF3QyxDQUFDO1FBQzdDLElBQUksTUFBTSxFQUFFLGFBQWEsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFBLHlCQUFnQixFQUNoQyxNQUFNLENBQUMsYUFBYSxFQUNwQixpQ0FBdUIsQ0FDMUIsQ0FBQztZQUNGLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDWCxNQUFNLElBQUksS0FBSyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7WUFDekQsQ0FBQztZQUVELGFBQWEsR0FBRyxNQUFNLENBQUMsYUFBOEIsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsSUFBSSxNQUFNLEVBQUUsY0FBYyxFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDO2dCQUNELElBQUksQ0FBQyxjQUFjLEdBQUcsc0JBQVMsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUNqRCxNQUFNLENBQUMsY0FBYyxDQUN4QixDQUFDO1lBQ04sQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2IsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQ1YsNENBQTRDLEtBQUssRUFBRSxDQUN0RCxDQUFDO2dCQUNGLE1BQU0sSUFBSSxLQUFLLENBQ1gsa0RBQWtELEtBQUssRUFBRSxDQUM1RCxDQUFDO1lBQ04sQ0FBQztRQUNMLENBQUM7UUFFRCxJQUFJLENBQUMsZUFBZSxHQUFHLElBQUksc0JBQVMsQ0FBQyxzQkFBc0IsQ0FBQztZQUN4RCxXQUFXO1lBQ1gsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNO1lBQ3RCLFdBQVcsRUFBRSxNQUFNLEVBQUUsV0FBVztZQUNoQyxZQUFZLEVBQUUsTUFBTSxFQUFFLFlBQVk7WUFDbEMsYUFBYTtZQUNiLFdBQVcsRUFBRSxLQUFLO1NBQ3JCLENBQUMsQ0FBQztJQUNQLENBQUM7SUFFRCxLQUFLLENBQUMsUUFBUSxDQUFDLFNBQW9CO1FBQy9CLFFBQVEsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ3JCLEtBQUssMEJBQWEsQ0FBQyxNQUFNO2dCQUNyQixJQUFJLENBQUM7b0JBQ0QsSUFBSSxRQUErQixDQUFDO29CQUNwQyxJQUFJLENBQUM7d0JBQ0QsUUFBUSxHQUFHLHNCQUFTLENBQUMsc0JBQXNCLENBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRSxRQUFRLENBQUMsQ0FDbEQsQ0FBQztvQkFDTixDQUFDO29CQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7d0JBQ2QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQ1YsMENBQTBDLENBQUMsRUFBRSxDQUNoRCxDQUFDO3dCQUNGLE1BQU0sQ0FBQyxDQUFDO29CQUNaLENBQUM7b0JBRUQsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLGFBQWEsQ0FBQztvQkFDdEMsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO3dCQUNWLE1BQU0sSUFBSSxLQUFLLENBQ1gsZ0RBQWdELFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FDbkUsQ0FBQztvQkFDTixDQUFDO29CQUVELElBQUksQ0FBQzt3QkFDRCxNQUFNLHNCQUFTLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUU7NEJBQ3hDLFNBQVMsRUFBRSxLQUFLOzRCQUNoQixjQUFjLEVBQUUsR0FBRyxJQUFJLENBQUMsTUFBTSxVQUFVO3lCQUMzQyxDQUFDLENBQUM7b0JBQ1AsQ0FBQztvQkFBQyxPQUFPLENBQU0sRUFBRSxDQUFDO3dCQUNkLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLGdDQUFnQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO3dCQUNwRCxNQUFNLENBQUMsQ0FBQztvQkFDWixDQUFDO29CQUVELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUM7b0JBQ25DLElBQUksQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLENBQUM7d0JBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztvQkFDdEQsQ0FBQztvQkFFRCxJQUFJLENBQUM7d0JBQ0QsSUFBSSxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7NEJBQ3RCLE1BQU0sc0JBQVMsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUMvQixNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFDaEMsSUFBSSxDQUFDLGNBQWMsQ0FDdEIsQ0FBQzt3QkFDTixDQUFDO29CQUNMLENBQUM7b0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQzt3QkFDZCxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQyxFQUFFLENBQUMsQ0FBQzt3QkFDcEQsTUFBTSxDQUFDLENBQUM7b0JBQ1osQ0FBQztvQkFFRCxNQUFNLFFBQVEsR0FBRyxNQUFNLHNCQUFTLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQ25DLENBQUM7b0JBQ0YsSUFBSSxTQUFpQixDQUFDO29CQUN0QixJQUFJLENBQUM7d0JBQ0QsU0FBUzs0QkFDTCxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsc0JBQXNCLENBQzdDLFNBQVMsQ0FDWixDQUFDO29CQUNWLENBQUM7b0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQzt3QkFDZCxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FDViwwQ0FBMEMsQ0FBQyxFQUFFLENBQ2hELENBQUM7d0JBQ0YsTUFBTSxDQUFDLENBQUM7b0JBQ1osQ0FBQztvQkFFRCxPQUFPO3dCQUNILE9BQU8sRUFBRSxJQUFJO3dCQUNiLGlCQUFpQixFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7d0JBQ3JELFdBQVcsRUFBRSxTQUFTO3FCQUN6QixDQUFDO2dCQUNOLENBQUM7Z0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQztvQkFDZCxPQUFPO3dCQUNILE9BQU8sRUFBRSxLQUFLO3dCQUNkLEtBQUssRUFBRSxDQUFDLENBQUMsT0FBTztxQkFDbkIsQ0FBQztnQkFDTixDQUFDO1FBQ1QsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0NBQ0o7QUFuSkQsNERBbUpDIn0=

package/dist/challengeValidator/challengeValidatorTdx.d.ts

@@ -0,0 +1,8 @@
+import { Challenge, Log } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+export declare class ChallengeValidatorTdx implements ChallengeValidator {
+    private readonly log;
+    private verifierService;
+    constructor(log: Log);
+    validate(challenge: Challenge): Promise<ChallengeResult>;
+}

package/dist/challengeValidator/challengeValidatorTdx.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorTdx = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const addons_tee_1 = require("@super-protocol/addons-tee");
+class ChallengeValidatorTdx {
+    log;
+    verifierService = new addons_tee_1.TeeNative.DcapQuoteVerifyService();
+    constructor(log) {
+        this.log = log;
+    }
+    async validate(challenge) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.TDX:
+            case pki_common_1.ChallengeType.TDXGOOGLE:
+                try {
+                    const evidence = addons_tee_1.TeeNative.deserializeTeeEvidence(Buffer.from(challenge.evidenceBase64, 'base64'));
+                    const tdxEvidence = challenge.type === pki_common_1.ChallengeType.TDXGOOGLE
+                        ? evidence.intelTdxGcp
+                        : evidence.intelTdxQemu;
+                    if (!tdxEvidence) {
+                        throw new Error(`Missing TDX evidence for challenge type ${challenge.type}`);
+                    }
+                    const quote = Buffer.from(tdxEvidence.quote);
+                    try {
+                        await this.verifierService.validateQuoteVerifierEnclave(quote);
+                    }
+                    catch (e) {
+                        this.log.debug(`validateQuoteVerifierEnclave returned error: ${e}`);
+                        if (!e.hasOwnProperty('criticalError') ||
+                            e.criticalError) {
+                            throw e;
+                        }
+                    }
+                    const parsedQuote = await this.verifierService.parseTDXQuote(quote);
+                    this.log.debug(`Parsed quote: ${JSON.stringify(parsedQuote)}`);
+                    await this.verifierService.validateRtmrEventLogIntegrity(tdxEvidence.eventLog, parsedQuote.rtmr0);
+                    const userData = parsedQuote.reportData;
+                    this.log.debug(`Parsed quote: ${JSON.stringify(parsedQuote)}`);
+                    const mrenclave = await this.verifierService.getTDXMrEclave(parsedQuote, tdxEvidence.eventLog);
+                    return {
+                        success: true,
+                        validatedUserData: userData.subarray(0, 64),
+                        validatedId: mrenclave,
+                    };
+                }
+                catch (e) {
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+}
+exports.ChallengeValidatorTdx = ChallengeValidatorTdx;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yVGR4LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JUZHgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkRBQTJFO0FBRTNFLDJEQUF1RDtBQUV2RCxNQUFhLHFCQUFxQjtJQUdEO0lBRnJCLGVBQWUsR0FBRyxJQUFJLHNCQUFTLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztJQUVqRSxZQUE2QixHQUFRO1FBQVIsUUFBRyxHQUFILEdBQUcsQ0FBSztJQUFHLENBQUM7SUFFekMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUFvQjtRQUMvQixRQUFRLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNyQixLQUFLLDBCQUFhLENBQUMsR0FBRyxDQUFDO1lBQ3ZCLEtBQUssMEJBQWEsQ0FBQyxTQUFTO2dCQUN4QixJQUFJLENBQUM7b0JBQ0QsTUFBTSxRQUFRLEdBQUcsc0JBQVMsQ0FBQyxzQkFBc0IsQ0FDN0MsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLFFBQVEsQ0FBQyxDQUNsRCxDQUFDO29CQUNGLE1BQU0sV0FBVyxHQUNiLFNBQVMsQ0FBQyxJQUFJLEtBQUssMEJBQWEsQ0FBQyxTQUFTO3dCQUN0QyxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVc7d0JBQ3RCLENBQUMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDO29CQUNoQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7d0JBQ2YsTUFBTSxJQUFJLEtBQUssQ0FDWCwyQ0FBMkMsU0FBUyxDQUFDLElBQUksRUFBRSxDQUM5RCxDQUFDO29CQUNOLENBQUM7b0JBRUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7b0JBQzdDLElBQUksQ0FBQzt3QkFDRCxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsNEJBQTRCLENBQ25ELEtBQUssQ0FDUixDQUFDO29CQUNOLENBQUM7b0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQzt3QkFDZCxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FDVixnREFBZ0QsQ0FBQyxFQUFFLENBQ3RELENBQUM7d0JBQ0YsSUFDSSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsZUFBZSxDQUFDOzRCQUNsQyxDQUFDLENBQUMsYUFBYSxFQUNqQixDQUFDOzRCQUNDLE1BQU0sQ0FBQyxDQUFDO3dCQUNaLENBQUM7b0JBQ0wsQ0FBQztvQkFDRCxNQUFNLFdBQVcsR0FDYixNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDO29CQUNwRCxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FDVixpQkFBaUIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUNqRCxDQUFDO29CQUNGLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyw2QkFBNkIsQ0FDcEQsV0FBVyxDQUFDLFFBQVEsRUFDcEIsV0FBVyxDQUFDLEtBQUssQ0FDcEIsQ0FBQztvQkFDRixNQUFNLFFBQVEsR0FBRyxXQUFXLENBQUMsVUFBVSxDQUFDO29CQUN4QyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FDVixpQkFBaUIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUNqRCxDQUFDO29CQUNGLE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxjQUFjLENBQ3ZELFdBQVcsRUFDWCxXQUFXLENBQUMsUUFBUSxDQUN2QixDQUFDO29CQUVGLE9BQU87d0JBQ0gsT0FBTyxFQUFFLElBQUk7d0JBQ2IsaUJBQWlCLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO3dCQUMzQyxXQUFXLEVBQUUsU0FBUztxQkFDekIsQ0FBQztnQkFDTixDQUFDO2dCQUFDLE9BQU8sQ0FBTSxFQUFFLENBQUM7b0JBQ2QsT0FBTzt3QkFDSCxPQUFPLEVBQUUsS0FBSzt3QkFDZCxLQUFLLEVBQUUsQ0FBQyxDQUFDLE9BQU87cUJBQ25CLENBQUM7Z0JBQ04sQ0FBQztRQUNULENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDL0MsQ0FBQztDQUNKO0FBdkVELHNEQXVFQyJ9

package/dist/challengeValidator/challengeValidatorToken.d.ts

@@ -0,0 +1,8 @@
+import { Challenge, Log } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+export declare class ChallengeValidatorToken implements ChallengeValidator {
+    private readonly token;
+    private readonly log;
+    constructor(token: string, log: Log);
+    validate(challenge: Challenge): Promise<ChallengeResult>;
+}

package/dist/challengeValidator/challengeValidatorToken.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorToken = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeValidatorToken {
+    token;
+    log;
+    constructor(token, log) {
+        this.token = token;
+        this.log = log;
+    }
+    async validate(challenge) {
+        switch (challenge.type) {
+            case pki_common_1.ChallengeType.Token:
+                try {
+                    if (challenge.token !== this.token) {
+                        throw new Error('Invalid token');
+                    }
+                    this.log.info(`token challenge validated successfully`);
+                    return {
+                        success: true,
+                        validatedUserData: Buffer.from(challenge.userDataBase64, 'base64'),
+                        validatedId: Buffer.alloc(0), // empty as we don't have id in token challenge
+                    };
+                }
+                catch (e) {
+                    this.log.error(`challengeValidatorToken returned error: ${e}`);
+                    return {
+                        success: false,
+                        error: e.message,
+                    };
+                }
+        }
+        throw new Error('Method not implemented.');
+    }
+}
+exports.ChallengeValidatorToken = ChallengeValidatorToken;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yVG9rZW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2NoYWxsZW5nZVZhbGlkYXRvclRva2VuLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJEQUEyRTtBQUczRSxNQUFhLHVCQUF1QjtJQUVYO0lBQ0E7SUFGckIsWUFDcUIsS0FBYSxFQUNiLEdBQVE7UUFEUixVQUFLLEdBQUwsS0FBSyxDQUFRO1FBQ2IsUUFBRyxHQUFILEdBQUcsQ0FBSztJQUMxQixDQUFDO0lBRUosS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUFvQjtRQUMvQixRQUFRLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNyQixLQUFLLDBCQUFhLENBQUMsS0FBSztnQkFDcEIsSUFBSSxDQUFDO29CQUNELElBQUksU0FBUyxDQUFDLEtBQUssS0FBSyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7d0JBQ2pDLE1BQU0sSUFBSSxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUM7b0JBQ3JDLENBQUM7b0JBQ0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsd0NBQXdDLENBQUMsQ0FBQztvQkFFeEQsT0FBTzt3QkFDSCxPQUFPLEVBQUUsSUFBSTt3QkFDYixpQkFBaUIsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUMxQixTQUFTLENBQUMsY0FBYyxFQUN4QixRQUFRLENBQ1g7d0JBQ0QsV0FBVyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsK0NBQStDO3FCQUNoRixDQUFDO2dCQUNOLENBQUM7Z0JBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQztvQkFDZCxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FDViwyQ0FBMkMsQ0FBQyxFQUFFLENBQ2pELENBQUM7b0JBQ0YsT0FBTzt3QkFDSCxPQUFPLEVBQUUsS0FBSzt3QkFDZCxLQUFLLEVBQUUsQ0FBQyxDQUFDLE9BQU87cUJBQ25CLENBQUM7Z0JBQ04sQ0FBQztRQUNULENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDL0MsQ0FBQztDQUNKO0FBbkNELDBEQW1DQyJ9

package/dist/challengeValidator/index.d.ts

@@ -0,0 +1,9 @@
+export * from './challengeValidator';
+export * from './validatorConfig';
+export { ChallengeValidatorAzure, type ChallengeValidatorAzureOptions, } from './challengeValidatorAzure';
+export { buildAzureVerifyOptions, checkAzureVerificationResult, checkTeeVerificationResult, isAzureEvidenceType, type AttestationWasmAzure, } from './wasmVerificationPolicy';
+export { ChallengeValidatorCertificate } from './challengeValidatorCertificate';
+export { ChallengeValidatorNvidia } from './challengeValidatorNvidia';
+export { ChallengeValidatorTdx } from './challengeValidatorTdx';
+export { ChallengeValidatorSevSnp } from './challengeValidatorSevSnp';
+export { ChallengeValidatorToken } from './challengeValidatorToken';

package/dist/challengeValidator/index.js

@@ -0,0 +1,37 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorToken = exports.ChallengeValidatorSevSnp = exports.ChallengeValidatorTdx = exports.ChallengeValidatorNvidia = exports.ChallengeValidatorCertificate = exports.isAzureEvidenceType = exports.checkTeeVerificationResult = exports.checkAzureVerificationResult = exports.buildAzureVerifyOptions = exports.ChallengeValidatorAzure = void 0;
+__exportStar(require("./challengeValidator"), exports);
+__exportStar(require("./validatorConfig"), exports);
+var challengeValidatorAzure_1 = require("./challengeValidatorAzure");
+Object.defineProperty(exports, "ChallengeValidatorAzure", { enumerable: true, get: function () { return challengeValidatorAzure_1.ChallengeValidatorAzure; } });
+var wasmVerificationPolicy_1 = require("./wasmVerificationPolicy");
+Object.defineProperty(exports, "buildAzureVerifyOptions", { enumerable: true, get: function () { return wasmVerificationPolicy_1.buildAzureVerifyOptions; } });
+Object.defineProperty(exports, "checkAzureVerificationResult", { enumerable: true, get: function () { return wasmVerificationPolicy_1.checkAzureVerificationResult; } });
+Object.defineProperty(exports, "checkTeeVerificationResult", { enumerable: true, get: function () { return wasmVerificationPolicy_1.checkTeeVerificationResult; } });
+Object.defineProperty(exports, "isAzureEvidenceType", { enumerable: true, get: function () { return wasmVerificationPolicy_1.isAzureEvidenceType; } });
+var challengeValidatorCertificate_1 = require("./challengeValidatorCertificate");
+Object.defineProperty(exports, "ChallengeValidatorCertificate", { enumerable: true, get: function () { return challengeValidatorCertificate_1.ChallengeValidatorCertificate; } });
+var challengeValidatorNvidia_1 = require("./challengeValidatorNvidia");
+Object.defineProperty(exports, "ChallengeValidatorNvidia", { enumerable: true, get: function () { return challengeValidatorNvidia_1.ChallengeValidatorNvidia; } });
+var challengeValidatorTdx_1 = require("./challengeValidatorTdx");
+Object.defineProperty(exports, "ChallengeValidatorTdx", { enumerable: true, get: function () { return challengeValidatorTdx_1.ChallengeValidatorTdx; } });
+var challengeValidatorSevSnp_1 = require("./challengeValidatorSevSnp");
+Object.defineProperty(exports, "ChallengeValidatorSevSnp", { enumerable: true, get: function () { return challengeValidatorSevSnp_1.ChallengeValidatorSevSnp; } });
+var challengeValidatorToken_1 = require("./challengeValidatorToken");
+Object.defineProperty(exports, "ChallengeValidatorToken", { enumerable: true, get: function () { return challengeValidatorToken_1.ChallengeValidatorToken; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXFDO0FBQ3JDLG9EQUFrQztBQUNsQyxxRUFHbUM7QUFGL0Isa0lBQUEsdUJBQXVCLE9BQUE7QUFHM0IsbUVBTWtDO0FBTDlCLGlJQUFBLHVCQUF1QixPQUFBO0FBQ3ZCLHNJQUFBLDRCQUE0QixPQUFBO0FBQzVCLG9JQUFBLDBCQUEwQixPQUFBO0FBQzFCLDZIQUFBLG1CQUFtQixPQUFBO0FBR3ZCLGlGQUFnRjtBQUF2RSw4SUFBQSw2QkFBNkIsT0FBQTtBQUN0Qyx1RUFBc0U7QUFBN0Qsb0lBQUEsd0JBQXdCLE9BQUE7QUFDakMsaUVBQWdFO0FBQXZELDhIQUFBLHFCQUFxQixPQUFBO0FBQzlCLHVFQUFzRTtBQUE3RCxvSUFBQSx3QkFBd0IsT0FBQTtBQUNqQyxxRUFBb0U7QUFBM0Qsa0lBQUEsdUJBQXVCLE9BQUEifQ==

package/dist/challengeValidator/schemas.d.ts

@@ -0,0 +1,13 @@
+export declare const accessCredentialsSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+    storageType: import("@sinclair/typebox").TLiteral<"STORJ">;
+    credentials: import("@sinclair/typebox").TObject<{
+        token: import("@sinclair/typebox").TString;
+    }>;
+}>, import("@sinclair/typebox").TObject<{
+    storageType: import("@sinclair/typebox").TLiteral<"S3">;
+    credentials: import("@sinclair/typebox").TObject<{
+        accessKeyId: import("@sinclair/typebox").TString;
+        secretKey: import("@sinclair/typebox").TString;
+        endpoint: import("@sinclair/typebox").TString;
+    }>;
+}>]>;

package/dist/challengeValidator/schemas.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accessCredentialsSchema = void 0;
+const typebox_1 = require("@sinclair/typebox");
+exports.accessCredentialsSchema = typebox_1.Type.Union([
+    typebox_1.Type.Object({
+        storageType: typebox_1.Type.Literal('STORJ'),
+        credentials: typebox_1.Type.Object({
+            token: typebox_1.Type.String(),
+        }),
+    }),
+    typebox_1.Type.Object({
+        storageType: typebox_1.Type.Literal('S3'),
+        credentials: typebox_1.Type.Object({
+            accessKeyId: typebox_1.Type.String(),
+            secretKey: typebox_1.Type.String(),
+            endpoint: typebox_1.Type.String(),
+        }),
+    }),
+]);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VWYWxpZGF0b3Ivc2NoZW1hcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwrQ0FBeUM7QUFFNUIsUUFBQSx1QkFBdUIsR0FBRyxjQUFJLENBQUMsS0FBSyxDQUFDO0lBQzlDLGNBQUksQ0FBQyxNQUFNLENBQUM7UUFDUixXQUFXLEVBQUUsY0FBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7UUFDbEMsV0FBVyxFQUFFLGNBQUksQ0FBQyxNQUFNLENBQUM7WUFDckIsS0FBSyxFQUFFLGNBQUksQ0FBQyxNQUFNLEVBQUU7U0FDdkIsQ0FBQztLQUNMLENBQUM7SUFDRixjQUFJLENBQUMsTUFBTSxDQUFDO1FBQ1IsV0FBVyxFQUFFLGNBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO1FBQy9CLFdBQVcsRUFBRSxjQUFJLENBQUMsTUFBTSxDQUFDO1lBQ3JCLFdBQVcsRUFBRSxjQUFJLENBQUMsTUFBTSxFQUFFO1lBQzFCLFNBQVMsRUFBRSxjQUFJLENBQUMsTUFBTSxFQUFFO1lBQ3hCLFFBQVEsRUFBRSxjQUFJLENBQUMsTUFBTSxFQUFFO1NBQzFCLENBQUM7S0FDTCxDQUFDO0NBQ0wsQ0FBQyxDQUFDIn0=

package/dist/challengeValidator/validatorConfig.d.ts

@@ -0,0 +1,28 @@
+export interface SevValidationConfig {
+    sevTmp?: string;
+    cacheFolder?: string;
+    vmRepoOwner?: string;
+    vmRepo?: string;
+    releaseAsset?: string;
+    storageAccess?: Record<string, unknown>;
+    securityPolicy?: Record<string, unknown>;
+}
+export type NvidiaVerifierMode = 'remote' | 'local';
+export interface NvtrustWrapperConfig {
+    tmp?: string;
+    timeout?: number;
+    /**
+     * remote asks NVIDIA NRAS. local verifies evidence on this authority.
+     * Absent means remote.
+     */
+    verifier?: NvidiaVerifierMode;
+    /** Override for a local RIM cache. Empty uses the SDK production URL. */
+    rimUrl?: string;
+    /** Override for a local OCSP cache. Empty uses the SDK production URL. */
+    ocspUrl?: string;
+}
+export interface AzureValidationConfig {
+    /** Microsoft Azure Attestation instance, https://sharedeus.eus.attest.azure.net by default. */
+    maaEndpoint?: string;
+    maaTimeoutMs?: number;
+}

package/dist/challengeValidator/validatorConfig.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdG9yQ29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci92YWxpZGF0b3JDb25maWcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/challengeValidator/wasmVerificationPolicy.d.ts

@@ -0,0 +1,60 @@
+/// <reference types="node" />
+import { TeeEvidenceType } from '@super-protocol/attestation-common';
+import { Log, NetworkType } from '@super-protocol/pki-common';
+import { AzureValidationConfig } from './validatorConfig';
+type TcbSeverity = 'Ok' | 'Warning' | 'Critical';
+export interface AttestationWasmAzure {
+    verifyTeeEvidence(serialized: Uint8Array, options: ReturnType<typeof buildAzureVerifyOptions>): Promise<{
+        evidenceType: TeeEvidenceType;
+    }>;
+    describeTdxTcbStatus(status: string): {
+        severity: TcbSeverity;
+    } | undefined;
+}
+type TcbDescriber = Pick<AttestationWasmAzure, 'describeTdxTcbStatus'>;
+interface PolicyOptions {
+    /**
+     * A debug VM offers no confidentiality, so it is accepted only when the
+     * network is explicitly untrusted. Plain TDX needs no such check: its
+     * TDATTRIBUTES, which hold the DEBUG bit, are part of mrEnclave.
+     */
+    networkType?: NetworkType;
+    log?: Log;
+}
+export declare const isAzureEvidenceType: (evidenceType: TeeEvidenceType) => boolean;
+export declare const buildAzureVerifyOptions: (config?: AzureValidationConfig) => {
+    tdx: {
+        getCollateral: boolean;
+    };
+    azure: {
+        maa: true;
+        maaEndpoint: string | undefined;
+        timeoutMs: number | undefined;
+    };
+};
+/**
+ * Applies the TEE policy to an attestation-wasm verification result: the
+ * hardware report integrity, an acceptable TDX TCB, an unrevoked certificate
+ * chain, no debug SEV-SNP VM unless the network is explicitly untrusted and,
+ * for Azure, a positive Microsoft Azure Attestation verdict.
+ *
+ * @throws If the result violates the policy.
+ */
+export declare const checkTeeVerificationResult: (verification: {
+    evidenceType: TeeEvidenceType;
+}, attestation: TcbDescriber, options: PolicyOptions) => void;
+/**
+ * Applies the Azure CVM policy (see {@link checkTeeVerificationResult}).
+ * Debug is checked explicitly: the Azure mrEnclave covers the vTPM PCRs, not
+ * the TD attributes or the SEV-SNP policy of the paravisor. Returns the Azure
+ * mrEnclave and the 64-byte report data.
+ *
+ * @throws If the result violates the policy.
+ */
+export declare const checkAzureVerificationResult: (verification: {
+    evidenceType: TeeEvidenceType;
+}, attestation: TcbDescriber, options: PolicyOptions) => {
+    mrEnclave: Buffer;
+    reportData: Buffer;
+};
+export {};

package/dist/challengeValidator/wasmVerificationPolicy.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAzureVerificationResult = exports.checkTeeVerificationResult = exports.buildAzureVerifyOptions = exports.isAzureEvidenceType = void 0;
+const attestation_common_1 = require("@super-protocol/attestation-common");
+const REPORT_DATA_BYTES = 64;
+const isAzureEvidenceType = (evidenceType) => evidenceType === attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE ||
+    evidenceType === attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE;
+exports.isAzureEvidenceType = isAzureEvidenceType;
+const buildAzureVerifyOptions = (config) => ({
+    tdx: { getCollateral: true },
+    azure: {
+        maa: true,
+        maaEndpoint: config?.maaEndpoint,
+        timeoutMs: config?.maaTimeoutMs,
+    },
+});
+exports.buildAzureVerifyOptions = buildAzureVerifyOptions;
+const checkTcbStatus = (attestation, component, status, log) => {
+    const severity = attestation.describeTdxTcbStatus(status)?.severity;
+    if (severity === 'Ok') {
+        return;
+    }
+    if (severity === 'Warning') {
+        log?.warn(`${component} TCB status is not up to date: ${status}`);
+        return;
+    }
+    throw new Error(`${component} TCB status is not acceptable: ${status}`);
+};
+const checkTdxResult = (result, attestation, log) => {
+    if (!result.quoteIntegrity) {
+        throw new Error('TD quote integrity check failed');
+    }
+    if (!result.tdxTcbStatus) {
+        throw new Error('TD quote TCB status is missing');
+    }
+    checkTcbStatus(attestation, 'TDX', result.tdxTcbStatus, log);
+    if (result.qeTcbStatus) {
+        checkTcbStatus(attestation, 'QE', result.qeTcbStatus, log);
+    }
+    if (result.certChainRevocationStatusOk === false) {
+        throw new Error('TD quote certificate chain is revoked');
+    }
+};
+const checkSevSnpResult = (result) => {
+    if (!result.attestationReportIntegrity) {
+        throw new Error('SEV-SNP report integrity check failed');
+    }
+    if (result.certChainRevocationStatusOk === false) {
+        throw new Error('SEV-SNP certificate chain is revoked');
+    }
+};
+const checkDebug = (debug, options) => {
+    if (debug && options.networkType !== 'untrusted') {
+        throw new Error(`Debug VM is not allowed for networkType=${options.networkType ?? 'undefined'}`);
+    }
+};
+/**
+ * Applies the TEE policy to an attestation-wasm verification result: the
+ * hardware report integrity, an acceptable TDX TCB, an unrevoked certificate
+ * chain, no debug SEV-SNP VM unless the network is explicitly untrusted and,
+ * for Azure, a positive Microsoft Azure Attestation verdict.
+ *
+ * @throws If the result violates the policy.
+ */
+const checkTeeVerificationResult = (verification, attestation, options) => {
+    const tee = verification;
+    switch (tee.evidenceType) {
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_QEMU:
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_GCP:
+            checkTdxResult(tee.result, attestation, options.log);
+            return;
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_QEMU:
+            checkSevSnpResult(tee.result);
+            checkDebug(tee.result.securityFields.debugAllowed, options);
+            return;
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE:
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE:
+            (0, exports.checkAzureVerificationResult)(tee, attestation, options);
+            return;
+        default:
+            throw new Error(`Unsupported TEE evidence type ${verification.evidenceType}`);
+    }
+};
+exports.checkTeeVerificationResult = checkTeeVerificationResult;
+/**
+ * Applies the Azure CVM policy (see {@link checkTeeVerificationResult}).
+ * Debug is checked explicitly: the Azure mrEnclave covers the vTPM PCRs, not
+ * the TD attributes or the SEV-SNP policy of the paravisor. Returns the Azure
+ * mrEnclave and the 64-byte report data.
+ *
+ * @throws If the result violates the policy.
+ */
+const checkAzureVerificationResult = (verification, attestation, options) => {
+    const azureVerification = verification;
+    let debug;
+    if (azureVerification.evidenceType ===
+        attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE) {
+        const { result } = azureVerification;
+        checkTdxResult(result, attestation, options.log);
+        debug = result.azure.tdDebug;
+    }
+    else if (azureVerification.evidenceType ===
+        attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE) {
+        const { result } = azureVerification;
+        checkSevSnpResult(result);
+        debug = result.azure.debugAllowed || result.securityFields.debugAllowed;
+    }
+    else {
+        throw new Error(`Evidence type ${verification.evidenceType} is not an Azure confidential VM evidence`);
+    }
+    const { azure } = azureVerification.result;
+    if (!azure.maa?.azureCompliant) {
+        throw new Error('Microsoft Azure Attestation did not confirm a genuine Azure confidential VM');
+    }
+    checkDebug(debug, options);
+    const reportData = Buffer.from(azureVerification.reportData);
+    if (reportData.length !== REPORT_DATA_BYTES) {
+        throw new Error(`Unexpected report data length: ${reportData.length}`);
+    }
+    return { mrEnclave: Buffer.from(azure.mrEnclave), reportData };
+};
+exports.checkAzureVerificationResult = checkAzureVerificationResult;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid2FzbVZlcmlmaWNhdGlvblBvbGljeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VWYWxpZGF0b3Ivd2FzbVZlcmlmaWNhdGlvblBvbGljeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyRUFBcUU7QUFZckUsTUFBTSxpQkFBaUIsR0FBRyxFQUFFLENBQUM7QUFrRXRCLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxZQUE2QixFQUFXLEVBQUUsQ0FDMUUsWUFBWSxLQUFLLG9DQUFlLENBQUMsaUNBQWlDO0lBQ2xFLFlBQVksS0FBSyxvQ0FBZSxDQUFDLG1DQUFtQyxDQUFDO0FBRjVELFFBQUEsbUJBQW1CLHVCQUV5QztBQUVsRSxNQUFNLHVCQUF1QixHQUFHLENBQUMsTUFBOEIsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUN4RSxHQUFHLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFO0lBQzVCLEtBQUssRUFBRTtRQUNILEdBQUcsRUFBRSxJQUFhO1FBQ2xCLFdBQVcsRUFBRSxNQUFNLEVBQUUsV0FBVztRQUNoQyxTQUFTLEVBQUUsTUFBTSxFQUFFLFlBQVk7S0FDbEM7Q0FDSixDQUFDLENBQUM7QUFQVSxRQUFBLHVCQUF1QiwyQkFPakM7QUFFSCxNQUFNLGNBQWMsR0FBRyxDQUNuQixXQUF5QixFQUN6QixTQUFpQixFQUNqQixNQUFjLEVBQ2QsR0FBUyxFQUNMLEVBQUU7SUFDTixNQUFNLFFBQVEsR0FBRyxXQUFXLENBQUMsb0JBQW9CLENBQUMsTUFBTSxDQUFDLEVBQUUsUUFBUSxDQUFDO0lBQ3BFLElBQUksUUFBUSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3BCLE9BQU87SUFDWCxDQUFDO0lBQ0QsSUFBSSxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDekIsR0FBRyxFQUFFLElBQUksQ0FBQyxHQUFHLFNBQVMsa0NBQWtDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDbEUsT0FBTztJQUNYLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsU0FBUyxrQ0FBa0MsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUM1RSxDQUFDLENBQUM7QUFFRixNQUFNLGNBQWMsR0FBRyxDQUNuQixNQUFpQixFQUNqQixXQUF5QixFQUN6QixHQUFTLEVBQ0wsRUFBRTtJQUNOLElBQUksQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDekIsTUFBTSxJQUFJLEtBQUssQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsY0FBYyxDQUFDLFdBQVcsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLFlBQVksRUFBRSxHQUFHLENBQUMsQ0FBQztJQUM3RCxJQUFJLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNyQixjQUFjLENBQUMsV0FBVyxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQywyQkFBMkIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUMvQyxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDN0QsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxNQUFvQixFQUFRLEVBQUU7SUFDckQsSUFBSSxDQUFDLE1BQU0sQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1FBQ3JDLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsMkJBQTJCLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDL0MsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQzVELENBQUM7QUFDTCxDQUFDLENBQUM7QUFFRixNQUFNLFVBQVUsR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFzQixFQUFRLEVBQUU7SUFDaEUsSUFBSSxLQUFLLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUMvQyxNQUFNLElBQUksS0FBSyxDQUNYLDJDQUEyQyxPQUFPLENBQUMsV0FBVyxJQUFJLFdBQVcsRUFBRSxDQUNsRixDQUFDO0lBQ04sQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSSxNQUFNLDBCQUEwQixHQUFHLENBQ3RDLFlBQStDLEVBQy9DLFdBQXlCLEVBQ3pCLE9BQXNCLEVBQ2xCLEVBQUU7SUFDTixNQUFNLEdBQUcsR0FBRyxZQUFxQyxDQUFDO0lBQ2xELFFBQVEsR0FBRyxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3ZCLEtBQUssb0NBQWUsQ0FBQyxnQ0FBZ0MsQ0FBQztRQUN0RCxLQUFLLG9DQUFlLENBQUMsK0JBQStCO1lBQ2hELGNBQWMsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDckQsT0FBTztRQUNYLEtBQUssb0NBQWUsQ0FBQyxrQ0FBa0M7WUFDbkQsaUJBQWlCLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzlCLFVBQVUsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUM7WUFDNUQsT0FBTztRQUNYLEtBQUssb0NBQWUsQ0FBQyxpQ0FBaUMsQ0FBQztRQUN2RCxLQUFLLG9DQUFlLENBQUMsbUNBQW1DO1lBQ3BELElBQUEsb0NBQTRCLEVBQUMsR0FBRyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsQ0FBQztZQUN4RCxPQUFPO1FBQ1g7WUFDSSxNQUFNLElBQUksS0FBSyxDQUNYLGlDQUFpQyxZQUFZLENBQUMsWUFBWSxFQUFFLENBQy9ELENBQUM7SUFDVixDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBeEJXLFFBQUEsMEJBQTBCLDhCQXdCckM7QUFFRjs7Ozs7OztHQU9HO0FBQ0ksTUFBTSw0QkFBNEIsR0FBRyxDQUN4QyxZQUErQyxFQUMvQyxXQUF5QixFQUN6QixPQUFzQixFQUNtQixFQUFFO0lBQzNDLE1BQU0saUJBQWlCLEdBQUcsWUFBcUMsQ0FBQztJQUNoRSxJQUFJLEtBQWMsQ0FBQztJQUNuQixJQUNJLGlCQUFpQixDQUFDLFlBQVk7UUFDOUIsb0NBQWUsQ0FBQyxpQ0FBaUMsRUFDbkQsQ0FBQztRQUNDLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxpQkFBaUIsQ0FBQztRQUNyQyxjQUFjLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDakQsS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDO0lBQ2pDLENBQUM7U0FBTSxJQUNILGlCQUFpQixDQUFDLFlBQVk7UUFDOUIsb0NBQWUsQ0FBQyxtQ0FBbUMsRUFDckQsQ0FBQztRQUNDLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxpQkFBaUIsQ0FBQztRQUNyQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMxQixLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxZQUFZLENBQUM7SUFDNUUsQ0FBQztTQUFNLENBQUM7UUFDSixNQUFNLElBQUksS0FBSyxDQUNYLGlCQUFpQixZQUFZLENBQUMsWUFBWSwyQ0FBMkMsQ0FDeEYsQ0FBQztJQUNOLENBQUM7SUFFRCxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsaUJBQWlCLENBQUMsTUFBTSxDQUFDO0lBQzNDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLGNBQWMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBSSxLQUFLLENBQ1gsNkVBQTZFLENBQ2hGLENBQUM7SUFDTixDQUFDO0lBRUQsVUFBVSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztJQUUzQixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzdELElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxpQkFBaUIsRUFBRSxDQUFDO1FBQzFDLE1BQU0sSUFBSSxLQUFLLENBQUMsa0NBQWtDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBQ25FLENBQUMsQ0FBQztBQTFDVyxRQUFBLDRCQUE0QixnQ0EwQ3ZDIn0=

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from './certificateGenerator';
+export * from './challengeProvider';
+export * from './challengeValidator';
+export * from './swarmCertValidation';
+export * from './attestationType';
+export * from './azure';
+export * from './mrEnclaveSignature';

package/dist/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./certificateGenerator"), exports);
+__exportStar(require("./challengeProvider"), exports);
+__exportStar(require("./challengeValidator"), exports);
+__exportStar(require("./swarmCertValidation"), exports);
+__exportStar(require("./attestationType"), exports);
+__exportStar(require("./azure"), exports);
+__exportStar(require("./mrEnclaveSignature"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHlEQUF1QztBQUN2QyxzREFBb0M7QUFDcEMsdURBQXFDO0FBQ3JDLHdEQUFzQztBQUN0QyxvREFBa0M7QUFDbEMsMENBQXdCO0FBQ3hCLHVEQUFxQyJ9

package/dist/mrEnclaveSignature.d.ts

@@ -0,0 +1,9 @@
+/// <reference types="node" />
+import { ChallengeType } from '@super-protocol/pki-common';
+/**
+ * Verifies that the mrEnclave of a TEE challenge is signed by Super Protocol
+ * and present in the trusted registry.
+ *
+ * @throws If the challenge type has no registry or the signature is missing or invalid.
+ */
+export declare const verifyChallengeMrEnclaveSignature: (mrEnclave: Buffer, challengeType: ChallengeType) => Promise<void>;