@super-protocol/pki-attestation-engine 3.0.0

package/dist/certificateGenerator.d.ts

@@ -0,0 +1,34 @@
+import { CustomExtension } from '@super-protocol/sdk-js';
+import { PkiCertParams, CertificateType, CertificateChallengeInfo, Challenge, NetworkType, PKISslCertificate } from '@super-protocol/pki-common';
+export declare const generateRootCertificate: (params: {
+    domains: string[];
+    privateKeyPem: string;
+    publicKeyPem: string;
+    challenge: Challenge;
+    certParams: PkiCertParams;
+    networkType?: NetworkType;
+}) => Promise<string>;
+type GenerateCertificateParams = {
+    certType: CertificateType;
+    domains: string[];
+    caBundle: string;
+    signingCertPem: string;
+    signingPrivateKeyPem: string;
+    certParams: PkiCertParams;
+    publicKeyPem: string;
+    ocspSigning: boolean;
+    validated?: boolean;
+    commonName?: string;
+    challengeInfo?: CertificateChallengeInfo;
+    clientExtensionAttrs?: CustomExtension[];
+    vmCertificatePem?: string;
+};
+export declare const generateSubrootCertificate: (params: GenerateCertificateParams) => Promise<PKISslCertificate>;
+export declare const generateEntityCertificate: (params: GenerateCertificateParams) => Promise<PKISslCertificate>;
+export declare const getParamsFromCSR: (csrPem: string) => Promise<{
+    commonName: string | undefined;
+    publicKeyPem: string;
+    clientDomains: string[];
+    clientExtensionAttrs: CustomExtension[];
+}>;
+export {};

package/dist/certificateGenerator.js

@@ -0,0 +1,271 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getParamsFromCSR = exports.generateEntityCertificate = exports.generateSubrootCertificate = exports.generateRootCertificate = void 0;
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const sp_nvtrust_wrapper_1 = require("@super-protocol/sp-nvtrust-wrapper");
+const pki_common_1 = require("@super-protocol/pki-common");
+const MIN_CERT_LIFETIME_DAYS = 1;
+const MAX_CERT_LIFETIME_DAYS = 18250;
+const addDaysUtc = (base, days) => {
+    const next = new Date(base);
+    next.setUTCDate(next.getUTCDate() + days);
+    return next;
+};
+const resolveNotAfter = (certParams) => {
+    const { lifetimeDays } = certParams;
+    if (!Number.isInteger(lifetimeDays) ||
+        lifetimeDays < MIN_CERT_LIFETIME_DAYS ||
+        lifetimeDays > MAX_CERT_LIFETIME_DAYS) {
+        throw new Error(`certParams.lifetimeDays must be an integer between ${MIN_CERT_LIFETIME_DAYS} and ${MAX_CERT_LIFETIME_DAYS}`);
+    }
+    return addDaysUtc(new Date(), lifetimeDays);
+};
+const buildPrincipal = (certParams) => ({
+    commonName: certParams.commonName,
+    country: certParams.countryName,
+    stateName: certParams.stateName,
+    localityName: certParams.localityName,
+    organization: certParams.organizationName,
+    organizationalUnit: certParams.organizationUnitName,
+});
+const getQuoteBase64FromChallenge = (challenge) => {
+    let quoteBase64;
+    switch (challenge.type) {
+        case pki_common_1.ChallengeType.SGXDCAP:
+        case pki_common_1.ChallengeType.TDX:
+            quoteBase64 = challenge.quoteBase64;
+            break;
+        case pki_common_1.ChallengeType.SEVSNP:
+            quoteBase64 = challenge.serializedReportBase64;
+            break;
+    }
+    if (!quoteBase64) {
+        return;
+    }
+    return { challengeType: challenge.type, quoteBase64 };
+};
+const generateRootCertificate = async (params) => {
+    const principal = buildPrincipal(params.certParams);
+    const notAfter = resolveNotAfter(params.certParams);
+    const customExtensions = [
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE,
+            value: Buffer.from(params.challenge.type, 'ascii'),
+        },
+    ];
+    if (params.networkType) {
+        customExtensions.push({
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_NETWORK_TYPE,
+            value: Buffer.from(params.networkType, 'ascii'),
+        });
+    }
+    const challenge = getQuoteBase64FromChallenge(params.challenge);
+    if (challenge) {
+        customExtensions.push({
+            oid: pki_common_1.OID_SGX_QUOTE,
+            value: Buffer.from(challenge.quoteBase64, 'base64'),
+        });
+    }
+    const generateCertParams = {
+        privateKey: params.privateKeyPem,
+        publicKey: params.publicKeyPem,
+        subject: principal,
+        issuer: principal,
+        notAfter,
+        dnsNames: params.domains,
+        ca: true,
+        customExtensions,
+    };
+    return sdk_js_1.CertificateGenerator.generateCert(generateCertParams);
+};
+exports.generateRootCertificate = generateRootCertificate;
+const SYSTEM_MANAGED_EXTENSION_OIDS = [
+    pki_common_1.OID_SGX_QUOTE,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_ID,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID,
+    pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_SUBTYPE,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_CERTIFICATE_ID,
+];
+const filterClientExtensions = (extensions = []) => extensions.filter((ext) => !SYSTEM_MANAGED_EXTENSION_OIDS.some((oid) => ext.oid.startsWith(oid)));
+const buildNvidiaGpuExtension = (challenge) => {
+    if (!(0, pki_common_1.hasChallengeNvidiaToken)(challenge)) {
+        return [];
+    }
+    const gpusInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractGPUInfoFromToken({
+        jwt: challenge.nvidiaTokens.gpuToken,
+    });
+    return [
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+            value: Buffer.from(sp_nvtrust_wrapper_1.NvtrustGPUList.encode(gpusInfo).finish()),
+        },
+    ];
+};
+const buildCertificateChallengeExtensions = (challenge) => {
+    if (challenge.type !== pki_common_1.ChallengeType.Certificate) {
+        return [];
+    }
+    const challengeSubtype = sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE);
+    const certificateId = sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, sdk_js_1.constants.OID_CUSTOM_EXTENSION_USER_DATA);
+    if (!challengeSubtype || !certificateId) {
+        throw new Error(`Challenge certificate is missing required extensions: ${pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE} or ${sdk_js_1.constants.OID_CUSTOM_EXTENSION_USER_DATA}`);
+    }
+    return [
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_SUBTYPE,
+            value: challengeSubtype,
+        },
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_CERTIFICATE_ID,
+            value: certificateId,
+        },
+    ];
+};
+const buildValidatedExtension = (validated) => {
+    if (!validated) {
+        return [];
+    }
+    return [
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_VALIDATED,
+            value: Buffer.alloc(0),
+        },
+    ];
+};
+// TODO: Investigate behavior
+// const buildVmGpuExtension = (
+//     vmCertificatePem: string | undefined,
+//     existingExtensions: CustomExtension[],
+// ): CustomExtension[] => {
+//     if (!vmCertificatePem) {
+//         return [];
+//     }
+//
+//     const gpuInfo = CertificatesHelper.getExtensionValue(
+//         vmCertificatePem,
+//         OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+//     );
+//
+//     if (
+//         gpuInfo &&
+//         !existingExtensions.some(
+//             (ext) => ext.oid === OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+//         )
+//     ) {
+//         return [
+//             {
+//                 oid: OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+//                 value: gpuInfo,
+//             },
+//         ];
+//     }
+//
+//     return [];
+// };
+const buildCommonExtensions = (params) => {
+    const extensions = [];
+    if (params.challengeInfo) {
+        const { challenge, idHex, commonIdHex } = params.challengeInfo;
+        extensions.push({
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE,
+            value: Buffer.from(challenge.type, 'ascii'),
+        });
+        if (challenge.type !== pki_common_1.ChallengeType.Token) {
+            extensions.push({
+                oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_ID,
+                value: Buffer.from(idHex, 'hex'),
+            });
+            if (commonIdHex) {
+                extensions.push({
+                    oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID,
+                    value: Buffer.from(commonIdHex, 'hex'),
+                });
+            }
+            if (params.certType === pki_common_1.CertificateType.Basic) {
+                const quote = getQuoteBase64FromChallenge(challenge);
+                if (quote) {
+                    extensions.push({
+                        oid: pki_common_1.OID_SGX_QUOTE,
+                        value: Buffer.from(quote.quoteBase64, 'base64'),
+                    });
+                }
+            }
+            extensions.push(...buildNvidiaGpuExtension(challenge));
+            extensions.push(...buildCertificateChallengeExtensions(challenge));
+        }
+    }
+    const filteredClientExtensions = filterClientExtensions(params.clientExtensionAttrs);
+    return [...filteredClientExtensions, ...extensions];
+};
+const generateCertificate = async (params) => {
+    const signingCert = await sdk_js_1.CertificateGenerator.checkAndParseCert(params.signingCertPem);
+    const customExtensions = buildCommonExtensions({
+        certType: params.certType,
+        challengeInfo: params.challengeInfo,
+        clientExtensionAttrs: params.clientExtensionAttrs,
+    });
+    customExtensions.push(...buildValidatedExtension(params.validated));
+    // TODO: Investigate behavior
+    // customExtensions.push(
+    //     ...buildVmGpuExtension(params.vmCertificatePem, customExtensions),
+    // );
+    const subject = {
+        commonName: params.commonName || params.domains[0] || '',
+        country: params.certParams.countryName,
+        stateName: params.certParams.stateName,
+        localityName: params.certParams.localityName,
+        organization: params.certParams.organizationName,
+        organizationalUnit: params.certParams.organizationUnitName,
+    };
+    const domains = params.certType === pki_common_1.CertificateType.Basic ? params.domains : [];
+    const notAfter = resolveNotAfter(params.certParams);
+    const generateCertParams = {
+        privateKey: params.signingPrivateKeyPem,
+        publicKey: params.publicKeyPem,
+        subject,
+        dnsNames: domains,
+        ca: params.ca,
+        ocspSigning: params.ocspSigning,
+        issuer: signingCert.subject,
+        notAfter,
+        customExtensions,
+    };
+    if (params.certParams.ocspUrl) {
+        generateCertParams.ocspExtension = {
+            ocspUrl: params.certParams.ocspUrl,
+        };
+    }
+    const certPem = await sdk_js_1.CertificateGenerator.generateCert(generateCertParams);
+    const rootCertsPem = params.caBundle === params.signingCertPem
+        ? params.signingCertPem
+        : params.signingCertPem + '\n' + params.caBundle;
+    return {
+        certPem,
+        domains,
+        rootCertsPem,
+    };
+};
+const generateSubrootCertificate = async (params) => generateCertificate({
+    ...params,
+    ca: true,
+});
+exports.generateSubrootCertificate = generateSubrootCertificate;
+const generateEntityCertificate = async (params) => generateCertificate({
+    ...params,
+    ca: false,
+});
+exports.generateEntityCertificate = generateEntityCertificate;
+const getParamsFromCSR = async (csrPem) => {
+    const parsedCsr = await sdk_js_1.CertificateGenerator.checkAndParseCsr(csrPem);
+    const commonName = parsedCsr.subject.match(/CN=([^,]+)/)?.[1]?.trim();
+    return {
+        commonName,
+        publicKeyPem: await sdk_js_1.CryptoKeysTransformer.cryptoKeyToSpkiPem(parsedCsr.publicKey),
+        clientDomains: parsedCsr.dnsNames || [],
+        clientExtensionAttrs: parsedCsr.extensions || [],
+    };
+};
+exports.getParamsFromCSR = getParamsFromCSR;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VydGlmaWNhdGVHZW5lcmF0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2VydGlmaWNhdGVHZW5lcmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbURBUWdDO0FBQ2hDLDJFQUc0QztBQUM1QywyREFrQm9DO0FBRXBDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxDQUFDO0FBQ2pDLE1BQU0sc0JBQXNCLEdBQUcsS0FBSyxDQUFDO0FBRXJDLE1BQU0sVUFBVSxHQUFHLENBQUMsSUFBVSxFQUFFLElBQVksRUFBUSxFQUFFO0lBQ2xELE1BQU0sSUFBSSxHQUFHLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzVCLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFDO0lBQzFDLE9BQU8sSUFBSSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sZUFBZSxHQUFHLENBQUMsVUFBeUIsRUFBUSxFQUFFO0lBQ3hELE1BQU0sRUFBRSxZQUFZLEVBQUUsR0FBRyxVQUFVLENBQUM7SUFFcEMsSUFDSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDO1FBQy9CLFlBQVksR0FBRyxzQkFBc0I7UUFDckMsWUFBWSxHQUFHLHNCQUFzQixFQUN2QyxDQUFDO1FBQ0MsTUFBTSxJQUFJLEtBQUssQ0FDWCxzREFBc0Qsc0JBQXNCLFFBQVEsc0JBQXNCLEVBQUUsQ0FDL0csQ0FBQztJQUNOLENBQUM7SUFFRCxPQUFPLFVBQVUsQ0FBQyxJQUFJLElBQUksRUFBRSxFQUFFLFlBQVksQ0FBQyxDQUFDO0FBQ2hELENBQUMsQ0FBQztBQUVGLE1BQU0sY0FBYyxHQUFHLENBQUMsVUFBeUIsRUFBd0IsRUFBRSxDQUFDLENBQUM7SUFDekUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO0lBQ2pDLE9BQU8sRUFBRSxVQUFVLENBQUMsV0FBVztJQUMvQixTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsWUFBWSxFQUFFLFVBQVUsQ0FBQyxZQUFZO0lBQ3JDLFlBQVksRUFBRSxVQUFVLENBQUMsZ0JBQWdCO0lBQ3pDLGtCQUFrQixFQUFFLFVBQVUsQ0FBQyxvQkFBb0I7Q0FDdEQsQ0FBQyxDQUFDO0FBRUgsTUFBTSwyQkFBMkIsR0FBRyxDQUNoQyxTQUFvQixFQUM2QyxFQUFFO0lBQ25FLElBQUksV0FBVyxDQUFDO0lBRWhCLFFBQVEsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3JCLEtBQUssMEJBQWEsQ0FBQyxPQUFPLENBQUM7UUFDM0IsS0FBSywwQkFBYSxDQUFDLEdBQUc7WUFDbEIsV0FBVyxHQUFHLFNBQVMsQ0FBQyxXQUFXLENBQUM7WUFDcEMsTUFBTTtRQUNWLEtBQUssMEJBQWEsQ0FBQyxNQUFNO1lBQ3JCLFdBQVcsR0FBRyxTQUFTLENBQUMsc0JBQXNCLENBQUM7WUFDL0MsTUFBTTtJQUNkLENBQUM7SUFFRCxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDZixPQUFPO0lBQ1gsQ0FBQztJQUVELE9BQU8sRUFBRSxhQUFhLEVBQUUsU0FBUyxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUMxRCxDQUFDLENBQUM7QUFFSyxNQUFNLHVCQUF1QixHQUFHLEtBQUssRUFBRSxNQU83QyxFQUFtQixFQUFFO0lBQ2xCLE1BQU0sU0FBUyxHQUFHLGNBQWMsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEQsTUFBTSxRQUFRLEdBQUcsZUFBZSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUVwRCxNQUFNLGdCQUFnQixHQUFzQjtRQUN4QztZQUNJLEdBQUcsRUFBRSxnREFBbUM7WUFDeEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDO1NBQ3JEO0tBQ0osQ0FBQztJQUVGLElBQUksTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ3JCLGdCQUFnQixDQUFDLElBQUksQ0FBQztZQUNsQixHQUFHLEVBQUUsOENBQWlDO1lBQ3RDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsT0FBTyxDQUFDO1NBQ2xELENBQUMsQ0FBQztJQUNQLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRywyQkFBMkIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEUsSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUNaLGdCQUFnQixDQUFDLElBQUksQ0FBQztZQUNsQixHQUFHLEVBQUUsMEJBQWE7WUFDbEIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUM7U0FDdEQsQ0FBQyxDQUFDO0lBQ1AsQ0FBQztJQUVELE1BQU0sa0JBQWtCLEdBQXVCO1FBQzNDLFVBQVUsRUFBRSxNQUFNLENBQUMsYUFBYTtRQUNoQyxTQUFTLEVBQUUsTUFBTSxDQUFDLFlBQVk7UUFDOUIsT0FBTyxFQUFFLFNBQVM7UUFDbEIsTUFBTSxFQUFFLFNBQVM7UUFDakIsUUFBUTtRQUNSLFFBQVEsRUFBRSxNQUFNLENBQUMsT0FBTztRQUN4QixFQUFFLEVBQUUsSUFBSTtRQUNSLGdCQUFnQjtLQUNuQixDQUFDO0lBRUYsT0FBTyw2QkFBb0IsQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUNqRSxDQUFDLENBQUM7QUE3Q1csUUFBQSx1QkFBdUIsMkJBNkNsQztBQUVGLE1BQU0sNkJBQTZCLEdBQUc7SUFDbEMsMEJBQWE7SUFDYixnREFBbUM7SUFDbkMsOENBQWlDO0lBQ2pDLHFEQUF3QztJQUN4QyxpREFBb0M7SUFDcEMsbURBQXNDO0lBQ3RDLDBEQUE2QztDQUNoRCxDQUFDO0FBRUYsTUFBTSxzQkFBc0IsR0FBRyxDQUMzQixhQUFnQyxFQUFFLEVBQ2pCLEVBQUUsQ0FDbkIsVUFBVSxDQUFDLE1BQU0sQ0FDYixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ0osQ0FBQyw2QkFBNkIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUN4QyxHQUFHLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FDMUIsQ0FDUixDQUFDO0FBRU4sTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFNBQW9CLEVBQXFCLEVBQUU7SUFDeEUsSUFBSSxDQUFDLElBQUEsb0NBQXVCLEVBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUN0QyxPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxtQ0FBYyxDQUFDLHVCQUF1QixDQUFDO1FBQ3BELEdBQUcsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLFFBQVE7S0FDdkMsQ0FBQyxDQUFDO0lBRUgsT0FBTztRQUNIO1lBQ0ksR0FBRyxFQUFFLGlEQUFvQztZQUN6QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxtQ0FBYyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztTQUMvRDtLQUNKLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRixNQUFNLG1DQUFtQyxHQUFHLENBQ3hDLFNBQW9CLEVBQ0gsRUFBRTtJQUNuQixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssMEJBQWEsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUMvQyxPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFFRCxNQUFNLGdCQUFnQixHQUFHLDJCQUFrQixDQUFDLGlCQUFpQixDQUN6RCxTQUFTLENBQUMsZ0JBQWdCLEVBQzFCLGdEQUFtQyxDQUN0QyxDQUFDO0lBQ0YsTUFBTSxhQUFhLEdBQUcsMkJBQWtCLENBQUMsaUJBQWlCLENBQ3RELFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsa0JBQVMsQ0FBQyw4QkFBOEIsQ0FDM0MsQ0FBQztJQUVGLElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sSUFBSSxLQUFLLENBQ1gseURBQXlELGdEQUFtQyxPQUFPLGtCQUFTLENBQUMsOEJBQThCLEVBQUUsQ0FDaEosQ0FBQztJQUNOLENBQUM7SUFFRCxPQUFPO1FBQ0g7WUFDSSxHQUFHLEVBQUUsbURBQXNDO1lBQzNDLEtBQUssRUFBRSxnQkFBZ0I7U0FDMUI7UUFDRDtZQUNJLEdBQUcsRUFBRSwwREFBNkM7WUFDbEQsS0FBSyxFQUFFLGFBQWE7U0FDdkI7S0FDSixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUYsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFNBQW1CLEVBQXFCLEVBQUU7SUFDdkUsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2IsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0lBRUQsT0FBTztRQUNIO1lBQ0ksR0FBRyxFQUFFLHFEQUF3QztZQUM3QyxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7U0FDekI7S0FDSixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUYsNkJBQTZCO0FBQzdCLGdDQUFnQztBQUNoQyw0Q0FBNEM7QUFDNUMsNkNBQTZDO0FBQzdDLDRCQUE0QjtBQUM1QiwrQkFBK0I7QUFDL0IscUJBQXFCO0FBQ3JCLFFBQVE7QUFDUixFQUFFO0FBQ0YsNERBQTREO0FBQzVELDRCQUE0QjtBQUM1QixnREFBZ0Q7QUFDaEQsU0FBUztBQUNULEVBQUU7QUFDRixXQUFXO0FBQ1gscUJBQXFCO0FBQ3JCLG9DQUFvQztBQUNwQyx5RUFBeUU7QUFDekUsWUFBWTtBQUNaLFVBQVU7QUFDVixtQkFBbUI7QUFDbkIsZ0JBQWdCO0FBQ2hCLDZEQUE2RDtBQUM3RCxrQ0FBa0M7QUFDbEMsaUJBQWlCO0FBQ2pCLGFBQWE7QUFDYixRQUFRO0FBQ1IsRUFBRTtBQUNGLGlCQUFpQjtBQUNqQixLQUFLO0FBRUwsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLE1BSTlCLEVBQXFCLEVBQUU7SUFDcEIsTUFBTSxVQUFVLEdBQXNCLEVBQUUsQ0FBQztJQUV6QyxJQUFJLE1BQU0sQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUN2QixNQUFNLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxXQUFXLEVBQUUsR0FBRyxNQUFNLENBQUMsYUFBYSxDQUFDO1FBRS9ELFVBQVUsQ0FBQyxJQUFJLENBQUM7WUFDWixHQUFHLEVBQUUsZ0RBQW1DO1lBQ3hDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDO1NBQzlDLENBQUMsQ0FBQztRQUVILElBQUksU0FBUyxDQUFDLElBQUksS0FBSywwQkFBYSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3pDLFVBQVUsQ0FBQyxJQUFJLENBQUM7Z0JBQ1osR0FBRyxFQUFFLDhDQUFpQztnQkFDdEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQzthQUNuQyxDQUFDLENBQUM7WUFFSCxJQUFJLFdBQVcsRUFBRSxDQUFDO2dCQUNkLFVBQVUsQ0FBQyxJQUFJLENBQUM7b0JBQ1osR0FBRyxFQUFFLHFEQUF3QztvQkFDN0MsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLEtBQUssQ0FBQztpQkFDekMsQ0FBQyxDQUFDO1lBQ1AsQ0FBQztZQUVELElBQUksTUFBTSxDQUFDLFFBQVEsS0FBSyw0QkFBZSxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUM1QyxNQUFNLEtBQUssR0FBRywyQkFBMkIsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDckQsSUFBSSxLQUFLLEVBQUUsQ0FBQztvQkFDUixVQUFVLENBQUMsSUFBSSxDQUFDO3dCQUNaLEdBQUcsRUFBRSwwQkFBYTt3QkFDbEIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUM7cUJBQ2xELENBQUMsQ0FBQztnQkFDUCxDQUFDO1lBQ0wsQ0FBQztZQUVELFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyx1QkFBdUIsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ3ZELFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxtQ0FBbUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7SUFDTCxDQUFDO0lBRUQsTUFBTSx3QkFBd0IsR0FBRyxzQkFBc0IsQ0FDbkQsTUFBTSxDQUFDLG9CQUFvQixDQUM5QixDQUFDO0lBRUYsT0FBTyxDQUFDLEdBQUcsd0JBQXdCLEVBQUUsR0FBRyxVQUFVLENBQUMsQ0FBQztBQUN4RCxDQUFDLENBQUM7QUFrQkYsTUFBTSxtQkFBbUIsR0FBRyxLQUFLLEVBQzdCLE1BQW1ELEVBQ3pCLEVBQUU7SUFDNUIsTUFBTSxXQUFXLEdBQUcsTUFBTSw2QkFBb0IsQ0FBQyxpQkFBaUIsQ0FDNUQsTUFBTSxDQUFDLGNBQWMsQ0FDeEIsQ0FBQztJQUVGLE1BQU0sZ0JBQWdCLEdBQUcscUJBQXFCLENBQUM7UUFDM0MsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO1FBQ3pCLGFBQWEsRUFBRSxNQUFNLENBQUMsYUFBYTtRQUNuQyxvQkFBb0IsRUFBRSxNQUFNLENBQUMsb0JBQW9CO0tBQ3BELENBQUMsQ0FBQztJQUVILGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLHVCQUF1QixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLDZCQUE2QjtJQUM3Qix5QkFBeUI7SUFDekIseUVBQXlFO0lBQ3pFLEtBQUs7SUFFTCxNQUFNLE9BQU8sR0FBeUI7UUFDbEMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFO1FBQ3hELE9BQU8sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFdBQVc7UUFDdEMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsU0FBUztRQUN0QyxZQUFZLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxZQUFZO1FBQzVDLFlBQVksRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLGdCQUFnQjtRQUNoRCxrQkFBa0IsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLG9CQUFvQjtLQUM3RCxDQUFDO0lBRUYsTUFBTSxPQUFPLEdBQ1QsTUFBTSxDQUFDLFFBQVEsS0FBSyw0QkFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3BFLE1BQU0sUUFBUSxHQUFHLGVBQWUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFFcEQsTUFBTSxrQkFBa0IsR0FBdUI7UUFDM0MsVUFBVSxFQUFFLE1BQU0sQ0FBQyxvQkFBb0I7UUFDdkMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxZQUFZO1FBQzlCLE9BQU87UUFDUCxRQUFRLEVBQUUsT0FBTztRQUNqQixFQUFFLEVBQUUsTUFBTSxDQUFDLEVBQUU7UUFDYixXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7UUFDL0IsTUFBTSxFQUFFLFdBQVcsQ0FBQyxPQUFPO1FBQzNCLFFBQVE7UUFDUixnQkFBZ0I7S0FDbkIsQ0FBQztJQUVGLElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUM1QixrQkFBa0IsQ0FBQyxhQUFhLEdBQUc7WUFDL0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsT0FBTztTQUNyQyxDQUFDO0lBQ04sQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLE1BQU0sNkJBQW9CLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFFNUUsTUFBTSxZQUFZLEdBQ2QsTUFBTSxDQUFDLFFBQVEsS0FBSyxNQUFNLENBQUMsY0FBYztRQUNyQyxDQUFDLENBQUMsTUFBTSxDQUFDLGNBQWM7UUFDdkIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEdBQUcsSUFBSSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUM7SUFFekQsT0FBTztRQUNILE9BQU87UUFDUCxPQUFPO1FBQ1AsWUFBWTtLQUNmLENBQUM7QUFDTixDQUFDLENBQUM7QUFFSyxNQUFNLDBCQUEwQixHQUFHLEtBQUssRUFDM0MsTUFBaUMsRUFDUCxFQUFFLENBQzVCLG1CQUFtQixDQUFDO0lBQ2hCLEdBQUcsTUFBTTtJQUNULEVBQUUsRUFBRSxJQUFJO0NBQ1gsQ0FBQyxDQUFDO0FBTk0sUUFBQSwwQkFBMEIsOEJBTWhDO0FBRUEsTUFBTSx5QkFBeUIsR0FBRyxLQUFLLEVBQzFDLE1BQWlDLEVBQ1AsRUFBRSxDQUM1QixtQkFBbUIsQ0FBQztJQUNoQixHQUFHLE1BQU07SUFDVCxFQUFFLEVBQUUsS0FBSztDQUNaLENBQUMsQ0FBQztBQU5NLFFBQUEseUJBQXlCLDZCQU0vQjtBQUVBLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxFQUFFLE1BQWMsRUFBRSxFQUFFO0lBQ3JELE1BQU0sU0FBUyxHQUFHLE1BQU0sNkJBQW9CLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLENBQUM7SUFFdEUsTUFBTSxVQUFVLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0RSxPQUFPO1FBQ0gsVUFBVTtRQUNWLFlBQVksRUFBRSxNQUFNLDhCQUFxQixDQUFDLGtCQUFrQixDQUN4RCxTQUFTLENBQUMsU0FBUyxDQUN0QjtRQUNELGFBQWEsRUFBRSxTQUFTLENBQUMsUUFBUSxJQUFJLEVBQUU7UUFDdkMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLFVBQVUsSUFBSSxFQUFFO0tBQ25ELENBQUM7QUFDTixDQUFDLENBQUM7QUFaVyxRQUFBLGdCQUFnQixvQkFZM0IifQ==

package/dist/challengeProvider/challengeNvidiaCCHelper.d.ts

@@ -0,0 +1,10 @@
+/// <reference types="node" />
+import { NvidiaCCToken, Log } from '@super-protocol/pki-common';
+export declare class ChallengeNvidiaCCHelper {
+    private static getNvidiaToken;
+    static getTokenHash(token: NvidiaCCToken): Buffer;
+    static getTokenAndCombinedChallengeData(baseUserData: Buffer, logger?: Log): Promise<{
+        nvidiaTokens: NvidiaCCToken | undefined;
+        challengeData: Buffer;
+    }>;
+}

package/dist/challengeProvider/challengeNvidiaCCHelper.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeNvidiaCCHelper = void 0;
+const sp_nvtrust_wrapper_1 = require("@super-protocol/sp-nvtrust-wrapper");
+const crypto_1 = require("crypto");
+class ChallengeNvidiaCCHelper {
+    static async getNvidiaToken(logger) {
+        try {
+            //TODO: add nvswitchToken here
+            const wrapper = new sp_nvtrust_wrapper_1.NvtrustWrapper();
+            const topology = await wrapper.getGPUTopology();
+            if (!topology.gpuCount) {
+                return;
+            }
+            const nonce = sp_nvtrust_wrapper_1.NvtrustWrapper.generateNonce();
+            const gpuTokenRaw = await wrapper.getNvidiaToken({
+                device: sp_nvtrust_wrapper_1.NvidiaDeviceType.GPU,
+                nonce,
+                ppcieMode: false,
+            });
+            return { gpuToken: gpuTokenRaw.jwt };
+        }
+        catch (error) {
+            if (error instanceof sp_nvtrust_wrapper_1.NvtrustWrapperCallError) {
+                logger?.error(`NvtrustWrapperCallError: ${error.message}`);
+                if (error.traceback?.trim()) {
+                    logger?.debug(`Traceback:\n${error.traceback}`);
+                }
+                const logEntries = Object.entries(error.logs ?? {});
+                if (logEntries.length > 0) {
+                    logger?.debug('Logs from nvtrust wrapper:');
+                    for (const [fileName, logContent] of logEntries) {
+                        logger?.debug(`--- ${fileName} ---`);
+                        logger?.debug(String(logContent));
+                    }
+                }
+            }
+            else {
+                logger?.error(`Error during NVIDIA token retrieval: ${error}`);
+            }
+            throw error;
+        }
+    }
+    static getTokenHash(token) {
+        const hash = (0, crypto_1.createHash)('sha256');
+        hash.update(JSON.stringify(token));
+        return hash.digest();
+    }
+    static async getTokenAndCombinedChallengeData(baseUserData, logger) {
+        const nvidiaTokens = await ChallengeNvidiaCCHelper.getNvidiaToken(logger);
+        const nvidiaTokenHash = nvidiaTokens && ChallengeNvidiaCCHelper.getTokenHash(nvidiaTokens);
+        const challengeData = nvidiaTokenHash
+            ? Buffer.concat([baseUserData, nvidiaTokenHash])
+            : baseUserData;
+        if (challengeData.length > 64) {
+            throw new Error('challengeData length exceeds 64 bytes');
+        }
+        return { nvidiaTokens, challengeData };
+    }
+}
+exports.ChallengeNvidiaCCHelper = ChallengeNvidiaCCHelper;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBSTRDO0FBRTVDLG1DQUFvQztBQUVwQyxNQUFhLHVCQUF1QjtJQUN4QixNQUFNLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FDL0IsTUFBWTtRQUVaLElBQUksQ0FBQztZQUNELDhCQUE4QjtZQUM5QixNQUFNLE9BQU8sR0FBRyxJQUFJLG1DQUFjLEVBQUUsQ0FBQztZQUNyQyxNQUFNLFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUVoRCxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUNyQixPQUFPO1lBQ1gsQ0FBQztZQUVELE1BQU0sS0FBSyxHQUFHLG1DQUFjLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDN0MsTUFBTSxXQUFXLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxDQUFDO2dCQUM3QyxNQUFNLEVBQUUscUNBQWdCLENBQUMsR0FBRztnQkFDNUIsS0FBSztnQkFDTCxTQUFTLEVBQUUsS0FBSzthQUNuQixDQUFDLENBQUM7WUFDSCxPQUFPLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN6QyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNiLElBQUksS0FBSyxZQUFZLDRDQUF1QixFQUFFLENBQUM7Z0JBQzNDLE1BQU0sRUFBRSxLQUFLLENBQUMsNEJBQTRCLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUMzRCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztvQkFDMUIsTUFBTSxFQUFFLEtBQUssQ0FBQyxlQUFlLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO2dCQUNwRCxDQUFDO2dCQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDcEQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN4QixNQUFNLEVBQUUsS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7b0JBQzVDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDOUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxPQUFPLFFBQVEsTUFBTSxDQUFDLENBQUM7d0JBQ3JDLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7b0JBQ3RDLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7aUJBQU0sQ0FBQztnQkFDSixNQUFNLEVBQUUsS0FBSyxDQUFDLHdDQUF3QyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQ25FLENBQUM7WUFFRCxNQUFNLEtBQUssQ0FBQztRQUNoQixDQUFDO0lBQ0wsQ0FBQztJQUVELE1BQU0sQ0FBQyxZQUFZLENBQUMsS0FBb0I7UUFDcEMsTUFBTSxJQUFJLEdBQUcsSUFBQSxtQkFBVSxFQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2xDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ25DLE9BQU8sSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFRCxNQUFNLENBQUMsS0FBSyxDQUFDLGdDQUFnQyxDQUN6QyxZQUFvQixFQUNwQixNQUFZO1FBS1osTUFBTSxZQUFZLEdBQ2QsTUFBTSx1QkFBdUIsQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDekQsTUFBTSxlQUFlLEdBQ2pCLFlBQVksSUFBSSx1QkFBdUIsQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLENBQUM7UUFFdkUsTUFBTSxhQUFhLEdBQUcsZUFBZTtZQUNqQyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFlBQVksRUFBRSxlQUFlLENBQUMsQ0FBQztZQUNoRCxDQUFDLENBQUMsWUFBWSxDQUFDO1FBRW5CLElBQUksYUFBYSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUNELE9BQU8sRUFBRSxZQUFZLEVBQUUsYUFBYSxFQUFFLENBQUM7SUFDM0MsQ0FBQztDQUNKO0FBckVELDBEQXFFQyJ9

package/dist/challengeProvider/challengeProvider.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="node" />
+import { Challenge, Log } from '@super-protocol/pki-common';
+export interface ChallengeProvider {
+    logger?: Log;
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProvider.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlUHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/challengeProvider/challengeProviderCertificate.d.ts

@@ -0,0 +1,15 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+export declare class ChallengeProviderCertificate implements ChallengeProvider {
+    private readonly orderCertsPath;
+    readonly logger?: Log | undefined;
+    private orderCert;
+    private orderCaBundle;
+    private orderPrivateKey;
+    private initialized;
+    constructor(orderCertsPath: string, logger?: Log | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+    private readOrderCerts;
+    private signUserData;
+}

package/dist/challengeProvider/challengeProviderCertificate.js

@@ -0,0 +1,82 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderCertificate = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const crypto_1 = __importDefault(require("crypto"));
+class ChallengeProviderCertificate {
+    orderCertsPath;
+    logger;
+    orderCert;
+    orderCaBundle;
+    orderPrivateKey;
+    initialized = false;
+    constructor(orderCertsPath, logger) {
+        this.orderCertsPath = orderCertsPath;
+        this.logger = logger;
+    }
+    async generateChallenge(userData, networkID) {
+        if (!this.initialized) {
+            try {
+                await this.readOrderCerts();
+                this.initialized = true;
+            }
+            catch (error) {
+                throw new Error(`Error on reading order certificate files: ${error.message}`);
+            }
+        }
+        return {
+            type: pki_common_1.ChallengeType.Certificate,
+            userDataSignatureBase64: this.signUserData(userData),
+            orderCertificate: this.orderCert,
+            orderCABundle: this.orderCaBundle,
+            networkID,
+        };
+    }
+    async readOrderCerts() {
+        this.orderCert = await fs.readFile(path.join(this.orderCertsPath, 'order_cert.crt'), 'utf8');
+        this.orderPrivateKey = await fs.readFile(path.join(this.orderCertsPath, 'order_cert.key'), 'utf8');
+        this.orderCaBundle = await fs.readFile(path.join(this.orderCertsPath, 'order_cert_ca_bundle.crt'), 'utf8');
+    }
+    signUserData(userData) {
+        const privateKeyObj = crypto_1.default.createPrivateKey({
+            key: this.orderPrivateKey,
+            format: 'pem',
+            type: 'pkcs8',
+        });
+        const signer = crypto_1.default.createSign('sha256');
+        signer.update(userData);
+        signer.end();
+        const signature = signer.sign(privateKeyObj);
+        return signature.toString('base64');
+    }
+}
+exports.ChallengeProviderCertificate = ChallengeProviderCertificate;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJDZXJ0aWZpY2F0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VQcm92aWRlci9jaGFsbGVuZ2VQcm92aWRlckNlcnRpZmljYXRlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQ0EsMkRBQTJFO0FBQzNFLGdEQUFrQztBQUNsQywyQ0FBNkI7QUFDN0Isb0RBQTRCO0FBRTVCLE1BQWEsNEJBQTRCO0lBT2hCO0lBQ0Q7SUFQWixTQUFTLENBQVU7SUFDbkIsYUFBYSxDQUFVO0lBQ3ZCLGVBQWUsQ0FBVTtJQUN6QixXQUFXLEdBQUcsS0FBSyxDQUFDO0lBRTVCLFlBQ3FCLGNBQXNCLEVBQ3ZCLE1BQVk7UUFEWCxtQkFBYyxHQUFkLGNBQWMsQ0FBUTtRQUN2QixXQUFNLEdBQU4sTUFBTSxDQUFNO0lBQzdCLENBQUM7SUFDSixLQUFLLENBQUMsaUJBQWlCLENBQ25CLFFBQWdCLEVBQ2hCLFNBQWtCO1FBRWxCLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDcEIsSUFBSSxDQUFDO2dCQUNELE1BQU0sSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO2dCQUM1QixJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQztZQUM1QixDQUFDO1lBQUMsT0FBTyxLQUFVLEVBQUUsQ0FBQztnQkFDbEIsTUFBTSxJQUFJLEtBQUssQ0FDWCw2Q0FBNkMsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUMvRCxDQUFDO1lBQ04sQ0FBQztRQUNMLENBQUM7UUFDRCxPQUFPO1lBQ0gsSUFBSSxFQUFFLDBCQUFhLENBQUMsV0FBVztZQUMvQix1QkFBdUIsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQztZQUNwRCxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsU0FBUztZQUNoQyxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWE7WUFDakMsU0FBUztTQUNaLENBQUM7SUFDTixDQUFDO0lBQ08sS0FBSyxDQUFDLGNBQWM7UUFDeEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQzlCLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxnQkFBZ0IsQ0FBQyxFQUNoRCxNQUFNLENBQ1QsQ0FBQztRQUNGLElBQUksQ0FBQyxlQUFlLEdBQUcsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUNwQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsZ0JBQWdCLENBQUMsRUFDaEQsTUFBTSxDQUNULENBQUM7UUFDRixJQUFJLENBQUMsYUFBYSxHQUFHLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FDbEMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLDBCQUEwQixDQUFDLEVBQzFELE1BQU0sQ0FDVCxDQUFDO0lBQ04sQ0FBQztJQUVPLFlBQVksQ0FBQyxRQUFnQjtRQUNqQyxNQUFNLGFBQWEsR0FBRyxnQkFBTSxDQUFDLGdCQUFnQixDQUFDO1lBQzFDLEdBQUcsRUFBRSxJQUFJLENBQUMsZUFBZTtZQUN6QixNQUFNLEVBQUUsS0FBSztZQUNiLElBQUksRUFBRSxPQUFPO1NBQ2hCLENBQUMsQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLGdCQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzNDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDeEIsTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ2IsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUM3QyxPQUFPLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDeEMsQ0FBQztDQUNKO0FBM0RELG9FQTJEQyJ9

package/dist/challengeProvider/challengeProviderSevSnp.d.ts

@@ -0,0 +1,8 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+export declare class ChallengeProviderSevSnp implements ChallengeProvider {
+    readonly logger?: Log | undefined;
+    constructor(logger?: Log | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProviderSevSnp.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderSevSnp = void 0;
+const challengeNvidiaCCHelper_1 = require("./challengeNvidiaCCHelper");
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeProviderSevSnp {
+    logger;
+    constructor(logger) {
+        this.logger = logger;
+    }
+    async generateChallenge(userData, networkID) {
+        // This module depends on native library that cannot be compiled for all architectures / operating systems.
+        // That is why we load it dynamically and use only when it's really needed.
+        const { SgxNative } = await Promise.resolve().then(() => __importStar(require('@super-protocol/addons-tee')));
+        const { challengeData, nvidiaTokens } = await challengeNvidiaCCHelper_1.ChallengeNvidiaCCHelper.getTokenAndCombinedChallengeData(userData, this.logger);
+        const report = await SgxNative.SevSNP.generateSNPReportWithChain(challengeData);
+        return {
+            type: pki_common_1.ChallengeType.SEVSNP,
+            serializedReportBase64: SgxNative.SevSNP.serializeSNPReport(report).toString('base64'),
+            nvidiaTokens,
+            networkID,
+        };
+    }
+}
+exports.ChallengeProviderSevSnp = ChallengeProviderSevSnp;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJTZXZTbnAuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlUHJvdmlkZXJTZXZTbnAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1RUFBb0U7QUFFcEUsMkRBQTJFO0FBRTNFLE1BQWEsdUJBQXVCO0lBQ0o7SUFBNUIsWUFBNEIsTUFBWTtRQUFaLFdBQU0sR0FBTixNQUFNLENBQU07SUFBRyxDQUFDO0lBRTVDLEtBQUssQ0FBQyxpQkFBaUIsQ0FDbkIsUUFBZ0IsRUFDaEIsU0FBa0I7UUFFbEIsMkdBQTJHO1FBQzNHLDJFQUEyRTtRQUMzRSxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsd0RBQWEsNEJBQTRCLEdBQUMsQ0FBQztRQUVqRSxNQUFNLEVBQUUsYUFBYSxFQUFFLFlBQVksRUFBRSxHQUNqQyxNQUFNLGlEQUF1QixDQUFDLGdDQUFnQyxDQUMxRCxRQUFRLEVBQ1IsSUFBSSxDQUFDLE1BQU0sQ0FDZCxDQUFDO1FBQ04sTUFBTSxNQUFNLEdBQ1IsTUFBTSxTQUFTLENBQUMsTUFBTSxDQUFDLDBCQUEwQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3JFLE9BQU87WUFDSCxJQUFJLEVBQUUsMEJBQWEsQ0FBQyxNQUFNO1lBQzFCLHNCQUFzQixFQUNsQixTQUFTLENBQUMsTUFBTSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7WUFDbEUsWUFBWTtZQUNaLFNBQVM7U0FDWixDQUFDO0lBQ04sQ0FBQztDQUNKO0FBMUJELDBEQTBCQyJ9

package/dist/challengeProvider/challengeProviderSgx.d.ts

@@ -0,0 +1,8 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+export declare class ChallengeProviderSgx implements ChallengeProvider {
+    readonly logger?: Log | undefined;
+    constructor(logger?: Log | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProviderSgx.js

@@ -0,0 +1,47 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderSgx = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+class ChallengeProviderSgx {
+    logger;
+    constructor(logger) {
+        this.logger = logger;
+    }
+    async generateChallenge(userData, networkID) {
+        // This module depends on native library that cannot be compiled for all architectures / operating systems.
+        // That is why we load it dynamically and use only when it's really needed.
+        const { SgxNative } = await Promise.resolve().then(() => __importStar(require('@super-protocol/addons-tee')));
+        const dcapVerifyService = new SgxNative.DcapQuoteVerifyService();
+        const quoteData = await dcapVerifyService.generateSGXQuote(userData);
+        return {
+            type: pki_common_1.ChallengeType.SGXDCAP,
+            quoteBase64: quoteData.toString('base64'),
+            networkID,
+        };
+    }
+}
+exports.ChallengeProviderSgx = ChallengeProviderSgx;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJTZ3guanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlUHJvdmlkZXJTZ3gudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFDQSwyREFBMkU7QUFFM0UsTUFBYSxvQkFBb0I7SUFDRDtJQUE1QixZQUE0QixNQUFZO1FBQVosV0FBTSxHQUFOLE1BQU0sQ0FBTTtJQUFHLENBQUM7SUFFNUMsS0FBSyxDQUFDLGlCQUFpQixDQUNuQixRQUFnQixFQUNoQixTQUFrQjtRQUVsQiwyR0FBMkc7UUFDM0csMkVBQTJFO1FBQzNFLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyx3REFBYSw0QkFBNEIsR0FBQyxDQUFDO1FBQ2pFLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxTQUFTLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztRQUNqRSxNQUFNLFNBQVMsR0FBRyxNQUFNLGlCQUFpQixDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3JFLE9BQU87WUFDSCxJQUFJLEVBQUUsMEJBQWEsQ0FBQyxPQUFPO1lBQzNCLFdBQVcsRUFBRSxTQUFTLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztZQUN6QyxTQUFTO1NBQ1osQ0FBQztJQUNOLENBQUM7Q0FDSjtBQWxCRCxvREFrQkMifQ==

package/dist/challengeProvider/challengeProviderTdx.d.ts

@@ -0,0 +1,8 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+export declare class ChallengeProviderTdx implements ChallengeProvider {
+    readonly logger?: Log | undefined;
+    constructor(logger?: Log | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}