@super-protocol/pki-attestation-engine 5.0.6 → 5.1.0-beta1

package/dist/attestationType.d.ts

@@ -1,4 +1,4 @@
 import { ChallengeType } from '@super-protocol/pki-common';
-export type DetectAttestationType = ChallengeType.TDX | ChallengeType.TDXGOOGLE | ChallengeType.SEVSNP | ChallengeType.Untrusted;
+export type DetectAttestationType = ChallengeType.TDX | ChallengeType.TDXGOOGLE | ChallengeType.TDXAZURE | ChallengeType.SEVSNP | ChallengeType.Untrusted;
 export declare const isGoogleCloudVm: () => Promise<boolean>;
 export declare const detectAttestationType: () => Promise<DetectAttestationType>;

package/dist/attestationType.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectAttestationType = exports.isGoogleCloudVm = void 0;
 const pki_common_1 = require("@super-protocol/pki-common");
 const fs_1 = require("fs");
+const detectAzureTdx_1 = require("./azure/detectAzureTdx");
 const GCP_METADATA_URL = 'http://169.254.169.254/computeMetadata/v1/instance/id';
 const GCP_METADATA_TIMEOUT_MS = 500;
 const isGoogleCloudVm = async () => {
@@ -26,6 +27,9 @@ const isGoogleCloudVm = async () => {
 exports.isGoogleCloudVm = isGoogleCloudVm;
 const detectAttestationType = async () => {
     try {
+        if (await (0, detectAzureTdx_1.isAzureTdxVm)()) {
+            return pki_common_1.ChallengeType.TDXAZURE;
+        }
         const tdxPath = '/dev/tdx_guest';
         const sevPath = '/dev/sev-guest';
         if ((0, fs_1.existsSync)(tdxPath)) {
@@ -51,4 +55,4 @@ const detectAttestationType = async () => {
     return pki_common_1.ChallengeType.Untrusted;
 };
 exports.detectAttestationType = detectAttestationType;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0ZXN0YXRpb25UeXBlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2F0dGVzdGF0aW9uVHlwZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyREFBMkQ7QUFDM0QsMkJBQTBDO0FBUTFDLE1BQU0sZ0JBQWdCLEdBQ2xCLHVEQUF1RCxDQUFDO0FBQzVELE1BQU0sdUJBQXVCLEdBQUcsR0FBRyxDQUFDO0FBRTdCLE1BQU0sZUFBZSxHQUFHLEtBQUssSUFBc0IsRUFBRTtJQUN4RCxJQUFJLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRTtZQUMzQyxPQUFPLEVBQUU7Z0JBQ0wsaUJBQWlCLEVBQUUsUUFBUTthQUM5QjtZQUNELE1BQU0sRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLHVCQUF1QixDQUFDO1NBQ3ZELENBQUMsQ0FBQztRQUVILElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDZixPQUFPLEtBQUssQ0FBQztRQUNqQixDQUFDO1FBRUQsTUFBTSxVQUFVLEdBQUcsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDekMsT0FBTyxVQUFVLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ0wsT0FBTyxLQUFLLENBQUM7SUFDakIsQ0FBQztBQUNMLENBQUMsQ0FBQztBQWxCVyxRQUFBLGVBQWUsbUJBa0IxQjtBQUVLLE1BQU0scUJBQXFCLEdBQzlCLEtBQUssSUFBb0MsRUFBRTtJQUN2QyxJQUFJLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxnQkFBZ0IsQ0FBQztRQUNqQyxNQUFNLE9BQU8sR0FBRyxnQkFBZ0IsQ0FBQztRQUVqQyxJQUFJLElBQUEsZUFBVSxFQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDdEIsTUFBTSxLQUFLLEdBQUcsSUFBQSxhQUFRLEVBQUMsT0FBTyxDQUFDLENBQUM7WUFDaEMsSUFBSSxLQUFLLENBQUMsaUJBQWlCLEVBQUUsRUFBRSxDQUFDO2dCQUM1QixPQUFPLENBQUMsTUFBTSxJQUFBLHVCQUFlLEdBQUUsQ0FBQztvQkFDNUIsQ0FBQyxDQUFDLDBCQUFhLENBQUMsU0FBUztvQkFDekIsQ0FBQyxDQUFDLDBCQUFhLENBQUMsR0FBRyxDQUFDO1lBQzVCLENBQUM7UUFDTCxDQUFDO1FBRUQsSUFBSSxJQUFBLGVBQVUsRUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sS0FBSyxHQUFHLElBQUEsYUFBUSxFQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ2hDLElBQUksS0FBSyxDQUFDLGlCQUFpQixFQUFFLEVBQUUsQ0FBQztnQkFDNUIsT0FBTyxDQUFDLE1BQU0sSUFBQSx1QkFBZSxHQUFFLENBQUM7b0JBQzVCLENBQUMsQ0FBQywwQkFBYSxDQUFDLFNBQVM7b0JBQ3pCLENBQUMsQ0FBQywwQkFBYSxDQUFDLE1BQU0sQ0FBQztZQUMvQixDQUFDO1FBQ0wsQ0FBQztJQUNMLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDTCxvREFBb0Q7SUFDeEQsQ0FBQztJQUVELE9BQU8sMEJBQWEsQ0FBQyxTQUFTLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBNUJPLFFBQUEscUJBQXFCLHlCQTRCNUIifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0ZXN0YXRpb25UeXBlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2F0dGVzdGF0aW9uVHlwZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyREFBMkQ7QUFDM0QsMkJBQTBDO0FBRTFDLDJEQUFzRDtBQVN0RCxNQUFNLGdCQUFnQixHQUNsQix1REFBdUQsQ0FBQztBQUM1RCxNQUFNLHVCQUF1QixHQUFHLEdBQUcsQ0FBQztBQUU3QixNQUFNLGVBQWUsR0FBRyxLQUFLLElBQXNCLEVBQUU7SUFDeEQsSUFBSSxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsZ0JBQWdCLEVBQUU7WUFDM0MsT0FBTyxFQUFFO2dCQUNMLGlCQUFpQixFQUFFLFFBQVE7YUFDOUI7WUFDRCxNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyx1QkFBdUIsQ0FBQztTQUN2RCxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ2YsT0FBTyxLQUFLLENBQUM7UUFDakIsQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFHLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3pDLE9BQU8sVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNMLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDTCxDQUFDLENBQUM7QUFsQlcsUUFBQSxlQUFlLG1CQWtCMUI7QUFFSyxNQUFNLHFCQUFxQixHQUM5QixLQUFLLElBQW9DLEVBQUU7SUFDdkMsSUFBSSxDQUFDO1FBQ0QsSUFBSSxNQUFNLElBQUEsNkJBQVksR0FBRSxFQUFFLENBQUM7WUFDdkIsT0FBTywwQkFBYSxDQUFDLFFBQVEsQ0FBQztRQUNsQyxDQUFDO1FBRUQsTUFBTSxPQUFPLEdBQUcsZ0JBQWdCLENBQUM7UUFDakMsTUFBTSxPQUFPLEdBQUcsZ0JBQWdCLENBQUM7UUFFakMsSUFBSSxJQUFBLGVBQVUsRUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sS0FBSyxHQUFHLElBQUEsYUFBUSxFQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ2hDLElBQUksS0FBSyxDQUFDLGlCQUFpQixFQUFFLEVBQUUsQ0FBQztnQkFDNUIsT0FBTyxDQUFDLE1BQU0sSUFBQSx1QkFBZSxHQUFFLENBQUM7b0JBQzVCLENBQUMsQ0FBQywwQkFBYSxDQUFDLFNBQVM7b0JBQ3pCLENBQUMsQ0FBQywwQkFBYSxDQUFDLEdBQUcsQ0FBQztZQUM1QixDQUFDO1FBQ0wsQ0FBQztRQUVELElBQUksSUFBQSxlQUFVLEVBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUN0QixNQUFNLEtBQUssR0FBRyxJQUFBLGFBQVEsRUFBQyxPQUFPLENBQUMsQ0FBQztZQUNoQyxJQUFJLEtBQUssQ0FBQyxpQkFBaUIsRUFBRSxFQUFFLENBQUM7Z0JBQzVCLE9BQU8sQ0FBQyxNQUFNLElBQUEsdUJBQWUsR0FBRSxDQUFDO29CQUM1QixDQUFDLENBQUMsMEJBQWEsQ0FBQyxTQUFTO29CQUN6QixDQUFDLENBQUMsMEJBQWEsQ0FBQyxNQUFNLENBQUM7WUFDL0IsQ0FBQztRQUNMLENBQUM7SUFDTCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ0wsb0RBQW9EO0lBQ3hELENBQUM7SUFFRCxPQUFPLDBCQUFhLENBQUMsU0FBUyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQWhDTyxRQUFBLHFCQUFxQix5QkFnQzVCIn0=

package/dist/azure/detectAzureTdx.d.ts

@@ -0,0 +1,3 @@
+export declare const isTdxGuest: () => boolean;
+export declare const isAzureConfidentialVm: () => Promise<boolean>;
+export declare const isAzureTdxVm: () => Promise<boolean>;

package/dist/azure/detectAzureTdx.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAzureTdxVm = exports.isAzureConfidentialVm = exports.isTdxGuest = void 0;
+const fs_1 = require("fs");
+const AZURE_IMDS_COMPUTE_URL = 'http://169.254.169.254/metadata/instance/compute?api-version=2023-07-01';
+const IMDS_TIMEOUT_MS = 500;
+const SEV_DEVICE_PATH = '/dev/sev-guest';
+const cpuinfoFlagTokens = () => {
+    try {
+        const text = (0, fs_1.readFileSync)('/proc/cpuinfo', 'utf8');
+        const tokens = new Set();
+        for (const line of text.split('\n')) {
+            const [key, value] = line.split(':');
+            if (key?.trim() === 'flags' || key?.trim() === 'Features') {
+                for (const token of (value ?? '').split(/\s+/)) {
+                    if (token) {
+                        tokens.add(token);
+                    }
+                }
+            }
+        }
+        return tokens;
+    }
+    catch {
+        return new Set();
+    }
+};
+const isTdxGuest = () => {
+    try {
+        if ((0, fs_1.existsSync)(SEV_DEVICE_PATH) &&
+            (0, fs_1.statSync)(SEV_DEVICE_PATH).isCharacterDevice()) {
+            return false;
+        }
+    }
+    catch {
+        // ignore
+    }
+    if (cpuinfoFlagTokens().has('tdx_guest')) {
+        return true;
+    }
+    if ((0, fs_1.existsSync)('/sys/module/tdx_guest')) {
+        return true;
+    }
+    try {
+        return (0, fs_1.readFileSync)('/proc/cpuinfo', 'utf8').includes('Intel TDX');
+    }
+    catch {
+        return false;
+    }
+};
+exports.isTdxGuest = isTdxGuest;
+const isAzureConfidentialVm = async () => {
+    try {
+        const response = await fetch(AZURE_IMDS_COMPUTE_URL, {
+            headers: { Metadata: 'true' },
+            signal: AbortSignal.timeout(IMDS_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            return false;
+        }
+        const compute = (await response.json());
+        return (String(compute?.securityProfile?.securityType ?? '')
+            .trim()
+            .toLowerCase() === 'confidentialvm');
+    }
+    catch {
+        return false;
+    }
+};
+exports.isAzureConfidentialVm = isAzureConfidentialVm;
+const isAzureTdxVm = async () => (await (0, exports.isAzureConfidentialVm)()) && (0, exports.isTdxGuest)();
+exports.isAzureTdxVm = isAzureTdxVm;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGV0ZWN0QXp1cmVUZHguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXp1cmUvZGV0ZWN0QXp1cmVUZHgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkJBQXdEO0FBRXhELE1BQU0sc0JBQXNCLEdBQ3hCLHlFQUF5RSxDQUFDO0FBQzlFLE1BQU0sZUFBZSxHQUFHLEdBQUcsQ0FBQztBQUM1QixNQUFNLGVBQWUsR0FBRyxnQkFBZ0IsQ0FBQztBQUV6QyxNQUFNLGlCQUFpQixHQUFHLEdBQWdCLEVBQUU7SUFDeEMsSUFBSSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsSUFBQSxpQkFBWSxFQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNuRCxNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ2pDLEtBQUssTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2xDLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNyQyxJQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsS0FBSyxPQUFPLElBQUksR0FBRyxFQUFFLElBQUksRUFBRSxLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUN4RCxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO29CQUM3QyxJQUFJLEtBQUssRUFBRSxDQUFDO3dCQUNSLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7b0JBQ3RCLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7UUFDTCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDbEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNMLE9BQU8sSUFBSSxHQUFHLEVBQUUsQ0FBQztJQUNyQixDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUssTUFBTSxVQUFVLEdBQUcsR0FBWSxFQUFFO0lBQ3BDLElBQUksQ0FBQztRQUNELElBQ0ksSUFBQSxlQUFVLEVBQUMsZUFBZSxDQUFDO1lBQzNCLElBQUEsYUFBUSxFQUFDLGVBQWUsQ0FBQyxDQUFDLGlCQUFpQixFQUFFLEVBQy9DLENBQUM7WUFDQyxPQUFPLEtBQUssQ0FBQztRQUNqQixDQUFDO0lBQ0wsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNMLFNBQVM7SUFDYixDQUFDO0lBRUQsSUFBSSxpQkFBaUIsRUFBRSxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE9BQU8sSUFBSSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxJQUFJLElBQUEsZUFBVSxFQUFDLHVCQUF1QixDQUFDLEVBQUUsQ0FBQztRQUN0QyxPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0QsT0FBTyxJQUFBLGlCQUFZLEVBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ0wsT0FBTyxLQUFLLENBQUM7SUFDakIsQ0FBQztBQUNMLENBQUMsQ0FBQztBQXZCVyxRQUFBLFVBQVUsY0F1QnJCO0FBRUssTUFBTSxxQkFBcUIsR0FBRyxLQUFLLElBQXNCLEVBQUU7SUFDOUQsSUFBSSxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsc0JBQXNCLEVBQUU7WUFDakQsT0FBTyxFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRTtZQUM3QixNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQUM7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNmLE9BQU8sS0FBSyxDQUFDO1FBQ2pCLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUVyQyxDQUFDO1FBQ0YsT0FBTyxDQUNILE1BQU0sQ0FBQyxPQUFPLEVBQUUsZUFBZSxFQUFFLFlBQVksSUFBSSxFQUFFLENBQUM7YUFDL0MsSUFBSSxFQUFFO2FBQ04sV0FBVyxFQUFFLEtBQUssZ0JBQWdCLENBQzFDLENBQUM7SUFDTixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ0wsT0FBTyxLQUFLLENBQUM7SUFDakIsQ0FBQztBQUNMLENBQUMsQ0FBQztBQXBCVyxRQUFBLHFCQUFxQix5QkFvQmhDO0FBRUssTUFBTSxZQUFZLEdBQUcsS0FBSyxJQUFzQixFQUFFLENBQ3JELENBQUMsTUFBTSxJQUFBLDZCQUFxQixHQUFFLENBQUMsSUFBSSxJQUFBLGtCQUFVLEdBQUUsQ0FBQztBQUR2QyxRQUFBLFlBQVksZ0JBQzJCIn0=

package/dist/azure/tdxAzureEvidence.d.ts

@@ -0,0 +1,14 @@
+/// <reference types="node" />
+export declare const TDX_AZURE_EVIDENCE_FORMAT = "tdx-azure-maa-v1";
+export interface TdxAzureEvidenceV1 {
+    format: typeof TDX_AZURE_EVIDENCE_FORMAT;
+    token: string;
+}
+export declare const encodeTdxAzureEvidence: (token: string) => Buffer;
+export declare const parseTdxAzureEvidence: (evidence: Buffer) => TdxAzureEvidenceV1;
+export declare const computeAzureTdxMrEnclave: (tdAttributesHex: string, mrtdHex: string, pcrSha256Hex: string[]) => Buffer;
+export declare const verifyMaaJwt: (token: string) => Promise<Record<string, unknown>>;
+export declare const validateAzureTdxClaims: (claims: Record<string, unknown>) => {
+    userData: Buffer;
+    mrenclave: Buffer;
+};

package/dist/azure/tdxAzureEvidence.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAzureTdxClaims = exports.verifyMaaJwt = exports.computeAzureTdxMrEnclave = exports.parseTdxAzureEvidence = exports.encodeTdxAzureEvidence = exports.TDX_AZURE_EVIDENCE_FORMAT = void 0;
+const crypto_1 = require("crypto");
+exports.TDX_AZURE_EVIDENCE_FORMAT = 'tdx-azure-maa-v1';
+const encodeTdxAzureEvidence = (token) => Buffer.from(JSON.stringify({
+    format: exports.TDX_AZURE_EVIDENCE_FORMAT,
+    token,
+}), 'utf8');
+exports.encodeTdxAzureEvidence = encodeTdxAzureEvidence;
+const parseTdxAzureEvidence = (evidence) => {
+    const parsed = JSON.parse(evidence.toString('utf8'));
+    if (parsed.format !== exports.TDX_AZURE_EVIDENCE_FORMAT || typeof parsed.token !== 'string') {
+        throw new Error('Invalid tdx-azure evidence format');
+    }
+    return parsed;
+};
+exports.parseTdxAzureEvidence = parseTdxAzureEvidence;
+const hexToBuffer = (hex, expectedBytes) => {
+    const normalized = hex.trim().toLowerCase().replace(/^0x/, '');
+    if (!/^[0-9a-f]*$/.test(normalized) || normalized.length % 2 !== 0) {
+        throw new Error(`Invalid hex value: ${hex}`);
+    }
+    const buffer = Buffer.from(normalized, 'hex');
+    if (expectedBytes !== undefined && buffer.length !== expectedBytes) {
+        throw new Error(`Expected ${expectedBytes} bytes, got ${buffer.length} from hex ${hex}`);
+    }
+    return buffer;
+};
+const decodeJwtPart = (part) => JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+const computeAzureTdxMrEnclave = (tdAttributesHex, mrtdHex, pcrSha256Hex) => {
+    if (pcrSha256Hex.length < 8) {
+        throw new Error('tdx-azure mrEnclave requires SHA-256 PCR[0]..PCR[7]');
+    }
+    const parts = [
+        hexToBuffer(tdAttributesHex, 8),
+        hexToBuffer(mrtdHex, 48),
+        ...pcrSha256Hex.slice(0, 8).map((value) => hexToBuffer(value, 32)),
+    ];
+    return (0, crypto_1.createHash)('sha256').update(Buffer.concat(parts)).digest();
+};
+exports.computeAzureTdxMrEnclave = computeAzureTdxMrEnclave;
+const extractPcrSha256Hex = (claims) => {
+    const values = claims['x-ms-azurevm-attested-pcr-values'];
+    if (Array.isArray(values) && values.every((item) => typeof item === 'string')) {
+        return values;
+    }
+    if (values && typeof values === 'object') {
+        const sha256 = values.sha256;
+        if (Array.isArray(sha256) && sha256.every((item) => typeof item === 'string')) {
+            return sha256;
+        }
+    }
+    throw new Error('MAA token is missing SHA-256 PCR values');
+};
+const isolationTee = (claims) => {
+    const nested = claims['x-ms-isolation-tee'];
+    if (nested && typeof nested === 'object') {
+        return nested;
+    }
+    return claims;
+};
+const fetchJwks = async (url) => {
+    const response = await fetch(url, { signal: AbortSignal.timeout(5000) });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch MAA JWKS: ${response.status}`);
+    }
+    return (await response.json());
+};
+const verifyMaaJwt = async (token) => {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw new Error('MAA token is not a JWT');
+    }
+    const header = decodeJwtPart(parts[0]);
+    const payload = decodeJwtPart(parts[1]);
+    if (header.alg !== 'RS256') {
+        throw new Error(`Unsupported MAA JWT alg: ${header.alg}`);
+    }
+    const iss = payload.iss;
+    if (typeof iss !== 'string' || !/^https:\/\/[^/]+\.attest\.azure\.net\/?$/.test(iss)) {
+        throw new Error(`Unexpected MAA issuer: ${String(iss)}`);
+    }
+    const jwksUrl = header.jku ?? `${iss.replace(/\/$/, '')}/certs`;
+    if (typeof jwksUrl !== 'string' || !jwksUrl.startsWith(iss.replace(/\/$/, ''))) {
+        throw new Error('MAA JWT jku is not on the issuer host');
+    }
+    const jwks = await fetchJwks(jwksUrl);
+    const jwk = jwks.keys?.find((key) => key.kid === header.kid) ?? jwks.keys?.[0];
+    if (!jwk) {
+        throw new Error('MAA JWKS does not contain a verification key');
+    }
+    const key = (0, crypto_1.createPublicKey)({
+        key: jwk,
+        format: 'jwk',
+    });
+    const ok = (0, crypto_1.verify)('RSA-SHA256', Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], 'base64url'));
+    if (!ok) {
+        throw new Error('MAA JWT signature verification failed');
+    }
+    return payload;
+};
+exports.verifyMaaJwt = verifyMaaJwt;
+const validateAzureTdxClaims = (claims) => {
+    const tee = isolationTee(claims);
+    if (tee['tdx_td_attributes_debug'] === true) {
+        throw new Error('Azure TDX debug attribute is enabled');
+    }
+    if (tee['x-ms-compliance-status'] !== 'azure-compliant-cvm') {
+        throw new Error(`Azure TDX compliance status is ${String(tee['x-ms-compliance-status'])}`);
+    }
+    const tcbStatus = tee['attester_tcb_status'] ?? claims['attester_tcb_status'];
+    if (tcbStatus && tcbStatus !== 'UpToDate') {
+        throw new Error(`Azure TDX TCB is ${String(tcbStatus)}`);
+    }
+    const runtime = (tee['x-ms-runtime'] ?? claims['x-ms-runtime']);
+    const userDataHex = runtime?.['user-data'];
+    if (typeof userDataHex !== 'string') {
+        throw new Error('MAA token is missing runtime user-data');
+    }
+    const userData = hexToBuffer(userDataHex);
+    if (userData.length < 64) {
+        throw new Error('MAA user-data is shorter than 64 bytes');
+    }
+    const tdAttributes = String(tee['tdx_td_attributes'] ?? '');
+    const mrtd = String(tee['tdx_mrtd'] ?? '');
+    const pcrs = extractPcrSha256Hex(claims);
+    const mrenclave = (0, exports.computeAzureTdxMrEnclave)(tdAttributes, mrtd, pcrs);
+    return {
+        userData: userData.subarray(0, 64),
+        mrenclave,
+    };
+};
+exports.validateAzureTdxClaims = validateAzureTdxClaims;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGR4QXp1cmVFdmlkZW5jZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9henVyZS90ZHhBenVyZUV2aWRlbmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUFnRztBQUVuRixRQUFBLHlCQUF5QixHQUFHLGtCQUFrQixDQUFDO0FBT3JELE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxLQUFhLEVBQVUsRUFBRSxDQUM1RCxNQUFNLENBQUMsSUFBSSxDQUNQLElBQUksQ0FBQyxTQUFTLENBQUM7SUFDWCxNQUFNLEVBQUUsaUNBQXlCO0lBQ2pDLEtBQUs7Q0FDcUIsQ0FBQyxFQUMvQixNQUFNLENBQ1QsQ0FBQztBQVBPLFFBQUEsc0JBQXNCLDBCQU83QjtBQUVDLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxRQUFnQixFQUFzQixFQUFFO0lBQzFFLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBZ0MsQ0FBQztJQUNwRixJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssaUNBQXlCLElBQUksT0FBTyxNQUFNLENBQUMsS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBQ0QsT0FBTyxNQUE0QixDQUFDO0FBQ3hDLENBQUMsQ0FBQztBQU5XLFFBQUEscUJBQXFCLHlCQU1oQztBQUVGLE1BQU0sV0FBVyxHQUFHLENBQUMsR0FBVyxFQUFFLGFBQXNCLEVBQVUsRUFBRTtJQUNoRSxNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztJQUMvRCxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksS0FBSyxDQUFDLHNCQUFzQixHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM5QyxJQUFJLGFBQWEsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksS0FBSyxDQUNYLFlBQVksYUFBYSxlQUFlLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxFQUFFLENBQzFFLENBQUM7SUFDTixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxJQUFZLEVBQVcsRUFBRSxDQUM1QyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBRXpELE1BQU0sd0JBQXdCLEdBQUcsQ0FDcEMsZUFBdUIsRUFDdkIsT0FBZSxFQUNmLFlBQXNCLEVBQ2hCLEVBQUU7SUFDUixJQUFJLFlBQVksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRztRQUNWLFdBQVcsQ0FBQyxlQUFlLEVBQUUsQ0FBQyxDQUFDO1FBQy9CLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ3hCLEdBQUcsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0tBQ3JFLENBQUM7SUFDRixPQUFPLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO0FBQ3RFLENBQUMsQ0FBQztBQWRXLFFBQUEsd0JBQXdCLDRCQWNuQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxNQUErQixFQUFZLEVBQUU7SUFDdEUsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDMUQsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDNUUsT0FBTyxNQUFrQixDQUFDO0lBQzlCLENBQUM7SUFDRCxJQUFJLE1BQU0sSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN2QyxNQUFNLE1BQU0sR0FBSSxNQUErQixDQUFDLE1BQU0sQ0FBQztRQUN2RCxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsT0FBTyxJQUFJLEtBQUssUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM1RSxPQUFPLE1BQWtCLENBQUM7UUFDOUIsQ0FBQztJQUNMLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7QUFDL0QsQ0FBQyxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FDakIsTUFBK0IsRUFDUixFQUFFO0lBQ3pCLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQzVDLElBQUksTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3ZDLE9BQU8sTUFBaUMsQ0FBQztJQUM3QyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsS0FBSyxFQUFFLEdBQVcsRUFBK0MsRUFBRTtJQUNqRixNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDekUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNmLE1BQU0sSUFBSSxLQUFLLENBQUMsNkJBQTZCLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxPQUFPLENBQUMsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQXVDLENBQUM7QUFDekUsQ0FBQyxDQUFDO0FBRUssTUFBTSxZQUFZLEdBQUcsS0FBSyxFQUM3QixLQUFhLEVBQ21CLEVBQUU7SUFDbEMsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUMvQixJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFpRCxDQUFDO0lBQ3ZGLE1BQU0sT0FBTyxHQUFHLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQTRCLENBQUM7SUFDbkUsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMsNEJBQTRCLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDO0lBQ3hCLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsMENBQTBDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbkYsTUFBTSxJQUFJLEtBQUssQ0FBQywwQkFBMEIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEdBQUcsSUFBSSxHQUFHLEdBQUcsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUM7SUFDaEUsSUFBSSxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM3RSxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELE1BQU0sSUFBSSxHQUFHLE1BQU0sU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3RDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0UsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ1AsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxJQUFBLHdCQUFlLEVBQUM7UUFDeEIsR0FBRyxFQUFFLEdBQWdDO1FBQ3JDLE1BQU0sRUFBRSxLQUFLO0tBQ2hCLENBQUMsQ0FBQztJQUNILE1BQU0sRUFBRSxHQUFHLElBQUEsZUFBTSxFQUNiLFlBQVksRUFDWixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQ3RDLEdBQUcsRUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLENBQUMsQ0FDckMsQ0FBQztJQUNGLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNOLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUM7QUFDbkIsQ0FBQyxDQUFDO0FBdkNXLFFBQUEsWUFBWSxnQkF1Q3ZCO0FBRUssTUFBTSxzQkFBc0IsR0FBRyxDQUNsQyxNQUErQixFQUNRLEVBQUU7SUFDekMsTUFBTSxHQUFHLEdBQUcsWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ2pDLElBQUksR0FBRyxDQUFDLHlCQUF5QixDQUFDLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDMUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFDRCxJQUFJLEdBQUcsQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLHFCQUFxQixFQUFFLENBQUM7UUFDMUQsTUFBTSxJQUFJLEtBQUssQ0FDWCxrQ0FBa0MsTUFBTSxDQUFDLEdBQUcsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDLEVBQUUsQ0FDNUUsQ0FBQztJQUNOLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMscUJBQXFCLENBQUMsSUFBSSxNQUFNLENBQUMscUJBQXFCLENBQUMsQ0FBQztJQUM5RSxJQUFJLFNBQVMsSUFBSSxTQUFTLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQkFBb0IsTUFBTSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsQ0FBQyxHQUFHLENBQUMsY0FBYyxDQUFDLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxDQUUvQyxDQUFDO0lBQ2hCLE1BQU0sV0FBVyxHQUFHLE9BQU8sRUFBRSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzNDLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDbEMsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxXQUFXLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDMUMsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLEVBQUUsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBRUQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzVELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFDM0MsTUFBTSxJQUFJLEdBQUcsbUJBQW1CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDekMsTUFBTSxTQUFTLEdBQUcsSUFBQSxnQ0FBd0IsRUFBQyxZQUFZLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBRXJFLE9BQU87UUFDSCxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2xDLFNBQVM7S0FDWixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBdENXLFFBQUEsc0JBQXNCLDBCQXNDakMifQ==

package/dist/certificateGenerator.js

@@ -60,6 +60,7 @@ const getAttestationPayloadBase64FromChallenge = (challenge) => {
     switch (challenge.type) {
         case pki_common_1.ChallengeType.TDX:
         case pki_common_1.ChallengeType.TDXGOOGLE:
+        case pki_common_1.ChallengeType.TDXAZURE:
         case pki_common_1.ChallengeType.SEVSNP:
             return challenge.evidenceBase64;
         default:
@@ -108,23 +109,56 @@ const SYSTEM_MANAGED_EXTENSION_OIDS = [
     pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID,
     pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_VALIDATED,
     pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+    pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU_INTERCONNECT,
     pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_SUBTYPE,
     pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_CERTIFICATE_ID,
 ];
 const filterClientExtensions = (extensions = []) => extensions.filter((ext) => !SYSTEM_MANAGED_EXTENSION_OIDS.some((oid) => ext.oid.startsWith(oid)));
-const buildNvidiaGpuExtension = (challenge) => {
+const buildNvidiaExtensions = (challenge) => {
     if (!(0, pki_common_1.hasChallengeNvidiaToken)(challenge)) {
         return [];
     }
     const gpusInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractGPUInfoFromToken({
         jwt: challenge.nvidiaTokens.gpuToken,
     });
-    return [
+    const extensions = [
         {
             oid: pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
             value: Buffer.from(sp_nvtrust_wrapper_1.NvtrustGPUList.encode(gpusInfo).finish()),
         },
     ];
+    const { gpuInterconnectStatus, nvswitchToken } = challenge.nvidiaTokens;
+    if (gpusInfo.gpus.length === 1) {
+        if (gpuInterconnectStatus !== undefined ||
+            nvswitchToken !== undefined) {
+            throw new Error('NVIDIA GPU interconnect data must be omitted for a single GPU');
+        }
+        return extensions;
+    }
+    if (gpusInfo.gpus.length === 0) {
+        throw new Error('NVIDIA GPU token does not contain any GPU claims');
+    }
+    if (gpuInterconnectStatus === undefined) {
+        throw new Error('NVIDIA GPU interconnect status is required for multiple GPUs');
+    }
+    const isVerifiedNVSwitchInterconnect = gpuInterconnectStatus ===
+        sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED;
+    if (!isVerifiedNVSwitchInterconnect && nvswitchToken !== undefined) {
+        throw new Error('NVIDIA NVSwitch token is only allowed for a verified NVLink switch interconnect');
+    }
+    if (isVerifiedNVSwitchInterconnect && !nvswitchToken) {
+        throw new Error('Verified NVIDIA NVLink switch interconnect requires a non-empty NVSwitch token');
+    }
+    // ChallengeValidatorNvidia verifies this token before certificate issuance.
+    const switches = nvswitchToken
+        ? sp_nvtrust_wrapper_1.NvtrustWrapper.extractNVSwitchInfoFromToken({ jwt: nvswitchToken })
+        : [];
+    const interconnectInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.createNvidiaGpuInterconnectInfo(gpuInterconnectStatus, switches);
+    extensions.push({
+        oid: pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU_INTERCONNECT,
+        value: Buffer.from(sp_nvtrust_wrapper_1.NvidiaGpuInterconnectInfo.encode(interconnectInfo).finish()),
+    });
+    return extensions;
 };
 const buildCertificateChallengeExtensions = (challenge) => {
     if (challenge.type !== pki_common_1.ChallengeType.Certificate) {
@@ -215,7 +249,7 @@ const buildCommonExtensions = (params) => {
                     });
                 }
             }
-            extensions.push(...buildNvidiaGpuExtension(challenge));
+            extensions.push(...buildNvidiaExtensions(challenge));
             extensions.push(...buildCertificateChallengeExtensions(challenge));
         }
     }
@@ -298,4 +332,4 @@ const getParamsFromCSR = async (csrPem) => {
     };
 };
 exports.getParamsFromCSR = getParamsFromCSR;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VydGlmaWNhdGVHZW5lcmF0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2VydGlmaWNhdGVHZW5lcmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbURBUWdDO0FBQ2hDLDJFQUc0QztBQUM1Qyw2QkFBMkI7QUFDM0IsMkRBbUJvQztBQUVwQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsQ0FBQztBQUNqQyxNQUFNLHNCQUFzQixHQUFHLEtBQUssQ0FBQztBQUNyQyxNQUFNLGVBQWUsR0FBRyx5Q0FBeUMsQ0FBQztBQUVsRSxNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDakQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xDLElBQUksQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUM3QyxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsWUFBWSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRCxNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQztJQUVuRSxJQUFJLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxXQUFXLEVBQUUsS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUN4RCxPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBRUQsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ25DLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN2RCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsT0FBTyxDQUFDLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztBQUM1QyxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDakQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xDLE9BQU8sSUFBQSxVQUFJLEVBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ3ZFLENBQUMsQ0FBQztBQUVGLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxNQUFnQixFQUFZLEVBQUUsQ0FDN0QsTUFBTTtLQUNELEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0tBQzVCLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxJQUFJLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFOUQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxJQUFVLEVBQUUsSUFBWSxFQUFRLEVBQUU7SUFDbEQsTUFBTSxJQUFJLEdBQUcsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDNUIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDMUMsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxVQUF5QixFQUFRLEVBQUU7SUFDeEQsTUFBTSxFQUFFLFlBQVksRUFBRSxHQUFHLFVBQVUsQ0FBQztJQUVwQyxJQUNJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUM7UUFDL0IsWUFBWSxHQUFHLHNCQUFzQjtRQUNyQyxZQUFZLEdBQUcsc0JBQXNCLEVBQ3ZDLENBQUM7UUFDQyxNQUFNLElBQUksS0FBSyxDQUNYLHNEQUFzRCxzQkFBc0IsUUFBUSxzQkFBc0IsRUFBRSxDQUMvRyxDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU8sVUFBVSxDQUFDLElBQUksSUFBSSxFQUFFLEVBQUUsWUFBWSxDQUFDLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxVQUF5QixFQUF3QixFQUFFLENBQUMsQ0FBQztJQUN6RSxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7SUFDakMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxXQUFXO0lBQy9CLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztJQUMvQixZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7SUFDckMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxnQkFBZ0I7SUFDekMsa0JBQWtCLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtDQUN0RCxDQUFDLENBQUM7QUFFSCxNQUFNLHdDQUF3QyxHQUFHLENBQzdDLFNBQW9CLEVBQ0YsRUFBRTtJQUNwQixRQUFRLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNyQixLQUFLLDBCQUFhLENBQUMsR0FBRyxDQUFDO1FBQ3ZCLEtBQUssMEJBQWEsQ0FBQyxTQUFTLENBQUM7UUFDN0IsS0FBSywwQkFBYSxDQUFDLE1BQU07WUFDckIsT0FBTyxTQUFTLENBQUMsY0FBYyxDQUFDO1FBQ3BDO1lBQ0ksT0FBTztJQUNmLENBQUM7QUFDTCxDQUFDLENBQUM7QUFFSyxNQUFNLHVCQUF1QixHQUFHLEtBQUssRUFBRSxNQU83QyxFQUFtQixFQUFFO0lBQ2xCLE1BQU0sU0FBUyxHQUFHLGNBQWMsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEQsTUFBTSxRQUFRLEdBQUcsZUFBZSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUVwRCxNQUFNLGdCQUFnQixHQUFzQjtRQUN4QztZQUNJLEdBQUcsRUFBRSxnREFBbUM7WUFDeEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDO1NBQ3JEO0tBQ0osQ0FBQztJQUVGLElBQUksTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ3JCLGdCQUFnQixDQUFDLElBQUksQ0FBQztZQUNsQixHQUFHLEVBQUUsOENBQWlDO1lBQ3RDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsT0FBTyxDQUFDO1NBQ2xELENBQUMsQ0FBQztJQUNQLENBQUM7SUFFRCxNQUFNLHdCQUF3QixHQUFHLHdDQUF3QyxDQUNyRSxNQUFNLENBQUMsU0FBUyxDQUNuQixDQUFDO0lBQ0YsSUFBSSx3QkFBd0IsRUFBRSxDQUFDO1FBQzNCLGdCQUFnQixDQUFDLElBQUksQ0FBQztZQUNsQixHQUFHLEVBQUUsNkJBQWdCO1lBQ3JCLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixFQUFFLFFBQVEsQ0FBQztTQUN6RCxDQUFDLENBQUM7SUFDUCxDQUFDO0lBRUQsTUFBTSxrQkFBa0IsR0FBdUI7UUFDM0MsVUFBVSxFQUFFLE1BQU0sQ0FBQyxhQUFhO1FBQ2hDLFNBQVMsRUFBRSxNQUFNLENBQUMsWUFBWTtRQUM5QixPQUFPLEVBQUUsU0FBUztRQUNsQixNQUFNLEVBQUUsU0FBUztRQUNqQixRQUFRO1FBQ1IsUUFBUSxFQUFFLE1BQU0sQ0FBQyxPQUFPO1FBQ3hCLEVBQUUsRUFBRSxJQUFJO1FBQ1IsZ0JBQWdCO0tBQ25CLENBQUM7SUFFRixPQUFPLDZCQUFvQixDQUFDLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0FBQ2pFLENBQUMsQ0FBQztBQS9DVyxRQUFBLHVCQUF1QiwyQkErQ2xDO0FBRUYsTUFBTSw2QkFBNkIsR0FBRztJQUNsQyw2QkFBZ0I7SUFDaEIsZ0RBQW1DO0lBQ25DLDhDQUFpQztJQUNqQyxxREFBd0M7SUFDeEMscURBQXdDO0lBQ3hDLGlEQUFvQztJQUNwQyxtREFBc0M7SUFDdEMsMERBQTZDO0NBQ2hELENBQUM7QUFFRixNQUFNLHNCQUFzQixHQUFHLENBQzNCLGFBQWdDLEVBQUUsRUFDakIsRUFBRSxDQUNuQixVQUFVLENBQUMsTUFBTSxDQUNiLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDSixDQUFDLDZCQUE2QixDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ3hDLEdBQUcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUMxQixDQUNSLENBQUM7QUFFTixNQUFNLHVCQUF1QixHQUFHLENBQUMsU0FBb0IsRUFBcUIsRUFBRTtJQUN4RSxJQUFJLENBQUMsSUFBQSxvQ0FBdUIsRUFBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3RDLE9BQU8sRUFBRSxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLG1DQUFjLENBQUMsdUJBQXVCLENBQUM7UUFDcEQsR0FBRyxFQUFFLFNBQVMsQ0FBQyxZQUFZLENBQUMsUUFBUTtLQUN2QyxDQUFDLENBQUM7SUFFSCxPQUFPO1FBQ0g7WUFDSSxHQUFHLEVBQUUsaURBQW9DO1lBQ3pDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFjLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1NBQy9EO0tBQ0osQ0FBQztBQUNOLENBQUMsQ0FBQztBQUVGLE1BQU0sbUNBQW1DLEdBQUcsQ0FDeEMsU0FBb0IsRUFDSCxFQUFFO0lBQ25CLElBQUksU0FBUyxDQUFDLElBQUksS0FBSywwQkFBYSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQy9DLE9BQU8sRUFBRSxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sZ0JBQWdCLEdBQUcsMkJBQWtCLENBQUMsaUJBQWlCLENBQ3pELFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsZ0RBQW1DLENBQ3RDLENBQUM7SUFDRixNQUFNLGFBQWEsR0FBRywyQkFBa0IsQ0FBQyxpQkFBaUIsQ0FDdEQsU0FBUyxDQUFDLGdCQUFnQixFQUMxQixrQkFBUyxDQUFDLDhCQUE4QixDQUMzQyxDQUFDO0lBRUYsSUFBSSxDQUFDLGdCQUFnQixJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDdEMsTUFBTSxJQUFJLEtBQUssQ0FDWCx5REFBeUQsZ0RBQW1DLE9BQU8sa0JBQVMsQ0FBQyw4QkFBOEIsRUFBRSxDQUNoSixDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU87UUFDSDtZQUNJLEdBQUcsRUFBRSxtREFBc0M7WUFDM0MsS0FBSyxFQUFFLGdCQUFnQjtTQUMxQjtRQUNEO1lBQ0ksR0FBRyxFQUFFLDBEQUE2QztZQUNsRCxLQUFLLEVBQUUsYUFBYTtTQUN2QjtLQUNKLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRixNQUFNLHVCQUF1QixHQUFHLENBQUMsU0FBbUIsRUFBcUIsRUFBRTtJQUN2RSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDYixPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFFRCxPQUFPO1FBQ0g7WUFDSSxHQUFHLEVBQUUscURBQXdDO1lBQzdDLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztTQUN6QjtLQUNKLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRiw2QkFBNkI7QUFDN0IsZ0NBQWdDO0FBQ2hDLDRDQUE0QztBQUM1Qyw2Q0FBNkM7QUFDN0MsNEJBQTRCO0FBQzVCLCtCQUErQjtBQUMvQixxQkFBcUI7QUFDckIsUUFBUTtBQUNSLEVBQUU7QUFDRiw0REFBNEQ7QUFDNUQsNEJBQTRCO0FBQzVCLGdEQUFnRDtBQUNoRCxTQUFTO0FBQ1QsRUFBRTtBQUNGLFdBQVc7QUFDWCxxQkFBcUI7QUFDckIsb0NBQW9DO0FBQ3BDLHlFQUF5RTtBQUN6RSxZQUFZO0FBQ1osVUFBVTtBQUNWLG1CQUFtQjtBQUNuQixnQkFBZ0I7QUFDaEIsNkRBQTZEO0FBQzdELGtDQUFrQztBQUNsQyxpQkFBaUI7QUFDakIsYUFBYTtBQUNiLFFBQVE7QUFDUixFQUFFO0FBQ0YsaUJBQWlCO0FBQ2pCLEtBQUs7QUFFTCxNQUFNLHFCQUFxQixHQUFHLENBQUMsTUFJOUIsRUFBcUIsRUFBRTtJQUNwQixNQUFNLFVBQVUsR0FBc0IsRUFBRSxDQUFDO0lBRXpDLElBQUksTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxHQUFHLE1BQU0sQ0FBQyxhQUFhLENBQUM7UUFFL0QsVUFBVSxDQUFDLElBQUksQ0FBQztZQUNaLEdBQUcsRUFBRSxnREFBbUM7WUFDeEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUM7U0FDOUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLDBCQUFhLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDekMsVUFBVSxDQUFDLElBQUksQ0FBQztnQkFDWixHQUFHLEVBQUUsOENBQWlDO2dCQUN0QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDO2FBQ25DLENBQUMsQ0FBQztZQUVILElBQUksV0FBVyxFQUFFLENBQUM7Z0JBQ2QsVUFBVSxDQUFDLElBQUksQ0FBQztvQkFDWixHQUFHLEVBQUUscURBQXdDO29CQUM3QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsS0FBSyxDQUFDO2lCQUN6QyxDQUFDLENBQUM7WUFDUCxDQUFDO1lBRUQsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLDRCQUFlLENBQUMsS0FBSyxFQUFFLENBQUM7Z0JBQzVDLE1BQU0sd0JBQXdCLEdBQzFCLHdDQUF3QyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUN4RCxJQUFJLHdCQUF3QixFQUFFLENBQUM7b0JBQzNCLFVBQVUsQ0FBQyxJQUFJLENBQUM7d0JBQ1osR0FBRyxFQUFFLDZCQUFnQjt3QkFDckIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLEVBQUUsUUFBUSxDQUFDO3FCQUN6RCxDQUFDLENBQUM7Z0JBQ1AsQ0FBQztZQUNMLENBQUM7WUFFRCxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsdUJBQXVCLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztZQUN2RCxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcsbUNBQW1DLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUN2RSxDQUFDO0lBQ0wsQ0FBQztJQUVELE1BQU0sd0JBQXdCLEdBQUcsc0JBQXNCLENBQ25ELE1BQU0sQ0FBQyxvQkFBb0IsQ0FDOUIsQ0FBQztJQUVGLE9BQU8sQ0FBQyxHQUFHLHdCQUF3QixFQUFFLEdBQUcsVUFBVSxDQUFDLENBQUM7QUFDeEQsQ0FBQyxDQUFDO0FBa0JGLE1BQU0sbUJBQW1CLEdBQUcsS0FBSyxFQUM3QixNQUFtRCxFQUN6QixFQUFFO0lBQzVCLE1BQU0sZUFBZSxHQUFHLElBQUEsMkNBQThCLEVBQ2xELE1BQU0sQ0FBQyxjQUFjLEVBQ3JCLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDSiwyQkFBa0IsQ0FBQyx1QkFBdUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUN0RCwyQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FDOUQsQ0FDUixDQUFDO0lBRUYsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUMxQixNQUFNLElBQUksS0FBSyxDQUNYLG9FQUFvRSxDQUN2RSxDQUFDO0lBQ04sQ0FBQztJQUVELE1BQU0sY0FBYyxHQUFHLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMxQyxNQUFNLFdBQVcsR0FDYixNQUFNLDZCQUFvQixDQUFDLGlCQUFpQixDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBRWpFLE1BQU0sZ0JBQWdCLEdBQUcscUJBQXFCLENBQUM7UUFDM0MsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO1FBQ3pCLGFBQWEsRUFBRSxNQUFNLENBQUMsYUFBYTtRQUNuQyxvQkFBb0IsRUFBRSxNQUFNLENBQUMsb0JBQW9CO0tBQ3BELENBQUMsQ0FBQztJQUVILGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLHVCQUF1QixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLDZCQUE2QjtJQUM3Qix5QkFBeUI7SUFDekIseUVBQXlFO0lBQ3pFLEtBQUs7SUFFTCxNQUFNLE9BQU8sR0FDVCxNQUFNLENBQUMsUUFBUSxLQUFLLDRCQUFlLENBQUMsS0FBSztRQUNyQyxDQUFDLENBQUMseUJBQXlCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUMzQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBRWIsTUFBTSxPQUFPLEdBQXlCO1FBQ2xDLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRTtRQUN4RCxPQUFPLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxXQUFXO1FBQ3RDLFNBQVMsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFNBQVM7UUFDdEMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsWUFBWTtRQUM1QyxZQUFZLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0I7UUFDaEQsa0JBQWtCLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxvQkFBb0I7S0FDN0QsQ0FBQztJQUVGLE1BQU0sUUFBUSxHQUFHLGVBQWUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFFcEQsTUFBTSxrQkFBa0IsR0FBdUI7UUFDM0MsVUFBVSxFQUFFLE1BQU0sQ0FBQyxvQkFBb0I7UUFDdkMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxZQUFZO1FBQzlCLE9BQU87UUFDUCxRQUFRLEVBQUUsT0FBTztRQUNqQixFQUFFLEVBQUUsTUFBTSxDQUFDLEVBQUU7UUFDYixXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7UUFDL0IsTUFBTSxFQUFFLFdBQVcsQ0FBQyxPQUFPO1FBQzNCLFFBQVE7UUFDUixnQkFBZ0I7S0FDbkIsQ0FBQztJQUVGLElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUM1QixrQkFBa0IsQ0FBQyxhQUFhLEdBQUc7WUFDL0IsT0FBTyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsT0FBTztTQUNyQyxDQUFDO0lBQ04sQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLE1BQU0sNkJBQW9CLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFFNUUsTUFBTSxZQUFZLEdBQ2QsTUFBTSxDQUFDLFFBQVEsS0FBSyxNQUFNLENBQUMsY0FBYztRQUNyQyxDQUFDLENBQUMsTUFBTSxDQUFDLGNBQWM7UUFDdkIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEdBQUcsSUFBSSxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUM7SUFFekQsT0FBTztRQUNILE9BQU87UUFDUCxPQUFPO1FBQ1AsWUFBWTtLQUNmLENBQUM7QUFDTixDQUFDLENBQUM7QUFFSyxNQUFNLDBCQUEwQixHQUFHLEtBQUssRUFDM0MsTUFBaUMsRUFDUCxFQUFFLENBQzVCLG1CQUFtQixDQUFDO0lBQ2hCLEdBQUcsTUFBTTtJQUNULEVBQUUsRUFBRSxJQUFJO0NBQ1gsQ0FBQyxDQUFDO0FBTk0sUUFBQSwwQkFBMEIsOEJBTWhDO0FBRUEsTUFBTSw0QkFBNEIsR0FBRyxLQUFLLEVBQzdDLE1BQWlDLEVBQ1AsRUFBRSxDQUM1QixtQkFBbUIsQ0FBQztJQUNoQixHQUFHLE1BQU07SUFDVCxFQUFFLEVBQUUsS0FBSztDQUNaLENBQUMsQ0FBQztBQU5NLFFBQUEsNEJBQTRCLGdDQU1sQztBQUVBLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxFQUFFLE1BQWMsRUFBRSxFQUFFO0lBQ3JELE1BQU0sU0FBUyxHQUFHLE1BQU0sNkJBQW9CLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLENBQUM7SUFFdEUsTUFBTSxVQUFVLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0RSxPQUFPO1FBQ0gsVUFBVTtRQUNWLFlBQVksRUFBRSxNQUFNLDhCQUFxQixDQUFDLGtCQUFrQixDQUN4RCxTQUFTLENBQUMsU0FBUyxDQUN0QjtRQUNELGFBQWEsRUFBRSxTQUFTLENBQUMsUUFBUSxJQUFJLEVBQUU7UUFDdkMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLFVBQVUsSUFBSSxFQUFFO0tBQ25ELENBQUM7QUFDTixDQUFDLENBQUM7QUFaVyxRQUFBLGdCQUFnQixvQkFZM0IifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VydGlmaWNhdGVHZW5lcmF0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2VydGlmaWNhdGVHZW5lcmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbURBUWdDO0FBQ2hDLDJFQUs0QztBQUM1Qyw2QkFBMkI7QUFDM0IsMkRBb0JvQztBQUVwQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsQ0FBQztBQUNqQyxNQUFNLHNCQUFzQixHQUFHLEtBQUssQ0FBQztBQUNyQyxNQUFNLGVBQWUsR0FBRyx5Q0FBeUMsQ0FBQztBQUVsRSxNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDakQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xDLElBQUksQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUM3QyxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsWUFBWSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRCxNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQztJQUVuRSxJQUFJLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxXQUFXLEVBQUUsS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUN4RCxPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBRUQsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ25DLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN2RCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsT0FBTyxDQUFDLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztBQUM1QyxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDakQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xDLE9BQU8sSUFBQSxVQUFJLEVBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ3ZFLENBQUMsQ0FBQztBQUVGLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxNQUFnQixFQUFZLEVBQUUsQ0FDN0QsTUFBTTtLQUNELEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0tBQzVCLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxJQUFJLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFOUQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxJQUFVLEVBQUUsSUFBWSxFQUFRLEVBQUU7SUFDbEQsTUFBTSxJQUFJLEdBQUcsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDNUIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDMUMsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxVQUF5QixFQUFRLEVBQUU7SUFDeEQsTUFBTSxFQUFFLFlBQVksRUFBRSxHQUFHLFVBQVUsQ0FBQztJQUVwQyxJQUNJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUM7UUFDL0IsWUFBWSxHQUFHLHNCQUFzQjtRQUNyQyxZQUFZLEdBQUcsc0JBQXNCLEVBQ3ZDLENBQUM7UUFDQyxNQUFNLElBQUksS0FBSyxDQUNYLHNEQUFzRCxzQkFBc0IsUUFBUSxzQkFBc0IsRUFBRSxDQUMvRyxDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU8sVUFBVSxDQUFDLElBQUksSUFBSSxFQUFFLEVBQUUsWUFBWSxDQUFDLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxVQUF5QixFQUF3QixFQUFFLENBQUMsQ0FBQztJQUN6RSxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7SUFDakMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxXQUFXO0lBQy9CLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztJQUMvQixZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7SUFDckMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxnQkFBZ0I7SUFDekMsa0JBQWtCLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtDQUN0RCxDQUFDLENBQUM7QUFFSCxNQUFNLHdDQUF3QyxHQUFHLENBQzdDLFNBQW9CLEVBQ0YsRUFBRTtJQUNwQixRQUFRLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNyQixLQUFLLDBCQUFhLENBQUMsR0FBRyxDQUFDO1FBQ3ZCLEtBQUssMEJBQWEsQ0FBQyxTQUFTLENBQUM7UUFDN0IsS0FBSywwQkFBYSxDQUFDLFFBQVEsQ0FBQztRQUM1QixLQUFLLDBCQUFhLENBQUMsTUFBTTtZQUNyQixPQUFPLFNBQVMsQ0FBQyxjQUFjLENBQUM7UUFDcEM7WUFDSSxPQUFPO0lBQ2YsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVLLE1BQU0sdUJBQXVCLEdBQUcsS0FBSyxFQUFFLE1BTzdDLEVBQW1CLEVBQUU7SUFDbEIsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNwRCxNQUFNLFFBQVEsR0FBRyxlQUFlLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBRXBELE1BQU0sZ0JBQWdCLEdBQXNCO1FBQ3hDO1lBQ0ksR0FBRyxFQUFFLGdEQUFtQztZQUN4QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUM7U0FDckQ7S0FDSixDQUFDO0lBRUYsSUFBSSxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDckIsZ0JBQWdCLENBQUMsSUFBSSxDQUFDO1lBQ2xCLEdBQUcsRUFBRSw4Q0FBaUM7WUFDdEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxPQUFPLENBQUM7U0FDbEQsQ0FBQyxDQUFDO0lBQ1AsQ0FBQztJQUVELE1BQU0sd0JBQXdCLEdBQUcsd0NBQXdDLENBQ3JFLE1BQU0sQ0FBQyxTQUFTLENBQ25CLENBQUM7SUFDRixJQUFJLHdCQUF3QixFQUFFLENBQUM7UUFDM0IsZ0JBQWdCLENBQUMsSUFBSSxDQUFDO1lBQ2xCLEdBQUcsRUFBRSw2QkFBZ0I7WUFDckIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLEVBQUUsUUFBUSxDQUFDO1NBQ3pELENBQUMsQ0FBQztJQUNQLENBQUM7SUFFRCxNQUFNLGtCQUFrQixHQUF1QjtRQUMzQyxVQUFVLEVBQUUsTUFBTSxDQUFDLGFBQWE7UUFDaEMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxZQUFZO1FBQzlCLE9BQU8sRUFBRSxTQUFTO1FBQ2xCLE1BQU0sRUFBRSxTQUFTO1FBQ2pCLFFBQVE7UUFDUixRQUFRLEVBQUUsTUFBTSxDQUFDLE9BQU87UUFDeEIsRUFBRSxFQUFFLElBQUk7UUFDUixnQkFBZ0I7S0FDbkIsQ0FBQztJQUVGLE9BQU8sNkJBQW9CLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLENBQUM7QUFDakUsQ0FBQyxDQUFDO0FBL0NXLFFBQUEsdUJBQXVCLDJCQStDbEM7QUFFRixNQUFNLDZCQUE2QixHQUFHO0lBQ2xDLDZCQUFnQjtJQUNoQixnREFBbUM7SUFDbkMsOENBQWlDO0lBQ2pDLHFEQUF3QztJQUN4QyxxREFBd0M7SUFDeEMsaURBQW9DO0lBQ3BDLDhEQUFpRDtJQUNqRCxtREFBc0M7SUFDdEMsMERBQTZDO0NBQ2hELENBQUM7QUFFRixNQUFNLHNCQUFzQixHQUFHLENBQzNCLGFBQWdDLEVBQUUsRUFDakIsRUFBRSxDQUNuQixVQUFVLENBQUMsTUFBTSxDQUNiLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDSixDQUFDLDZCQUE2QixDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ3hDLEdBQUcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUMxQixDQUNSLENBQUM7QUFFTixNQUFNLHFCQUFxQixHQUFHLENBQUMsU0FBb0IsRUFBcUIsRUFBRTtJQUN0RSxJQUFJLENBQUMsSUFBQSxvQ0FBdUIsRUFBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3RDLE9BQU8sRUFBRSxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLG1DQUFjLENBQUMsdUJBQXVCLENBQUM7UUFDcEQsR0FBRyxFQUFFLFNBQVMsQ0FBQyxZQUFZLENBQUMsUUFBUTtLQUN2QyxDQUFDLENBQUM7SUFFSCxNQUFNLFVBQVUsR0FBc0I7UUFDbEM7WUFDSSxHQUFHLEVBQUUsaURBQW9DO1lBQ3pDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFjLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1NBQy9EO0tBQ0osQ0FBQztJQUVGLE1BQU0sRUFBRSxxQkFBcUIsRUFBRSxhQUFhLEVBQUUsR0FBRyxTQUFTLENBQUMsWUFBWSxDQUFDO0lBQ3hFLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDN0IsSUFDSSxxQkFBcUIsS0FBSyxTQUFTO1lBQ25DLGFBQWEsS0FBSyxTQUFTLEVBQzdCLENBQUM7WUFDQyxNQUFNLElBQUksS0FBSyxDQUNYLCtEQUErRCxDQUNsRSxDQUFDO1FBQ04sQ0FBQztRQUNELE9BQU8sVUFBVSxDQUFDO0lBQ3RCLENBQUM7SUFFRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxxQkFBcUIsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksS0FBSyxDQUNYLDhEQUE4RCxDQUNqRSxDQUFDO0lBQ04sQ0FBQztJQUVELE1BQU0sOEJBQThCLEdBQ2hDLHFCQUFxQjtRQUNyQixnREFBMkIsQ0FBQywwREFBMEQsQ0FBQztJQUMzRixJQUFJLENBQUMsOEJBQThCLElBQUksYUFBYSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sSUFBSSxLQUFLLENBQ1gsaUZBQWlGLENBQ3BGLENBQUM7SUFDTixDQUFDO0lBQ0QsSUFBSSw4QkFBOEIsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ25ELE1BQU0sSUFBSSxLQUFLLENBQ1gsZ0ZBQWdGLENBQ25GLENBQUM7SUFDTixDQUFDO0lBRUQsNEVBQTRFO0lBQzVFLE1BQU0sUUFBUSxHQUFHLGFBQWE7UUFDMUIsQ0FBQyxDQUFDLG1DQUFjLENBQUMsNEJBQTRCLENBQUMsRUFBRSxHQUFHLEVBQUUsYUFBYSxFQUFFLENBQUM7UUFDckUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNULE1BQU0sZ0JBQWdCLEdBQUcsbUNBQWMsQ0FBQywrQkFBK0IsQ0FDbkUscUJBQW9ELEVBQ3BELFFBQVEsQ0FDWCxDQUFDO0lBQ0YsVUFBVSxDQUFDLElBQUksQ0FBQztRQUNaLEdBQUcsRUFBRSw4REFBaUQ7UUFDdEQsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQ2QsOENBQXlCLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLENBQUMsTUFBTSxFQUFFLENBQzlEO0tBQ0osQ0FBQyxDQUFDO0lBRUgsT0FBTyxVQUFVLENBQUM7QUFDdEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxtQ0FBbUMsR0FBRyxDQUN4QyxTQUFvQixFQUNILEVBQUU7SUFDbkIsSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLDBCQUFhLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDL0MsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0lBRUQsTUFBTSxnQkFBZ0IsR0FBRywyQkFBa0IsQ0FBQyxpQkFBaUIsQ0FDekQsU0FBUyxDQUFDLGdCQUFnQixFQUMxQixnREFBbUMsQ0FDdEMsQ0FBQztJQUNGLE1BQU0sYUFBYSxHQUFHLDJCQUFrQixDQUFDLGlCQUFpQixDQUN0RCxTQUFTLENBQUMsZ0JBQWdCLEVBQzFCLGtCQUFTLENBQUMsOEJBQThCLENBQzNDLENBQUM7SUFFRixJQUFJLENBQUMsZ0JBQWdCLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksS0FBSyxDQUNYLHlEQUF5RCxnREFBbUMsT0FBTyxrQkFBUyxDQUFDLDhCQUE4QixFQUFFLENBQ2hKLENBQUM7SUFDTixDQUFDO0lBRUQsT0FBTztRQUNIO1lBQ0ksR0FBRyxFQUFFLG1EQUFzQztZQUMzQyxLQUFLLEVBQUUsZ0JBQWdCO1NBQzFCO1FBQ0Q7WUFDSSxHQUFHLEVBQUUsMERBQTZDO1lBQ2xELEtBQUssRUFBRSxhQUFhO1NBQ3ZCO0tBQ0osQ0FBQztBQUNOLENBQUMsQ0FBQztBQUVGLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxTQUFtQixFQUFxQixFQUFFO0lBQ3ZFLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUNiLE9BQU8sRUFBRSxDQUFDO0lBQ2QsQ0FBQztJQUVELE9BQU87UUFDSDtZQUNJLEdBQUcsRUFBRSxxREFBd0M7WUFDN0MsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1NBQ3pCO0tBQ0osQ0FBQztBQUNOLENBQUMsQ0FBQztBQUVGLDZCQUE2QjtBQUM3QixnQ0FBZ0M7QUFDaEMsNENBQTRDO0FBQzVDLDZDQUE2QztBQUM3Qyw0QkFBNEI7QUFDNUIsK0JBQStCO0FBQy9CLHFCQUFxQjtBQUNyQixRQUFRO0FBQ1IsRUFBRTtBQUNGLDREQUE0RDtBQUM1RCw0QkFBNEI7QUFDNUIsZ0RBQWdEO0FBQ2hELFNBQVM7QUFDVCxFQUFFO0FBQ0YsV0FBVztBQUNYLHFCQUFxQjtBQUNyQixvQ0FBb0M7QUFDcEMseUVBQXlFO0FBQ3pFLFlBQVk7QUFDWixVQUFVO0FBQ1YsbUJBQW1CO0FBQ25CLGdCQUFnQjtBQUNoQiw2REFBNkQ7QUFDN0Qsa0NBQWtDO0FBQ2xDLGlCQUFpQjtBQUNqQixhQUFhO0FBQ2IsUUFBUTtBQUNSLEVBQUU7QUFDRixpQkFBaUI7QUFDakIsS0FBSztBQUVMLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxNQUk5QixFQUFxQixFQUFFO0lBQ3BCLE1BQU0sVUFBVSxHQUFzQixFQUFFLENBQUM7SUFFekMsSUFBSSxNQUFNLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDdkIsTUFBTSxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLEdBQUcsTUFBTSxDQUFDLGFBQWEsQ0FBQztRQUUvRCxVQUFVLENBQUMsSUFBSSxDQUFDO1lBQ1osR0FBRyxFQUFFLGdEQUFtQztZQUN4QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQztTQUM5QyxDQUFDLENBQUM7UUFFSCxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssMEJBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUN6QyxVQUFVLENBQUMsSUFBSSxDQUFDO2dCQUNaLEdBQUcsRUFBRSw4Q0FBaUM7Z0JBQ3RDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUM7YUFDbkMsQ0FBQyxDQUFDO1lBRUgsSUFBSSxXQUFXLEVBQUUsQ0FBQztnQkFDZCxVQUFVLENBQUMsSUFBSSxDQUFDO29CQUNaLEdBQUcsRUFBRSxxREFBd0M7b0JBQzdDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxLQUFLLENBQUM7aUJBQ3pDLENBQUMsQ0FBQztZQUNQLENBQUM7WUFFRCxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssNEJBQWUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDNUMsTUFBTSx3QkFBd0IsR0FDMUIsd0NBQXdDLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQ3hELElBQUksd0JBQXdCLEVBQUUsQ0FBQztvQkFDM0IsVUFBVSxDQUFDLElBQUksQ0FBQzt3QkFDWixHQUFHLEVBQUUsNkJBQWdCO3dCQUNyQixLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsRUFBRSxRQUFRLENBQUM7cUJBQ3pELENBQUMsQ0FBQztnQkFDUCxDQUFDO1lBQ0wsQ0FBQztZQUVELFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ3JELFVBQVUsQ0FBQyxJQUFJLENBQUMsR0FBRyxtQ0FBbUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7SUFDTCxDQUFDO0lBRUQsTUFBTSx3QkFBd0IsR0FBRyxzQkFBc0IsQ0FDbkQsTUFBTSxDQUFDLG9CQUFvQixDQUM5QixDQUFDO0lBRUYsT0FBTyxDQUFDLEdBQUcsd0JBQXdCLEVBQUUsR0FBRyxVQUFVLENBQUMsQ0FBQztBQUN4RCxDQUFDLENBQUM7QUFrQkYsTUFBTSxtQkFBbUIsR0FBRyxLQUFLLEVBQzdCLE1BQW1ELEVBQ3pCLEVBQUU7SUFDNUIsTUFBTSxlQUFlLEdBQUcsSUFBQSwyQ0FBOEIsRUFDbEQsTUFBTSxDQUFDLGNBQWMsRUFDckIsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUNKLDJCQUFrQixDQUFDLHVCQUF1QixDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQ3RELDJCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUM5RCxDQUNSLENBQUM7SUFFRixJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzFCLE1BQU0sSUFBSSxLQUFLLENBQ1gsb0VBQW9FLENBQ3ZFLENBQUM7SUFDTixDQUFDO0lBRUQsTUFBTSxjQUFjLEdBQUcsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzFDLE1BQU0sV0FBVyxHQUNiLE1BQU0sNkJBQW9CLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFFakUsTUFBTSxnQkFBZ0IsR0FBRyxxQkFBcUIsQ0FBQztRQUMzQyxRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVE7UUFDekIsYUFBYSxFQUFFLE1BQU0sQ0FBQyxhQUFhO1FBQ25DLG9CQUFvQixFQUFFLE1BQU0sQ0FBQyxvQkFBb0I7S0FDcEQsQ0FBQyxDQUFDO0lBRUgsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEdBQUcsdUJBQXVCLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7SUFDcEUsNkJBQTZCO0lBQzdCLHlCQUF5QjtJQUN6Qix5RUFBeUU7SUFDekUsS0FBSztJQUVMLE1BQU0sT0FBTyxHQUNULE1BQU0sQ0FBQyxRQUFRLEtBQUssNEJBQWUsQ0FBQyxLQUFLO1FBQ3JDLENBQUMsQ0FBQyx5QkFBeUIsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQzNDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFFYixNQUFNLE9BQU8sR0FBeUI7UUFDbEMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFO1FBQ3hELE9BQU8sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFdBQVc7UUFDdEMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsU0FBUztRQUN0QyxZQUFZLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxZQUFZO1FBQzVDLFlBQVksRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLGdCQUFnQjtRQUNoRCxrQkFBa0IsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLG9CQUFvQjtLQUM3RCxDQUFDO0lBRUYsTUFBTSxRQUFRLEdBQUcsZUFBZSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUVwRCxNQUFNLGtCQUFrQixHQUF1QjtRQUMzQyxVQUFVLEVBQUUsTUFBTSxDQUFDLG9CQUFvQjtRQUN2QyxTQUFTLEVBQUUsTUFBTSxDQUFDLFlBQVk7UUFDOUIsT0FBTztRQUNQLFFBQVEsRUFBRSxPQUFPO1FBQ2pCLEVBQUUsRUFBRSxNQUFNLENBQUMsRUFBRTtRQUNiLFdBQVcsRUFBRSxNQUFNLENBQUMsV0FBVztRQUMvQixNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU87UUFDM0IsUUFBUTtRQUNSLGdCQUFnQjtLQUNuQixDQUFDO0lBRUYsSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQzVCLGtCQUFrQixDQUFDLGFBQWEsR0FBRztZQUMvQixPQUFPLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxPQUFPO1NBQ3JDLENBQUM7SUFDTixDQUFDO0lBRUQsTUFBTSxPQUFPLEdBQUcsTUFBTSw2QkFBb0IsQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUU1RSxNQUFNLFlBQVksR0FDZCxNQUFNLENBQUMsUUFBUSxLQUFLLE1BQU0sQ0FBQyxjQUFjO1FBQ3JDLENBQUMsQ0FBQyxNQUFNLENBQUMsY0FBYztRQUN2QixDQUFDLENBQUMsTUFBTSxDQUFDLGNBQWMsR0FBRyxJQUFJLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQztJQUV6RCxPQUFPO1FBQ0gsT0FBTztRQUNQLE9BQU87UUFDUCxZQUFZO0tBQ2YsQ0FBQztBQUNOLENBQUMsQ0FBQztBQUVLLE1BQU0sMEJBQTBCLEdBQUcsS0FBSyxFQUMzQyxNQUFpQyxFQUNQLEVBQUUsQ0FDNUIsbUJBQW1CLENBQUM7SUFDaEIsR0FBRyxNQUFNO0lBQ1QsRUFBRSxFQUFFLElBQUk7Q0FDWCxDQUFDLENBQUM7QUFOTSxRQUFBLDBCQUEwQiw4QkFNaEM7QUFFQSxNQUFNLDRCQUE0QixHQUFHLEtBQUssRUFDN0MsTUFBaUMsRUFDUCxFQUFFLENBQzVCLG1CQUFtQixDQUFDO0lBQ2hCLEdBQUcsTUFBTTtJQUNULEVBQUUsRUFBRSxLQUFLO0NBQ1osQ0FBQyxDQUFDO0FBTk0sUUFBQSw0QkFBNEIsZ0NBTWxDO0FBRUEsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLEVBQUUsTUFBYyxFQUFFLEVBQUU7SUFDckQsTUFBTSxTQUFTLEdBQUcsTUFBTSw2QkFBb0IsQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUV0RSxNQUFNLFVBQVUsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ3RFLE9BQU87UUFDSCxVQUFVO1FBQ1YsWUFBWSxFQUFFLE1BQU0sOEJBQXFCLENBQUMsa0JBQWtCLENBQ3hELFNBQVMsQ0FBQyxTQUFTLENBQ3RCO1FBQ0QsYUFBYSxFQUFFLFNBQVMsQ0FBQyxRQUFRLElBQUksRUFBRTtRQUN2QyxvQkFBb0IsRUFBRSxTQUFTLENBQUMsVUFBVSxJQUFJLEVBQUU7S0FDbkQsQ0FBQztBQUNOLENBQUMsQ0FBQztBQVpXLFFBQUEsZ0JBQWdCLG9CQVkzQiJ9

package/dist/challengeProvider/challengeNvidiaCCHelper.d.ts

@@ -5,17 +5,16 @@ export declare class ChallengeNvidiaCCHelper {
     /**
      * Reports how the GPUs can reach each other's memory.
      *
-     * A PCIe or unidentified peer path carries traffic outside the encrypted
-     * CPU-GPU channel and nothing can vouch for it, so it is rejected here.
-     * NVLink is accepted here. Whether a separate NVSwitch token is required
-     * is determined from the LS10 count returned by getGPUTopology(): Hopper
-     * exposes attestable LS10 switches, while Blackwell does not.
+     * PCIe and unidentified peer paths are reported as unverified metadata;
+     * the verifier only permits that state on an untrusted network. Whether
+     * NVLink requires a separate NVSwitch token is determined from the LS10
+     * count returned by getGPUTopology(): Hopper exposes attestable LS10
+     * switches, while Blackwell does not.
      *
-     * @returns whether any GPU pair is linked over NVLink
-     * @throws if a peer path bypasses the encrypted channel, or if NVML cannot
-     *   be queried
+     * @returns the metadata status to bind to the TEE challenge
+     * @throws if NVML cannot be queried
      */
-    private static checkGpuInterconnect;
+    private static getGpuInterconnectStatus;
     static getTokenHash(token: NvidiaCCToken): Buffer;
     static getTokenAndCombinedChallengeData(baseUserData: Buffer, logger?: Log): Promise<{
         nvidiaTokens: NvidiaCCToken | undefined;

package/dist/challengeProvider/challengeNvidiaCCHelper.js

@@ -18,17 +18,16 @@ class ChallengeNvidiaCCHelper {
                 gpuCount: topology.gpuCount,
                 nvswitchCount: topology.nvswitchCount,
             });
-            if (topology.gpuCount > 1) {
-                const { hasNvlink } = await ChallengeNvidiaCCHelper.checkGpuInterconnect(wrapper, log);
-                if (hasNvlink && topology.nvswitchCount === 0) {
-                    log?.warn('No attestable LS10 NVSwitch devices were found; continuing with GPU-only attestation (expected for Blackwell)');
-                }
-            }
             if (!topology.gpuCount) {
                 log?.info('Challenge NVIDIA token present: false');
                 log?.info('NVIDIA token retrieval skipped: no GPUs detected in topology');
                 return;
             }
+            let gpuInterconnectStatus;
+            if (topology.gpuCount > 1) {
+                gpuInterconnectStatus =
+                    await ChallengeNvidiaCCHelper.getGpuInterconnectStatus(wrapper, topology.nvswitchCount, log);
+            }
             const nonce = sp_nvtrust_wrapper_1.NvtrustWrapper.generateNonce();
             log?.debug('Attempting NVIDIA token retrieval for detected GPUs', {
                 gpuCount: topology.gpuCount,
@@ -39,7 +38,8 @@ class ChallengeNvidiaCCHelper {
                 ppcieMode: false,
             });
             let nvswitchToken;
-            if (topology.nvswitchCount > 0) {
+            if (gpuInterconnectStatus ===
+                sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED) {
                 log?.debug('Attempting NVIDIA NVSwitch token retrieval', {
                     nvswitchCount: topology.nvswitchCount,
                 });
@@ -60,7 +60,10 @@ class ChallengeNvidiaCCHelper {
             });
             return {
                 gpuToken: gpuTokenRaw.jwt,
-                ...(nvswitchToken ? { nvswitchToken } : {}),
+                ...(gpuInterconnectStatus !== undefined
+                    ? { gpuInterconnectStatus }
+                    : {}),
+                ...(nvswitchToken !== undefined ? { nvswitchToken } : {}),
             };
         }
         catch (error) {
@@ -92,17 +95,16 @@ class ChallengeNvidiaCCHelper {
     /**
      * Reports how the GPUs can reach each other's memory.
      *
-     * A PCIe or unidentified peer path carries traffic outside the encrypted
-     * CPU-GPU channel and nothing can vouch for it, so it is rejected here.
-     * NVLink is accepted here. Whether a separate NVSwitch token is required
-     * is determined from the LS10 count returned by getGPUTopology(): Hopper
-     * exposes attestable LS10 switches, while Blackwell does not.
+     * PCIe and unidentified peer paths are reported as unverified metadata;
+     * the verifier only permits that state on an untrusted network. Whether
+     * NVLink requires a separate NVSwitch token is determined from the LS10
+     * count returned by getGPUTopology(): Hopper exposes attestable LS10
+     * switches, while Blackwell does not.
      *
-     * @returns whether any GPU pair is linked over NVLink
-     * @throws if a peer path bypasses the encrypted channel, or if NVML cannot
-     *   be queried
+     * @returns the metadata status to bind to the TEE challenge
+     * @throws if NVML cannot be queried
      */
-    static async checkGpuInterconnect(wrapper, log) {
+    static async getGpuInterconnectStatus(wrapper, nvswitchCount, log) {
         const links = await wrapper.getGpuInterconnect();
         const describe = (type) => sp_nvtrust_wrapper_1.GpuInterconnectLinkType[type] ?? String(type);
         const format = (subset) => subset
@@ -119,23 +121,35 @@ class ChallengeNvidiaCCHelper {
             sp_nvtrust_wrapper_1.GpuInterconnectLinkType.GPU_INTERCONNECT_LINK_TYPE_NONE);
         if (connected.length === 0) {
             log?.info('GPUs are isolated: no direct interconnect detected');
-            return { hasNvlink: false };
+            return sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_DISCONNECTED;
         }
         const bypassing = connected.filter((link) => link.type !==
             sp_nvtrust_wrapper_1.GpuInterconnectLinkType.GPU_INTERCONNECT_LINK_TYPE_NVLINK);
         if (bypassing.length > 0) {
             const details = format(bypassing);
-            log?.error('GPU interconnect bypasses the encrypted channel', {
-                links: details,
-            });
-            throw new Error(`Unsupported direct GPU interconnect detected: ${details}`);
+            log?.warn('Unverified direct GPU interconnect detected; it is allowed only on an untrusted network', { links: details });
+            return sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_DIRECT_UNVERIFIED;
         }
         log?.warn('NVLink interconnect detected', { links: format(connected) });
-        return { hasNvlink: true };
+        if (nvswitchCount === 0) {
+            log?.warn('No attestable LS10 NVSwitch devices were found; continuing with GPU-only attestation (expected for Blackwell)');
+            return sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_NOT_APPLICABLE;
+        }
+        return sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED;
     }
     static getTokenHash(token) {
         const hash = (0, crypto_1.createHash)('sha256');
-        hash.update(JSON.stringify(token));
+        hash.update(JSON.stringify({
+            gpuToken: token.gpuToken,
+            ...(token.gpuInterconnectStatus !== undefined
+                ? {
+                    gpuInterconnectStatus: token.gpuInterconnectStatus,
+                }
+                : {}),
+            ...(token.nvswitchToken !== undefined
+                ? { nvswitchToken: token.nvswitchToken }
+                : {}),
+        }));
         return hash.digest();
     }
     static async getTokenAndCombinedChallengeData(baseUserData, logger) {
@@ -159,4 +173,4 @@ class ChallengeNvidiaCCHelper {
     }
 }
 exports.ChallengeNvidiaCCHelper = ChallengeNvidiaCCHelper;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBTTRDO0FBRTVDLG1DQUFvQztBQUVwQyxNQUFhLHVCQUF1QjtJQUN4QixNQUFNLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FDL0IsTUFBWTtRQUVaLE1BQU0sR0FBRyxHQUFHLE1BQU0sRUFBRSxLQUFLLENBQUM7WUFDdEIsTUFBTSxFQUFFLHlCQUF5QjtTQUNwQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLG1DQUFjLEVBQUUsQ0FBQztZQUNyQyxHQUFHLEVBQUUsSUFBSSxDQUFDLDZCQUE2QixDQUFDLENBQUM7WUFDekMsTUFBTSxPQUFPLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUNsQyxHQUFHLEVBQUUsSUFBSSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7WUFFOUMsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDaEQsR0FBRyxFQUFFLEtBQUssQ0FBQyw4QkFBOEIsRUFBRTtnQkFDdkMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2dCQUMzQixhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7YUFDeEMsQ0FBQyxDQUFDO1lBRUgsSUFBSSxRQUFRLENBQUMsUUFBUSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUN4QixNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQ2YsTUFBTSx1QkFBdUIsQ0FBQyxvQkFBb0IsQ0FDOUMsT0FBTyxFQUNQLEdBQUcsQ0FDTixDQUFDO2dCQUNOLElBQUksU0FBUyxJQUFJLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7b0JBQzVDLEdBQUcsRUFBRSxJQUFJLENBQ0wsK0dBQStHLENBQ2xILENBQUM7Z0JBQ04sQ0FBQztZQUNMLENBQUM7WUFFRCxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUNyQixHQUFHLEVBQUUsSUFBSSxDQUFDLHVDQUF1QyxDQUFDLENBQUM7Z0JBQ25ELEdBQUcsRUFBRSxJQUFJLENBQ0wsOERBQThELENBQ2pFLENBQUM7Z0JBQ0YsT0FBTztZQUNYLENBQUM7WUFFRCxNQUFNLEtBQUssR0FBRyxtQ0FBYyxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQzdDLEdBQUcsRUFBRSxLQUFLLENBQUMscURBQXFELEVBQUU7Z0JBQzlELFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUTthQUM5QixDQUFDLENBQUM7WUFDSCxNQUFNLFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxjQUFjLENBQUM7Z0JBQzdDLE1BQU0sRUFBRSxxQ0FBZ0IsQ0FBQyxHQUFHO2dCQUM1QixLQUFLO2dCQUNMLFNBQVMsRUFBRSxLQUFLO2FBQ25CLENBQUMsQ0FBQztZQUVILElBQUksYUFBaUMsQ0FBQztZQUN0QyxJQUFJLFFBQVEsQ0FBQyxhQUFhLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQzdCLEdBQUcsRUFBRSxLQUFLLENBQUMsNENBQTRDLEVBQUU7b0JBQ3JELGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYTtpQkFDeEMsQ0FBQyxDQUFDO2dCQUNILE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxDQUFDO29CQUNsRCxNQUFNLEVBQUUscUNBQWdCLENBQUMsTUFBTTtvQkFDL0IsS0FBSztvQkFDTCxTQUFTLEVBQUUsS0FBSztpQkFDbkIsQ0FBQyxDQUFDO2dCQUNILGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUM7Z0JBQ3JDLEdBQUcsRUFBRSxJQUFJLENBQUMsOENBQThDLEVBQUU7b0JBQ3RELGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYTtpQkFDeEMsQ0FBQyxDQUFDO1lBQ1AsQ0FBQztZQUVELEdBQUcsRUFBRSxJQUFJLENBQUMsc0NBQXNDLENBQUMsQ0FBQztZQUNsRCxHQUFHLEVBQUUsSUFBSSxDQUFDLHFDQUFxQyxFQUFFO2dCQUM3QyxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVE7Z0JBQzNCLGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYTthQUN4QyxDQUFDLENBQUM7WUFDSCxPQUFPO2dCQUNILFFBQVEsRUFBRSxXQUFXLENBQUMsR0FBRztnQkFDekIsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQzlDLENBQUM7UUFDTixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNiLElBQUksS0FBSyxZQUFZLDRDQUF1QixFQUFFLENBQUM7Z0JBQzNDLEdBQUcsRUFBRSxLQUFLLENBQUMsNEJBQTRCLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUN4RCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztvQkFDMUIsR0FBRyxFQUFFLEtBQUssQ0FBQyxlQUFlLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDcEQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN4QixHQUFHLEVBQUUsS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7b0JBQ3pDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDOUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxPQUFPLFFBQVEsTUFBTSxDQUFDLENBQUM7d0JBQ2xDLEdBQUcsRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7b0JBQ25DLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7aUJBQU0sSUFBSSxLQUFLLFlBQVksdUNBQWtCLEVBQUUsQ0FBQztnQkFDN0MsR0FBRyxFQUFFLEtBQUssQ0FBQyx5QkFBeUIsRUFBRTtvQkFDbEMsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNO2lCQUN2QixDQUFDLENBQUM7WUFDUCxDQUFDO2lCQUFNLENBQUM7Z0JBQ0osR0FBRyxFQUFFLEtBQUssQ0FBQyx3Q0FBd0MsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUNoRSxDQUFDO1lBRUQsTUFBTSxLQUFLLENBQUM7UUFDaEIsQ0FBQztJQUNMLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7O09BWUc7SUFDSyxNQUFNLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUNyQyxPQUF1QixFQUN2QixHQUFTO1FBRVQsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUNqRCxNQUFNLFFBQVEsR0FBRyxDQUFDLElBQTZCLEVBQVUsRUFBRSxDQUN2RCw0Q0FBdUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDbEQsTUFBTSxNQUFNLEdBQUcsQ0FBQyxNQUFvQixFQUFVLEVBQUUsQ0FDNUMsTUFBTTthQUNELEdBQUcsQ0FDQSxDQUFDLElBQUksRUFBRSxFQUFFLENBQ0wsR0FBRyxJQUFJLENBQUMsSUFBSSxRQUFRLElBQUksQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUM5RDthQUNBLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUVwQixHQUFHLEVBQUUsS0FBSyxDQUFDLDBCQUEwQixFQUFFO1lBQ25DLEtBQUssRUFBRSxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUN4QixJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQ2YsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO2dCQUNmLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQzthQUM1QixDQUFDLENBQUM7U0FDTixDQUFDLENBQUM7UUFFSCxNQUFNLFNBQVMsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUMxQixDQUFDLElBQUksRUFBRSxFQUFFLENBQ0wsSUFBSSxDQUFDLElBQUk7WUFDVCw0Q0FBdUIsQ0FBQywrQkFBK0IsQ0FDOUQsQ0FBQztRQUNGLElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6QixHQUFHLEVBQUUsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7WUFDaEUsT0FBTyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUNoQyxDQUFDO1FBRUQsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FDOUIsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUNMLElBQUksQ0FBQyxJQUFJO1lBQ1QsNENBQXVCLENBQUMsaUNBQWlDLENBQ2hFLENBQUM7UUFDRixJQUFJLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdkIsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2xDLEdBQUcsRUFBRSxLQUFLLENBQUMsaURBQWlELEVBQUU7Z0JBQzFELEtBQUssRUFBRSxPQUFPO2FBQ2pCLENBQUMsQ0FBQztZQUNILE1BQU0sSUFBSSxLQUFLLENBQ1gsaURBQWlELE9BQU8sRUFBRSxDQUM3RCxDQUFDO1FBQ04sQ0FBQztRQUVELEdBQUcsRUFBRSxJQUFJLENBQUMsOEJBQThCLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4RSxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQy9CLENBQUM7SUFFRCxNQUFNLENBQUMsWUFBWSxDQUFDLEtBQW9CO1FBQ3BDLE1BQU0sSUFBSSxHQUFHLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQztRQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNuQyxPQUFPLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUN6QixDQUFDO0lBRUQsTUFBTSxDQUFDLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FDekMsWUFBb0IsRUFDcEIsTUFBWTtRQUtaLE1BQU0sR0FBRyxHQUFHLE1BQU0sRUFBRSxLQUFLLENBQUM7WUFDdEIsTUFBTSxFQUFFLHlCQUF5QjtTQUNwQyxDQUFDLENBQUM7UUFDSCxNQUFNLFlBQVksR0FDZCxNQUFNLHVCQUF1QixDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN6RCxNQUFNLGVBQWUsR0FDakIsWUFBWSxJQUFJLHVCQUF1QixDQUFDLFlBQVksQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUV2RSxNQUFNLGFBQWEsR0FBRyxlQUFlO1lBQ2pDLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsWUFBWSxFQUFFLGVBQWUsQ0FBQyxDQUFDO1lBQ2hELENBQUMsQ0FBQyxZQUFZLENBQUM7UUFFbkIsSUFBSSxhQUFhLENBQUMsTUFBTSxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQzVCLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBQ0QsR0FBRyxFQUFFLEtBQUssQ0FBQyxrQ0FBa0MsRUFBRTtZQUMzQyxrQkFBa0IsRUFBRSxZQUFZLENBQUMsTUFBTTtZQUN2QyxtQkFBbUIsRUFBRSxhQUFhLENBQUMsTUFBTTtZQUN6QyxjQUFjLEVBQUUsT0FBTyxDQUFDLFlBQVksQ0FBQztTQUN4QyxDQUFDLENBQUM7UUFDSCxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxDQUFDO0lBQzNDLENBQUM7Q0FDSjtBQTFNRCwwREEwTUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvY2hhbGxlbmdlTnZpZGlhQ0NIZWxwZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBTzRDO0FBRTVDLG1DQUFvQztBQUVwQyxNQUFhLHVCQUF1QjtJQUN4QixNQUFNLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FDL0IsTUFBWTtRQUVaLE1BQU0sR0FBRyxHQUFHLE1BQU0sRUFBRSxLQUFLLENBQUM7WUFDdEIsTUFBTSxFQUFFLHlCQUF5QjtTQUNwQyxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLG1DQUFjLEVBQUUsQ0FBQztZQUNyQyxHQUFHLEVBQUUsSUFBSSxDQUFDLDZCQUE2QixDQUFDLENBQUM7WUFDekMsTUFBTSxPQUFPLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUNsQyxHQUFHLEVBQUUsSUFBSSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7WUFFOUMsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDaEQsR0FBRyxFQUFFLEtBQUssQ0FBQyw4QkFBOEIsRUFBRTtnQkFDdkMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2dCQUMzQixhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7YUFDeEMsQ0FBQyxDQUFDO1lBRUgsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztnQkFDckIsR0FBRyxFQUFFLElBQUksQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO2dCQUNuRCxHQUFHLEVBQUUsSUFBSSxDQUNMLDhEQUE4RCxDQUNqRSxDQUFDO2dCQUNGLE9BQU87WUFDWCxDQUFDO1lBRUQsSUFBSSxxQkFBOEQsQ0FBQztZQUNuRSxJQUFJLFFBQVEsQ0FBQyxRQUFRLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hCLHFCQUFxQjtvQkFDakIsTUFBTSx1QkFBdUIsQ0FBQyx3QkFBd0IsQ0FDbEQsT0FBTyxFQUNQLFFBQVEsQ0FBQyxhQUFhLEVBQ3RCLEdBQUcsQ0FDTixDQUFDO1lBQ1YsQ0FBQztZQUVELE1BQU0sS0FBSyxHQUFHLG1DQUFjLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDN0MsR0FBRyxFQUFFLEtBQUssQ0FBQyxxREFBcUQsRUFBRTtnQkFDOUQsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2FBQzlCLENBQUMsQ0FBQztZQUNILE1BQU0sV0FBVyxHQUFHLE1BQU0sT0FBTyxDQUFDLGNBQWMsQ0FBQztnQkFDN0MsTUFBTSxFQUFFLHFDQUFnQixDQUFDLEdBQUc7Z0JBQzVCLEtBQUs7Z0JBQ0wsU0FBUyxFQUFFLEtBQUs7YUFDbkIsQ0FBQyxDQUFDO1lBRUgsSUFBSSxhQUFpQyxDQUFDO1lBQ3RDLElBQ0kscUJBQXFCO2dCQUNyQixnREFBMkIsQ0FBQywwREFBMEQsRUFDeEYsQ0FBQztnQkFDQyxHQUFHLEVBQUUsS0FBSyxDQUFDLDRDQUE0QyxFQUFFO29CQUNyRCxhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7aUJBQ3hDLENBQUMsQ0FBQztnQkFDSCxNQUFNLGdCQUFnQixHQUFHLE1BQU0sT0FBTyxDQUFDLGNBQWMsQ0FBQztvQkFDbEQsTUFBTSxFQUFFLHFDQUFnQixDQUFDLE1BQU07b0JBQy9CLEtBQUs7b0JBQ0wsU0FBUyxFQUFFLEtBQUs7aUJBQ25CLENBQUMsQ0FBQztnQkFDSCxhQUFhLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDO2dCQUNyQyxHQUFHLEVBQUUsSUFBSSxDQUFDLDhDQUE4QyxFQUFFO29CQUN0RCxhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7aUJBQ3hDLENBQUMsQ0FBQztZQUNQLENBQUM7WUFFRCxHQUFHLEVBQUUsSUFBSSxDQUFDLHNDQUFzQyxDQUFDLENBQUM7WUFDbEQsR0FBRyxFQUFFLElBQUksQ0FBQyxxQ0FBcUMsRUFBRTtnQkFDN0MsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRO2dCQUMzQixhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7YUFDeEMsQ0FBQyxDQUFDO1lBQ0gsT0FBTztnQkFDSCxRQUFRLEVBQUUsV0FBVyxDQUFDLEdBQUc7Z0JBQ3pCLEdBQUcsQ0FBQyxxQkFBcUIsS0FBSyxTQUFTO29CQUNuQyxDQUFDLENBQUMsRUFBRSxxQkFBcUIsRUFBRTtvQkFDM0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDVCxHQUFHLENBQUMsYUFBYSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQzVELENBQUM7UUFDTixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNiLElBQUksS0FBSyxZQUFZLDRDQUF1QixFQUFFLENBQUM7Z0JBQzNDLEdBQUcsRUFBRSxLQUFLLENBQUMsNEJBQTRCLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUN4RCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztvQkFDMUIsR0FBRyxFQUFFLEtBQUssQ0FBQyxlQUFlLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDcEQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN4QixHQUFHLEVBQUUsS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7b0JBQ3pDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDOUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxPQUFPLFFBQVEsTUFBTSxDQUFDLENBQUM7d0JBQ2xDLEdBQUcsRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7b0JBQ25DLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7aUJBQU0sSUFBSSxLQUFLLFlBQVksdUNBQWtCLEVBQUUsQ0FBQztnQkFDN0MsR0FBRyxFQUFFLEtBQUssQ0FBQyx5QkFBeUIsRUFBRTtvQkFDbEMsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNO2lCQUN2QixDQUFDLENBQUM7WUFDUCxDQUFDO2lCQUFNLENBQUM7Z0JBQ0osR0FBRyxFQUFFLEtBQUssQ0FBQyx3Q0FBd0MsS0FBSyxFQUFFLENBQUMsQ0FBQztZQUNoRSxDQUFDO1lBRUQsTUFBTSxLQUFLLENBQUM7UUFDaEIsQ0FBQztJQUNMLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7T0FXRztJQUNLLE1BQU0sQ0FBQyxLQUFLLENBQUMsd0JBQXdCLENBQ3pDLE9BQXVCLEVBQ3ZCLGFBQXFCLEVBQ3JCLEdBQVM7UUFFVCxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1FBQ2pELE1BQU0sUUFBUSxHQUFHLENBQUMsSUFBNkIsRUFBVSxFQUFFLENBQ3ZELDRDQUF1QixDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNsRCxNQUFNLE1BQU0sR0FBRyxDQUFDLE1BQW9CLEVBQVUsRUFBRSxDQUM1QyxNQUFNO2FBQ0QsR0FBRyxDQUNBLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FDTCxHQUFHLElBQUksQ0FBQyxJQUFJLFFBQVEsSUFBSSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQzlEO2FBQ0EsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXBCLEdBQUcsRUFBRSxLQUFLLENBQUMsMEJBQTBCLEVBQUU7WUFDbkMsS0FBSyxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ3hCLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtnQkFDZixJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7Z0JBQ2YsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDO2FBQzVCLENBQUMsQ0FBQztTQUNOLENBQUMsQ0FBQztRQUVILE1BQU0sU0FBUyxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQzFCLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FDTCxJQUFJLENBQUMsSUFBSTtZQUNULDRDQUF1QixDQUFDLCtCQUErQixDQUM5RCxDQUFDO1FBQ0YsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pCLEdBQUcsRUFBRSxJQUFJLENBQUMsb0RBQW9ELENBQUMsQ0FBQztZQUNoRSxPQUFPLGdEQUEyQixDQUFDLG9DQUFvQyxDQUFDO1FBQzVFLENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxTQUFTLENBQUMsTUFBTSxDQUM5QixDQUFDLElBQUksRUFBRSxFQUFFLENBQ0wsSUFBSSxDQUFDLElBQUk7WUFDVCw0Q0FBdUIsQ0FBQyxpQ0FBaUMsQ0FDaEUsQ0FBQztRQUNGLElBQUksU0FBUyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDbEMsR0FBRyxFQUFFLElBQUksQ0FDTCx5RkFBeUYsRUFDekYsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQ3JCLENBQUM7WUFDRixPQUFPLGdEQUEyQixDQUFDLHlDQUF5QyxDQUFDO1FBQ2pGLENBQUM7UUFFRCxHQUFHLEVBQUUsSUFBSSxDQUFDLDhCQUE4QixFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDeEUsSUFBSSxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEIsR0FBRyxFQUFFLElBQUksQ0FDTCwrR0FBK0csQ0FDbEgsQ0FBQztZQUNGLE9BQU8sZ0RBQTJCLENBQUMsZ0VBQWdFLENBQUM7UUFDeEcsQ0FBQztRQUVELE9BQU8sZ0RBQTJCLENBQUMsMERBQTBELENBQUM7SUFDbEcsQ0FBQztJQUVELE1BQU0sQ0FBQyxZQUFZLENBQUMsS0FBb0I7UUFDcEMsTUFBTSxJQUFJLEdBQUcsSUFBQSxtQkFBVSxFQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2xDLElBQUksQ0FBQyxNQUFNLENBQ1AsSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUNYLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixHQUFHLENBQUMsS0FBSyxDQUFDLHFCQUFxQixLQUFLLFNBQVM7Z0JBQ3pDLENBQUMsQ0FBQztvQkFDSSxxQkFBcUIsRUFBRSxLQUFLLENBQUMscUJBQXFCO2lCQUNyRDtnQkFDSCxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ1QsR0FBRyxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssU0FBUztnQkFDakMsQ0FBQyxDQUFDLEVBQUUsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhLEVBQUU7Z0JBQ3hDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDWixDQUFDLENBQ0wsQ0FBQztRQUNGLE9BQU8sSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3pCLENBQUM7SUFFRCxNQUFNLENBQUMsS0FBSyxDQUFDLGdDQUFnQyxDQUN6QyxZQUFvQixFQUNwQixNQUFZO1FBS1osTUFBTSxHQUFHLEdBQUcsTUFBTSxFQUFFLEtBQUssQ0FBQztZQUN0QixNQUFNLEVBQUUseUJBQXlCO1NBQ3BDLENBQUMsQ0FBQztRQUNILE1BQU0sWUFBWSxHQUNkLE1BQU0sdUJBQXVCLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pELE1BQU0sZUFBZSxHQUNqQixZQUFZLElBQUksdUJBQXVCLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBRXZFLE1BQU0sYUFBYSxHQUFHLGVBQWU7WUFDakMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxZQUFZLEVBQUUsZUFBZSxDQUFDLENBQUM7WUFDaEQsQ0FBQyxDQUFDLFlBQVksQ0FBQztRQUVuQixJQUFJLGFBQWEsQ0FBQyxNQUFNLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFDRCxHQUFHLEVBQUUsS0FBSyxDQUFDLGtDQUFrQyxFQUFFO1lBQzNDLGtCQUFrQixFQUFFLFlBQVksQ0FBQyxNQUFNO1lBQ3ZDLG1CQUFtQixFQUFFLGFBQWEsQ0FBQyxNQUFNO1lBQ3pDLGNBQWMsRUFBRSxPQUFPLENBQUMsWUFBWSxDQUFDO1NBQ3hDLENBQUMsQ0FBQztRQUNILE9BQU8sRUFBRSxZQUFZLEVBQUUsYUFBYSxFQUFFLENBQUM7SUFDM0MsQ0FBQztDQUNKO0FBL05ELDBEQStOQyJ9

package/dist/challengeProvider/challengeProviderTdxAzure.d.ts

@@ -0,0 +1,8 @@
+/// <reference types="node" />
+import { ChallengeProvider } from './challengeProvider';
+import { Challenge, Log } from '@super-protocol/pki-common';
+export declare class ChallengeProviderTdxAzure implements ChallengeProvider {
+    readonly logger?: Log | undefined;
+    constructor(logger?: Log | undefined);
+    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
+}

package/dist/challengeProvider/challengeProviderTdxAzure.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeProviderTdxAzure = void 0;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const challengeNvidiaCCHelper_1 = require("./challengeNvidiaCCHelper");
+const pki_common_1 = require("@super-protocol/pki-common");
+const tdxAzureEvidence_1 = require("../azure/tdxAzureEvidence");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+class ChallengeProviderTdxAzure {
+    logger;
+    constructor(logger) {
+        this.logger = logger;
+    }
+    async generateChallenge(userData, networkID) {
+        const { challengeData, nvidiaTokens } = await challengeNvidiaCCHelper_1.ChallengeNvidiaCCHelper.getTokenAndCombinedChallengeData(userData, this.logger);
+        const bin = process.env.AZURE_GUEST_ATTEST ?? 'azure-guest-attest';
+        const args = [
+            'guest-attest',
+            '--provider',
+            'maa',
+            '--json',
+            '--user-data',
+            `hex:${challengeData.toString('hex')}`,
+        ];
+        let stdout;
+        try {
+            const result = await execFileAsync(bin, args, {
+                timeout: 30000,
+                maxBuffer: 4 * 1024 * 1024,
+            });
+            stdout = result.stdout;
+        }
+        catch (error) {
+            throw new Error(`azure-guest-attest failed (${bin}): ${error.stderr || error.message}`);
+        }
+        const jsonStart = stdout.indexOf('{');
+        if (jsonStart < 0) {
+            throw new Error('azure-guest-attest returned no JSON');
+        }
+        const parsed = JSON.parse(stdout.slice(jsonStart));
+        if (!parsed.passed || typeof parsed.token !== 'string') {
+            throw new Error(`Azure MAA guest attestation failed: ${parsed.error || 'no token'}`);
+        }
+        return {
+            type: pki_common_1.ChallengeType.TDXAZURE,
+            evidenceBase64: (0, tdxAzureEvidence_1.encodeTdxAzureEvidence)(parsed.token).toString('base64'),
+            nvidiaTokens,
+            networkID,
+        };
+    }
+}
+exports.ChallengeProviderTdxAzure = ChallengeProviderTdxAzure;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlUHJvdmlkZXJUZHhBenVyZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VQcm92aWRlci9jaGFsbGVuZ2VQcm92aWRlclRkeEF6dXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLGlEQUF5QztBQUN6QywrQkFBaUM7QUFDakMsdUVBQW9FO0FBRXBFLDJEQUEyRTtBQUMzRSxnRUFBbUU7QUFFbkUsTUFBTSxhQUFhLEdBQUcsSUFBQSxnQkFBUyxFQUFDLHdCQUFRLENBQUMsQ0FBQztBQUUxQyxNQUFhLHlCQUF5QjtJQUNOO0lBQTVCLFlBQTRCLE1BQVk7UUFBWixXQUFNLEdBQU4sTUFBTSxDQUFNO0lBQUcsQ0FBQztJQUU1QyxLQUFLLENBQUMsaUJBQWlCLENBQ25CLFFBQWdCLEVBQ2hCLFNBQWtCO1FBRWxCLE1BQU0sRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUFFLEdBQ2pDLE1BQU0saURBQXVCLENBQUMsZ0NBQWdDLENBQzFELFFBQVEsRUFDUixJQUFJLENBQUMsTUFBTSxDQUNkLENBQUM7UUFFTixNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGtCQUFrQixJQUFJLG9CQUFvQixDQUFDO1FBQ25FLE1BQU0sSUFBSSxHQUFHO1lBQ1QsY0FBYztZQUNkLFlBQVk7WUFDWixLQUFLO1lBQ0wsUUFBUTtZQUNSLGFBQWE7WUFDYixPQUFPLGFBQWEsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUU7U0FDekMsQ0FBQztRQUVGLElBQUksTUFBYyxDQUFDO1FBQ25CLElBQUksQ0FBQztZQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sYUFBYSxDQUFDLEdBQUcsRUFBRSxJQUFJLEVBQUU7Z0JBQzFDLE9BQU8sRUFBRSxLQUFNO2dCQUNmLFNBQVMsRUFBRSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUk7YUFDN0IsQ0FBQyxDQUFDO1lBQ0gsTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDM0IsQ0FBQztRQUFDLE9BQU8sS0FBVSxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLEtBQUssQ0FDWCw4QkFBOEIsR0FBRyxNQUFNLEtBQUssQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUN6RSxDQUFDO1FBQ04sQ0FBQztRQUVELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDdEMsSUFBSSxTQUFTLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDaEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBSWhELENBQUM7UUFDRixJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sSUFBSSxPQUFPLE1BQU0sQ0FBQyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDckQsTUFBTSxJQUFJLEtBQUssQ0FDWCx1Q0FBdUMsTUFBTSxDQUFDLEtBQUssSUFBSSxVQUFVLEVBQUUsQ0FDdEUsQ0FBQztRQUNOLENBQUM7UUFFRCxPQUFPO1lBQ0gsSUFBSSxFQUFFLDBCQUFhLENBQUMsUUFBUTtZQUM1QixjQUFjLEVBQUUsSUFBQSx5Q0FBc0IsRUFBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUN6RCxRQUFRLENBQ1g7WUFDRCxZQUFZO1lBQ1osU0FBUztTQUNaLENBQUM7SUFDTixDQUFDO0NBQ0o7QUE1REQsOERBNERDIn0=

package/dist/challengeProvider/index.d.ts

@@ -1,5 +1,6 @@
 export * from './challengeProvider';
 export * from './challengeProviderTdx';
+export * from './challengeProviderTdxAzure';
 export * from './challengeProviderUntrusted';
 export * from './challengeProviderSevSnp';
 export * from './challengeNvidiaCCHelper';

package/dist/challengeProvider/index.js

@@ -16,9 +16,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./challengeProvider"), exports);
 __exportStar(require("./challengeProviderTdx"), exports);
+__exportStar(require("./challengeProviderTdxAzure"), exports);
 __exportStar(require("./challengeProviderUntrusted"), exports);
 __exportStar(require("./challengeProviderSevSnp"), exports);
 __exportStar(require("./challengeNvidiaCCHelper"), exports);
 __exportStar(require("./challengeProviderCertificate"), exports);
 __exportStar(require("./challengeProviderToken"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHNEQUFvQztBQUNwQyx5REFBdUM7QUFDdkMsK0RBQTZDO0FBQzdDLDREQUEwQztBQUMxQyw0REFBMEM7QUFDMUMsaUVBQStDO0FBQy9DLDJEQUF5QyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlUHJvdmlkZXIvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHNEQUFvQztBQUNwQyx5REFBdUM7QUFDdkMsOERBQTRDO0FBQzVDLCtEQUE2QztBQUM3Qyw0REFBMEM7QUFDMUMsNERBQTBDO0FBQzFDLGlFQUErQztBQUMvQywyREFBeUMifQ==

package/dist/challengeValidator/challengeValidatorNvidia.js

@@ -48,8 +48,58 @@ class ChallengeValidatorNvidia {
                 throw new Error('Failed to verify Nvidia GPU token: validateToken returned success=false');
             }
             log.info('NVIDIA validation passed: nvtrust token verification succeeded');
-            const { nvswitchToken } = challenge.nvidiaTokens;
-            if (nvswitchToken) {
+            const gpusInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractGPUInfoFromToken({
+                jwt: challenge.nvidiaTokens.gpuToken,
+            });
+            const gpuCount = gpusInfo.gpus.length;
+            if (gpuCount === 0) {
+                throw new Error('Validated NVIDIA GPU token does not contain any GPU claims');
+            }
+            const { gpuInterconnectStatus, nvswitchToken } = challenge.nvidiaTokens;
+            const hasGpuInterconnectStatus = gpuInterconnectStatus !== undefined;
+            const hasNVSwitchToken = nvswitchToken !== undefined;
+            if (gpuCount === 1) {
+                if (hasGpuInterconnectStatus || hasNVSwitchToken) {
+                    throw new Error('NVIDIA GPU interconnect status and NVSwitch token must be omitted for a single GPU');
+                }
+            }
+            else if (!hasGpuInterconnectStatus) {
+                throw new Error('NVIDIA GPU interconnect status is required when the validated GPU token contains multiple GPUs');
+            }
+            if (gpuInterconnectStatus !==
+                sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED &&
+                hasNVSwitchToken) {
+                throw new Error('NVIDIA NVSwitch token is only allowed for a verified NVLink switch interconnect');
+            }
+            switch (gpuInterconnectStatus) {
+                case undefined:
+                    break;
+                case sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_DISCONNECTED:
+                    log.info('Multiple disconnected NVIDIA GPUs were reported by TEE-bound interconnect metadata');
+                    break;
+                case sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_DIRECT_UNVERIFIED:
+                    if (networkType !== 'untrusted') {
+                        throw new Error('Unverified direct NVIDIA GPU interconnect is only allowed on an untrusted network');
+                    }
+                    log.warn('Allowing unverified direct NVIDIA GPU interconnect on an untrusted network');
+                    break;
+                case sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_NOT_APPLICABLE:
+                    // TODO(NVIDIA NVLink attestation): Revisit this branch if NVIDIA
+                    // introduces or requires separate NVLink/NVSwitch attestation for
+                    // Blackwell. NOT_APPLICABLE currently has no switch token and relies
+                    // on the validated GPU token plus TEE-bound interconnect metadata.
+                    log.info('Separate NVIDIA NVSwitch attestation is not applicable to this NVLink topology');
+                    break;
+                case sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED:
+                    if (!nvswitchToken) {
+                        throw new Error('Verified NVIDIA NVLink switch interconnect requires a non-empty NVSwitch token');
+                    }
+                    break;
+                default:
+                    throw new Error(`Unknown NVIDIA GPU interconnect status: ${gpuInterconnectStatus}`);
+            }
+            if (gpuInterconnectStatus ===
+                sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED) {
                 nvidiaTokenValidationResult = await nvtrusWrapper.validateToken({
                     device: sp_nvtrust_wrapper_1.NvidiaDeviceType.SWITCH,
                     policy: sp_nvtrust_wrapper_1.defaultNVSwitchPolicy,
@@ -59,11 +109,27 @@ class ChallengeValidatorNvidia {
                     throw new Error('Failed to verify Nvidia NVSwitch token: validateToken returned success=false');
                 }
                 log.info('NVIDIA NVSwitch validation passed: nvtrust token verification succeeded');
+                const switchesInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractNVSwitchInfoFromToken({
+                    jwt: nvswitchToken,
+                });
+                if (switchesInfo.length === 0) {
+                    throw new Error('Validated NVIDIA NVSwitch token does not contain any switch claims');
+                }
+                if (networkType === 'trusted') {
+                    const insecureSwitchNumbers = switchesInfo
+                        .map((nvSwitch, index) => ({
+                        nvSwitch,
+                        switchNumber: index + 1,
+                    }))
+                        .filter(({ nvSwitch }) => !nvSwitch.secureBoot || nvSwitch.debugEnabled)
+                        .map(({ switchNumber }) => switchNumber);
+                    if (insecureSwitchNumbers.length > 0) {
+                        throw new Error(`Trusted network requires secure boot and disabled debug mode on every NVIDIA NVSwitch. Invalid switch(es): ${insecureSwitchNumbers.join(', ')}`);
+                    }
+                    log.info(`NVIDIA trusted policy check passed: secure boot is enabled and debug mode is disabled on all ${switchesInfo.length} NVSwitch(es)`);
+                }
             }
             if (networkType === 'trusted') {
-                const gpusInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.extractGPUInfoFromToken({
-                    jwt: challenge.nvidiaTokens.gpuToken,
-                });
                 const debugGpuNumbers = gpusInfo.gpus
                     .map((gpu, index) => ({ gpu, gpuNumber: index + 1 }))
                     .filter(({ gpu }) => gpu.dbgStat === true)
@@ -102,4 +168,4 @@ class ChallengeValidatorNvidia {
     }
 }
 exports.ChallengeValidatorNvidia = ChallengeValidatorNvidia;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yTnZpZGlhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JOdmlkaWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBTzRDO0FBRTVDLDJEQUlvQztBQUNwQyw0REFBK0Q7QUFHL0QsTUFBYSx3QkFBd0I7SUFFWjtJQUNBO0lBRnJCLFlBQ3FCLEdBQVEsRUFDUixNQUE2QjtRQUQ3QixRQUFHLEdBQUgsR0FBRyxDQUFLO1FBQ1IsV0FBTSxHQUFOLE1BQU0sQ0FBdUI7SUFDL0MsQ0FBQztJQUVKLEtBQUssQ0FBQyxRQUFRLENBQ1YsU0FBb0IsRUFDcEIsUUFBZ0IsRUFDaEIsV0FBeUI7UUFFekIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUM7WUFDdkIsU0FBUyxFQUFFLDBCQUEwQjtTQUN4QyxDQUFDLENBQUM7UUFDSCxNQUFNLGNBQWMsR0FBRyxJQUFBLG9DQUF1QixFQUFDLFNBQVMsQ0FBQyxDQUFDO1FBRTFELEdBQUcsQ0FBQyxLQUFLLENBQUMsbUNBQW1DLGNBQWMsRUFBRSxDQUFDLENBQUM7UUFDL0QsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ2xCLEdBQUcsQ0FBQyxLQUFLLENBQ0wsb0VBQW9FLENBQ3ZFLENBQUM7WUFDRixPQUFPO1FBQ1gsQ0FBQztRQUNELEdBQUcsQ0FBQyxLQUFLLENBQ0wsNkNBQTZDLFdBQVcsSUFBSSxXQUFXLEVBQUUsQ0FDNUUsQ0FBQztRQUVGLE1BQU0sU0FBUyxHQUFHLDJDQUF1QixDQUFDLFlBQVksQ0FDbEQsU0FBUyxDQUFDLFlBQVksQ0FDekIsQ0FBQztRQUVGLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE1BQU0sWUFBWSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0MsTUFBTSxlQUFlLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRCxHQUFHLENBQUMsS0FBSyxDQUNMLHFCQUFxQixZQUFZLG1CQUFtQixlQUFlLEVBQUUsQ0FDeEUsQ0FBQztRQUNGLElBQUksWUFBWSxLQUFLLGVBQWUsRUFBRSxDQUFDO1lBQ25DLE1BQU0sSUFBSSxLQUFLLENBQ1gsNEdBQTRHLENBQy9HLENBQUM7UUFDTixDQUFDO1FBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixxRUFBcUUsQ0FDeEUsQ0FBQztRQUVGLE1BQU0sYUFBYSxHQUFHLElBQUksbUNBQWMsQ0FDcEMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLElBQUksa0JBQWtCLEVBQ3RDLElBQUksQ0FBQyxNQUFNLEVBQUUsT0FBTyxJQUFJLEtBQUssQ0FDaEMsQ0FBQztRQUVGLElBQUksMkJBQTJCLEdBQXVCO1lBQ2xELE9BQU8sRUFBRSxLQUFLO1NBQ2pCLENBQUM7UUFDRixJQUFJLENBQUM7WUFDRCwyQkFBMkIsR0FBRyxNQUFNLGFBQWEsQ0FBQyxhQUFhLENBQUM7Z0JBQzVELE1BQU0sRUFBRSxxQ0FBZ0IsQ0FBQyxHQUFHO2dCQUM1QixNQUFNLEVBQUUscUNBQWdCO2dCQUN4QixLQUFLLEVBQUUsRUFBRSxHQUFHLEVBQUUsU0FBUyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7YUFDbEQsQ0FBQyxDQUFDO1lBQ0gsSUFBSSwyQkFBMkIsQ0FBQyxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQy9DLE1BQU0sSUFBSSxLQUFLLENBQ1gseUVBQXlFLENBQzVFLENBQUM7WUFDTixDQUFDO1lBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixnRUFBZ0UsQ0FDbkUsQ0FBQztZQUVGLE1BQU0sRUFBRSxhQUFhLEVBQUUsR0FBRyxTQUFTLENBQUMsWUFBWSxDQUFDO1lBQ2pELElBQUksYUFBYSxFQUFFLENBQUM7Z0JBQ2hCLDJCQUEyQixHQUFHLE1BQU0sYUFBYSxDQUFDLGFBQWEsQ0FDM0Q7b0JBQ0ksTUFBTSxFQUFFLHFDQUFnQixDQUFDLE1BQU07b0JBQy9CLE1BQU0sRUFBRSwwQ0FBcUI7b0JBQzdCLEtBQUssRUFBRSxFQUFFLEdBQUcsRUFBRSxhQUFhLEVBQUU7aUJBQ2hDLENBQ0osQ0FBQztnQkFDRixJQUFJLDJCQUEyQixDQUFDLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztvQkFDL0MsTUFBTSxJQUFJLEtBQUssQ0FDWCw4RUFBOEUsQ0FDakYsQ0FBQztnQkFDTixDQUFDO2dCQUNELEdBQUcsQ0FBQyxJQUFJLENBQ0oseUVBQXlFLENBQzVFLENBQUM7WUFDTixDQUFDO1lBRUQsSUFBSSxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sUUFBUSxHQUFHLG1DQUFjLENBQUMsdUJBQXVCLENBQUM7b0JBQ3BELEdBQUcsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLFFBQVE7aUJBQ3ZDLENBQUMsQ0FBQztnQkFDSCxNQUFNLGVBQWUsR0FBRyxRQUFRLENBQUMsSUFBSTtxQkFDaEMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsS0FBSyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7cUJBQ3BELE1BQU0sQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDO3FCQUN6QyxHQUFHLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDdkMsTUFBTSxrQkFBa0IsR0FBRyxlQUFlLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztnQkFDdEQsSUFBSSxrQkFBa0IsRUFBRSxDQUFDO29CQUNyQixNQUFNLG1CQUFtQixHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7b0JBQ3ZELE1BQU0sSUFBSSxLQUFLLENBQ1gsMEZBQTBGLG1CQUFtQixFQUFFLENBQ2xILENBQUM7Z0JBQ04sQ0FBQztnQkFDRCxHQUFHLENBQUMsSUFBSSxDQUNKLDREQUE0RCxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sU0FBUyxDQUM1RixDQUFDO1lBQ04sQ0FBQztpQkFBTSxDQUFDO2dCQUNKLEdBQUcsQ0FBQyxJQUFJLENBQ0osc0VBQXNFLFdBQVcsSUFBSSxXQUFXLEVBQUUsQ0FDckcsQ0FBQztZQUNOLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNiLElBQUksS0FBSyxZQUFZLDRDQUF1QixFQUFFLENBQUM7Z0JBQzNDLEdBQUcsQ0FBQyxLQUFLLENBQUMsNEJBQTRCLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUN2RCxJQUFJLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztvQkFDMUIsR0FBRyxDQUFDLEtBQUssQ0FBQyxlQUFlLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO2dCQUNoRCxDQUFDO2dCQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDcEQsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN4QixHQUFHLENBQUMsS0FBSyxDQUFDLDRCQUE0QixDQUFDLENBQUM7b0JBQ3hDLEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDOUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLFFBQVEsTUFBTSxDQUFDLENBQUM7d0JBQ2pDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7b0JBQ2xDLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7aUJBQU0sQ0FBQztnQkFDSixHQUFHLENBQUMsS0FBSyxDQUFDLHlDQUF5QyxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQ2hFLENBQUM7WUFFRCxNQUFNLEtBQUssQ0FBQztRQUNoQixDQUFDO0lBQ0wsQ0FBQztDQUNKO0FBdklELDREQXVJQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yTnZpZGlhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NoYWxsZW5nZVZhbGlkYXRvci9jaGFsbGVuZ2VWYWxpZGF0b3JOdmlkaWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkVBUTRDO0FBRTVDLDJEQUlvQztBQUNwQyw0REFBK0Q7QUFHL0QsTUFBYSx3QkFBd0I7SUFFWjtJQUNBO0lBRnJCLFlBQ3FCLEdBQVEsRUFDUixNQUE2QjtRQUQ3QixRQUFHLEdBQUgsR0FBRyxDQUFLO1FBQ1IsV0FBTSxHQUFOLE1BQU0sQ0FBdUI7SUFDL0MsQ0FBQztJQUVKLEtBQUssQ0FBQyxRQUFRLENBQ1YsU0FBb0IsRUFDcEIsUUFBZ0IsRUFDaEIsV0FBeUI7UUFFekIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUM7WUFDdkIsU0FBUyxFQUFFLDBCQUEwQjtTQUN4QyxDQUFDLENBQUM7UUFDSCxNQUFNLGNBQWMsR0FBRyxJQUFBLG9DQUF1QixFQUFDLFNBQVMsQ0FBQyxDQUFDO1FBRTFELEdBQUcsQ0FBQyxLQUFLLENBQUMsbUNBQW1DLGNBQWMsRUFBRSxDQUFDLENBQUM7UUFDL0QsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ2xCLEdBQUcsQ0FBQyxLQUFLLENBQ0wsb0VBQW9FLENBQ3ZFLENBQUM7WUFDRixPQUFPO1FBQ1gsQ0FBQztRQUNELEdBQUcsQ0FBQyxLQUFLLENBQ0wsNkNBQTZDLFdBQVcsSUFBSSxXQUFXLEVBQUUsQ0FDNUUsQ0FBQztRQUVGLE1BQU0sU0FBUyxHQUFHLDJDQUF1QixDQUFDLFlBQVksQ0FDbEQsU0FBUyxDQUFDLFlBQVksQ0FDekIsQ0FBQztRQUVGLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE1BQU0sWUFBWSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQzVDLE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0MsTUFBTSxlQUFlLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRCxHQUFHLENBQUMsS0FBSyxDQUNMLHFCQUFxQixZQUFZLG1CQUFtQixlQUFlLEVBQUUsQ0FDeEUsQ0FBQztRQUNGLElBQUksWUFBWSxLQUFLLGVBQWUsRUFBRSxDQUFDO1lBQ25DLE1BQU0sSUFBSSxLQUFLLENBQ1gsNEdBQTRHLENBQy9HLENBQUM7UUFDTixDQUFDO1FBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixxRUFBcUUsQ0FDeEUsQ0FBQztRQUVGLE1BQU0sYUFBYSxHQUFHLElBQUksbUNBQWMsQ0FDcEMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLElBQUksa0JBQWtCLEVBQ3RDLElBQUksQ0FBQyxNQUFNLEVBQUUsT0FBTyxJQUFJLEtBQUssQ0FDaEMsQ0FBQztRQUVGLElBQUksMkJBQTJCLEdBQXVCO1lBQ2xELE9BQU8sRUFBRSxLQUFLO1NBQ2pCLENBQUM7UUFDRixJQUFJLENBQUM7WUFDRCwyQkFBMkIsR0FBRyxNQUFNLGFBQWEsQ0FBQyxhQUFhLENBQUM7Z0JBQzVELE1BQU0sRUFBRSxxQ0FBZ0IsQ0FBQyxHQUFHO2dCQUM1QixNQUFNLEVBQUUscUNBQWdCO2dCQUN4QixLQUFLLEVBQUUsRUFBRSxHQUFHLEVBQUUsU0FBUyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7YUFDbEQsQ0FBQyxDQUFDO1lBQ0gsSUFBSSwyQkFBMkIsQ0FBQyxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQy9DLE1BQU0sSUFBSSxLQUFLLENBQ1gseUVBQXlFLENBQzVFLENBQUM7WUFDTixDQUFDO1lBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixnRUFBZ0UsQ0FDbkUsQ0FBQztZQUVGLE1BQU0sUUFBUSxHQUFHLG1DQUFjLENBQUMsdUJBQXVCLENBQUM7Z0JBQ3BELEdBQUcsRUFBRSxTQUFTLENBQUMsWUFBWSxDQUFDLFFBQVE7YUFDdkMsQ0FBQyxDQUFDO1lBQ0gsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7WUFDdEMsSUFBSSxRQUFRLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ2pCLE1BQU0sSUFBSSxLQUFLLENBQ1gsNERBQTRELENBQy9ELENBQUM7WUFDTixDQUFDO1lBRUQsTUFBTSxFQUFFLHFCQUFxQixFQUFFLGFBQWEsRUFBRSxHQUMxQyxTQUFTLENBQUMsWUFBWSxDQUFDO1lBQzNCLE1BQU0sd0JBQXdCLEdBQzFCLHFCQUFxQixLQUFLLFNBQVMsQ0FBQztZQUN4QyxNQUFNLGdCQUFnQixHQUFHLGFBQWEsS0FBSyxTQUFTLENBQUM7WUFFckQsSUFBSSxRQUFRLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ2pCLElBQUksd0JBQXdCLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztvQkFDL0MsTUFBTSxJQUFJLEtBQUssQ0FDWCxvRkFBb0YsQ0FDdkYsQ0FBQztnQkFDTixDQUFDO1lBQ0wsQ0FBQztpQkFBTSxJQUFJLENBQUMsd0JBQXdCLEVBQUUsQ0FBQztnQkFDbkMsTUFBTSxJQUFJLEtBQUssQ0FDWCxnR0FBZ0csQ0FDbkcsQ0FBQztZQUNOLENBQUM7WUFFRCxJQUNJLHFCQUFxQjtnQkFDakIsZ0RBQTJCLENBQUMsMERBQTBEO2dCQUMxRixnQkFBZ0IsRUFDbEIsQ0FBQztnQkFDQyxNQUFNLElBQUksS0FBSyxDQUNYLGlGQUFpRixDQUNwRixDQUFDO1lBQ04sQ0FBQztZQUVELFFBQVEscUJBQXFCLEVBQUUsQ0FBQztnQkFDNUIsS0FBSyxTQUFTO29CQUNWLE1BQU07Z0JBQ1YsS0FBSyxnREFBMkIsQ0FBQyxvQ0FBb0M7b0JBQ2pFLEdBQUcsQ0FBQyxJQUFJLENBQ0osb0ZBQW9GLENBQ3ZGLENBQUM7b0JBQ0YsTUFBTTtnQkFDVixLQUFLLGdEQUEyQixDQUFDLHlDQUF5QztvQkFDdEUsSUFBSSxXQUFXLEtBQUssV0FBVyxFQUFFLENBQUM7d0JBQzlCLE1BQU0sSUFBSSxLQUFLLENBQ1gsbUZBQW1GLENBQ3RGLENBQUM7b0JBQ04sQ0FBQztvQkFDRCxHQUFHLENBQUMsSUFBSSxDQUNKLDRFQUE0RSxDQUMvRSxDQUFDO29CQUNGLE1BQU07Z0JBQ1YsS0FBSyxnREFBMkIsQ0FBQyxnRUFBZ0U7b0JBQzdGLGlFQUFpRTtvQkFDakUsa0VBQWtFO29CQUNsRSxxRUFBcUU7b0JBQ3JFLG1FQUFtRTtvQkFDbkUsR0FBRyxDQUFDLElBQUksQ0FDSixnRkFBZ0YsQ0FDbkYsQ0FBQztvQkFDRixNQUFNO2dCQUNWLEtBQUssZ0RBQTJCLENBQUMsMERBQTBEO29CQUN2RixJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7d0JBQ2pCLE1BQU0sSUFBSSxLQUFLLENBQ1gsZ0ZBQWdGLENBQ25GLENBQUM7b0JBQ04sQ0FBQztvQkFDRCxNQUFNO2dCQUNWO29CQUNJLE1BQU0sSUFBSSxLQUFLLENBQ1gsMkNBQTJDLHFCQUFxQixFQUFFLENBQ3JFLENBQUM7WUFDVixDQUFDO1lBRUQsSUFDSSxxQkFBcUI7Z0JBQ3JCLGdEQUEyQixDQUFDLDBEQUEwRCxFQUN4RixDQUFDO2dCQUNDLDJCQUEyQixHQUFHLE1BQU0sYUFBYSxDQUFDLGFBQWEsQ0FDM0Q7b0JBQ0ksTUFBTSxFQUFFLHFDQUFnQixDQUFDLE1BQU07b0JBQy9CLE1BQU0sRUFBRSwwQ0FBcUI7b0JBQzdCLEtBQUssRUFBRSxFQUFFLEdBQUcsRUFBRSxhQUFjLEVBQUU7aUJBQ2pDLENBQ0osQ0FBQztnQkFDRixJQUFJLDJCQUEyQixDQUFDLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztvQkFDL0MsTUFBTSxJQUFJLEtBQUssQ0FDWCw4RUFBOEUsQ0FDakYsQ0FBQztnQkFDTixDQUFDO2dCQUNELEdBQUcsQ0FBQyxJQUFJLENBQ0oseUVBQXlFLENBQzVFLENBQUM7Z0JBRUYsTUFBTSxZQUFZLEdBQ2QsbUNBQWMsQ0FBQyw0QkFBNEIsQ0FBQztvQkFDeEMsR0FBRyxFQUFFLGFBQWM7aUJBQ3RCLENBQUMsQ0FBQztnQkFDUCxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7b0JBQzVCLE1BQU0sSUFBSSxLQUFLLENBQ1gsb0VBQW9FLENBQ3ZFLENBQUM7Z0JBQ04sQ0FBQztnQkFFRCxJQUFJLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztvQkFDNUIsTUFBTSxxQkFBcUIsR0FBRyxZQUFZO3lCQUNyQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO3dCQUN2QixRQUFRO3dCQUNSLFlBQVksRUFBRSxLQUFLLEdBQUcsQ0FBQztxQkFDMUIsQ0FBQyxDQUFDO3lCQUNGLE1BQU0sQ0FDSCxDQUFDLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxDQUNiLENBQUMsUUFBUSxDQUFDLFVBQVUsSUFBSSxRQUFRLENBQUMsWUFBWSxDQUNwRDt5QkFDQSxHQUFHLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsQ0FBQztvQkFDN0MsSUFBSSxxQkFBcUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7d0JBQ25DLE1BQU0sSUFBSSxLQUFLLENBQ1gsOEdBQThHLHFCQUFxQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUNuSixDQUFDO29CQUNOLENBQUM7b0JBQ0QsR0FBRyxDQUFDLElBQUksQ0FDSixnR0FBZ0csWUFBWSxDQUFDLE1BQU0sZUFBZSxDQUNySSxDQUFDO2dCQUNOLENBQUM7WUFDTCxDQUFDO1lBRUQsSUFBSSxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sZUFBZSxHQUFHLFFBQVEsQ0FBQyxJQUFJO3FCQUNoQyxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLFNBQVMsRUFBRSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztxQkFDcEQsTUFBTSxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUM7cUJBQ3pDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUN2QyxNQUFNLGtCQUFrQixHQUFHLGVBQWUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO2dCQUN0RCxJQUFJLGtCQUFrQixFQUFFLENBQUM7b0JBQ3JCLE1BQU0sbUJBQW1CLEdBQUcsZUFBZSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztvQkFDdkQsTUFBTSxJQUFJLEtBQUssQ0FDWCwwRkFBMEYsbUJBQW1CLEVBQUUsQ0FDbEgsQ0FBQztnQkFDTixDQUFDO2dCQUNELEdBQUcsQ0FBQyxJQUFJLENBQ0osNERBQTRELFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxTQUFTLENBQzVGLENBQUM7WUFDTixDQUFDO2lCQUFNLENBQUM7Z0JBQ0osR0FBRyxDQUFDLElBQUksQ0FDSixzRUFBc0UsV0FBVyxJQUFJLFdBQVcsRUFBRSxDQUNyRyxDQUFDO1lBQ04sQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2IsSUFBSSxLQUFLLFlBQVksNENBQXVCLEVBQUUsQ0FBQztnQkFDM0MsR0FBRyxDQUFDLEtBQUssQ0FBQyw0QkFBNEIsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7Z0JBQ3ZELElBQUksS0FBSyxDQUFDLFNBQVMsRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDO29CQUMxQixHQUFHLENBQUMsS0FBSyxDQUFDLGVBQWUsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7Z0JBQ2hELENBQUM7Z0JBQ0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDO2dCQUNwRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQ3hCLEdBQUcsQ0FBQyxLQUFLLENBQUMsNEJBQTRCLENBQUMsQ0FBQztvQkFDeEMsS0FBSyxNQUFNLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxJQUFJLFVBQVUsRUFBRSxDQUFDO3dCQUM5QyxHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sUUFBUSxNQUFNLENBQUMsQ0FBQzt3QkFDakMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztvQkFDbEMsQ0FBQztnQkFDTCxDQUFDO1lBQ0wsQ0FBQztpQkFBTSxDQUFDO2dCQUNKLEdBQUcsQ0FBQyxLQUFLLENBQUMseUNBQXlDLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDaEUsQ0FBQztZQUVELE1BQU0sS0FBSyxDQUFDO1FBQ2hCLENBQUM7SUFDTCxDQUFDO0NBQ0o7QUFuUEQsNERBbVBDIn0=

package/dist/challengeValidator/challengeValidatorTdxAzure.d.ts

@@ -0,0 +1,7 @@
+import { Challenge, Log } from '@super-protocol/pki-common';
+import { ChallengeResult, ChallengeValidator } from './challengeValidator';
+export declare class ChallengeValidatorTdxAzure implements ChallengeValidator {
+    private readonly log;
+    constructor(log: Log);
+    validate(challenge: Challenge): Promise<ChallengeResult>;
+}

package/dist/challengeValidator/challengeValidatorTdxAzure.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChallengeValidatorTdxAzure = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const tdxAzureEvidence_1 = require("../azure/tdxAzureEvidence");
+class ChallengeValidatorTdxAzure {
+    log;
+    constructor(log) {
+        this.log = log;
+    }
+    async validate(challenge) {
+        if (challenge.type !== pki_common_1.ChallengeType.TDXAZURE) {
+            throw new Error('Method not implemented.');
+        }
+        try {
+            const evidence = (0, tdxAzureEvidence_1.parseTdxAzureEvidence)(Buffer.from(challenge.evidenceBase64, 'base64'));
+            const claims = await (0, tdxAzureEvidence_1.verifyMaaJwt)(evidence.token);
+            const { userData, mrenclave } = (0, tdxAzureEvidence_1.validateAzureTdxClaims)(claims);
+            this.log.debug('Validated tdx-azure MAA claims', {
+                mrenclaveHex: mrenclave.toString('hex'),
+            });
+            return {
+                success: true,
+                validatedUserData: userData,
+                validatedId: mrenclave,
+            };
+        }
+        catch (e) {
+            return {
+                success: false,
+                error: e.message,
+            };
+        }
+    }
+}
+exports.ChallengeValidatorTdxAzure = ChallengeValidatorTdxAzure;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2hhbGxlbmdlVmFsaWRhdG9yVGR4QXp1cmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2NoYWxsZW5nZVZhbGlkYXRvclRkeEF6dXJlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJEQUEyRTtBQUUzRSxnRUFJbUM7QUFFbkMsTUFBYSwwQkFBMEI7SUFDTjtJQUE3QixZQUE2QixHQUFRO1FBQVIsUUFBRyxHQUFILEdBQUcsQ0FBSztJQUFHLENBQUM7SUFFekMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUFvQjtRQUMvQixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssMEJBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUM1QyxNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixDQUFDLENBQUM7UUFDL0MsQ0FBQztRQUVELElBQUksQ0FBQztZQUNELE1BQU0sUUFBUSxHQUFHLElBQUEsd0NBQXFCLEVBQ2xDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRSxRQUFRLENBQUMsQ0FDbEQsQ0FBQztZQUNGLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBQSwrQkFBWSxFQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNsRCxNQUFNLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxHQUFHLElBQUEseUNBQXNCLEVBQUMsTUFBTSxDQUFDLENBQUM7WUFDL0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsZ0NBQWdDLEVBQUU7Z0JBQzdDLFlBQVksRUFBRSxTQUFTLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQzthQUMxQyxDQUFDLENBQUM7WUFDSCxPQUFPO2dCQUNILE9BQU8sRUFBRSxJQUFJO2dCQUNiLGlCQUFpQixFQUFFLFFBQVE7Z0JBQzNCLFdBQVcsRUFBRSxTQUFTO2FBQ3pCLENBQUM7UUFDTixDQUFDO1FBQUMsT0FBTyxDQUFNLEVBQUUsQ0FBQztZQUNkLE9BQU87Z0JBQ0gsT0FBTyxFQUFFLEtBQUs7Z0JBQ2QsS0FBSyxFQUFFLENBQUMsQ0FBQyxPQUFPO2FBQ25CLENBQUM7UUFDTixDQUFDO0lBQ0wsQ0FBQztDQUNKO0FBN0JELGdFQTZCQyJ9

package/dist/challengeValidator/index.d.ts

@@ -3,5 +3,6 @@ export * from './validatorConfig';
 export { ChallengeValidatorCertificate } from './challengeValidatorCertificate';
 export { ChallengeValidatorNvidia } from './challengeValidatorNvidia';
 export { ChallengeValidatorTdx } from './challengeValidatorTdx';
+export { ChallengeValidatorTdxAzure } from './challengeValidatorTdxAzure';
 export { ChallengeValidatorSevSnp } from './challengeValidatorSevSnp';
 export { ChallengeValidatorToken } from './challengeValidatorToken';

package/dist/challengeValidator/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ChallengeValidatorToken = exports.ChallengeValidatorSevSnp = exports.ChallengeValidatorTdx = exports.ChallengeValidatorNvidia = exports.ChallengeValidatorCertificate = void 0;
+exports.ChallengeValidatorToken = exports.ChallengeValidatorSevSnp = exports.ChallengeValidatorTdxAzure = exports.ChallengeValidatorTdx = exports.ChallengeValidatorNvidia = exports.ChallengeValidatorCertificate = void 0;
 __exportStar(require("./challengeValidator"), exports);
 __exportStar(require("./validatorConfig"), exports);
 var challengeValidatorCertificate_1 = require("./challengeValidatorCertificate");
@@ -23,8 +23,10 @@ var challengeValidatorNvidia_1 = require("./challengeValidatorNvidia");
 Object.defineProperty(exports, "ChallengeValidatorNvidia", { enumerable: true, get: function () { return challengeValidatorNvidia_1.ChallengeValidatorNvidia; } });
 var challengeValidatorTdx_1 = require("./challengeValidatorTdx");
 Object.defineProperty(exports, "ChallengeValidatorTdx", { enumerable: true, get: function () { return challengeValidatorTdx_1.ChallengeValidatorTdx; } });
+var challengeValidatorTdxAzure_1 = require("./challengeValidatorTdxAzure");
+Object.defineProperty(exports, "ChallengeValidatorTdxAzure", { enumerable: true, get: function () { return challengeValidatorTdxAzure_1.ChallengeValidatorTdxAzure; } });
 var challengeValidatorSevSnp_1 = require("./challengeValidatorSevSnp");
 Object.defineProperty(exports, "ChallengeValidatorSevSnp", { enumerable: true, get: function () { return challengeValidatorSevSnp_1.ChallengeValidatorSevSnp; } });
 var challengeValidatorToken_1 = require("./challengeValidatorToken");
 Object.defineProperty(exports, "ChallengeValidatorToken", { enumerable: true, get: function () { return challengeValidatorToken_1.ChallengeValidatorToken; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXFDO0FBQ3JDLG9EQUFrQztBQUNsQyxpRkFBZ0Y7QUFBdkUsOElBQUEsNkJBQTZCLE9BQUE7QUFDdEMsdUVBQXNFO0FBQTdELG9JQUFBLHdCQUF3QixPQUFBO0FBQ2pDLGlFQUFnRTtBQUF2RCw4SEFBQSxxQkFBcUIsT0FBQTtBQUM5Qix1RUFBc0U7QUFBN0Qsb0lBQUEsd0JBQXdCLE9BQUE7QUFDakMscUVBQW9FO0FBQTNELGtJQUFBLHVCQUF1QixPQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2hhbGxlbmdlVmFsaWRhdG9yL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXFDO0FBQ3JDLG9EQUFrQztBQUNsQyxpRkFBZ0Y7QUFBdkUsOElBQUEsNkJBQTZCLE9BQUE7QUFDdEMsdUVBQXNFO0FBQTdELG9JQUFBLHdCQUF3QixPQUFBO0FBQ2pDLGlFQUFnRTtBQUF2RCw4SEFBQSxxQkFBcUIsT0FBQTtBQUM5QiwyRUFBMEU7QUFBakUsd0lBQUEsMEJBQTBCLE9BQUE7QUFDbkMsdUVBQXNFO0FBQTdELG9JQUFBLHdCQUF3QixPQUFBO0FBQ2pDLHFFQUFvRTtBQUEzRCxrSUFBQSx1QkFBdUIsT0FBQSJ9

package/dist/index.d.ts

@@ -3,3 +3,5 @@ export * from './challengeProvider';
 export * from './challengeValidator';
 export * from './swarmCertValidation';
 export * from './attestationType';
+export * from './azure/detectAzureTdx';
+export * from './azure/tdxAzureEvidence';

package/dist/index.js

@@ -19,4 +19,6 @@ __exportStar(require("./challengeProvider"), exports);
 __exportStar(require("./challengeValidator"), exports);
 __exportStar(require("./swarmCertValidation"), exports);
 __exportStar(require("./attestationType"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHlEQUF1QztBQUN2QyxzREFBb0M7QUFDcEMsdURBQXFDO0FBQ3JDLHdEQUFzQztBQUN0QyxvREFBa0MifQ==
+__exportStar(require("./azure/detectAzureTdx"), exports);
+__exportStar(require("./azure/tdxAzureEvidence"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHlEQUF1QztBQUN2QyxzREFBb0M7QUFDcEMsdURBQXFDO0FBQ3JDLHdEQUFzQztBQUN0QyxvREFBa0M7QUFDbEMseURBQXVDO0FBQ3ZDLDJEQUF5QyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@super-protocol/pki-attestation-engine",
-  "version": "5.0.6",
+  "version": "5.1.0-beta1",
   "description": "",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -21,8 +21,8 @@
   "dependencies": {
     "@sinclair/typebox": "0.33.22",
     "@super-protocol/addons-tee": "^4.1.0",
-    "@super-protocol/pki-common": "^5.0.1",
-    "@super-protocol/sp-nvtrust-wrapper": "^2.4.0"
+    "@super-protocol/pki-common": "5.1.0-beta1",
+    "@super-protocol/sp-nvtrust-wrapper": "^2.6.0"
   },
   "peerDependencies": {
     "@super-protocol/sdk-js": "*"