@super-protocol/pki-attestation-engine 5.1.0-beta3 → 5.1.0

package/dist/challengeValidator/wasmVerificationPolicy.d.ts

@@ -0,0 +1,60 @@
+/// <reference types="node" />
+import { TeeEvidenceType } from '@super-protocol/attestation-common';
+import { Log, NetworkType } from '@super-protocol/pki-common';
+import { AzureValidationConfig } from './validatorConfig';
+type TcbSeverity = 'Ok' | 'Warning' | 'Critical';
+export interface AttestationWasmAzure {
+    verifyTeeEvidence(serialized: Uint8Array, options: ReturnType<typeof buildAzureVerifyOptions>): Promise<{
+        evidenceType: TeeEvidenceType;
+    }>;
+    describeTdxTcbStatus(status: string): {
+        severity: TcbSeverity;
+    } | undefined;
+}
+type TcbDescriber = Pick<AttestationWasmAzure, 'describeTdxTcbStatus'>;
+interface PolicyOptions {
+    /**
+     * A debug VM offers no confidentiality, so it is accepted only when the
+     * network is explicitly untrusted. Plain TDX needs no such check: its
+     * TDATTRIBUTES, which hold the DEBUG bit, are part of mrEnclave.
+     */
+    networkType?: NetworkType;
+    log?: Log;
+}
+export declare const isAzureEvidenceType: (evidenceType: TeeEvidenceType) => boolean;
+export declare const buildAzureVerifyOptions: (config?: AzureValidationConfig) => {
+    tdx: {
+        getCollateral: boolean;
+    };
+    azure: {
+        maa: true;
+        maaEndpoint: string | undefined;
+        timeoutMs: number | undefined;
+    };
+};
+/**
+ * Applies the TEE policy to an attestation-wasm verification result: the
+ * hardware report integrity, an acceptable TDX TCB, an unrevoked certificate
+ * chain, no debug SEV-SNP VM unless the network is explicitly untrusted and,
+ * for Azure, a positive Microsoft Azure Attestation verdict.
+ *
+ * @throws If the result violates the policy.
+ */
+export declare const checkTeeVerificationResult: (verification: {
+    evidenceType: TeeEvidenceType;
+}, attestation: TcbDescriber, options: PolicyOptions) => void;
+/**
+ * Applies the Azure CVM policy (see {@link checkTeeVerificationResult}).
+ * Debug is checked explicitly: the Azure mrEnclave covers the vTPM PCRs, not
+ * the TD attributes or the SEV-SNP policy of the paravisor. Returns the Azure
+ * mrEnclave and the 64-byte report data.
+ *
+ * @throws If the result violates the policy.
+ */
+export declare const checkAzureVerificationResult: (verification: {
+    evidenceType: TeeEvidenceType;
+}, attestation: TcbDescriber, options: PolicyOptions) => {
+    mrEnclave: Buffer;
+    reportData: Buffer;
+};
+export {};

package/dist/challengeValidator/wasmVerificationPolicy.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAzureVerificationResult = exports.checkTeeVerificationResult = exports.buildAzureVerifyOptions = exports.isAzureEvidenceType = void 0;
+const attestation_common_1 = require("@super-protocol/attestation-common");
+const REPORT_DATA_BYTES = 64;
+const isAzureEvidenceType = (evidenceType) => evidenceType === attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE ||
+    evidenceType === attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE;
+exports.isAzureEvidenceType = isAzureEvidenceType;
+const buildAzureVerifyOptions = (config) => ({
+    tdx: { getCollateral: true },
+    azure: {
+        maa: true,
+        maaEndpoint: config?.maaEndpoint,
+        timeoutMs: config?.maaTimeoutMs,
+    },
+});
+exports.buildAzureVerifyOptions = buildAzureVerifyOptions;
+const checkTcbStatus = (attestation, component, status, log) => {
+    const severity = attestation.describeTdxTcbStatus(status)?.severity;
+    if (severity === 'Ok') {
+        return;
+    }
+    if (severity === 'Warning') {
+        log?.warn(`${component} TCB status is not up to date: ${status}`);
+        return;
+    }
+    throw new Error(`${component} TCB status is not acceptable: ${status}`);
+};
+const checkTdxResult = (result, attestation, log) => {
+    if (!result.quoteIntegrity) {
+        throw new Error('TD quote integrity check failed');
+    }
+    if (!result.tdxTcbStatus) {
+        throw new Error('TD quote TCB status is missing');
+    }
+    checkTcbStatus(attestation, 'TDX', result.tdxTcbStatus, log);
+    if (result.qeTcbStatus) {
+        checkTcbStatus(attestation, 'QE', result.qeTcbStatus, log);
+    }
+    if (result.certChainRevocationStatusOk === false) {
+        throw new Error('TD quote certificate chain is revoked');
+    }
+};
+const checkSevSnpResult = (result) => {
+    if (!result.attestationReportIntegrity) {
+        throw new Error('SEV-SNP report integrity check failed');
+    }
+    if (result.certChainRevocationStatusOk === false) {
+        throw new Error('SEV-SNP certificate chain is revoked');
+    }
+};
+const checkDebug = (debug, options) => {
+    if (debug && options.networkType !== 'untrusted') {
+        throw new Error(`Debug VM is not allowed for networkType=${options.networkType ?? 'undefined'}`);
+    }
+};
+/**
+ * Applies the TEE policy to an attestation-wasm verification result: the
+ * hardware report integrity, an acceptable TDX TCB, an unrevoked certificate
+ * chain, no debug SEV-SNP VM unless the network is explicitly untrusted and,
+ * for Azure, a positive Microsoft Azure Attestation verdict.
+ *
+ * @throws If the result violates the policy.
+ */
+const checkTeeVerificationResult = (verification, attestation, options) => {
+    const tee = verification;
+    switch (tee.evidenceType) {
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_QEMU:
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_GCP:
+            checkTdxResult(tee.result, attestation, options.log);
+            return;
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_QEMU:
+            checkSevSnpResult(tee.result);
+            checkDebug(tee.result.securityFields.debugAllowed, options);
+            return;
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE:
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE:
+            (0, exports.checkAzureVerificationResult)(tee, attestation, options);
+            return;
+        default:
+            throw new Error(`Unsupported TEE evidence type ${verification.evidenceType}`);
+    }
+};
+exports.checkTeeVerificationResult = checkTeeVerificationResult;
+/**
+ * Applies the Azure CVM policy (see {@link checkTeeVerificationResult}).
+ * Debug is checked explicitly: the Azure mrEnclave covers the vTPM PCRs, not
+ * the TD attributes or the SEV-SNP policy of the paravisor. Returns the Azure
+ * mrEnclave and the 64-byte report data.
+ *
+ * @throws If the result violates the policy.
+ */
+const checkAzureVerificationResult = (verification, attestation, options) => {
+    const azureVerification = verification;
+    let debug;
+    if (azureVerification.evidenceType ===
+        attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE) {
+        const { result } = azureVerification;
+        checkTdxResult(result, attestation, options.log);
+        debug = result.azure.tdDebug;
+    }
+    else if (azureVerification.evidenceType ===
+        attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE) {
+        const { result } = azureVerification;
+        checkSevSnpResult(result);
+        debug = result.azure.debugAllowed || result.securityFields.debugAllowed;
+    }
+    else {
+        throw new Error(`Evidence type ${verification.evidenceType} is not an Azure confidential VM evidence`);
+    }
+    const { azure } = azureVerification.result;
+    if (!azure.maa?.azureCompliant) {
+        throw new Error('Microsoft Azure Attestation did not confirm a genuine Azure confidential VM');
+    }
+    checkDebug(debug, options);
+    const reportData = Buffer.from(azureVerification.reportData);
+    if (reportData.length !== REPORT_DATA_BYTES) {
+        throw new Error(`Unexpected report data length: ${reportData.length}`);
+    }
+    return { mrEnclave: Buffer.from(azure.mrEnclave), reportData };
+};
+exports.checkAzureVerificationResult = checkAzureVerificationResult;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoid2FzbVZlcmlmaWNhdGlvblBvbGljeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jaGFsbGVuZ2VWYWxpZGF0b3Ivd2FzbVZlcmlmaWNhdGlvblBvbGljeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyRUFBcUU7QUFZckUsTUFBTSxpQkFBaUIsR0FBRyxFQUFFLENBQUM7QUFrRXRCLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxZQUE2QixFQUFXLEVBQUUsQ0FDMUUsWUFBWSxLQUFLLG9DQUFlLENBQUMsaUNBQWlDO0lBQ2xFLFlBQVksS0FBSyxvQ0FBZSxDQUFDLG1DQUFtQyxDQUFDO0FBRjVELFFBQUEsbUJBQW1CLHVCQUV5QztBQUVsRSxNQUFNLHVCQUF1QixHQUFHLENBQUMsTUFBOEIsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUN4RSxHQUFHLEVBQUUsRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFO0lBQzVCLEtBQUssRUFBRTtRQUNILEdBQUcsRUFBRSxJQUFhO1FBQ2xCLFdBQVcsRUFBRSxNQUFNLEVBQUUsV0FBVztRQUNoQyxTQUFTLEVBQUUsTUFBTSxFQUFFLFlBQVk7S0FDbEM7Q0FDSixDQUFDLENBQUM7QUFQVSxRQUFBLHVCQUF1QiwyQkFPakM7QUFFSCxNQUFNLGNBQWMsR0FBRyxDQUNuQixXQUF5QixFQUN6QixTQUFpQixFQUNqQixNQUFjLEVBQ2QsR0FBUyxFQUNMLEVBQUU7SUFDTixNQUFNLFFBQVEsR0FBRyxXQUFXLENBQUMsb0JBQW9CLENBQUMsTUFBTSxDQUFDLEVBQUUsUUFBUSxDQUFDO0lBQ3BFLElBQUksUUFBUSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3BCLE9BQU87SUFDWCxDQUFDO0lBQ0QsSUFBSSxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDekIsR0FBRyxFQUFFLElBQUksQ0FBQyxHQUFHLFNBQVMsa0NBQWtDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDbEUsT0FBTztJQUNYLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsU0FBUyxrQ0FBa0MsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUM1RSxDQUFDLENBQUM7QUFFRixNQUFNLGNBQWMsR0FBRyxDQUNuQixNQUFpQixFQUNqQixXQUF5QixFQUN6QixHQUFTLEVBQ0wsRUFBRTtJQUNOLElBQUksQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDekIsTUFBTSxJQUFJLEtBQUssQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsY0FBYyxDQUFDLFdBQVcsRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLFlBQVksRUFBRSxHQUFHLENBQUMsQ0FBQztJQUM3RCxJQUFJLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNyQixjQUFjLENBQUMsV0FBVyxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQywyQkFBMkIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUMvQyxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDN0QsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxNQUFvQixFQUFRLEVBQUU7SUFDckQsSUFBSSxDQUFDLE1BQU0sQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1FBQ3JDLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsMkJBQTJCLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDL0MsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQzVELENBQUM7QUFDTCxDQUFDLENBQUM7QUFFRixNQUFNLFVBQVUsR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFzQixFQUFRLEVBQUU7SUFDaEUsSUFBSSxLQUFLLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUMvQyxNQUFNLElBQUksS0FBSyxDQUNYLDJDQUEyQyxPQUFPLENBQUMsV0FBVyxJQUFJLFdBQVcsRUFBRSxDQUNsRixDQUFDO0lBQ04sQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSSxNQUFNLDBCQUEwQixHQUFHLENBQ3RDLFlBQStDLEVBQy9DLFdBQXlCLEVBQ3pCLE9BQXNCLEVBQ2xCLEVBQUU7SUFDTixNQUFNLEdBQUcsR0FBRyxZQUFxQyxDQUFDO0lBQ2xELFFBQVEsR0FBRyxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3ZCLEtBQUssb0NBQWUsQ0FBQyxnQ0FBZ0MsQ0FBQztRQUN0RCxLQUFLLG9DQUFlLENBQUMsK0JBQStCO1lBQ2hELGNBQWMsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDckQsT0FBTztRQUNYLEtBQUssb0NBQWUsQ0FBQyxrQ0FBa0M7WUFDbkQsaUJBQWlCLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzlCLFVBQVUsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUM7WUFDNUQsT0FBTztRQUNYLEtBQUssb0NBQWUsQ0FBQyxpQ0FBaUMsQ0FBQztRQUN2RCxLQUFLLG9DQUFlLENBQUMsbUNBQW1DO1lBQ3BELElBQUEsb0NBQTRCLEVBQUMsR0FBRyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsQ0FBQztZQUN4RCxPQUFPO1FBQ1g7WUFDSSxNQUFNLElBQUksS0FBSyxDQUNYLGlDQUFpQyxZQUFZLENBQUMsWUFBWSxFQUFFLENBQy9ELENBQUM7SUFDVixDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBeEJXLFFBQUEsMEJBQTBCLDhCQXdCckM7QUFFRjs7Ozs7OztHQU9HO0FBQ0ksTUFBTSw0QkFBNEIsR0FBRyxDQUN4QyxZQUErQyxFQUMvQyxXQUF5QixFQUN6QixPQUFzQixFQUNtQixFQUFFO0lBQzNDLE1BQU0saUJBQWlCLEdBQUcsWUFBcUMsQ0FBQztJQUNoRSxJQUFJLEtBQWMsQ0FBQztJQUNuQixJQUNJLGlCQUFpQixDQUFDLFlBQVk7UUFDOUIsb0NBQWUsQ0FBQyxpQ0FBaUMsRUFDbkQsQ0FBQztRQUNDLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxpQkFBaUIsQ0FBQztRQUNyQyxjQUFjLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDakQsS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDO0lBQ2pDLENBQUM7U0FBTSxJQUNILGlCQUFpQixDQUFDLFlBQVk7UUFDOUIsb0NBQWUsQ0FBQyxtQ0FBbUMsRUFDckQsQ0FBQztRQUNDLE1BQU0sRUFBRSxNQUFNLEVBQUUsR0FBRyxpQkFBaUIsQ0FBQztRQUNyQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMxQixLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxZQUFZLENBQUM7SUFDNUUsQ0FBQztTQUFNLENBQUM7UUFDSixNQUFNLElBQUksS0FBSyxDQUNYLGlCQUFpQixZQUFZLENBQUMsWUFBWSwyQ0FBMkMsQ0FDeEYsQ0FBQztJQUNOLENBQUM7SUFFRCxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsaUJBQWlCLENBQUMsTUFBTSxDQUFDO0lBQzNDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLGNBQWMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBSSxLQUFLLENBQ1gsNkVBQTZFLENBQ2hGLENBQUM7SUFDTixDQUFDO0lBRUQsVUFBVSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztJQUUzQixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzdELElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxpQkFBaUIsRUFBRSxDQUFDO1FBQzFDLE1BQU0sSUFBSSxLQUFLLENBQUMsa0NBQWtDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFFRCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBQ25FLENBQUMsQ0FBQztBQTFDVyxRQUFBLDRCQUE0QixnQ0EwQ3ZDIn0=

package/dist/index.d.ts

@@ -3,5 +3,5 @@ export * from './challengeProvider';
 export * from './challengeValidator';
 export * from './swarmCertValidation';
 export * from './attestationType';
-export * from './azure/detectAzureTdx';
-export * from './azure/tdxAzureEvidence';
+export * from './azure';
+export * from './mrEnclaveSignature';

package/dist/index.js

@@ -19,6 +19,6 @@ __exportStar(require("./challengeProvider"), exports);
 __exportStar(require("./challengeValidator"), exports);
 __exportStar(require("./swarmCertValidation"), exports);
 __exportStar(require("./attestationType"), exports);
-__exportStar(require("./azure/detectAzureTdx"), exports);
-__exportStar(require("./azure/tdxAzureEvidence"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHlEQUF1QztBQUN2QyxzREFBb0M7QUFDcEMsdURBQXFDO0FBQ3JDLHdEQUFzQztBQUN0QyxvREFBa0M7QUFDbEMseURBQXVDO0FBQ3ZDLDJEQUF5QyJ9
+__exportStar(require("./azure"), exports);
+__exportStar(require("./mrEnclaveSignature"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHlEQUF1QztBQUN2QyxzREFBb0M7QUFDcEMsdURBQXFDO0FBQ3JDLHdEQUFzQztBQUN0QyxvREFBa0M7QUFDbEMsMENBQXdCO0FBQ3hCLHVEQUFxQyJ9

package/dist/mrEnclaveSignature.d.ts

@@ -0,0 +1,9 @@
+/// <reference types="node" />
+import { ChallengeType } from '@super-protocol/pki-common';
+/**
+ * Verifies that the mrEnclave of a TEE challenge is signed by Super Protocol
+ * and present in the trusted registry.
+ *
+ * @throws If the challenge type has no registry or the signature is missing or invalid.
+ */
+export declare const verifyChallengeMrEnclaveSignature: (mrEnclave: Buffer, challengeType: ChallengeType) => Promise<void>;

package/dist/mrEnclaveSignature.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyChallengeMrEnclaveSignature = void 0;
+const attestation_common_1 = require("@super-protocol/attestation-common");
+const pki_common_1 = require("@super-protocol/pki-common");
+const challengeTypeToEvidenceType = (challengeType) => {
+    switch (challengeType) {
+        case pki_common_1.ChallengeType.TDX:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_QEMU;
+        case pki_common_1.ChallengeType.TDXGOOGLE:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_GCP;
+        case pki_common_1.ChallengeType.TDXAZURE:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE;
+        case pki_common_1.ChallengeType.SEVSNP:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_QEMU;
+        case pki_common_1.ChallengeType.SEVSNPAZURE:
+            return attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE;
+        default:
+            throw new Error(`mrEnclave signature verification is not supported for challenge type ${challengeType}`);
+    }
+};
+/**
+ * Verifies that the mrEnclave of a TEE challenge is signed by Super Protocol
+ * and present in the trusted registry.
+ *
+ * @throws If the challenge type has no registry or the signature is missing or invalid.
+ */
+const verifyChallengeMrEnclaveSignature = async (mrEnclave, challengeType) => {
+    await (0, attestation_common_1.verifyMrEnclaveSignature)(mrEnclave, challengeTypeToEvidenceType(challengeType));
+};
+exports.verifyChallengeMrEnclaveSignature = verifyChallengeMrEnclaveSignature;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibXJFbmNsYXZlU2lnbmF0dXJlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL21yRW5jbGF2ZVNpZ25hdHVyZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyRUFHNEM7QUFDNUMsMkRBQTJEO0FBRTNELE1BQU0sMkJBQTJCLEdBQUcsQ0FDaEMsYUFBNEIsRUFDYixFQUFFO0lBQ2pCLFFBQVEsYUFBYSxFQUFFLENBQUM7UUFDcEIsS0FBSywwQkFBYSxDQUFDLEdBQUc7WUFDbEIsT0FBTyxvQ0FBZSxDQUFDLGdDQUFnQyxDQUFDO1FBQzVELEtBQUssMEJBQWEsQ0FBQyxTQUFTO1lBQ3hCLE9BQU8sb0NBQWUsQ0FBQywrQkFBK0IsQ0FBQztRQUMzRCxLQUFLLDBCQUFhLENBQUMsUUFBUTtZQUN2QixPQUFPLG9DQUFlLENBQUMsaUNBQWlDLENBQUM7UUFDN0QsS0FBSywwQkFBYSxDQUFDLE1BQU07WUFDckIsT0FBTyxvQ0FBZSxDQUFDLGtDQUFrQyxDQUFDO1FBQzlELEtBQUssMEJBQWEsQ0FBQyxXQUFXO1lBQzFCLE9BQU8sb0NBQWUsQ0FBQyxtQ0FBbUMsQ0FBQztRQUMvRDtZQUNJLE1BQU0sSUFBSSxLQUFLLENBQ1gsd0VBQXdFLGFBQWEsRUFBRSxDQUMxRixDQUFDO0lBQ1YsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0ksTUFBTSxpQ0FBaUMsR0FBRyxLQUFLLEVBQ2xELFNBQWlCLEVBQ2pCLGFBQTRCLEVBQ2YsRUFBRTtJQUNmLE1BQU0sSUFBQSw2Q0FBd0IsRUFDMUIsU0FBUyxFQUNULDJCQUEyQixDQUFDLGFBQWEsQ0FBQyxDQUM3QyxDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBUlcsUUFBQSxpQ0FBaUMscUNBUTVDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@super-protocol/pki-attestation-engine",
-  "version": "5.1.0-beta3",
+  "version": "5.1.0",
   "description": "",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -20,9 +20,11 @@
   "license": "ISC",
   "dependencies": {
     "@sinclair/typebox": "0.33.22",
-    "@super-protocol/addons-tee": "^4.1.0",
-    "@super-protocol/pki-common": "5.1.0-beta1",
-    "@super-protocol/sp-nvtrust-wrapper": "^2.6.0"
+    "@super-protocol/addons-tee": "^4.2.0",
+    "@super-protocol/attestation-common": "^0.3.1",
+    "@super-protocol/attestation-wasm": "^0.3.0",
+    "@super-protocol/pki-common": "^5.1.0",
+    "@super-protocol/sp-nvtrust-wrapper": "^2.7.0"
   },
   "peerDependencies": {
     "@super-protocol/sdk-js": "*"

package/dist/azure/detectAzureTdx.d.ts

@@ -1,3 +0,0 @@
-export declare const isTdxGuest: () => boolean;
-export declare const isAzureConfidentialVm: () => Promise<boolean>;
-export declare const isAzureTdxVm: () => Promise<boolean>;

package/dist/azure/detectAzureTdx.js

@@ -1,87 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isAzureTdxVm = exports.isAzureConfidentialVm = exports.isTdxGuest = void 0;
-const fs_1 = require("fs");
-const AZURE_IMDS_COMPUTE_URL = 'http://169.254.169.254/metadata/instance/compute?api-version=2023-07-01';
-const IMDS_TIMEOUT_MS = 500;
-const SEV_DEVICE_PATH = '/dev/sev-guest';
-const cpuinfoFlagTokens = () => {
-    try {
-        const text = (0, fs_1.readFileSync)('/proc/cpuinfo', 'utf8');
-        const tokens = new Set();
-        for (const line of text.split('\n')) {
-            const [key, value] = line.split(':');
-            if (key?.trim() === 'flags' || key?.trim() === 'Features') {
-                for (const token of (value ?? '').split(/\s+/)) {
-                    if (token) {
-                        tokens.add(token);
-                    }
-                }
-            }
-        }
-        return tokens;
-    }
-    catch {
-        return new Set();
-    }
-};
-const isTdxGuest = () => {
-    try {
-        if ((0, fs_1.existsSync)(SEV_DEVICE_PATH) &&
-            (0, fs_1.statSync)(SEV_DEVICE_PATH).isCharacterDevice()) {
-            return false;
-        }
-    }
-    catch {
-        // ignore
-    }
-    if (cpuinfoFlagTokens().has('tdx_guest')) {
-        return true;
-    }
-    if ((0, fs_1.existsSync)('/sys/module/tdx_guest')) {
-        return true;
-    }
-    try {
-        return (0, fs_1.readFileSync)('/proc/cpuinfo', 'utf8').includes('Intel TDX');
-    }
-    catch {
-        return false;
-    }
-};
-exports.isTdxGuest = isTdxGuest;
-const isAzureConfidentialVm = async () => {
-    try {
-        const response = await fetch(AZURE_IMDS_COMPUTE_URL, {
-            headers: { Metadata: 'true' },
-            signal: AbortSignal.timeout(IMDS_TIMEOUT_MS),
-        });
-        if (!response.ok) {
-            return false;
-        }
-        const compute = (await response.json());
-        return (String(compute?.securityProfile?.securityType ?? '')
-            .trim()
-            .toLowerCase() === 'confidentialvm');
-    }
-    catch {
-        return false;
-    }
-};
-exports.isAzureConfidentialVm = isAzureConfidentialVm;
-const isAzureTdxVm = async () => {
-    if (!(await (0, exports.isAzureConfidentialVm)())) {
-        return false;
-    }
-    try {
-        if ((0, fs_1.existsSync)(SEV_DEVICE_PATH) &&
-            (0, fs_1.statSync)(SEV_DEVICE_PATH).isCharacterDevice()) {
-            return false;
-        }
-    }
-    catch {
-        // ignore
-    }
-    return true;
-};
-exports.isAzureTdxVm = isAzureTdxVm;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGV0ZWN0QXp1cmVUZHguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYXp1cmUvZGV0ZWN0QXp1cmVUZHgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkJBQXdEO0FBRXhELE1BQU0sc0JBQXNCLEdBQ3hCLHlFQUF5RSxDQUFDO0FBQzlFLE1BQU0sZUFBZSxHQUFHLEdBQUcsQ0FBQztBQUM1QixNQUFNLGVBQWUsR0FBRyxnQkFBZ0IsQ0FBQztBQUV6QyxNQUFNLGlCQUFpQixHQUFHLEdBQWdCLEVBQUU7SUFDeEMsSUFBSSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsSUFBQSxpQkFBWSxFQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNuRCxNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ2pDLEtBQUssTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2xDLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNyQyxJQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsS0FBSyxPQUFPLElBQUksR0FBRyxFQUFFLElBQUksRUFBRSxLQUFLLFVBQVUsRUFBRSxDQUFDO2dCQUN4RCxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO29CQUM3QyxJQUFJLEtBQUssRUFBRSxDQUFDO3dCQUNSLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7b0JBQ3RCLENBQUM7Z0JBQ0wsQ0FBQztZQUNMLENBQUM7UUFDTCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDbEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNMLE9BQU8sSUFBSSxHQUFHLEVBQUUsQ0FBQztJQUNyQixDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUssTUFBTSxVQUFVLEdBQUcsR0FBWSxFQUFFO0lBQ3BDLElBQUksQ0FBQztRQUNELElBQ0ksSUFBQSxlQUFVLEVBQUMsZUFBZSxDQUFDO1lBQzNCLElBQUEsYUFBUSxFQUFDLGVBQWUsQ0FBQyxDQUFDLGlCQUFpQixFQUFFLEVBQy9DLENBQUM7WUFDQyxPQUFPLEtBQUssQ0FBQztRQUNqQixDQUFDO0lBQ0wsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNMLFNBQVM7SUFDYixDQUFDO0lBRUQsSUFBSSxpQkFBaUIsRUFBRSxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE9BQU8sSUFBSSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxJQUFJLElBQUEsZUFBVSxFQUFDLHVCQUF1QixDQUFDLEVBQUUsQ0FBQztRQUN0QyxPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0QsT0FBTyxJQUFBLGlCQUFZLEVBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ0wsT0FBTyxLQUFLLENBQUM7SUFDakIsQ0FBQztBQUNMLENBQUMsQ0FBQztBQXZCVyxRQUFBLFVBQVUsY0F1QnJCO0FBRUssTUFBTSxxQkFBcUIsR0FBRyxLQUFLLElBQXNCLEVBQUU7SUFDOUQsSUFBSSxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsc0JBQXNCLEVBQUU7WUFDakQsT0FBTyxFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRTtZQUM3QixNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQUM7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNmLE9BQU8sS0FBSyxDQUFDO1FBQ2pCLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUVyQyxDQUFDO1FBQ0YsT0FBTyxDQUNILE1BQU0sQ0FBQyxPQUFPLEVBQUUsZUFBZSxFQUFFLFlBQVksSUFBSSxFQUFFLENBQUM7YUFDL0MsSUFBSSxFQUFFO2FBQ04sV0FBVyxFQUFFLEtBQUssZ0JBQWdCLENBQzFDLENBQUM7SUFDTixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ0wsT0FBTyxLQUFLLENBQUM7SUFDakIsQ0FBQztBQUNMLENBQUMsQ0FBQztBQXBCVyxRQUFBLHFCQUFxQix5QkFvQmhDO0FBRUssTUFBTSxZQUFZLEdBQUcsS0FBSyxJQUFzQixFQUFFO0lBQ3JELElBQUksQ0FBQyxDQUFDLE1BQU0sSUFBQSw2QkFBcUIsR0FBRSxDQUFDLEVBQUUsQ0FBQztRQUNuQyxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0QsSUFDSSxJQUFBLGVBQVUsRUFBQyxlQUFlLENBQUM7WUFDM0IsSUFBQSxhQUFRLEVBQUMsZUFBZSxDQUFDLENBQUMsaUJBQWlCLEVBQUUsRUFDL0MsQ0FBQztZQUNDLE9BQU8sS0FBSyxDQUFDO1FBQ2pCLENBQUM7SUFDTCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ0wsU0FBUztJQUNiLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNoQixDQUFDLENBQUM7QUFmVyxRQUFBLFlBQVksZ0JBZXZCIn0=

package/dist/azure/tdxAzureEvidence.d.ts

@@ -1,16 +0,0 @@
-/// <reference types="node" />
-export declare const TDX_AZURE_EVIDENCE_FORMAT = "tdx-azure-maa-v1";
-export interface TdxAzureEvidenceV1 {
-    format: typeof TDX_AZURE_EVIDENCE_FORMAT;
-    token: string;
-}
-export declare const encodeTdxAzureEvidence: (token: string) => Buffer;
-export declare const parseTdxAzureEvidence: (evidence: Buffer) => TdxAzureEvidenceV1;
-/** vTPM SHA-256 PCRs mixed into Azure TDX mrEnclave. PCR[6] is omitted: Azure logs vmUniqueId there. */
-export declare const AZURE_TDX_MR_ENCLAVE_PCR_INDEXES: readonly [0, 1, 2, 3, 4, 5, 7];
-export declare const computeAzureTdxMrEnclave: (tdAttributesHex: string, mrtdHex: string, pcrSha256Hex: string[]) => Buffer;
-export declare const verifyMaaJwt: (token: string) => Promise<Record<string, unknown>>;
-export declare const validateAzureTdxClaims: (claims: Record<string, unknown>) => {
-    userData: Buffer;
-    mrenclave: Buffer;
-};

package/dist/azure/tdxAzureEvidence.js

@@ -1,207 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateAzureTdxClaims = exports.verifyMaaJwt = exports.computeAzureTdxMrEnclave = exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES = exports.parseTdxAzureEvidence = exports.encodeTdxAzureEvidence = exports.TDX_AZURE_EVIDENCE_FORMAT = void 0;
-const crypto_1 = require("crypto");
-exports.TDX_AZURE_EVIDENCE_FORMAT = 'tdx-azure-maa-v1';
-const encodeTdxAzureEvidence = (token) => Buffer.from(JSON.stringify({
-    format: exports.TDX_AZURE_EVIDENCE_FORMAT,
-    token,
-}), 'utf8');
-exports.encodeTdxAzureEvidence = encodeTdxAzureEvidence;
-const parseTdxAzureEvidence = (evidence) => {
-    const parsed = JSON.parse(evidence.toString('utf8'));
-    if (parsed.format !== exports.TDX_AZURE_EVIDENCE_FORMAT ||
-        typeof parsed.token !== 'string') {
-        throw new Error('Invalid tdx-azure evidence format');
-    }
-    return parsed;
-};
-exports.parseTdxAzureEvidence = parseTdxAzureEvidence;
-const hexToBuffer = (hex, expectedBytes) => {
-    const normalized = hex.trim().toLowerCase().replace(/^0x/, '');
-    if (!/^[0-9a-f]*$/.test(normalized) || normalized.length % 2 !== 0) {
-        throw new Error(`Invalid hex value: ${hex}`);
-    }
-    const buffer = Buffer.from(normalized, 'hex');
-    if (expectedBytes !== undefined && buffer.length !== expectedBytes) {
-        throw new Error(`Expected ${expectedBytes} bytes, got ${buffer.length} from hex ${hex}`);
-    }
-    return buffer;
-};
-const decodeJwtPart = (part) => JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
-/** vTPM SHA-256 PCRs mixed into Azure TDX mrEnclave. PCR[6] is omitted: Azure logs vmUniqueId there. */
-exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES = [0, 1, 2, 3, 4, 5, 7];
-const computeAzureTdxMrEnclave = (tdAttributesHex, mrtdHex, pcrSha256Hex) => {
-    const lastIndex = exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES[exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES.length - 1];
-    if (pcrSha256Hex.length <= lastIndex) {
-        throw new Error(`tdx-azure mrEnclave requires SHA-256 PCR[0]..PCR[${lastIndex}] (PCR[6] is not mixed in)`);
-    }
-    const parts = [
-        hexToBuffer(tdAttributesHex, 8),
-        hexToBuffer(mrtdHex, 48),
-        ...exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES.map((index) => hexToBuffer(pcrSha256Hex[index], 32)),
-    ];
-    return (0, crypto_1.createHash)('sha256').update(Buffer.concat(parts)).digest();
-};
-exports.computeAzureTdxMrEnclave = computeAzureTdxMrEnclave;
-const pcrValueToHex = (value) => {
-    const trimmed = value.trim();
-    if (/^[0-9a-f]{64}$/i.test(trimmed)) {
-        return trimmed.toLowerCase();
-    }
-    const decoded = Buffer.from(trimmed, 'base64');
-    if (decoded.length === 32) {
-        return decoded.toString('hex');
-    }
-    throw new Error('MAA PCR value is neither SHA-256 hex nor 32-byte base64');
-};
-const extractPcrSha256Hex = (claims) => {
-    const values = claims['x-ms-azurevm-attested-pcr-values'];
-    if (Array.isArray(values) &&
-        values.every((item) => typeof item === 'string')) {
-        return values.map(pcrValueToHex);
-    }
-    if (values && typeof values === 'object') {
-        const rec = values;
-        const sha256 = rec.sha256;
-        if (Array.isArray(sha256) &&
-            sha256.every((item) => typeof item === 'string')) {
-            return sha256.map(pcrValueToHex);
-        }
-        const out = [];
-        for (let index = 0; index < 24; index += 1) {
-            const item = rec[`pcr${index}`];
-            if (typeof item !== 'string') {
-                break;
-            }
-            out[index] = pcrValueToHex(item);
-        }
-        if (out.length >
-            exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES[exports.AZURE_TDX_MR_ENCLAVE_PCR_INDEXES.length - 1]) {
-            return out;
-        }
-    }
-    throw new Error('MAA token is missing SHA-256 PCR values');
-};
-const decodeClaimBytes = (value) => {
-    const trimmed = value.trim();
-    if (/^[0-9a-f]+$/i.test(trimmed) && trimmed.length % 2 === 0) {
-        return Buffer.from(trimmed, 'hex');
-    }
-    return Buffer.from(trimmed, 'base64');
-};
-const toUserData64 = (value) => {
-    if (value.length < 32) {
-        return undefined;
-    }
-    if (value.length >= 64) {
-        return value.subarray(0, 64);
-    }
-    const padded = Buffer.alloc(64);
-    value.copy(padded);
-    return padded;
-};
-const asRecord = (value) => value && typeof value === 'object'
-    ? value
-    : undefined;
-const userDataFromRuntime = (runtime) => {
-    if (!runtime) {
-        return undefined;
-    }
-    const payload = asRecord(runtime['client-payload']);
-    if (typeof payload?.['user-data'] === 'string') {
-        const decoded = toUserData64(decodeClaimBytes(payload['user-data']));
-        if (decoded) {
-            return decoded;
-        }
-    }
-    if (typeof runtime['user-data'] === 'string') {
-        return toUserData64(decodeClaimBytes(runtime['user-data']));
-    }
-    return undefined;
-};
-const extractRuntimeUserData = (claims, tee) => {
-    const fromTopLevel = userDataFromRuntime(asRecord(claims['x-ms-runtime']));
-    if (fromTopLevel) {
-        return fromTopLevel;
-    }
-    const fromTee = userDataFromRuntime(asRecord(tee['x-ms-runtime']));
-    if (fromTee) {
-        return fromTee;
-    }
-    throw new Error('MAA token is missing runtime user-data');
-};
-const isolationTee = (claims) => {
-    const nested = claims['x-ms-isolation-tee'];
-    if (nested && typeof nested === 'object') {
-        return nested;
-    }
-    return claims;
-};
-const fetchJwks = async (url) => {
-    const response = await fetch(url, { signal: AbortSignal.timeout(5000) });
-    if (!response.ok) {
-        throw new Error(`Failed to fetch MAA JWKS: ${response.status}`);
-    }
-    return (await response.json());
-};
-const verifyMaaJwt = async (token) => {
-    const parts = token.split('.');
-    if (parts.length !== 3) {
-        throw new Error('MAA token is not a JWT');
-    }
-    const header = decodeJwtPart(parts[0]);
-    const payload = decodeJwtPart(parts[1]);
-    if (header.alg !== 'RS256') {
-        throw new Error(`Unsupported MAA JWT alg: ${header.alg}`);
-    }
-    const iss = payload.iss;
-    if (typeof iss !== 'string' ||
-        !/^https:\/\/[^/]+\.attest\.azure\.net\/?$/.test(iss)) {
-        throw new Error(`Unexpected MAA issuer: ${String(iss)}`);
-    }
-    const jwksUrl = header.jku ?? `${iss.replace(/\/$/, '')}/certs`;
-    if (typeof jwksUrl !== 'string' ||
-        !jwksUrl.startsWith(iss.replace(/\/$/, ''))) {
-        throw new Error('MAA JWT jku is not on the issuer host');
-    }
-    const jwks = await fetchJwks(jwksUrl);
-    const jwk = jwks.keys?.find((key) => key.kid === header.kid) ?? jwks.keys?.[0];
-    if (!jwk) {
-        throw new Error('MAA JWKS does not contain a verification key');
-    }
-    const key = (0, crypto_1.createPublicKey)({
-        key: jwk,
-        format: 'jwk',
-    });
-    const ok = (0, crypto_1.verify)('RSA-SHA256', Buffer.from(`${parts[0]}.${parts[1]}`), key, Buffer.from(parts[2], 'base64url'));
-    if (!ok) {
-        throw new Error('MAA JWT signature verification failed');
-    }
-    return payload;
-};
-exports.verifyMaaJwt = verifyMaaJwt;
-const validateAzureTdxClaims = (claims) => {
-    const tee = isolationTee(claims);
-    if (tee['tdx_td_attributes_debug'] === true) {
-        throw new Error('Azure TDX debug attribute is enabled');
-    }
-    if (tee['x-ms-compliance-status'] !== 'azure-compliant-cvm') {
-        throw new Error(`Azure TDX compliance status is ${String(tee['x-ms-compliance-status'])}`);
-    }
-    const tcbStatus = tee['attester_tcb_status'] ?? claims['attester_tcb_status'];
-    if (tcbStatus && tcbStatus !== 'UpToDate') {
-        throw new Error(`Azure TDX TCB is ${String(tcbStatus)}`);
-    }
-    const userData = extractRuntimeUserData(claims, tee);
-    const tdAttributes = String(tee['tdx_td_attributes'] ?? '');
-    const mrtd = String(tee['tdx_mrtd'] ?? '');
-    const pcrs = extractPcrSha256Hex(claims);
-    const mrenclave = (0, exports.computeAzureTdxMrEnclave)(tdAttributes, mrtd, pcrs);
-    return {
-        userData,
-        mrenclave,
-    };
-};
-exports.validateAzureTdxClaims = validateAzureTdxClaims;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGR4QXp1cmVFdmlkZW5jZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9henVyZS90ZHhBenVyZUV2aWRlbmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLG1DQUtnQjtBQUVILFFBQUEseUJBQXlCLEdBQUcsa0JBQWtCLENBQUM7QUFPckQsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLEtBQWEsRUFBVSxFQUFFLENBQzVELE1BQU0sQ0FBQyxJQUFJLENBQ1AsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUNYLE1BQU0sRUFBRSxpQ0FBeUI7SUFDakMsS0FBSztDQUNxQixDQUFDLEVBQy9CLE1BQU0sQ0FDVCxDQUFDO0FBUE8sUUFBQSxzQkFBc0IsMEJBTzdCO0FBRUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWdCLEVBQXNCLEVBQUU7SUFDMUUsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FDckIsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FDRyxDQUFDO0lBQ2pDLElBQ0ksTUFBTSxDQUFDLE1BQU0sS0FBSyxpQ0FBeUI7UUFDM0MsT0FBTyxNQUFNLENBQUMsS0FBSyxLQUFLLFFBQVEsRUFDbEMsQ0FBQztRQUNDLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBQ0QsT0FBTyxNQUE0QixDQUFDO0FBQ3hDLENBQUMsQ0FBQztBQVhXLFFBQUEscUJBQXFCLHlCQVdoQztBQUVGLE1BQU0sV0FBVyxHQUFHLENBQUMsR0FBVyxFQUFFLGFBQXNCLEVBQVUsRUFBRTtJQUNoRSxNQUFNLFVBQVUsR0FBRyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztJQUMvRCxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksS0FBSyxDQUFDLHNCQUFzQixHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM5QyxJQUFJLGFBQWEsS0FBSyxTQUFTLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxhQUFhLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksS0FBSyxDQUNYLFlBQVksYUFBYSxlQUFlLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxFQUFFLENBQzFFLENBQUM7SUFDTixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxJQUFZLEVBQVcsRUFBRSxDQUM1QyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBRWhFLHdHQUF3RztBQUMzRixRQUFBLGdDQUFnQyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFVLENBQUM7QUFFeEUsTUFBTSx3QkFBd0IsR0FBRyxDQUNwQyxlQUF1QixFQUN2QixPQUFlLEVBQ2YsWUFBc0IsRUFDaEIsRUFBRTtJQUNSLE1BQU0sU0FBUyxHQUNYLHdDQUFnQyxDQUM1Qix3Q0FBZ0MsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUM5QyxDQUFDO0lBQ04sSUFBSSxZQUFZLENBQUMsTUFBTSxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQ25DLE1BQU0sSUFBSSxLQUFLLENBQ1gsb0RBQW9ELFNBQVMsNEJBQTRCLENBQzVGLENBQUM7SUFDTixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUc7UUFDVixXQUFXLENBQUMsZUFBZSxFQUFFLENBQUMsQ0FBQztRQUMvQixXQUFXLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUN4QixHQUFHLHdDQUFnQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQzlDLFdBQVcsQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQ3ZDO0tBQ0osQ0FBQztJQUNGLE9BQU8sSUFBQSxtQkFBVSxFQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDdEUsQ0FBQyxDQUFDO0FBdEJXLFFBQUEsd0JBQXdCLDRCQXNCbkM7QUFFRixNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWEsRUFBVSxFQUFFO0lBQzVDLE1BQU0sT0FBTyxHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM3QixJQUFJLGlCQUFpQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQ2pDLENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQztJQUMvQyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDeEIsT0FBTyxPQUFPLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ25DLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHlEQUF5RCxDQUFDLENBQUM7QUFDL0UsQ0FBQyxDQUFDO0FBRUYsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLE1BQStCLEVBQVksRUFBRTtJQUN0RSxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsa0NBQWtDLENBQUMsQ0FBQztJQUMxRCxJQUNJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQ3JCLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLE9BQU8sSUFBSSxLQUFLLFFBQVEsQ0FBQyxFQUNsRCxDQUFDO1FBQ0MsT0FBUSxNQUFtQixDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBQ0QsSUFBSSxNQUFNLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdkMsTUFBTSxHQUFHLEdBQUcsTUFBaUMsQ0FBQztRQUM5QyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDO1FBQzFCLElBQ0ksS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7WUFDckIsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsT0FBTyxJQUFJLEtBQUssUUFBUSxDQUFDLEVBQ2xELENBQUM7WUFDQyxPQUFRLE1BQW1CLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxNQUFNLEdBQUcsR0FBYSxFQUFFLENBQUM7UUFDekIsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLEVBQUUsRUFBRSxLQUFLLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDekMsTUFBTSxJQUFJLEdBQUcsR0FBRyxDQUFDLE1BQU0sS0FBSyxFQUFFLENBQUMsQ0FBQztZQUNoQyxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUMzQixNQUFNO1lBQ1YsQ0FBQztZQUNELEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxhQUFhLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDckMsQ0FBQztRQUNELElBQ0ksR0FBRyxDQUFDLE1BQU07WUFDVix3Q0FBZ0MsQ0FDNUIsd0NBQWdDLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FDOUMsRUFDSCxDQUFDO1lBQ0MsT0FBTyxHQUFHLENBQUM7UUFDZixDQUFDO0lBQ0wsQ0FBQztJQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseUNBQXlDLENBQUMsQ0FBQztBQUMvRCxDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsS0FBYSxFQUFVLEVBQUU7SUFDL0MsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzdCLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMzRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3ZDLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0FBQzFDLENBQUMsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBYSxFQUFzQixFQUFFO0lBQ3ZELElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUNwQixPQUFPLFNBQVMsQ0FBQztJQUNyQixDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsTUFBTSxJQUFJLEVBQUUsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDakMsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDaEMsS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNuQixPQUFPLE1BQU0sQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRixNQUFNLFFBQVEsR0FBRyxDQUFDLEtBQWMsRUFBdUMsRUFBRSxDQUNyRSxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtJQUM5QixDQUFDLENBQUUsS0FBaUM7SUFDcEMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUVwQixNQUFNLG1CQUFtQixHQUFHLENBQ3hCLE9BQTRDLEVBQzFCLEVBQUU7SUFDcEIsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ1gsT0FBTyxTQUFTLENBQUM7SUFDckIsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQ3BELElBQUksT0FBTyxPQUFPLEVBQUUsQ0FBQyxXQUFXLENBQUMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUM3QyxNQUFNLE9BQU8sR0FBRyxZQUFZLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNyRSxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQ1YsT0FBTyxPQUFPLENBQUM7UUFDbkIsQ0FBQztJQUNMLENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFdBQVcsQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNDLE9BQU8sWUFBWSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE9BQU8sU0FBUyxDQUFDO0FBQ3JCLENBQUMsQ0FBQztBQUVGLE1BQU0sc0JBQXNCLEdBQUcsQ0FDM0IsTUFBK0IsRUFDL0IsR0FBNEIsRUFDdEIsRUFBRTtJQUNSLE1BQU0sWUFBWSxHQUFHLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzNFLElBQUksWUFBWSxFQUFFLENBQUM7UUFDZixPQUFPLFlBQVksQ0FBQztJQUN4QixDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsbUJBQW1CLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbkUsSUFBSSxPQUFPLEVBQUUsQ0FBQztRQUNWLE9BQU8sT0FBTyxDQUFDO0lBQ25CLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7QUFDOUQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FDakIsTUFBK0IsRUFDUixFQUFFO0lBQ3pCLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQzVDLElBQUksTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3ZDLE9BQU8sTUFBaUMsQ0FBQztJQUM3QyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsS0FBSyxFQUNuQixHQUFXLEVBQ2dDLEVBQUU7SUFDN0MsTUFBTSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsR0FBRyxFQUFFLEVBQUUsTUFBTSxFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pFLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDZixNQUFNLElBQUksS0FBSyxDQUFDLDZCQUE2QixRQUFRLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBQ0QsT0FBTyxDQUFDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUF1QyxDQUFDO0FBQ3pFLENBQUMsQ0FBQztBQUVLLE1BQU0sWUFBWSxHQUFHLEtBQUssRUFDN0IsS0FBYSxFQUNtQixFQUFFO0lBQ2xDLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDL0IsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLENBQUMsQ0FBQztJQUM5QyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FJcEMsQ0FBQztJQUNGLE1BQU0sT0FBTyxHQUFHLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQTRCLENBQUM7SUFDbkUsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQUMsNEJBQTRCLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDO0lBQ3hCLElBQ0ksT0FBTyxHQUFHLEtBQUssUUFBUTtRQUN2QixDQUFDLDBDQUEwQyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFDdkQsQ0FBQztRQUNDLE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxHQUFHLElBQUksR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDO0lBQ2hFLElBQ0ksT0FBTyxPQUFPLEtBQUssUUFBUTtRQUMzQixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFDN0MsQ0FBQztRQUNDLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdEMsTUFBTSxHQUFHLEdBQ0wsSUFBSSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEtBQUssTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN2RSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE1BQU0sR0FBRyxHQUFHLElBQUEsd0JBQWUsRUFBQztRQUN4QixHQUFHLEVBQUUsR0FBZ0M7UUFDckMsTUFBTSxFQUFFLEtBQUs7S0FDaEIsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxFQUFFLEdBQUcsSUFBQSxlQUFNLEVBQ2IsWUFBWSxFQUNaLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFDdEMsR0FBRyxFQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUNyQyxDQUFDO0lBQ0YsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ04sTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxPQUFPLE9BQU8sQ0FBQztBQUNuQixDQUFDLENBQUM7QUFsRFcsUUFBQSxZQUFZLGdCQWtEdkI7QUFFSyxNQUFNLHNCQUFzQixHQUFHLENBQ2xDLE1BQStCLEVBQ1EsRUFBRTtJQUN6QyxNQUFNLEdBQUcsR0FBRyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDakMsSUFBSSxHQUFHLENBQUMseUJBQXlCLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUMxQyxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQUNELElBQUksR0FBRyxDQUFDLHdCQUF3QixDQUFDLEtBQUsscUJBQXFCLEVBQUUsQ0FBQztRQUMxRCxNQUFNLElBQUksS0FBSyxDQUNYLGtDQUFrQyxNQUFNLENBQUMsR0FBRyxDQUFDLHdCQUF3QixDQUFDLENBQUMsRUFBRSxDQUM1RSxDQUFDO0lBQ04sQ0FBQztJQUNELE1BQU0sU0FBUyxHQUNYLEdBQUcsQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQ2hFLElBQUksU0FBUyxJQUFJLFNBQVMsS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUN4QyxNQUFNLElBQUksS0FBSyxDQUFDLG9CQUFvQixNQUFNLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxzQkFBc0IsQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDckQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzVELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7SUFDM0MsTUFBTSxJQUFJLEdBQUcsbUJBQW1CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDekMsTUFBTSxTQUFTLEdBQUcsSUFBQSxnQ0FBd0IsRUFBQyxZQUFZLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBRXJFLE9BQU87UUFDSCxRQUFRO1FBQ1IsU0FBUztLQUNaLENBQUM7QUFDTixDQUFDLENBQUM7QUE1QlcsUUFBQSxzQkFBc0IsMEJBNEJqQyJ9

package/dist/challengeProvider/challengeProviderTdxAzure.d.ts

@@ -1,8 +0,0 @@
-/// <reference types="node" />
-import { ChallengeProvider } from './challengeProvider';
-import { Challenge, Log } from '@super-protocol/pki-common';
-export declare class ChallengeProviderTdxAzure implements ChallengeProvider {
-    readonly logger?: Log | undefined;
-    constructor(logger?: Log | undefined);
-    generateChallenge(userData: Buffer, networkID?: string): Promise<Challenge>;
-}