@super-protocol/pki-sync-client 0.0.0-nvidia-local-verifier

package/README.md

@@ -0,0 +1,372 @@
+# PKI Sync Client
+
+A secure client utility for synchronizing secrets from a PKI (Public Key Infrastructure) server with support for Trusted Execution Environments (TEE) including Intel TDX and AMD SEV-SNP.
+
+## Features
+
+- **Secure Secret Synchronization**: Fetch and save secrets from PKI servers with mutual TLS authentication
+- **TEE Support**: Automatic detection and support for Intel TDX and AMD SEV-SNP environments
+- **High Availability**: Automatic failover across multiple PKI servers
+- **Certificate Management**: Optionally save client certificates for external use
+- **Flexible Configuration**: YAML-based configuration for secrets and server endpoints
+- **CLI & Programmatic API**: Use as a command-line tool or integrate into your application
+
+## Installation
+
+### As a CLI Tool
+
+```bash
+npm install -g @super-protocol/pki-sync-client
+```
+
+### As a Library
+
+```bash
+npm install @super-protocol/pki-sync-client
+```
+
+## Configuration
+
+### Secrets Configuration File
+
+Create a YAML file (e.g., `secrets.yaml`) that defines which secrets to sync and where to save them:
+
+```yaml
+secrets:
+  - secretName: database-password
+    saveTo: /etc/app/db-password.txt
+  - secretName: api-key
+    saveTo: /var/secrets/api-key.txt
+  - secretName: tls-certificate
+    saveTo: /etc/app/certs/server.crt
+```
+
+**Schema:**
+- `secretName` (string, required): Name of the secret on the PKI server
+- `saveTo` (string, required): Absolute path where the secret should be saved
+
+### Swarm Environment File
+
+Create a YAML file (e.g., `swarm-env.yaml`) that defines PKI server connection details:
+
+```yaml
+pki_authority:
+  networkID: my-network-id
+  caBundle: |
+    -----BEGIN CERTIFICATE-----
+    MIIDXTCCAkWgAwIBAgIJAKL0UG+mRkSvMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
+    ... (certificate content) ...
+    -----END CERTIFICATE-----
+  servers:
+    - pki-server-1.example.com
+    - pki-server-2.example.com
+```
+
+**Schema:**
+- `pki_authority.networkID` (string, required): Network identifier for PKI authentication
+- `pki_authority.caBundle` (string, required): PEM-encoded CA certificate bundle for server verification
+- `pki_authority.servers` (array of strings, required): List of PKI server addresses (with automatic failover)
+
+`pki-sync-client` uses only certificates from `pki_authority.caBundle` as
+trusted CAs. System root certificates are never added to the TLS trust store.
+
+## CLI Usage
+
+### Basic Sync Command
+
+```bash
+pki-sync-client sync --config secrets.yaml --swarm-env swarm-env.yaml
+```
+
+### Complete Options
+
+```bash
+pki-sync-client sync [options]
+```
+
+#### Options
+
+| Option | Alias | Type | Default | Description |
+|--------|-------|------|---------|-------------|
+| `--config` | `-c` | string | *required* | Path to secrets configuration file (YAML) |
+| `--swarm-env` | | string | `/sp/swarm/swarm-env.yaml` | Path to swarm environment config (YAML) |
+| `--own-challenge` | | string | `auto` | Authentication challenge type: `auto`, `tdx`, `sev-snp`, or `untrusted` |
+| `--log-level` | `-l` | string | | Log level: `fatal`, `error`, `warn`, `info`, `debug`, `trace` |
+| `--retry-attempts` | | number | `3` | Number of retry attempts per server for retryable network/DNS errors |
+| `--retry-timeout` | | number | `10` | Timeout between retries in seconds for retryable network/DNS errors |
+| `--disable-server-identity-check` | | boolean | `false` | Disable server identity verification (not recommended) |
+| `--network-type-file` | | string | | Path to file containing local network type (`trusted` or `untrusted`). Defaults to `untrusted` when omitted |
+| `--save-certs-to-dir` | | string | | Directory to save client certificates (`key.pem`, `ca.pem`, `cert.pem`) |
+| `--save-certs-prefix` | | string | | Prefix for certificate filenames (e.g., `client` → `client_key.pem`) |
+
+By default, if `--log-level` is not provided, `SyncClient` runs with logging disabled.
+
+### Examples
+
+**Simple sync (no logs):**
+```bash
+pki-sync-client sync -c secrets.yaml
+```
+
+**Simple sync with explicit log level:**
+```bash
+pki-sync-client sync -c secrets.yaml --log-level info
+```
+
+**Sync with custom swarm environment:**
+```bash
+pki-sync-client sync -c secrets.yaml --swarm-env /custom/path/swarm-env.yaml
+```
+
+**Sync with custom retry policy:**
+```bash
+pki-sync-client sync -c secrets.yaml --retry-attempts 5 --retry-timeout 3
+```
+
+**Sync with explicit local network type file:**
+```bash
+pki-sync-client sync -c secrets.yaml --network-type-file /sp/swarm/network-type
+```
+
+**Sync and save client certificates:**
+```bash
+pki-sync-client sync -c secrets.yaml --save-certs-to-dir /etc/app/certs
+```
+
+**Sync with certificate prefix:**
+```bash
+pki-sync-client sync -c secrets.yaml \
+  --save-certs-to-dir /etc/app/certs \
+  --save-certs-prefix myapp
+# Creates: myapp_key.pem, myapp_ca.pem, myapp_cert.pem
+```
+
+**Force specific challenge type:**
+```bash
+pki-sync-client sync -c secrets.yaml --own-challenge tdx
+```
+
+**Development/testing (untrusted mode):**
+```bash
+pki-sync-client sync -c secrets.yaml --own-challenge untrusted
+```
+
+## Programmatic API
+
+### Basic Usage
+
+```typescript
+import { SyncClient, parseConfig, parseSwarmEnv } from '@super-protocol/pki-sync-client';
+
+async function syncSecrets() {
+  // Parse configuration files
+  const config = parseConfig('./secrets.yaml');
+  const swarmEnv = parseSwarmEnv('./swarm-env.yaml');
+
+  // Create sync client
+  const client = new SyncClient({
+    servers: swarmEnv.pki_authority.servers,
+    networkID: swarmEnv.pki_authority.networkID,
+    caBundle: swarmEnv.pki_authority.caBundle,
+    ownChallenge: 'auto',
+    logLevel: 'info',
+  });
+
+  // Perform sync
+  await client.sync(config);
+  console.log('Secrets synced successfully');
+}
+
+syncSecrets().catch(console.error);
+```
+
+### Advanced Usage with Certificate Saving
+
+```typescript
+import { SyncClient, SyncConfig } from '@super-protocol/pki-sync-client';
+
+const client = new SyncClient({
+  servers: ['pki1.example.com', 'pki2.example.com'],
+  networkID: 'my-network',
+  caBundle: fs.readFileSync('./ca-bundle.pem', 'utf-8'),
+  ownChallenge: 'tdx',
+  logLevel: 'debug',
+  disableServerIdentityCheck: false,
+  saveCertsToDir: '/etc/app/certs',
+  saveCertsPrefix: 'myapp',
+});
+
+const config: SyncConfig = {
+  secrets: [
+    { secretName: 'db-password', saveTo: '/etc/app/db-password' },
+    { secretName: 'api-key', saveTo: '/etc/app/api-key' },
+  ],
+};
+
+await client.sync(config);
+```
+
+### API Reference
+
+#### `SyncClient`
+
+**Constructor Options:**
+
+```typescript
+interface SyncClientOptions {
+  servers: string[];              // List of PKI server addresses
+  networkID: string;               // Network identifier
+  caBundle: string;                // PEM-encoded CA certificate bundle
+  ownChallenge: string;            // Challenge type: 'auto', 'tdx', 'sev-snp', 'untrusted'
+  retryAttempts?: number;          // Retry attempts per server (default: 3)
+  retryDelaySec?: number;          // Delay between retries in seconds (default: 10)
+  logLevel?: LogLevel;             // Log level: fatal | error | warn | info | debug | trace; if omitted logs are disabled
+  disableServerIdentityCheck?: boolean;  // Disable server identity verification (default: false)
+  networkTypeFile?: string;        // File containing local network type: trusted | untrusted; defaults to untrusted
+  saveCertsToDir?: string;         // Directory to save certificates
+  saveCertsPrefix?: string;        // Prefix for certificate filenames
+}
+```
+
+**Methods:**
+
+- `async sync(config: SyncConfig): Promise<void>` - Synchronize secrets from PKI server
+
+#### `parseConfig(configPath: string): SyncConfig`
+
+Parse and validate a secrets configuration file.
+
+**Throws:**
+- Error if file not found
+- Error if configuration schema is invalid
+
+#### `parseSwarmEnv(swarmEnvPath: string): SwarmEnv`
+
+Parse and validate a swarm environment configuration file.
+
+**Throws:**
+- Error if file not found
+- Error if configuration schema is invalid
+
+## Challenge Types
+
+The sync client supports different authentication challenge types:
+
+### `auto` (Default)
+Automatically detects the environment by checking for:
+- `/dev/tdx_guest` → Uses TDX challenge
+- `/dev/sev-guest` → Uses SEV-SNP challenge
+- If the VM is running in Google Cloud and the GCE metadata endpoint responds, TDX/SEV-SNP is temporarily downgraded to `untrusted`
+- Neither found → Falls back to untrusted mode
+
+### `tdx`
+Explicitly use Intel TDX attestation for authentication.
+
+### `sev-snp`
+Explicitly use AMD SEV-SNP attestation for authentication.
+
+### `untrusted`
+Use a static identifier for non-TEE environments (development/testing only).
+
+## How It Works
+
+1. **Configuration Loading**: Parses YAML configuration files for secrets and server details
+2. **Challenge Selection**: Determines authentication method based on environment or user specification
+3. **PKI Client Creation**: Establishes mutual TLS connection with PKI server
+4. **Secret Retrieval**: Requests specified secrets via authenticated API call
+5. **Secret Storage**: Saves Base64-decoded secrets to specified file paths with secure permissions (0600)
+6. **Certificate Export** (optional): Saves client certificates for external use
+7. **Failover**: Automatically tries next server if connection fails
+
+Retry behavior details:
+- Retries are performed for retryable network/DNS errors (for example: `ECONNRESET`, `ECONNREFUSED`, `ETIMEDOUT`, `EAI_AGAIN`, `ENOTFOUND`) and for HTTP `429`/`502` responses (e.g. throttling or temporary upstream failure behind OpenResty)
+- Retries are performed against the original hostname (SNI-safe), without replacing hostname with direct IPs
+
+## Error Handling
+
+The sync client provides clear error messages for common issues:
+
+```typescript
+try {
+  await client.sync(config);
+} catch (error) {
+  if (error.message.includes('not found')) {
+    // Secret doesn't exist on server
+  } else if (error.message.includes('Failed to sync from all servers')) {
+    // All servers unreachable
+  } else {
+    // Other errors (network, authentication, etc.)
+  }
+}
+```
+
+### Common Exit Codes (CLI)
+
+- `0`: Success
+- `1`: Sync failed (configuration error, network error, authentication failure, etc.)
+
+## File Permissions
+
+- **Secrets**: Saved with mode `0600` (read/write for owner only)
+- **Private keys**: Saved with mode `0600` (read/write for owner only)
+- **Certificates**: Saved with mode `0644` (readable by all, writable by owner)
+
+## Security Considerations
+
+1. **Server Identity Verification**: Always enabled by default. Only disable with `--disable-server-identity-check` in trusted development environments.
+2. **Root Certificate Trust Verification**: The root certificate network type extension must match the local network type. Trusted roots must include hardware evidence whose mrEnclave is present in the Super Protocol trusted registry.
+3. **Certificate Validation**: CA bundle is used to verify server certificates during TLS handshake.
+4. **Mutual TLS**: Both client and server authenticate each other using certificates.
+5. **TEE Attestation**: In TDX/SEV environments, hardware-backed attestation proves client identity.
+6. **Secure Storage**: Secrets are saved with restrictive file permissions to prevent unauthorized access.
+
+## Development
+
+### Building from Source
+
+```bash
+npm install
+npm run build
+```
+
+### Running Without Building
+
+```bash
+npm start -- sync -c conf/secrets-example.yaml
+```
+
+### Linting
+
+```bash
+npm run lint
+npm run lint:fix
+```
+
+## Example Configuration Files
+
+Example files are provided in the `conf/` directory:
+
+- [`conf/secrets-example.yaml`](conf/secrets-example.yaml) - Example secrets configuration
+- [`conf/swarm-env.example.yaml`](conf/swarm-env.example.yaml) - Example swarm environment configuration
+
+## Dependencies
+
+- **[@super-protocol/pki-client](https://www.npmjs.com/package/@super-protocol/pki-client)** - PKI client library with TEE support
+- **[@super-protocol/pki-common](https://www.npmjs.com/package/@super-protocol/pki-common)** - Common PKI utilities and types
+- **axios** - HTTP client for API requests
+- **js-yaml** - YAML parser for configuration files
+- **yargs** - Command-line argument parser
+
+## License
+
+ISC
+
+## Author
+
+Super Protocol
+
+## Related Packages
+
+- [@super-protocol/pki-client](../pki-client) - PKI client library
+- [@super-protocol/pki-common](../pki-common) - Common PKI utilities
+- [@super-protocol/pki-authority-service](../pki-authority-service) - PKI Authority Service

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const yargs_1 = __importDefault(require("yargs"));
+const helpers_1 = require("yargs/helpers");
+const config_1 = require("./config");
+const sync_client_1 = require("./sync-client");
+const pki_common_1 = require("@super-protocol/pki-common");
+const DEFAULT_SWARM_ENV_PATH = '/sp/swarm/swarm-env.yaml';
+async function sync(argv) {
+    try {
+        const config = (0, config_1.parseConfig)(argv.config);
+        const swarmEnv = (0, config_1.parseSwarmEnv)(argv.swarmEnv);
+        const client = new sync_client_1.SyncClient({
+            servers: swarmEnv.pki_authority.servers,
+            networkID: swarmEnv.pki_authority.networkID,
+            caBundle: swarmEnv.pki_authority.caBundle,
+            ownChallenge: argv.ownChallenge,
+            retryAttempts: argv.retryAttempts,
+            retryDelaySec: argv.retryTimeout,
+            logLevel: argv.logLevel,
+            disableServerIdentityCheck: argv.disableServerIdentityCheck,
+            saveCertsToDir: argv.saveCertsToDir,
+            saveCertsPrefix: argv.saveCertsPrefix,
+            networkTypeFile: argv.networkTypeFile,
+            nvtrust: swarmEnv.nvtrust,
+        });
+        await client.sync(config);
+        console.log('Sync completed successfully');
+    }
+    catch (error) {
+        console.error('Sync failed:', error.message);
+        process.exit(1);
+    }
+}
+async function main() {
+    await (0, yargs_1.default)((0, helpers_1.hideBin)(process.argv))
+        .usage('Usage: $0 sync [options]')
+        .command('sync', 'Sync secrets from PKI server', (yargs) => {
+        return yargs
+            .option('swarm-env', {
+            describe: 'Path to swarm environment config (YAML)',
+            type: 'string',
+            default: DEFAULT_SWARM_ENV_PATH,
+        })
+            .option('config', {
+            alias: 'c',
+            describe: 'Path to secrets config file (YAML)',
+            type: 'string',
+            demandOption: true,
+        })
+            .option('own-challenge', {
+            describe: 'Own challenge string for authentication (auto, tdx, tdx-google, tdx-azure, sev-snp, sev-snp-azure, untrusted)',
+            type: 'string',
+            default: 'auto',
+        })
+            .option('log-level', {
+            alias: 'l',
+            describe: 'Log level',
+            choices: Object.values(pki_common_1.LogLevel),
+            type: 'string',
+        })
+            .option('retry-attempts', {
+            describe: 'Number of retry attempts per server for retryable network/DNS errors',
+            type: 'number',
+            default: sync_client_1.SyncClient.DEFAULT_RETRY_ATTEMPTS,
+        })
+            .option('retry-timeout', {
+            describe: 'Timeout between retries in seconds for retryable network/DNS errors',
+            type: 'number',
+            default: sync_client_1.SyncClient.DEFAULT_RETRY_DELAY_SEC,
+        })
+            .option('disable-server-identity-check', {
+            describe: 'Disable server identity verification',
+            type: 'boolean',
+            default: false,
+        })
+            .option('network-type-file', {
+            describe: 'Path to file containing local network type (trusted or untrusted)',
+            type: 'string',
+        })
+            .option('save-certs-to-dir', {
+            describe: 'Directory to save client certificates (key.pem, ca.pem, cert.pem)',
+            type: 'string',
+        })
+            .option('save-certs-prefix', {
+            describe: 'Prefix for certificate filenames (e.g., "client" -> client_key.pem)',
+            type: 'string',
+        });
+    }, sync)
+        .demandCommand(1, 'You must provide a command')
+        .help()
+        .alias('help', 'h')
+        .version()
+        .alias('version', 'V')
+        .parse();
+}
+main().catch((error) => {
+    console.error('Error:', error.message);
+    process.exit(1);
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2NsaS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFDQSxrREFBMEI7QUFDMUIsMkNBQXdDO0FBQ3hDLHFDQUFzRDtBQUN0RCwrQ0FBMkM7QUFDM0MsMkRBQXNEO0FBRXRELE1BQU0sc0JBQXNCLEdBQUcsMEJBQTBCLENBQUM7QUFFMUQsS0FBSyxVQUFVLElBQUksQ0FBQyxJQUFTO0lBQ3pCLElBQUksQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUEsb0JBQVcsRUFBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDeEMsTUFBTSxRQUFRLEdBQUcsSUFBQSxzQkFBYSxFQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUU5QyxNQUFNLE1BQU0sR0FBRyxJQUFJLHdCQUFVLENBQUM7WUFDMUIsT0FBTyxFQUFFLFFBQVEsQ0FBQyxhQUFhLENBQUMsT0FBTztZQUN2QyxTQUFTLEVBQUUsUUFBUSxDQUFDLGFBQWEsQ0FBQyxTQUFTO1lBQzNDLFFBQVEsRUFBRSxRQUFRLENBQUMsYUFBYSxDQUFDLFFBQVE7WUFDekMsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1lBQy9CLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtZQUNqQyxhQUFhLEVBQUUsSUFBSSxDQUFDLFlBQVk7WUFDaEMsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRO1lBQ3ZCLDBCQUEwQixFQUFFLElBQUksQ0FBQywwQkFBMEI7WUFDM0QsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjO1lBQ25DLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZTtZQUNyQyxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWU7WUFDckMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO1NBQzVCLENBQUMsQ0FBQztRQUVILE1BQU0sTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUUxQixPQUFPLENBQUMsR0FBRyxDQUFDLDZCQUE2QixDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUFDLE9BQU8sS0FBVSxFQUFFLENBQUM7UUFDbEIsT0FBTyxDQUFDLEtBQUssQ0FBQyxjQUFjLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzdDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDcEIsQ0FBQztBQUNMLENBQUM7QUFFRCxLQUFLLFVBQVUsSUFBSTtJQUNmLE1BQU0sSUFBQSxlQUFLLEVBQUMsSUFBQSxpQkFBTyxFQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztTQUM3QixLQUFLLENBQUMsMEJBQTBCLENBQUM7U0FDakMsT0FBTyxDQUNKLE1BQU0sRUFDTiw4QkFBOEIsRUFDOUIsQ0FBQyxLQUFLLEVBQUUsRUFBRTtRQUNOLE9BQU8sS0FBSzthQUNQLE1BQU0sQ0FBQyxXQUFXLEVBQUU7WUFDakIsUUFBUSxFQUFFLHlDQUF5QztZQUNuRCxJQUFJLEVBQUUsUUFBUTtZQUNkLE9BQU8sRUFBRSxzQkFBc0I7U0FDbEMsQ0FBQzthQUNELE1BQU0sQ0FBQyxRQUFRLEVBQUU7WUFDZCxLQUFLLEVBQUUsR0FBRztZQUNWLFFBQVEsRUFBRSxvQ0FBb0M7WUFDOUMsSUFBSSxFQUFFLFFBQVE7WUFDZCxZQUFZLEVBQUUsSUFBSTtTQUNyQixDQUFDO2FBQ0QsTUFBTSxDQUFDLGVBQWUsRUFBRTtZQUNyQixRQUFRLEVBQ0osK0dBQStHO1lBQ25ILElBQUksRUFBRSxRQUFRO1lBQ2QsT0FBTyxFQUFFLE1BQU07U0FDbEIsQ0FBQzthQUNELE1BQU0sQ0FBQyxXQUFXLEVBQUU7WUFDakIsS0FBSyxFQUFFLEdBQUc7WUFDVixRQUFRLEVBQUUsV0FBVztZQUNyQixPQUFPLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxxQkFBUSxDQUFDO1lBQ2hDLElBQUksRUFBRSxRQUFRO1NBQ2pCLENBQUM7YUFDRCxNQUFNLENBQUMsZ0JBQWdCLEVBQUU7WUFDdEIsUUFBUSxFQUNKLHNFQUFzRTtZQUMxRSxJQUFJLEVBQUUsUUFBUTtZQUNkLE9BQU8sRUFBRSx3QkFBVSxDQUFDLHNCQUFzQjtTQUM3QyxDQUFDO2FBQ0QsTUFBTSxDQUFDLGVBQWUsRUFBRTtZQUNyQixRQUFRLEVBQ0oscUVBQXFFO1lBQ3pFLElBQUksRUFBRSxRQUFRO1lBQ2QsT0FBTyxFQUFFLHdCQUFVLENBQUMsdUJBQXVCO1NBQzlDLENBQUM7YUFDRCxNQUFNLENBQUMsK0JBQStCLEVBQUU7WUFDckMsUUFBUSxFQUFFLHNDQUFzQztZQUNoRCxJQUFJLEVBQUUsU0FBUztZQUNmLE9BQU8sRUFBRSxLQUFLO1NBQ2pCLENBQUM7YUFDRCxNQUFNLENBQUMsbUJBQW1CLEVBQUU7WUFDekIsUUFBUSxFQUNKLG1FQUFtRTtZQUN2RSxJQUFJLEVBQUUsUUFBUTtTQUNqQixDQUFDO2FBQ0QsTUFBTSxDQUFDLG1CQUFtQixFQUFFO1lBQ3pCLFFBQVEsRUFDSixtRUFBbUU7WUFDdkUsSUFBSSxFQUFFLFFBQVE7U0FDakIsQ0FBQzthQUNELE1BQU0sQ0FBQyxtQkFBbUIsRUFBRTtZQUN6QixRQUFRLEVBQ0oscUVBQXFFO1lBQ3pFLElBQUksRUFBRSxRQUFRO1NBQ2pCLENBQUMsQ0FBQztJQUNYLENBQUMsRUFDRCxJQUFJLENBQ1A7U0FDQSxhQUFhLENBQUMsQ0FBQyxFQUFFLDRCQUE0QixDQUFDO1NBQzlDLElBQUksRUFBRTtTQUNOLEtBQUssQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDO1NBQ2xCLE9BQU8sRUFBRTtTQUNULEtBQUssQ0FBQyxTQUFTLEVBQUUsR0FBRyxDQUFDO1NBQ3JCLEtBQUssRUFBRSxDQUFDO0FBQ2pCLENBQUM7QUFFRCxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtJQUNuQixPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdkMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNwQixDQUFDLENBQUMsQ0FBQyJ9

package/dist/config.d.ts

@@ -0,0 +1,29 @@
+import { Static } from '@sinclair/typebox';
+declare const SecretEntrySchema: import("@sinclair/typebox").TObject<{
+    secretName: import("@sinclair/typebox").TString;
+    saveTo: import("@sinclair/typebox").TString;
+}>;
+declare const SyncConfigSchema: import("@sinclair/typebox").TObject<{
+    secrets: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        secretName: import("@sinclair/typebox").TString;
+        saveTo: import("@sinclair/typebox").TString;
+    }>>;
+}>;
+declare const SwarmEnvSchema: import("@sinclair/typebox").TObject<{
+    pki_authority: import("@sinclair/typebox").TObject<{
+        networkID: import("@sinclair/typebox").TString;
+        caBundle: import("@sinclair/typebox").TString;
+        servers: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    }>;
+    nvtrust: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        verifier: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"remote">, import("@sinclair/typebox").TLiteral<"local">]>>;
+        rimUrl: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        ocspUrl: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>>;
+}>;
+export type SecretEntry = Static<typeof SecretEntrySchema>;
+export type SyncConfig = Static<typeof SyncConfigSchema>;
+export type SwarmEnv = Static<typeof SwarmEnvSchema>;
+export declare function parseConfig(configPath: string): SyncConfig;
+export declare function parseSwarmEnv(swarmEnvPath: string): SwarmEnv;
+export {};

package/dist/config.js

@@ -0,0 +1,76 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSwarmEnv = exports.parseConfig = void 0;
+const typebox_1 = require("@sinclair/typebox");
+const value_1 = require("@sinclair/typebox/value");
+const fs = __importStar(require("fs"));
+const yaml = __importStar(require("js-yaml"));
+const SecretEntrySchema = typebox_1.Type.Object({
+    secretName: typebox_1.Type.String(),
+    saveTo: typebox_1.Type.String(),
+});
+const SyncConfigSchema = typebox_1.Type.Object({
+    secrets: typebox_1.Type.Array(SecretEntrySchema),
+});
+const SwarmEnvSchema = typebox_1.Type.Object({
+    pki_authority: typebox_1.Type.Object({
+        networkID: typebox_1.Type.String(),
+        caBundle: typebox_1.Type.String(),
+        servers: typebox_1.Type.Array(typebox_1.Type.String()),
+    }),
+    nvtrust: typebox_1.Type.Optional(typebox_1.Type.Object({
+        verifier: typebox_1.Type.Optional(typebox_1.Type.Union([typebox_1.Type.Literal('remote'), typebox_1.Type.Literal('local')])),
+        rimUrl: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+        ocspUrl: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    })),
+});
+function parseConfig(configPath) {
+    if (!fs.existsSync(configPath)) {
+        throw new Error(`Config file not found: ${configPath}`);
+    }
+    const fileContent = fs.readFileSync(configPath, 'utf-8');
+    const parsed = yaml.load(fileContent, { schema: yaml.JSON_SCHEMA });
+    if (!value_1.Value.Check(SyncConfigSchema, parsed)) {
+        const errors = [...value_1.Value.Errors(SyncConfigSchema, parsed)];
+        throw new Error(`Invalid config file: ${errors.map((e) => `${e.path}: ${e.message}`).join(', ')}`);
+    }
+    return parsed;
+}
+exports.parseConfig = parseConfig;
+function parseSwarmEnv(swarmEnvPath) {
+    if (!fs.existsSync(swarmEnvPath)) {
+        throw new Error(`Swarm env file not found: ${swarmEnvPath}`);
+    }
+    const fileContent = fs.readFileSync(swarmEnvPath, 'utf-8');
+    const parsed = yaml.load(fileContent, { schema: yaml.JSON_SCHEMA });
+    if (!value_1.Value.Check(SwarmEnvSchema, parsed)) {
+        const errors = [...value_1.Value.Errors(SwarmEnvSchema, parsed)];
+        throw new Error(`Invalid swarm env file: ${errors.map((e) => `${e.path}: ${e.message}`).join(', ')}`);
+    }
+    return parsed;
+}
+exports.parseSwarmEnv = parseSwarmEnv;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2NvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLCtDQUFpRDtBQUNqRCxtREFBZ0Q7QUFDaEQsdUNBQXlCO0FBQ3pCLDhDQUFnQztBQUVoQyxNQUFNLGlCQUFpQixHQUFHLGNBQUksQ0FBQyxNQUFNLENBQUM7SUFDbEMsVUFBVSxFQUFFLGNBQUksQ0FBQyxNQUFNLEVBQUU7SUFDekIsTUFBTSxFQUFFLGNBQUksQ0FBQyxNQUFNLEVBQUU7Q0FDeEIsQ0FBQyxDQUFDO0FBRUgsTUFBTSxnQkFBZ0IsR0FBRyxjQUFJLENBQUMsTUFBTSxDQUFDO0lBQ2pDLE9BQU8sRUFBRSxjQUFJLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDO0NBQ3pDLENBQUMsQ0FBQztBQUVILE1BQU0sY0FBYyxHQUFHLGNBQUksQ0FBQyxNQUFNLENBQUM7SUFDL0IsYUFBYSxFQUFFLGNBQUksQ0FBQyxNQUFNLENBQUM7UUFDdkIsU0FBUyxFQUFFLGNBQUksQ0FBQyxNQUFNLEVBQUU7UUFDeEIsUUFBUSxFQUFFLGNBQUksQ0FBQyxNQUFNLEVBQUU7UUFDdkIsT0FBTyxFQUFFLGNBQUksQ0FBQyxLQUFLLENBQUMsY0FBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0tBQ3JDLENBQUM7SUFDRixPQUFPLEVBQUUsY0FBSSxDQUFDLFFBQVEsQ0FDbEIsY0FBSSxDQUFDLE1BQU0sQ0FBQztRQUNSLFFBQVEsRUFBRSxjQUFJLENBQUMsUUFBUSxDQUNuQixjQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsY0FBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxjQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FDOUQ7UUFDRCxNQUFNLEVBQUUsY0FBSSxDQUFDLFFBQVEsQ0FBQyxjQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDcEQsT0FBTyxFQUFFLGNBQUksQ0FBQyxRQUFRLENBQUMsY0FBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0tBQ3hELENBQUMsQ0FDTDtDQUNKLENBQUMsQ0FBQztBQU1ILFNBQWdCLFdBQVcsQ0FBQyxVQUFrQjtJQUMxQyxJQUFJLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLFVBQVUsRUFBRSxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQUVELE1BQU0sV0FBVyxHQUFHLEVBQUUsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ3pELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBRXBFLElBQUksQ0FBQyxhQUFLLENBQUMsS0FBSyxDQUFDLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDekMsTUFBTSxNQUFNLEdBQUcsQ0FBQyxHQUFHLGFBQUssQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMzRCxNQUFNLElBQUksS0FBSyxDQUNYLHdCQUF3QixNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQ3BGLENBQUM7SUFDTixDQUFDO0lBRUQsT0FBTyxNQUFNLENBQUM7QUFDbEIsQ0FBQztBQWhCRCxrQ0FnQkM7QUFFRCxTQUFnQixhQUFhLENBQUMsWUFBb0I7SUFDOUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUMvQixNQUFNLElBQUksS0FBSyxDQUFDLDZCQUE2QixZQUFZLEVBQUUsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFFRCxNQUFNLFdBQVcsR0FBRyxFQUFFLENBQUMsWUFBWSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQztJQUMzRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztJQUVwRSxJQUFJLENBQUMsYUFBSyxDQUFDLEtBQUssQ0FBQyxjQUFjLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN2QyxNQUFNLE1BQU0sR0FBRyxDQUFDLEdBQUcsYUFBSyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUN6RCxNQUFNLElBQUksS0FBSyxDQUNYLDJCQUEyQixNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEtBQUssQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQ3ZGLENBQUM7SUFDTixDQUFDO0lBRUQsT0FBTyxNQUFNLENBQUM7QUFDbEIsQ0FBQztBQWhCRCxzQ0FnQkMifQ==

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './sync-client';
+export * from './config';

package/dist/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./sync-client"), exports);
+__exportStar(require("./config"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGdEQUE4QjtBQUM5QiwyQ0FBeUIifQ==

package/dist/root-certificate-verifier.d.ts

@@ -0,0 +1,26 @@
+/// <reference types="node" />
+import { Log, NetworkType } from '@super-protocol/pki-common';
+import { TeeEvidenceType, type SNPReport } from '@super-protocol/attestation-common';
+import { buildAzureVerifyOptions, type AttestationWasmAzure } from '@super-protocol/pki-attestation-engine';
+interface AttestationWasmNode extends Pick<AttestationWasmAzure, 'describeTdxTcbStatus'> {
+    verifyTeeEvidence(serialized: Uint8Array | ArrayBuffer, options?: ReturnType<typeof buildAzureVerifyOptions>): Promise<{
+        evidenceType: TeeEvidenceType;
+    }>;
+    calculateMrEnclave(serialized: Uint8Array | ArrayBuffer): Promise<{
+        mrEnclave: Uint8Array;
+    }>;
+    calculateSnpSingleCoreMrEnclave(report: SNPReport): Promise<Uint8Array>;
+}
+export interface RootCertificateVerifierOptions {
+    caBundle: string;
+    networkTypeFile?: string;
+    log?: Log;
+    getExtensionValue?: (certPem: string, oid: string) => Buffer | undefined;
+    loadAttestationModule?: () => Promise<AttestationWasmNode>;
+    verifySignature?: (mrEnclave: Uint8Array, evidenceType: TeeEvidenceType) => Promise<void>;
+}
+export declare function resolveLocalNetworkType(networkTypeFile?: string): Promise<NetworkType>;
+export declare const getRootCertificate: (caBundle: string) => string;
+export declare const verifyRootCertificatesMatch: (trustedCaBundle: string, receivedCaBundle: string, log?: Log) => void;
+export declare function verifyRootCertificateTrust(options: RootCertificateVerifierOptions): Promise<void>;
+export {};