@super-protocol/pki-sync-client 0.0.0-nvidia-local-verifier

package/dist/root-certificate-verifier.js

@@ -0,0 +1,259 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyRootCertificateTrust = exports.verifyRootCertificatesMatch = exports.getRootCertificate = exports.resolveLocalNetworkType = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const attestation_common_1 = require("@super-protocol/attestation-common");
+const pki_attestation_engine_1 = require("@super-protocol/pki-attestation-engine");
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const preservedDynamicImport = new Function('specifier', 'return import(specifier)');
+const NETWORK_TYPES = ['trusted', 'untrusted'];
+const isNetworkType = (value) => NETWORK_TYPES.includes(value);
+const getEvidenceLogContext = (evidenceType) => ({
+    evidenceType,
+    evidenceTypeName: (0, attestation_common_1.teeEvidenceTypeToHumanReadable)(evidenceType),
+});
+async function resolveLocalNetworkType(networkTypeFile) {
+    if (!networkTypeFile) {
+        return 'untrusted';
+    }
+    const value = (await fs.promises.readFile(networkTypeFile, 'utf8')).trim();
+    if (!isNetworkType(value)) {
+        throw new Error(`Invalid network type file "${networkTypeFile}": expected trusted or untrusted`);
+    }
+    return value;
+}
+exports.resolveLocalNetworkType = resolveLocalNetworkType;
+const getRootCertificate = (caBundle) => {
+    const { ca } = sdk_js_1.CertificatesHelper.extractCAFromChain(caBundle);
+    const rootCerts = sdk_js_1.CertificatesHelper.splitPemCerts(ca);
+    if (rootCerts.length !== 1) {
+        throw new Error(`Root certificate verification failed: expected exactly one root certificate, got ${rootCerts.length}`);
+    }
+    return `${rootCerts[0].trim()}\n`;
+};
+exports.getRootCertificate = getRootCertificate;
+const verifyRootCertificatesMatch = (trustedCaBundle, receivedCaBundle, log) => {
+    const trustedRoot = new crypto_1.X509Certificate((0, exports.getRootCertificate)(trustedCaBundle));
+    const receivedRoot = new crypto_1.X509Certificate((0, exports.getRootCertificate)(receivedCaBundle));
+    const context = {
+        trustedRootFingerprint256: trustedRoot.fingerprint256,
+        trustedRootSubject: trustedRoot.subject,
+        receivedRootFingerprint256: receivedRoot.fingerprint256,
+        receivedRootSubject: receivedRoot.subject,
+    };
+    if (trustedRoot.fingerprint256 !== receivedRoot.fingerprint256) {
+        log?.error('Received certificate chain root does not match configured PKI authority CA bundle root', context);
+        throw new Error('Received certificate chain root does not match configured PKI authority CA bundle root');
+    }
+    log?.info('Received certificate chain root matches configured PKI authority CA bundle root', context);
+};
+exports.verifyRootCertificatesMatch = verifyRootCertificatesMatch;
+const readNetworkTypeExtension = (rootCertPem, getExtensionValue) => {
+    const networkType = getExtensionValue(rootCertPem, pki_common_1.OID_CUSTOM_EXTENSION_NETWORK_TYPE)
+        ?.toString('ascii')
+        .trim();
+    if (!networkType || !isNetworkType(networkType)) {
+        throw new Error(`Root certificate verification failed: missing or invalid ${pki_common_1.OID_CUSTOM_EXTENSION_NETWORK_TYPE} extension`);
+    }
+    return networkType;
+};
+const defaultLoadAttestationModule = () => preservedDynamicImport('@super-protocol/attestation-wasm/node');
+const calculateMrEnclave = async (serializedEvidence, evidenceType, attestation) => {
+    switch (evidenceType) {
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_QEMU:
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_GCP:
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_INTEL_TDX_AZURE:
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_AZURE:
+            return (await attestation.calculateMrEnclave(serializedEvidence))
+                .mrEnclave;
+        case attestation_common_1.TeeEvidenceType.TEE_EVIDENCE_TYPE_AMD_SEV_SNP_QEMU: {
+            const evidence = attestation_common_1.TeeEvidence.decode(serializedEvidence);
+            const report = evidence.amdSevSnpQemu?.snpReport;
+            if (!report) {
+                throw new Error('Root certificate verification failed: SEV-SNP evidence is missing snpReport');
+            }
+            return attestation.calculateSnpSingleCoreMrEnclave(report);
+        }
+        default:
+            throw new Error(`Root certificate verification failed: unsupported TEE evidence type ${evidenceType}`);
+    }
+};
+async function verifyRootCertificateTrust(options) {
+    const log = options.log;
+    const getExtensionValue = options.getExtensionValue ??
+        ((certPem, oid) => sdk_js_1.CertificatesHelper.getExtensionValue(certPem, oid));
+    const verifySignature = options.verifySignature ?? attestation_common_1.verifyMrEnclaveSignature;
+    log?.info('Starting root certificate trust verification', {
+        networkTypeFile: options.networkTypeFile,
+    });
+    const localNetworkType = await resolveLocalNetworkType(options.networkTypeFile);
+    log?.info('Local network type resolved', {
+        localNetworkType,
+        networkTypeFile: options.networkTypeFile,
+        networkTypeSource: options.networkTypeFile ? 'file' : 'default',
+    });
+    log?.debug('Extracting root certificate from CA bundle');
+    let rootCertPem;
+    try {
+        rootCertPem = (0, exports.getRootCertificate)(options.caBundle);
+    }
+    catch (error) {
+        log?.error('Root certificate extraction failed', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+    const rootCertificate = new crypto_1.X509Certificate(rootCertPem);
+    log?.info('Root certificate extracted from CA bundle', {
+        rootFingerprint256: rootCertificate.fingerprint256,
+        rootSubject: rootCertificate.subject,
+        rootIssuer: rootCertificate.issuer,
+    });
+    log?.debug('Reading root certificate network type extension', {
+        oid: pki_common_1.OID_CUSTOM_EXTENSION_NETWORK_TYPE,
+    });
+    let rootNetworkType;
+    try {
+        rootNetworkType = readNetworkTypeExtension(rootCertPem, getExtensionValue);
+    }
+    catch (error) {
+        log?.error('Root certificate network type extension check failed', {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_NETWORK_TYPE,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+    log?.info('Root certificate network type resolved', {
+        certificateNetworkType: rootNetworkType,
+        localNetworkType,
+    });
+    if (rootNetworkType !== localNetworkType) {
+        log?.error('Root certificate network type mismatch', {
+            certificateNetworkType: rootNetworkType,
+            localNetworkType,
+        });
+        throw new Error(`Root certificate verification failed: certificate network type "${rootNetworkType}" does not match local network type "${localNetworkType}"`);
+    }
+    log?.info('Root certificate network type matches local network type', {
+        certificateNetworkType: rootNetworkType,
+        localNetworkType,
+    });
+    if (rootNetworkType === 'untrusted') {
+        log?.info('Root certificate trust verification completed in untrusted mode', {
+            certificateNetworkType: rootNetworkType,
+            localNetworkType,
+            teeEvidenceRequired: false,
+        });
+        return;
+    }
+    log?.info('Trusted root certificate requires TEE evidence verification', {
+        certificateNetworkType: rootNetworkType,
+        localNetworkType,
+        teeEvidenceRequired: true,
+    });
+    const serializedEvidence = getExtensionValue(rootCertPem, pki_common_1.OID_TEE_EVIDENCE);
+    if (!serializedEvidence) {
+        log?.error('Trusted root certificate is missing TEE evidence extension', {
+            oid: pki_common_1.OID_TEE_EVIDENCE,
+        });
+        throw new Error(`Root certificate verification failed: trusted root certificate is missing ${pki_common_1.OID_TEE_EVIDENCE} evidence extension`);
+    }
+    log?.info('Root certificate TEE evidence extension found', {
+        oid: pki_common_1.OID_TEE_EVIDENCE,
+        evidenceLength: serializedEvidence.length,
+    });
+    log?.debug('Loading attestation verification module');
+    const attestation = await (options.loadAttestationModule ?? defaultLoadAttestationModule)();
+    log?.debug('Attestation verification module loaded');
+    log?.info('Verifying root certificate TEE evidence');
+    let verificationResult;
+    try {
+        verificationResult = await attestation.verifyTeeEvidence(serializedEvidence, (0, pki_attestation_engine_1.buildAzureVerifyOptions)());
+        // Only a trusted root reaches this point, so a debug VM is rejected.
+        (0, pki_attestation_engine_1.checkTeeVerificationResult)(verificationResult, attestation, {
+            networkType: rootNetworkType,
+            log,
+        });
+    }
+    catch (error) {
+        log?.error('Root certificate TEE evidence verification failed', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+    log?.info('Root certificate TEE evidence verified', {
+        ...getEvidenceLogContext(verificationResult.evidenceType),
+    });
+    log?.info('Calculating root certificate mrEnclave', {
+        ...getEvidenceLogContext(verificationResult.evidenceType),
+    });
+    let mrEnclave;
+    try {
+        mrEnclave = await calculateMrEnclave(serializedEvidence, verificationResult.evidenceType, attestation);
+    }
+    catch (error) {
+        log?.error('Root certificate mrEnclave calculation failed', {
+            ...getEvidenceLogContext(verificationResult.evidenceType),
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+    const mrEnclaveHex = Buffer.from(mrEnclave).toString('hex');
+    log?.info('Root certificate mrEnclave calculated', {
+        ...getEvidenceLogContext(verificationResult.evidenceType),
+        mrEnclaveHex,
+    });
+    log?.info('Checking root certificate mrEnclave in trusted registry', {
+        ...getEvidenceLogContext(verificationResult.evidenceType),
+        mrEnclaveHex,
+        registryCheckStatus: 'started',
+    });
+    try {
+        await verifySignature(mrEnclave, verificationResult.evidenceType);
+    }
+    catch (error) {
+        log?.error('Root certificate mrEnclave trusted registry check failed', {
+            ...getEvidenceLogContext(verificationResult.evidenceType),
+            mrEnclaveHex,
+            isTrusted: false,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+    log?.info('Root certificate mrEnclave trusted registry check passed', {
+        ...getEvidenceLogContext(verificationResult.evidenceType),
+        mrEnclaveHex,
+        isTrusted: true,
+    });
+    log?.info('Trusted root certificate evidence verified', {
+        ...getEvidenceLogContext(verificationResult.evidenceType),
+        mrEnclaveHex: Buffer.from(mrEnclave).toString('hex'),
+    });
+}
+exports.verifyRootCertificateTrust = verifyRootCertificateTrust;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9vdC1jZXJ0aWZpY2F0ZS12ZXJpZmllci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb290LWNlcnRpZmljYXRlLXZlcmlmaWVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsMkRBS29DO0FBQ3BDLDJFQU00QztBQUM1QyxtRkFJZ0Q7QUFDaEQsbURBQTREO0FBQzVELG1DQUF5QztBQUN6Qyx1Q0FBeUI7QUFnQnpCLE1BQU0sc0JBQXNCLEdBQUcsSUFBSSxRQUFRLENBQ3ZDLFdBQVcsRUFDWCwwQkFBMEIsQ0FDWixDQUFDO0FBY25CLE1BQU0sYUFBYSxHQUFrQixDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUU5RCxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWEsRUFBd0IsRUFBRSxDQUN6RCxhQUEwQixDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUVoRCxNQUFNLHFCQUFxQixHQUFHLENBQUMsWUFBNkIsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUM5RCxZQUFZO0lBQ1osZ0JBQWdCLEVBQUUsSUFBQSxtREFBOEIsRUFBQyxZQUFZLENBQUM7Q0FDakUsQ0FBQyxDQUFDO0FBRUksS0FBSyxVQUFVLHVCQUF1QixDQUN6QyxlQUF3QjtJQUV4QixJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDbkIsT0FBTyxXQUFXLENBQUM7SUFDdkIsQ0FBQztJQUVELE1BQU0sS0FBSyxHQUFHLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxlQUFlLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUMzRSxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDeEIsTUFBTSxJQUFJLEtBQUssQ0FDWCw4QkFBOEIsZUFBZSxrQ0FBa0MsQ0FDbEYsQ0FBQztJQUNOLENBQUM7SUFFRCxPQUFPLEtBQUssQ0FBQztBQUNqQixDQUFDO0FBZkQsMERBZUM7QUFFTSxNQUFNLGtCQUFrQixHQUFHLENBQUMsUUFBZ0IsRUFBVSxFQUFFO0lBQzNELE1BQU0sRUFBRSxFQUFFLEVBQUUsR0FBRywyQkFBa0IsQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMvRCxNQUFNLFNBQVMsR0FBRywyQkFBa0IsQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDLENBQUM7SUFFdkQsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3pCLE1BQU0sSUFBSSxLQUFLLENBQ1gsb0ZBQW9GLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FDekcsQ0FBQztJQUNOLENBQUM7SUFFRCxPQUFPLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUM7QUFDdEMsQ0FBQyxDQUFDO0FBWFcsUUFBQSxrQkFBa0Isc0JBVzdCO0FBRUssTUFBTSwyQkFBMkIsR0FBRyxDQUN2QyxlQUF1QixFQUN2QixnQkFBd0IsRUFDeEIsR0FBUyxFQUNMLEVBQUU7SUFDTixNQUFNLFdBQVcsR0FBRyxJQUFJLHdCQUFlLENBQ25DLElBQUEsMEJBQWtCLEVBQUMsZUFBZSxDQUFDLENBQ3RDLENBQUM7SUFDRixNQUFNLFlBQVksR0FBRyxJQUFJLHdCQUFlLENBQ3BDLElBQUEsMEJBQWtCLEVBQUMsZ0JBQWdCLENBQUMsQ0FDdkMsQ0FBQztJQUVGLE1BQU0sT0FBTyxHQUFHO1FBQ1oseUJBQXlCLEVBQUUsV0FBVyxDQUFDLGNBQWM7UUFDckQsa0JBQWtCLEVBQUUsV0FBVyxDQUFDLE9BQU87UUFDdkMsMEJBQTBCLEVBQUUsWUFBWSxDQUFDLGNBQWM7UUFDdkQsbUJBQW1CLEVBQUUsWUFBWSxDQUFDLE9BQU87S0FDNUMsQ0FBQztJQUVGLElBQUksV0FBVyxDQUFDLGNBQWMsS0FBSyxZQUFZLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDN0QsR0FBRyxFQUFFLEtBQUssQ0FDTix3RkFBd0YsRUFDeEYsT0FBTyxDQUNWLENBQUM7UUFDRixNQUFNLElBQUksS0FBSyxDQUNYLHdGQUF3RixDQUMzRixDQUFDO0lBQ04sQ0FBQztJQUVELEdBQUcsRUFBRSxJQUFJLENBQ0wsaUZBQWlGLEVBQ2pGLE9BQU8sQ0FDVixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBakNXLFFBQUEsMkJBQTJCLCtCQWlDdEM7QUFFRixNQUFNLHdCQUF3QixHQUFHLENBQzdCLFdBQW1CLEVBQ25CLGlCQUF1RSxFQUM1RCxFQUFFO0lBQ2IsTUFBTSxXQUFXLEdBQUcsaUJBQWlCLENBQ2pDLFdBQVcsRUFDWCw4Q0FBaUMsQ0FDcEM7UUFDRyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUM7U0FDbEIsSUFBSSxFQUFFLENBQUM7SUFFWixJQUFJLENBQUMsV0FBVyxJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDOUMsTUFBTSxJQUFJLEtBQUssQ0FDWCw0REFBNEQsOENBQWlDLFlBQVksQ0FDNUcsQ0FBQztJQUNOLENBQUM7SUFFRCxPQUFPLFdBQVcsQ0FBQztBQUN2QixDQUFDLENBQUM7QUFFRixNQUFNLDRCQUE0QixHQUFHLEdBQWlDLEVBQUUsQ0FDcEUsc0JBQXNCLENBQ2xCLHVDQUF1QyxDQUMxQyxDQUFDO0FBRU4sTUFBTSxrQkFBa0IsR0FBRyxLQUFLLEVBQzVCLGtCQUEwQixFQUMxQixZQUE2QixFQUM3QixXQUFnQyxFQUNiLEVBQUU7SUFDckIsUUFBUSxZQUFZLEVBQUUsQ0FBQztRQUNuQixLQUFLLG9DQUFlLENBQUMsZ0NBQWdDLENBQUM7UUFDdEQsS0FBSyxvQ0FBZSxDQUFDLCtCQUErQixDQUFDO1FBQ3JELEtBQUssb0NBQWUsQ0FBQyxpQ0FBaUMsQ0FBQztRQUN2RCxLQUFLLG9DQUFlLENBQUMsbUNBQW1DO1lBQ3BELE9BQU8sQ0FBQyxNQUFNLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO2lCQUM1RCxTQUFTLENBQUM7UUFDbkIsS0FBSyxvQ0FBZSxDQUFDLGtDQUFrQyxDQUFDLENBQUMsQ0FBQztZQUN0RCxNQUFNLFFBQVEsR0FBRyxnQ0FBVyxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1lBQ3hELE1BQU0sTUFBTSxHQUNSLFFBQVEsQ0FBQyxhQUFhLEVBQUUsU0FBUyxDQUFDO1lBQ3RDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDVixNQUFNLElBQUksS0FBSyxDQUNYLDZFQUE2RSxDQUNoRixDQUFDO1lBQ04sQ0FBQztZQUVELE9BQU8sV0FBVyxDQUFDLCtCQUErQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRDtZQUNJLE1BQU0sSUFBSSxLQUFLLENBQ1gsdUVBQXVFLFlBQVksRUFBRSxDQUN4RixDQUFDO0lBQ1YsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVLLEtBQUssVUFBVSwwQkFBMEIsQ0FDNUMsT0FBdUM7SUFFdkMsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQztJQUN4QixNQUFNLGlCQUFpQixHQUNuQixPQUFPLENBQUMsaUJBQWlCO1FBQ3pCLENBQUMsQ0FBQyxPQUFlLEVBQUUsR0FBVyxFQUFFLEVBQUUsQ0FDOUIsMkJBQWtCLENBQUMsaUJBQWlCLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDNUQsTUFBTSxlQUFlLEdBQUcsT0FBTyxDQUFDLGVBQWUsSUFBSSw2Q0FBd0IsQ0FBQztJQUM1RSxHQUFHLEVBQUUsSUFBSSxDQUFDLDhDQUE4QyxFQUFFO1FBQ3RELGVBQWUsRUFBRSxPQUFPLENBQUMsZUFBZTtLQUMzQyxDQUFDLENBQUM7SUFFSCxNQUFNLGdCQUFnQixHQUFHLE1BQU0sdUJBQXVCLENBQ2xELE9BQU8sQ0FBQyxlQUFlLENBQzFCLENBQUM7SUFDRixHQUFHLEVBQUUsSUFBSSxDQUFDLDZCQUE2QixFQUFFO1FBQ3JDLGdCQUFnQjtRQUNoQixlQUFlLEVBQUUsT0FBTyxDQUFDLGVBQWU7UUFDeEMsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxTQUFTO0tBQ2xFLENBQUMsQ0FBQztJQUVILEdBQUcsRUFBRSxLQUFLLENBQUMsNENBQTRDLENBQUMsQ0FBQztJQUN6RCxJQUFJLFdBQW1CLENBQUM7SUFDeEIsSUFBSSxDQUFDO1FBQ0QsV0FBVyxHQUFHLElBQUEsMEJBQWtCLEVBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2IsR0FBRyxFQUFFLEtBQUssQ0FBQyxvQ0FBb0MsRUFBRTtZQUM3QyxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQztTQUNoRSxDQUFDLENBQUM7UUFDSCxNQUFNLEtBQUssQ0FBQztJQUNoQixDQUFDO0lBRUQsTUFBTSxlQUFlLEdBQUcsSUFBSSx3QkFBZSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ3pELEdBQUcsRUFBRSxJQUFJLENBQUMsMkNBQTJDLEVBQUU7UUFDbkQsa0JBQWtCLEVBQUUsZUFBZSxDQUFDLGNBQWM7UUFDbEQsV0FBVyxFQUFFLGVBQWUsQ0FBQyxPQUFPO1FBQ3BDLFVBQVUsRUFBRSxlQUFlLENBQUMsTUFBTTtLQUNyQyxDQUFDLENBQUM7SUFFSCxHQUFHLEVBQUUsS0FBSyxDQUFDLGlEQUFpRCxFQUFFO1FBQzFELEdBQUcsRUFBRSw4Q0FBaUM7S0FDekMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxlQUE0QixDQUFDO0lBQ2pDLElBQUksQ0FBQztRQUNELGVBQWUsR0FBRyx3QkFBd0IsQ0FDdEMsV0FBVyxFQUNYLGlCQUFpQixDQUNwQixDQUFDO0lBQ04sQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixHQUFHLEVBQUUsS0FBSyxDQUFDLHNEQUFzRCxFQUFFO1lBQy9ELEdBQUcsRUFBRSw4Q0FBaUM7WUFDdEMsS0FBSyxFQUFFLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7U0FDaEUsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxLQUFLLENBQUM7SUFDaEIsQ0FBQztJQUNELEdBQUcsRUFBRSxJQUFJLENBQUMsd0NBQXdDLEVBQUU7UUFDaEQsc0JBQXNCLEVBQUUsZUFBZTtRQUN2QyxnQkFBZ0I7S0FDbkIsQ0FBQyxDQUFDO0lBRUgsSUFBSSxlQUFlLEtBQUssZ0JBQWdCLEVBQUUsQ0FBQztRQUN2QyxHQUFHLEVBQUUsS0FBSyxDQUFDLHdDQUF3QyxFQUFFO1lBQ2pELHNCQUFzQixFQUFFLGVBQWU7WUFDdkMsZ0JBQWdCO1NBQ25CLENBQUMsQ0FBQztRQUNILE1BQU0sSUFBSSxLQUFLLENBQ1gsbUVBQW1FLGVBQWUsd0NBQXdDLGdCQUFnQixHQUFHLENBQ2hKLENBQUM7SUFDTixDQUFDO0lBRUQsR0FBRyxFQUFFLElBQUksQ0FBQywwREFBMEQsRUFBRTtRQUNsRSxzQkFBc0IsRUFBRSxlQUFlO1FBQ3ZDLGdCQUFnQjtLQUNuQixDQUFDLENBQUM7SUFFSCxJQUFJLGVBQWUsS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUNsQyxHQUFHLEVBQUUsSUFBSSxDQUNMLGlFQUFpRSxFQUNqRTtZQUNJLHNCQUFzQixFQUFFLGVBQWU7WUFDdkMsZ0JBQWdCO1lBQ2hCLG1CQUFtQixFQUFFLEtBQUs7U0FDN0IsQ0FDSixDQUFDO1FBQ0YsT0FBTztJQUNYLENBQUM7SUFFRCxHQUFHLEVBQUUsSUFBSSxDQUFDLDZEQUE2RCxFQUFFO1FBQ3JFLHNCQUFzQixFQUFFLGVBQWU7UUFDdkMsZ0JBQWdCO1FBQ2hCLG1CQUFtQixFQUFFLElBQUk7S0FDNUIsQ0FBQyxDQUFDO0lBRUgsTUFBTSxrQkFBa0IsR0FBRyxpQkFBaUIsQ0FBQyxXQUFXLEVBQUUsNkJBQWdCLENBQUMsQ0FBQztJQUM1RSxJQUFJLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUN0QixHQUFHLEVBQUUsS0FBSyxDQUNOLDREQUE0RCxFQUM1RDtZQUNJLEdBQUcsRUFBRSw2QkFBZ0I7U0FDeEIsQ0FDSixDQUFDO1FBQ0YsTUFBTSxJQUFJLEtBQUssQ0FDWCw2RUFBNkUsNkJBQWdCLHFCQUFxQixDQUNySCxDQUFDO0lBQ04sQ0FBQztJQUNELEdBQUcsRUFBRSxJQUFJLENBQUMsK0NBQStDLEVBQUU7UUFDdkQsR0FBRyxFQUFFLDZCQUFnQjtRQUNyQixjQUFjLEVBQUUsa0JBQWtCLENBQUMsTUFBTTtLQUM1QyxDQUFDLENBQUM7SUFFSCxHQUFHLEVBQUUsS0FBSyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDdEQsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUN0QixPQUFPLENBQUMscUJBQXFCLElBQUksNEJBQTRCLENBQ2hFLEVBQUUsQ0FBQztJQUNKLEdBQUcsRUFBRSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztJQUVyRCxHQUFHLEVBQUUsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDckQsSUFBSSxrQkFBcUQsQ0FBQztJQUMxRCxJQUFJLENBQUM7UUFDRCxrQkFBa0IsR0FBRyxNQUFNLFdBQVcsQ0FBQyxpQkFBaUIsQ0FDcEQsa0JBQWtCLEVBQ2xCLElBQUEsZ0RBQXVCLEdBQUUsQ0FDNUIsQ0FBQztRQUNGLHFFQUFxRTtRQUNyRSxJQUFBLG1EQUEwQixFQUFDLGtCQUFrQixFQUFFLFdBQVcsRUFBRTtZQUN4RCxXQUFXLEVBQUUsZUFBZTtZQUM1QixHQUFHO1NBQ04sQ0FBQyxDQUFDO0lBQ1AsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixHQUFHLEVBQUUsS0FBSyxDQUFDLG1EQUFtRCxFQUFFO1lBQzVELEtBQUssRUFBRSxLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO1NBQ2hFLENBQUMsQ0FBQztRQUNILE1BQU0sS0FBSyxDQUFDO0lBQ2hCLENBQUM7SUFDRCxHQUFHLEVBQUUsSUFBSSxDQUFDLHdDQUF3QyxFQUFFO1FBQ2hELEdBQUcscUJBQXFCLENBQUMsa0JBQWtCLENBQUMsWUFBWSxDQUFDO0tBQzVELENBQUMsQ0FBQztJQUVILEdBQUcsRUFBRSxJQUFJLENBQUMsd0NBQXdDLEVBQUU7UUFDaEQsR0FBRyxxQkFBcUIsQ0FBQyxrQkFBa0IsQ0FBQyxZQUFZLENBQUM7S0FDNUQsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxTQUFxQixDQUFDO0lBQzFCLElBQUksQ0FBQztRQUNELFNBQVMsR0FBRyxNQUFNLGtCQUFrQixDQUNoQyxrQkFBa0IsRUFDbEIsa0JBQWtCLENBQUMsWUFBWSxFQUMvQixXQUFXLENBQ2QsQ0FBQztJQUNOLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2IsR0FBRyxFQUFFLEtBQUssQ0FBQywrQ0FBK0MsRUFBRTtZQUN4RCxHQUFHLHFCQUFxQixDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQztZQUN6RCxLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQztTQUNoRSxDQUFDLENBQUM7UUFDSCxNQUFNLEtBQUssQ0FBQztJQUNoQixDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDNUQsR0FBRyxFQUFFLElBQUksQ0FBQyx1Q0FBdUMsRUFBRTtRQUMvQyxHQUFHLHFCQUFxQixDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQztRQUN6RCxZQUFZO0tBQ2YsQ0FBQyxDQUFDO0lBRUgsR0FBRyxFQUFFLElBQUksQ0FBQyx5REFBeUQsRUFBRTtRQUNqRSxHQUFHLHFCQUFxQixDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQztRQUN6RCxZQUFZO1FBQ1osbUJBQW1CLEVBQUUsU0FBUztLQUNqQyxDQUFDLENBQUM7SUFDSCxJQUFJLENBQUM7UUFDRCxNQUFNLGVBQWUsQ0FBQyxTQUFTLEVBQUUsa0JBQWtCLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDYixHQUFHLEVBQUUsS0FBSyxDQUFDLDBEQUEwRCxFQUFFO1lBQ25FLEdBQUcscUJBQXFCLENBQUMsa0JBQWtCLENBQUMsWUFBWSxDQUFDO1lBQ3pELFlBQVk7WUFDWixTQUFTLEVBQUUsS0FBSztZQUNoQixLQUFLLEVBQUUsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQztTQUNoRSxDQUFDLENBQUM7UUFDSCxNQUFNLEtBQUssQ0FBQztJQUNoQixDQUFDO0lBRUQsR0FBRyxFQUFFLElBQUksQ0FBQywwREFBMEQsRUFBRTtRQUNsRSxHQUFHLHFCQUFxQixDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQztRQUN6RCxZQUFZO1FBQ1osU0FBUyxFQUFFLElBQUk7S0FDbEIsQ0FBQyxDQUFDO0lBQ0gsR0FBRyxFQUFFLElBQUksQ0FBQyw0Q0FBNEMsRUFBRTtRQUNwRCxHQUFHLHFCQUFxQixDQUFDLGtCQUFrQixDQUFDLFlBQVksQ0FBQztRQUN6RCxZQUFZLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO0tBQ3ZELENBQUMsQ0FBQztBQUNQLENBQUM7QUE1TEQsZ0VBNExDIn0=

package/dist/sync-client.d.ts

@@ -0,0 +1,47 @@
+import { SyncConfig } from './config';
+import { LogLevel } from '@super-protocol/pki-common';
+import { type DetectAttestationType } from '@super-protocol/pki-attestation-engine';
+export interface SyncClientOptions {
+    servers: string[];
+    networkID: string;
+    caBundle: string;
+    ownChallenge: DetectAttestationType | 'auto';
+    retryAttempts?: number;
+    retryDelaySec?: number;
+    logLevel?: LogLevel;
+    disableServerIdentityCheck?: boolean;
+    saveCertsToDir?: string;
+    saveCertsPrefix?: string;
+    networkTypeFile?: string;
+    nvtrust?: {
+        verifier?: 'remote' | 'local';
+    };
+}
+export declare class SyncClient {
+    static readonly DEFAULT_RETRY_ATTEMPTS = 1;
+    static readonly DEFAULT_RETRY_DELAY_SEC = 10;
+    private static readonly RETRYABLE_NETWORK_ERROR_CODES;
+    private static readonly RETRYABLE_HTTP_STATUS_CODES;
+    private options;
+    private challenge?;
+    private logger;
+    private retryAttempts;
+    private retryDelaySec;
+    private static getNvidiaTokenMode;
+    private static resolveLogger;
+    constructor(options: SyncClientOptions);
+    private static buildChallengeConfig;
+    private resolveChallenge;
+    private static normalizeRetryAttempts;
+    private static normalizeRetryDelaySec;
+    private static evaluateRetry;
+    private static buildChallengeProvider;
+    private createHttpsAgent;
+    private createAttestationServiceClient;
+    private preparePkiClient;
+    private fetchSecrets;
+    private saveSecrets;
+    private saveArtifacts;
+    private saveCertificates;
+    sync(config: SyncConfig): Promise<void>;
+}