burnledger 0.8.0 → 0.9.0

package/dist/cjs/enclave-registration.d.ts

@@ -0,0 +1,153 @@
+/**
+ * The customer's side of ADR-025: verify the enclave, enrol a key group, rotate
+ * it, register a system under it.
+ *
+ * Request-building and response-checking for the BurnLedger client's methods of
+ * the same names, kept in a Node-only module the client imports lazily — the
+ * client is also the browser entry's, and these need node:crypto. Nothing here
+ * holds a private key: every signature comes from a {@link KeyGroupSigner} (see
+ * key-group.ts for why, and for what losing a key costs).
+ *
+ * WHAT THE CHECKS ON EACH RESPONSE ARE FOR. The API relays every byte, so the
+ * documents it returns are only worth what the client checks, and it checks two
+ * things. First, that the enclave signed them — under the signing key of an
+ * enclave the caller attested against its own pinned PCR0. Without that, a relay
+ * could hand the customer a forged enrolment and they would believe themselves
+ * registered when nothing was. The key set at /.well-known/burnledger-keys is not
+ * the anchor for this: the same API serves it, so a relay that forged a document
+ * could publish the forging key beside it. Second, that they are about what the
+ * caller asked for. ADR-025 §2 names the load-bearing comparison: the enrolment
+ * statement must name the key group the customer generated. A relay that enrolled
+ * its own group instead would hand back a genuine, enclave-signed statement
+ * naming a key the customer does not hold; this comparison is where that stops
+ * being invisible. The enrolment and the authorization must also be for the team
+ * the customer named, and the authorization must end exactly at the `not_after`
+ * the customer signed and not start in the future: a relay that replayed an
+ * older genuine answer, or another team's, would otherwise have the caller
+ * believe a fresh window exists. The registration must name this key, this
+ * system, this config digest and this connector, or it registered something
+ * else.
+ */
+import { type CustomerKeyGroup } from "./customer-keys.js";
+import { type EnclaveIdentity, type SealOptions } from "./enclave-seal.js";
+import { type KeyGroupSigner } from "./key-group.js";
+import { type KeyEnrollmentResult, type System, type SystemRegistrationCertificate } from "./models.js";
+type Raw = Record<string, unknown>;
+/** How to check the enclave: the PCR0 you pinned out of band, and optionally
+ * your own challenge (otherwise 32 bytes are drawn from the OS CSPRNG). */
+export interface EnclavePinOptions extends SealOptions {
+    nonce?: Uint8Array;
+}
+/** What `createRegisteredSystem` did, in order. */
+export interface RegisteredSystem {
+    /** The system, created with its config sealed so the API never read it. */
+    readonly system: System;
+    /** The enclave's registration of that system under your key group. */
+    readonly registration: SystemRegistrationCertificate;
+}
+/**
+ * The challenge and the query string that carries it. A nonce the checked party
+ * chose — including one the API suggested — proves nothing about when the
+ * document was produced, so it is drawn here unless the caller brings its own.
+ */
+export declare function attestationParams(nonce?: Uint8Array): {
+    nonce: Uint8Array;
+    params: Record<string, string>;
+};
+/**
+ * Verify the document the API returned against this caller's own challenge. The
+ * `nonce` the API echoes beside the document is ignored: nothing signs it. The
+ * check is against the nonce inside the document, under AWS's signature.
+ */
+export declare function identityFromResponse(data: unknown, options: SealOptions & {
+    nonce: Uint8Array;
+}): Promise<EnclaveIdentity>;
+/**
+ * The ENROLL_KEY request, the key id it enrols and the `not_after` it signs.
+ * EVERY member signs.
+ */
+export declare function enrollBody(opts: {
+    teamId: string;
+    group: CustomerKeyGroup;
+    signers: readonly KeyGroupSigner[];
+    notAfter?: Date;
+}): Promise<{
+    body: Raw;
+    keyId: string;
+    notAfter: string;
+}>;
+/**
+ * The ROTATE_KEY request. Both groups sign the same key_rotation_request.v2: the
+ * OUTGOING group at its threshold, to spend its authority, and EVERY incoming
+ * member, to prove it holds its key.
+ */
+export declare function rotateBody(opts: {
+    teamId: string;
+    previousGroup: CustomerKeyGroup;
+    previousSigners: readonly KeyGroupSigner[];
+    nextGroup: CustomerKeyGroup;
+    nextSigners: readonly KeyGroupSigner[];
+    notAfter?: Date;
+}): Promise<{
+    body: Raw;
+    prevKeyId: string;
+    nextKeyId: string;
+    notAfter: string;
+}>;
+/**
+ * Verify both documents ENROLL_KEY and ROTATE_KEY return under the attested
+ * enclave's signing key, then refuse them unless they name the group this caller
+ * holds and the team it asked for, link to the predecessor it expects, end
+ * exactly at the `notAfter` (whole-second UTC) it signed, and do not start in
+ * the future. `teamId` is the team the request asserted; the SDK always asserts
+ * one, so there is no request this check has no team for.
+ *
+ * The end must be EXACT. A protocol-12 enclave ends the grant at the signed
+ * bound, to the second, so any other end answers some other request -- which is
+ * what a relay replaying an older genuine response, or dropping a renewal,
+ * hands back.
+ */
+export declare function checkEnrollment(data: unknown, opts: {
+    enclave: EnclaveIdentity;
+    keyId: string;
+    prevKeyId: string | undefined;
+    teamId: string;
+    notAfter: string;
+    /** The time to judge `not_before` against. Defaults to this machine's clock. */
+    now?: Date;
+}): Promise<KeyEnrollmentResult>;
+/** The exact bytes sealed, and therefore the bytes `config_digest` is over. */
+export declare function configBytes(config: Record<string, unknown>): Uint8Array;
+/**
+ * The REGISTER_SYSTEM request, its key id and the config digest it signs.
+ *
+ * `config` must be the EXACT bytes submitted when the system was created — the
+ * plaintext that was sealed, or the `connection_config` JSON text as sent. An
+ * object is refused: re-serializing it produces bytes that may differ by one
+ * space from what the enclave decrypts, and the refusal would be a 401 with no
+ * way to see why.
+ */
+export declare function registrationBody(opts: {
+    teamId: string;
+    group: CustomerKeyGroup;
+    signers: readonly KeyGroupSigner[];
+    systemId: string;
+    config: Uint8Array | string;
+    queryTemplate: string;
+    connectorType: string;
+}): Promise<{
+    body: Raw;
+    keyId: string;
+    configDigest: Uint8Array;
+}>;
+/** Verify the registration under the attested enclave's signing key, then
+ * refuse it unless it binds what this caller signed. */
+export declare function checkRegistration(data: unknown, opts: {
+    enclave: EnclaveIdentity;
+    keyId: string;
+    systemId: string;
+    configDigest: Uint8Array;
+    connectorType: string;
+}): Promise<SystemRegistrationCertificate>;
+export {};
+//# sourceMappingURL=enclave-registration.d.ts.map

package/dist/cjs/enclave-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-registration.d.ts","sourceRoot":"","sources":["../../src/enclave-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EASL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,MAAM,EACX,KAAK,6BAA6B,EACnC,MAAM,aAAa,CAAC;AAGrB,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC;2EAC2E;AAC3E,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,6BAA6B,CAAC;CACtD;AAyBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG;IACrD,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,CAGA;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,WAAW,GAAG;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GAC3C,OAAO,CAAC,eAAe,CAAC,CAM1B;AAYD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB1D;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,gBAAgB,CAAC;IAChC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,SAAS,cAAc,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmCjF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IACJ,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GACA,OAAO,CAAC,mBAAmB,CAAC,CAuD9B;AAID,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAEvE;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,gBAAgB,CAAC;IACxB,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,UAAU,CAAA;CAAE,CAAC,CA8BlE;AAED;wDACwD;AACxD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,OAAO,EACb,IAAI,EAAE;IACJ,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,6BAA6B,CAAC,CAuBxC"}

package/dist/cjs/enclave-registration.js

@@ -0,0 +1,275 @@
+"use strict";
+/**
+ * The customer's side of ADR-025: verify the enclave, enrol a key group, rotate
+ * it, register a system under it.
+ *
+ * Request-building and response-checking for the BurnLedger client's methods of
+ * the same names, kept in a Node-only module the client imports lazily — the
+ * client is also the browser entry's, and these need node:crypto. Nothing here
+ * holds a private key: every signature comes from a {@link KeyGroupSigner} (see
+ * key-group.ts for why, and for what losing a key costs).
+ *
+ * WHAT THE CHECKS ON EACH RESPONSE ARE FOR. The API relays every byte, so the
+ * documents it returns are only worth what the client checks, and it checks two
+ * things. First, that the enclave signed them — under the signing key of an
+ * enclave the caller attested against its own pinned PCR0. Without that, a relay
+ * could hand the customer a forged enrolment and they would believe themselves
+ * registered when nothing was. The key set at /.well-known/burnledger-keys is not
+ * the anchor for this: the same API serves it, so a relay that forged a document
+ * could publish the forging key beside it. Second, that they are about what the
+ * caller asked for. ADR-025 §2 names the load-bearing comparison: the enrolment
+ * statement must name the key group the customer generated. A relay that enrolled
+ * its own group instead would hand back a genuine, enclave-signed statement
+ * naming a key the customer does not hold; this comparison is where that stops
+ * being invisible. The enrolment and the authorization must also be for the team
+ * the customer named, and the authorization must end exactly at the `not_after`
+ * the customer signed and not start in the future: a relay that replayed an
+ * older genuine answer, or another team's, would otherwise have the caller
+ * believe a fresh window exists. The registration must name this key, this
+ * system, this config digest and this connector, or it registered something
+ * else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attestationParams = attestationParams;
+exports.identityFromResponse = identityFromResponse;
+exports.enrollBody = enrollBody;
+exports.rotateBody = rotateBody;
+exports.checkEnrollment = checkEnrollment;
+exports.configBytes = configBytes;
+exports.registrationBody = registrationBody;
+exports.checkRegistration = checkRegistration;
+const node_crypto_1 = require("node:crypto");
+const crypto_node_js_1 = require("./crypto-node.js");
+const customer_keys_js_1 = require("./customer-keys.js");
+const enclave_seal_js_1 = require("./enclave-seal.js");
+const errors_js_1 = require("./errors.js");
+const key_group_js_1 = require("./key-group.js");
+const models_js_1 = require("./models.js");
+const verify_js_1 = require("./verify.js");
+/** Mirrors core.DefaultAuthorizationWindow, the longest window the enclave
+ * grants: a request that names no `notAfter` asks for all of it. */
+const DEFAULT_AUTHORIZATION_WINDOW_MS = 90 * 24 * 60 * 60 * 1000;
+/** How far ahead of this machine's clock an authorization may start: room for
+ * an enclave clock that runs a little ahead, as core's notAfterSkew leaves room
+ * for a customer clock that does. Not room for a document from the future. */
+const NOT_BEFORE_SKEW_MS = 5 * 60 * 1000;
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+function sha256(bytes) {
+    return new Uint8Array((0, node_crypto_1.createHash)("sha256").update(bytes).digest());
+}
+function boundOf(notAfter) {
+    return notAfter ?? new Date(Date.now() + DEFAULT_AUTHORIZATION_WINDOW_MS);
+}
+// --- ATTEST_IDENTITY ----------------------------------------------------------
+/**
+ * The challenge and the query string that carries it. A nonce the checked party
+ * chose — including one the API suggested — proves nothing about when the
+ * document was produced, so it is drawn here unless the caller brings its own.
+ */
+function attestationParams(nonce) {
+    const drawn = nonce ?? node_crypto_1.webcrypto.getRandomValues(new Uint8Array(enclave_seal_js_1.IDENTITY_NONCE_SIZE));
+    return { nonce: drawn, params: { nonce: Buffer.from(drawn).toString("base64url") } };
+}
+/**
+ * Verify the document the API returned against this caller's own challenge. The
+ * `nonce` the API echoes beside the document is ignored: nothing signs it. The
+ * check is against the nonce inside the document, under AWS's signature.
+ */
+async function identityFromResponse(data, options) {
+    const raw = data?.nsm_attestation;
+    if (typeof raw !== "string") {
+        throw new errors_js_1.VerificationError("the attestation response carries no nsm_attestation");
+    }
+    return (0, enclave_seal_js_1.verifyEnclaveIdentity)(new Uint8Array(Buffer.from(raw, "base64")), options);
+}
+// --- ENROLL_KEY / ROTATE_KEY --------------------------------------------------
+function groupBody(group, signatures) {
+    return {
+        threshold: group.threshold,
+        member_keys: group.members.map(toHex),
+        signatures,
+    };
+}
+/**
+ * The ENROLL_KEY request, the key id it enrols and the `not_after` it signs.
+ * EVERY member signs.
+ */
+async function enrollBody(opts) {
+    const keyId = await (0, customer_keys_js_1.customerKeyId)(crypto_node_js_1.nodeCrypto, opts.group);
+    const bound = boundOf(opts.notAfter);
+    const payload = (0, customer_keys_js_1.buildKeyEnrollmentRequestPayload)({
+        assertedTeamId: opts.teamId,
+        customerKeyId: keyId,
+        notAfter: bound,
+    });
+    const signatures = await (0, key_group_js_1.signWithGroup)(payload, opts.group, opts.signers, opts.group.members.length);
+    const notAfter = (0, customer_keys_js_1.keyTime)(bound);
+    return {
+        body: {
+            asserted_team_id: opts.teamId.toLowerCase(),
+            not_after: notAfter,
+            ...groupBody(opts.group, signatures),
+        },
+        keyId,
+        notAfter,
+    };
+}
+/**
+ * The ROTATE_KEY request. Both groups sign the same key_rotation_request.v2: the
+ * OUTGOING group at its threshold, to spend its authority, and EVERY incoming
+ * member, to prove it holds its key.
+ */
+async function rotateBody(opts) {
+    const prevKeyId = await (0, customer_keys_js_1.customerKeyId)(crypto_node_js_1.nodeCrypto, opts.previousGroup);
+    const nextKeyId = await (0, customer_keys_js_1.customerKeyId)(crypto_node_js_1.nodeCrypto, opts.nextGroup);
+    const bound = boundOf(opts.notAfter);
+    const payload = (0, customer_keys_js_1.buildKeyRotationRequestPayload)({
+        assertedTeamId: opts.teamId,
+        prevKeyId,
+        nextKeyId,
+        notAfter: bound,
+    });
+    const signatures = await (0, key_group_js_1.signWithGroup)(payload, opts.previousGroup, opts.previousSigners, opts.previousGroup.threshold);
+    const nextSignatures = await (0, key_group_js_1.signWithGroup)(payload, opts.nextGroup, opts.nextSigners, opts.nextGroup.members.length);
+    const notAfter = (0, customer_keys_js_1.keyTime)(bound);
+    return {
+        body: {
+            asserted_team_id: opts.teamId.toLowerCase(),
+            prev_key_id: prevKeyId,
+            not_after: notAfter,
+            next_signatures: nextSignatures,
+            ...groupBody(opts.nextGroup, signatures),
+        },
+        prevKeyId,
+        nextKeyId,
+        notAfter,
+    };
+}
+/**
+ * Verify both documents ENROLL_KEY and ROTATE_KEY return under the attested
+ * enclave's signing key, then refuse them unless they name the group this caller
+ * holds and the team it asked for, link to the predecessor it expects, end
+ * exactly at the `notAfter` (whole-second UTC) it signed, and do not start in
+ * the future. `teamId` is the team the request asserted; the SDK always asserts
+ * one, so there is no request this check has no team for.
+ *
+ * The end must be EXACT. A protocol-12 enclave ends the grant at the signed
+ * bound, to the second, so any other end answers some other request -- which is
+ * what a relay replaying an older genuine response, or dropping a renewal,
+ * hands back.
+ */
+async function checkEnrollment(data, opts) {
+    const raw = (data ?? {});
+    await (0, customer_keys_js_1.verifyKeyEnrollmentStatement)(crypto_node_js_1.nodeCrypto, raw.enrollment, opts.enclave.signingKey);
+    await (0, customer_keys_js_1.verifyTeamAuthorization)(crypto_node_js_1.nodeCrypto, raw.authorization, opts.enclave.signingKey);
+    const result = (0, models_js_1.parseKeyEnrollmentResult)(raw);
+    const { enrollment, authorization } = result;
+    // One comparison covers the members and threshold too: a key id is a hash
+    // over both, and a verified statement's id is the one its own group derives.
+    if (enrollment.customerKeyId !== opts.keyId || authorization.customerKeyId !== opts.keyId) {
+        throw new errors_js_1.VerificationError(`the enclave's statement names key ${JSON.stringify(enrollment.customerKeyId)} ` +
+            `(authorization ${JSON.stringify(authorization.customerKeyId)}), not the group you ` +
+            `enrolled (${JSON.stringify(opts.keyId)}). Do not use it: this is what a substituted key looks like.`);
+    }
+    if (authorization.prevKeyId !== opts.prevKeyId) {
+        throw new errors_js_1.VerificationError(`the authorization links to predecessor ${JSON.stringify(authorization.prevKeyId ?? null)}, ` +
+            `expected ${JSON.stringify(opts.prevKeyId ?? null)}`);
+    }
+    const team = opts.teamId.toLowerCase();
+    for (const [what, named] of [
+        ["enrolment statement", enrollment.assertedTeamId],
+        ["authorization", authorization.assertedTeamId],
+    ]) {
+        if (named.toLowerCase() !== team) {
+            throw new errors_js_1.VerificationError(`the ${what} is for team ${named}, not the team you asked for (${team}). ` +
+                "Do not use it: a relay replaying another team's answer would produce exactly this.");
+        }
+    }
+    // Compared as the whole-second strings both sides sign, not as parsed
+    // dates: a Date has milliseconds, and a fraction on the wire is nobody's.
+    const granted = (0, verify_js_1.formatTimestamp)(raw.authorization.not_after, "authorization.not_after");
+    if (granted !== opts.notAfter) {
+        throw new errors_js_1.VerificationError(`the authorization ends at ${granted}, not at the not_after you signed (${opts.notAfter}). ` +
+            "The enclave ends the grant exactly there, so this answers some other request; " +
+            "a relay replaying an older response would produce exactly this.");
+    }
+    const now = opts.now ?? new Date();
+    if (!(now instanceof Date) || Number.isNaN(now.getTime())) {
+        throw new TypeError("now must be a valid Date");
+    }
+    if (authorization.notBefore.getTime() > now.getTime() + NOT_BEFORE_SKEW_MS) {
+        const starts = (0, verify_js_1.formatTimestamp)(raw.authorization.not_before, "authorization.not_before");
+        throw new errors_js_1.VerificationError(`the authorization starts at ${starts}, more than five minutes after this machine's clock ` +
+            `(${(0, customer_keys_js_1.keyTime)(now)}): the answer to a request just made cannot start in the future`);
+    }
+    return result;
+}
+// --- REGISTER_SYSTEM ----------------------------------------------------------
+/** The exact bytes sealed, and therefore the bytes `config_digest` is over. */
+function configBytes(config) {
+    return new TextEncoder().encode(JSON.stringify(config));
+}
+/**
+ * The REGISTER_SYSTEM request, its key id and the config digest it signs.
+ *
+ * `config` must be the EXACT bytes submitted when the system was created — the
+ * plaintext that was sealed, or the `connection_config` JSON text as sent. An
+ * object is refused: re-serializing it produces bytes that may differ by one
+ * space from what the enclave decrypts, and the refusal would be a 401 with no
+ * way to see why.
+ */
+async function registrationBody(opts) {
+    const config = typeof opts.config === "string" ? new TextEncoder().encode(opts.config) : opts.config;
+    if (!(config instanceof Uint8Array)) {
+        throw new TypeError("config must be the exact bytes (or text) submitted when the system was created, " +
+            "not a re-serializable object");
+    }
+    const keyId = await (0, customer_keys_js_1.customerKeyId)(crypto_node_js_1.nodeCrypto, opts.group);
+    const configDigest = sha256(config);
+    const payload = (0, customer_keys_js_1.buildSystemRegistrationRequestPayload)({
+        assertedTeamId: opts.teamId,
+        systemId: opts.systemId,
+        configDigest,
+        queryTemplateSha256: sha256(new TextEncoder().encode(opts.queryTemplate)),
+        connectorType: opts.connectorType,
+        customerKeyId: keyId,
+    });
+    const signatures = await (0, key_group_js_1.signWithGroup)(payload, opts.group, opts.signers, opts.group.threshold);
+    return {
+        body: {
+            asserted_team_id: opts.teamId.toLowerCase(),
+            system_id: opts.systemId.toLowerCase(),
+            query_template: opts.queryTemplate,
+            ...groupBody(opts.group, signatures),
+        },
+        keyId,
+        configDigest,
+    };
+}
+/** Verify the registration under the attested enclave's signing key, then
+ * refuse it unless it binds what this caller signed. */
+async function checkRegistration(data, opts) {
+    const raw = data?.registration;
+    await (0, customer_keys_js_1.verifySystemRegistration)(crypto_node_js_1.nodeCrypto, raw, opts.enclave.signingKey);
+    const registration = (0, models_js_1.parseSystemRegistrationCertificate)(raw);
+    const wrong = [];
+    if (registration.customerKeyId !== opts.keyId) {
+        wrong.push(`customer_key_id is ${JSON.stringify(registration.customerKeyId)}, expected ${JSON.stringify(opts.keyId)}`);
+    }
+    if (String(registration.systemId).toLowerCase() !== opts.systemId.toLowerCase()) {
+        wrong.push(`system_id is ${JSON.stringify(registration.systemId)}, expected ${JSON.stringify(opts.systemId)}`);
+    }
+    if (toHex(registration.configDigest) !== toHex(opts.configDigest)) {
+        wrong.push(`config_digest is ${toHex(registration.configDigest)}, expected ${toHex(opts.configDigest)}`);
+    }
+    if (registration.connectorType !== opts.connectorType) {
+        wrong.push(`connector_type is ${JSON.stringify(registration.connectorType)}, expected ${JSON.stringify(opts.connectorType)}`);
+    }
+    if (wrong.length > 0) {
+        throw new errors_js_1.VerificationError(`the enclave's registration does not bind what you signed: ${wrong.join(", ")}`);
+    }
+    return registration;
+}
+//# sourceMappingURL=enclave-registration.js.map

package/dist/cjs/enclave-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enclave-registration.js","sourceRoot":"","sources":["../../src/enclave-registration.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;;;;;;;;AAEH,6CAAoD;AACpD,qDAA8C;AAC9C,yDAU4B;AAC5B,uDAK2B;AAC3B,2CAAgD;AAChD,iDAAoE;AACpE,2CAMqB;AACrB,2CAA8C;AAkB9C;oEACoE;AACpE,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjE;;8EAE8E;AAC9E,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,IAAI,UAAU,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,OAAO,CAAC,QAA0B;IACzC,OAAO,QAAQ,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,+BAA+B,CAAC,CAAC;AAC5E,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,2BAAkC,KAAkB;IAIlD,MAAM,KAAK,GAAG,KAAK,IAAI,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,qCAAmB,CAAC,CAAC,CAAC;IACtF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACI,KAAK,+BACV,IAAa,EACb,OAA4C;IAE5C,MAAM,GAAG,GAAI,IAAmB,EAAE,eAAe,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAAiB,CAAC,qDAAqD,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAA,uCAAqB,EAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,iFAAiF;AAEjF,SAAS,SAAS,CAAC,KAAuB,EAAE,UAAkC;IAC5E,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QACrC,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,qBAAqB,IAKhC;IACC,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAa,EAAC,2BAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAA,mDAAgC,EAAC;QAC/C,cAAc,EAAE,IAAI,CAAC,MAAM;QAC3B,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,IAAA,4BAAa,EAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,IAAA,0BAAO,EAAC,KAAK,CAAC,CAAC;IAChC,OAAO;QACL,IAAI,EAAE;YACJ,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3C,SAAS,EAAE,QAAQ;YACnB,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC;SACrC;QACD,KAAK;QACL,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,qBAAqB,IAOhC;IACC,MAAM,SAAS,GAAG,MAAM,IAAA,gCAAa,EAAC,2BAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,IAAA,gCAAa,EAAC,2BAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAA,iDAA8B,EAAC;QAC7C,cAAc,EAAE,IAAI,CAAC,MAAM;QAC3B,SAAS;QACT,SAAS;QACT,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,IAAA,4BAAa,EACpC,OAAO,EACP,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,CAAC,SAAS,CAC7B,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,IAAA,4BAAa,EACxC,OAAO,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAC9B,CAAC;IACF,MAAM,QAAQ,GAAG,IAAA,0BAAO,EAAC,KAAK,CAAC,CAAC;IAChC,OAAO;QACL,IAAI,EAAE;YACJ,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3C,WAAW,EAAE,SAAS;YACtB,SAAS,EAAE,QAAQ;YACnB,eAAe,EAAE,cAAc;YAC/B,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;SACzC;QACD,SAAS;QACT,SAAS;QACT,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,0BACV,IAAa,EACb,IAQC;IAED,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAQ,CAAC;IAChC,MAAM,IAAA,+CAA4B,EAAC,2BAAU,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,IAAA,0CAAuB,EAAC,2BAAU,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,IAAA,oCAAwB,EAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC7C,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1F,MAAM,IAAI,6BAAiB,CACzB,qCAAqC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG;YAC9E,kBAAkB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,aAAa,CAAC,uBAAuB;YACpF,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,8DAA8D,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,6BAAiB,CACzB,0CAA0C,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI;YAC3F,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,qBAAqB,EAAE,UAAU,CAAC,cAAc,CAAC;QAClD,CAAC,eAAe,EAAE,aAAa,CAAC,cAAc,CAAC;KACvC,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,6BAAiB,CACzB,OAAO,IAAI,gBAAgB,KAAK,iCAAiC,IAAI,KAAK;gBACxE,oFAAoF,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,0EAA0E;IAC1E,MAAM,OAAO,GAAG,IAAA,2BAAe,EAAE,GAAG,CAAC,aAAqB,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACjG,IAAI,OAAO,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,6BAAiB,CACzB,6BAA6B,OAAO,sCAAsC,IAAI,CAAC,QAAQ,KAAK;YAC1F,gFAAgF;YAChF,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,CAAC,GAAG,YAAY,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAE,GAAG,CAAC,aAAqB,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;QAClG,MAAM,IAAI,6BAAiB,CACzB,+BAA+B,MAAM,sDAAsD;YACzF,IAAI,IAAA,0BAAO,EAAC,GAAG,CAAC,iEAAiE,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AAEjF,+EAA+E;AAC/E,qBAA4B,MAA+B;IACzD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,2BAA2B,IAQtC;IACC,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACxF,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CACjB,kFAAkF;YAChF,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAa,EAAC,2BAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAA,wDAAqC,EAAC;QACpD,cAAc,EAAE,IAAI,CAAC,MAAM;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY;QACZ,mBAAmB,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,IAAA,4BAAa,EAAC,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChG,OAAO;QACL,IAAI,EAAE;YACJ,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAC3C,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;YACtC,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC;SACrC;QACD,KAAK;QACL,YAAY;KACb,CAAC;AACJ,CAAC;AAED;wDACwD;AACjD,KAAK,4BACV,IAAa,EACb,IAMC;IAED,MAAM,GAAG,GAAI,IAAmB,EAAE,YAAY,CAAC;IAC/C,MAAM,IAAA,2CAAwB,EAAC,2BAAU,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,IAAA,8CAAkC,EAAC,GAAU,CAAC,CAAC;IACpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,6BAAiB,CACzB,6DAA6D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/cjs/enclave-seal.d.ts

@@ -98,4 +98,47 @@ export declare function sealToKey(recipientPublicKey: Uint8Array, plaintext: Uin
  * one from an enclave the host itself booted — would pass.
  */
 export declare function verifyEnclaveConfigSealKey(attestationDocument: Uint8Array, options: SealOptions): Promise<Uint8Array>;
+/** Mirrors enclave.AttestIdentityNonceSize. */
+export declare const IDENTITY_NONCE_SIZE = 32;
+/**
+ * What an ATTEST_IDENTITY document establishes once verified: which keys, held
+ * by an enclave running which image, answering THIS caller's challenge.
+ */
+export interface EnclaveIdentity {
+    /** The X25519 key to seal connection configs to. */
+    readonly configSealKey: Uint8Array;
+    /** The enclave's Ed25519 signing key, read out of the signed document. */
+    readonly signingKey: Uint8Array;
+    /** `dp_k_` + hex(SHA-256(signingKey)) — the id /.well-known/burnledger-keys publishes. */
+    readonly signingKeyId: string;
+    /** The PCR0 the document reports, hex. Equal to the one pinned, or this would have thrown. */
+    readonly pcr0: string;
+}
+export interface IdentityOptions extends SealOptions {
+    /**
+     * The 32-byte challenge sent with the request. Draw it from your own entropy:
+     * a nonce the party being checked chose proves nothing about when the
+     * document was produced.
+     */
+    nonce: Uint8Array;
+}
+/**
+ * Verify an ATTEST_IDENTITY document (`GET /v1/enclave/attestation?nonce=`).
+ *
+ * Port of enclave.VerifyIdentityAttestation: everything
+ * {@link verifyEnclaveConfigSealKey} checks, and then that the document carries
+ * exactly the nonce this caller sent and binds a 32-byte Ed25519 signing key in
+ * `user_data`.
+ *
+ * THE NONCE CHECK IS THE POINT. The other checks pass for every document this
+ * enclave image has ever produced, including one captured months ago and
+ * replayed by a relay that has since swapped keys. Only a document carrying the
+ * challenge this caller drew, under AWS's signature, is a statement about now.
+ *
+ * What a pass means, and no more: these keys are held by an AWS Nitro Enclave
+ * running an image that measures to the pinned PCR0, and it answered this
+ * challenge within five minutes of `now`. It does not mean the image was built
+ * from any particular source.
+ */
+export declare function verifyEnclaveIdentity(attestationDocument: Uint8Array, options: IdentityOptions): Promise<EnclaveIdentity>;
 //# sourceMappingURL=enclave-seal.d.ts.map

package/dist/cjs/enclave-seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enclave-seal.d.ts","sourceRoot":"","sources":["../../src/enclave-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,yBAAmE,CAAC;AAG/F,eAAO,MAAM,WAAW,QAAoD,CAAC;AAG7E;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6xBAc7B,CAAC;AAMF,+EAA+E;AAC/E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sEAAsE;IACtE,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,UAAU,EACrD,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,kBAAkB,EAAE,UAAU,EAC9B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAuCrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CA8CrB"}
+{"version":3,"file":"enclave-seal.d.ts","sourceRoot":"","sources":["../../src/enclave-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAUH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,yBAAmE,CAAC;AAG/F,eAAO,MAAM,WAAW,QAAoD,CAAC;AAG7E;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6xBAc7B,CAAC;AAMF,+EAA+E;AAC/E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,sEAAsE;IACtE,GAAG,CAAC,EAAE,IAAI,CAAC;IACX;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,UAAU,EACrD,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,kBAAkB,EAAE,UAAU,EAC9B,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAuCrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAC9C,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD;;;;OAIG;IACH,KAAK,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,qBAAqB,CACzC,mBAAmB,EAAE,UAAU,EAC/B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,eAAe,CAAC,CAmC1B"}

package/dist/cjs/enclave-seal.js

@@ -35,10 +35,11 @@
  * point.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EnclaveAttestationError = exports.NITRO_ROOT_G1_PEM = exports.HEADER_SIZE = exports.ENVELOPE_MAGIC = void 0;
+exports.IDENTITY_NONCE_SIZE = exports.EnclaveAttestationError = exports.NITRO_ROOT_G1_PEM = exports.HEADER_SIZE = exports.ENVELOPE_MAGIC = void 0;
 exports.sealConnectionConfig = sealConnectionConfig;
 exports.sealToKey = sealToKey;
 exports.verifyEnclaveConfigSealKey = verifyEnclaveConfigSealKey;
+exports.verifyEnclaveIdentity = verifyEnclaveIdentity;
 const node_crypto_1 = require("node:crypto");
 /**
  * Envelope wire format (v1). Must match enclave/configsealkey.go byte for byte:
@@ -140,6 +141,62 @@ async function sealToKey(recipientPublicKey, plaintext) {
  * one from an enclave the host itself booted — would pass.
  */
 async function verifyEnclaveConfigSealKey(attestationDocument, options) {
+    return configSealKeyOf(verifyDocument(attestationDocument, options));
+}
+/** Mirrors enclave.AttestIdentityNonceSize. */
+exports.IDENTITY_NONCE_SIZE = 32;
+/**
+ * Verify an ATTEST_IDENTITY document (`GET /v1/enclave/attestation?nonce=`).
+ *
+ * Port of enclave.VerifyIdentityAttestation: everything
+ * {@link verifyEnclaveConfigSealKey} checks, and then that the document carries
+ * exactly the nonce this caller sent and binds a 32-byte Ed25519 signing key in
+ * `user_data`.
+ *
+ * THE NONCE CHECK IS THE POINT. The other checks pass for every document this
+ * enclave image has ever produced, including one captured months ago and
+ * replayed by a relay that has since swapped keys. Only a document carrying the
+ * challenge this caller drew, under AWS's signature, is a statement about now.
+ *
+ * What a pass means, and no more: these keys are held by an AWS Nitro Enclave
+ * running an image that measures to the pinned PCR0, and it answered this
+ * challenge within five minutes of `now`. It does not mean the image was built
+ * from any particular source.
+ */
+async function verifyEnclaveIdentity(attestationDocument, options) {
+    const sent = options.nonce;
+    if (!(sent instanceof Uint8Array) || sent.length !== exports.IDENTITY_NONCE_SIZE) {
+        throw new EnclaveAttestationError(`challenge nonce is ${sent instanceof Uint8Array ? sent.length : 0} bytes, want exactly ` +
+            `${exports.IDENTITY_NONCE_SIZE} (this is a bug in the caller, not a bad document)`);
+    }
+    const payload = verifyDocument(attestationDocument, options);
+    const carried = payload.get("nonce");
+    if (!(carried instanceof Uint8Array) ||
+        carried.length !== sent.length ||
+        !(0, node_crypto_1.timingSafeEqual)(carried, sent)) {
+        throw new EnclaveAttestationError(`the document answers a different challenge than the one sent (sent ${toHex(sent)}, ` +
+            `document carries ${carried instanceof Uint8Array ? toHex(carried) : "none"}) — a genuine ` +
+            "document replayed for someone else's nonce proves nothing about now");
+    }
+    const signingKey = payload.get("user_data");
+    if (!(signingKey instanceof Uint8Array) || signingKey.length !== 32) {
+        const got = signingKey instanceof Uint8Array ? signingKey.length : 0;
+        throw new EnclaveAttestationError(`the document binds ${got} bytes where an Ed25519 public key belongs, want 32`);
+    }
+    const pcr0 = payload.get("pcrs").get(0);
+    return {
+        configSealKey: configSealKeyOf(payload),
+        signingKey,
+        signingKeyId: "dp_k_" + (0, node_crypto_1.createHash)("sha256").update(signingKey).digest("hex"),
+        pcr0: toHex(pcr0),
+    };
+}
+/**
+ * The checks every enclave document gets, whatever is read out of it after:
+ * COSE structure and algorithm, the chain to the pinned root, the signature, the
+ * AWS timestamp against `now`, and the pinned PCRs. Returns the verified payload.
+ */
+function verifyDocument(attestationDocument, options) {
     if (!attestationDocument || attestationDocument.length === 0) {
         throw new EnclaveAttestationError("no attestation document (nothing to verify — this is not a pass)");
     }
@@ -168,6 +225,10 @@ async function verifyEnclaveConfigSealKey(attestationDocument, options) {
     verifyCoseSignature(leaf, protectedBytes, payloadBytes, signature);
     checkClock(payload.get("timestamp"), now);
     matchPcrs(pcrs, expected);
+    return payload;
+}
+/** The 32-byte X25519 config-seal key a verified payload binds in `public_key`. */
+function configSealKeyOf(payload) {
     const publicKey = payload.get("public_key");
     if (!(publicKey instanceof Uint8Array) || publicKey.length !== KEY_SIZE) {
         const got = publicKey instanceof Uint8Array ? publicKey.length : 0;