privateer-agent 0.15.4 → 0.15.6

package/dist-boot/c-C67644MB.mjs

@@ -0,0 +1,1659 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  X509Certificate
+} from "./c-65UZIZC7.mjs";
+import {
+  ASN1Obj,
+  HashAlgorithms,
+  KeyTypes,
+  uint8ArrayEqual
+} from "./c-U4ITOXAN.mjs";
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// node_modules/@tinfoilsh/verifier/dist/errors.js
+var TinfoilError = class extends Error {
+  static {
+    __name(this, "TinfoilError");
+  }
+  constructor(message, options) {
+    super(message);
+    this.name = "TinfoilError";
+    if (options?.cause) {
+      this.cause = options.cause;
+    }
+  }
+};
+var ConfigurationError = class extends TinfoilError {
+  static {
+    __name(this, "ConfigurationError");
+  }
+  constructor(message, options) {
+    super(message, options);
+    this.name = "ConfigurationError";
+  }
+};
+var FetchError = class extends TinfoilError {
+  static {
+    __name(this, "FetchError");
+  }
+  constructor(message, options) {
+    super(message, options);
+    this.name = "FetchError";
+  }
+};
+var AttestationError = class extends TinfoilError {
+  static {
+    __name(this, "AttestationError");
+  }
+  constructor(message, options) {
+    super(message, options);
+    this.name = "AttestationError";
+  }
+};
+function wrapOrThrow(e, ErrorClass, message) {
+  if (e instanceof TinfoilError) {
+    throw e;
+  }
+  throw new ErrorClass(message, { cause: e });
+}
+__name(wrapOrThrow, "wrapOrThrow");
+
+// node_modules/@tinfoilsh/verifier/dist/types.js
+var PredicateType;
+(function(PredicateType2) {
+  PredicateType2["SevGuestV1"] = "https://tinfoil.sh/predicate/sev-snp-guest/v1";
+  PredicateType2["SevGuestV2"] = "https://tinfoil.sh/predicate/sev-snp-guest/v2";
+  PredicateType2["SnpTdxMultiplatformV1"] = "https://tinfoil.sh/predicate/snp-tdx-multiplatform/v1";
+})(PredicateType || (PredicateType = {}));
+function compareMeasurements(a, b) {
+  if (a.type === b.type) {
+    if (a.registers.length !== b.registers.length || !a.registers.every((reg, i) => reg === b.registers[i])) {
+      throw new AttestationError("Code measurement mismatch: The enclave is running different code than the expected release");
+    }
+    return;
+  }
+  if (a.type === PredicateType.SnpTdxMultiplatformV1 && b.type === PredicateType.SevGuestV2) {
+    if (a.registers.length < 1 || b.registers.length < 1) {
+      throw new AttestationError("Invalid measurement data: Missing measurement registers");
+    }
+    if (a.registers[0] !== b.registers[0]) {
+      throw new AttestationError("Code measurement mismatch: The SNP measurement from the enclave does not match the expected measurement from the signed release");
+    }
+    return;
+  }
+  if (a.type === PredicateType.SevGuestV2 && b.type === PredicateType.SnpTdxMultiplatformV1) {
+    if (a.registers.length < 1 || b.registers.length < 1) {
+      throw new AttestationError("Invalid measurement data: Missing measurement registers");
+    }
+    if (a.registers[0] !== b.registers[0]) {
+      throw new AttestationError("Code measurement mismatch: The SNP measurement from the enclave does not match the expected measurement from the signed release");
+    }
+    return;
+  }
+  throw new AttestationError(`Cannot compare measurements: Incompatible measurement types "${a.type}" and "${b.type}"`);
+}
+__name(compareMeasurements, "compareMeasurements");
+async function measurementFingerprint(m) {
+  if (m.registers.length === 1) {
+    return m.registers[0];
+  }
+  const allData = m.type + m.registers.join("");
+  const encoder = new TextEncoder();
+  const hashBuffer = await crypto.subtle.digest("SHA-256", encoder.encode(allData));
+  const hashArray = new Uint8Array(hashBuffer);
+  return Array.from(hashArray).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+__name(measurementFingerprint, "measurementFingerprint");
+async function hashAttestationDocument(doc) {
+  const data = doc.format + doc.body;
+  const encoder = new TextEncoder();
+  const hashBuffer = await crypto.subtle.digest("SHA-256", encoder.encode(data));
+  const hashArray = new Uint8Array(hashBuffer);
+  return Array.from(hashArray).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+__name(hashAttestationDocument, "hashAttestationDocument");
+
+// node_modules/@tinfoilsh/verifier/dist/sev/constants.js
+var POLICY_RESERVED_1_BIT = 17;
+var REPORT_SIZE = 1184;
+var SIGNATURE_OFFSET = 672;
+var ECDSA_RS_SIZE = 72;
+var ECDSA_P384_SHA384_SIGNATURE_SIZE = ECDSA_RS_SIZE + ECDSA_RS_SIZE;
+var ZEN3ZEN4_FAMILY = 25;
+var ZEN5_FAMILY = 26;
+var MILAN_MODEL = 0 | 1;
+var GENOA_MODEL = 1 << 4 | 1;
+var TURIN_MODEL = 2;
+var ReportSigner;
+(function(ReportSigner2) {
+  ReportSigner2[ReportSigner2["VcekReportSigner"] = 0] = "VcekReportSigner";
+  ReportSigner2[ReportSigner2["VlekReportSigner"] = 1] = "VlekReportSigner";
+  ReportSigner2[ReportSigner2["endorseReserved2"] = 2] = "endorseReserved2";
+  ReportSigner2[ReportSigner2["endorseReserved3"] = 3] = "endorseReserved3";
+  ReportSigner2[ReportSigner2["endorseReserved4"] = 4] = "endorseReserved4";
+  ReportSigner2[ReportSigner2["endorseReserved5"] = 5] = "endorseReserved5";
+  ReportSigner2[ReportSigner2["endorseReserved6"] = 6] = "endorseReserved6";
+  ReportSigner2[ReportSigner2["NoneReportSigner"] = 7] = "NoneReportSigner";
+})(ReportSigner || (ReportSigner = {}));
+
+// node_modules/@tinfoilsh/verifier/dist/sev/utils.js
+function tcbFromInt(tcb) {
+  return {
+    ucodeSpl: Number(tcb >> 56n & 0xffn),
+    snpSpl: Number(tcb >> 48n & 0xffn),
+    teeSpl: Number(tcb >> 8n & 0xffn),
+    blSpl: Number(tcb & 0xffn)
+  };
+}
+__name(tcbFromInt, "tcbFromInt");
+function tcbMeetsMinimum(tcb, minimum) {
+  return tcb.blSpl >= minimum.blSpl && tcb.teeSpl >= minimum.teeSpl && tcb.snpSpl >= minimum.snpSpl && tcb.ucodeSpl >= minimum.ucodeSpl;
+}
+__name(tcbMeetsMinimum, "tcbMeetsMinimum");
+function platformInfoFromInt(value) {
+  return {
+    smtEnabled: !!(value & 1n),
+    tsmeEnabled: !!(value & 2n),
+    eccEnabled: !!(value & 4n),
+    raplDisabled: !!(value & 8n),
+    ciphertextHidingDramEnabled: !!(value & 16n),
+    aliasCheckComplete: !!(value & 32n),
+    tioEnabled: !!(value & 128n)
+  };
+}
+__name(platformInfoFromInt, "platformInfoFromInt");
+function policyFromInt(value) {
+  return {
+    abiMinor: Number(value & 0xffn),
+    abiMajor: Number(value >> 8n & 0xffn),
+    smt: !!(value & 1n << 16n),
+    migrateMa: !!(value & 1n << 18n),
+    debug: !!(value & 1n << 19n),
+    singleSocket: !!(value & 1n << 20n),
+    cxlAllowed: !!(value & 1n << 21n),
+    memAes256Xts: !!(value & 1n << 22n),
+    raplDis: !!(value & 1n << 23n),
+    ciphertextHidingDram: !!(value & 1n << 24n),
+    pageSwapDisabled: !!(value & 1n << 25n)
+  };
+}
+__name(policyFromInt, "policyFromInt");
+function bytesToHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+__name(bytesToHex, "bytesToHex");
+
+// node_modules/@tinfoilsh/verifier/dist/sev/report.js
+var Report = class {
+  static {
+    __name(this, "Report");
+  }
+  /**
+   * Parse an attestation report from raw bytes in SEV SNP ABI format.
+   *
+   * @param data - Raw bytes of the attestation report
+   * @returns Report object containing parsed data
+   * @throws Error if data is malformed or validation fails
+   */
+  constructor(data) {
+    if (data.length < REPORT_SIZE) {
+      throw new AttestationError(`Invalid attestation report: Data size (${data.length} bytes) is smaller than expected SEV-SNP report size (${REPORT_SIZE} bytes)`);
+    }
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    this.version = view.getUint32(0, true);
+    this.guestSvn = view.getUint32(4, true);
+    this.policy = view.getBigUint64(8, true);
+    if (!(this.policy & 1n << BigInt(POLICY_RESERVED_1_BIT))) {
+      throw new AttestationError("Invalid attestation report: Policy field has invalid reserved bit (must be 1)");
+    }
+    if (this.policy >> 26n) {
+      throw new AttestationError("Invalid attestation report: Policy field has non-zero reserved bits");
+    }
+    this.familyId = data.slice(16, 32);
+    this.imageId = data.slice(32, 48);
+    this.vmpl = view.getUint32(48, true);
+    this.signatureAlgo = view.getUint32(52, true);
+    this.currentTcb = view.getBigUint64(56, true);
+    try {
+      mbz64(this.currentTcb, "current_tcb", 47, 16);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: TCB (Trusted Computing Base) version field is malformed", { cause: e });
+    }
+    this.platformInfo = view.getBigUint64(64, true);
+    this.policyParsed = policyFromInt(this.policy);
+    this.platformInfoParsed = platformInfoFromInt(this.platformInfo);
+    this.signerInfo = view.getUint32(72, true);
+    try {
+      mbz64(BigInt(this.signerInfo), "signer_info", 31, 5);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Signer info field is malformed", { cause: e });
+    }
+    const signingKey = this.signerInfo >> 2 & 7;
+    if (signingKey !== ReportSigner.VcekReportSigner) {
+      throw new AttestationError(`Unsupported signing key type: This verifier only supports VCEK-signed attestation reports (got signing key type ${signingKey})`);
+    }
+    this.signerInfoParsed = {
+      signingKey,
+      maskChipKey: !!(this.signerInfo & 2),
+      authorKeyEn: !!(this.signerInfo & 1)
+    };
+    try {
+      mbz(data, 76, 80);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Reserved bytes at offset 0x4C are not zeroed", { cause: e });
+    }
+    this.reportData = data.slice(80, 144);
+    this.measurement = data.slice(144, 192);
+    this.hostData = data.slice(192, 224);
+    this.idKeyDigest = data.slice(224, 272);
+    this.authorKeyDigest = data.slice(272, 320);
+    this.reportId = data.slice(320, 352);
+    this.reportIdMa = data.slice(352, 384);
+    this.reportedTcb = view.getBigUint64(384, true);
+    try {
+      mbz64(this.reportedTcb, "reported_tcb", 47, 16);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Reported TCB field is malformed", { cause: e });
+    }
+    let mbzLo = 392;
+    if (this.version >= 3) {
+      this.family = view.getUint8(392);
+      this.model = view.getUint8(393);
+      this.stepping = view.getUint8(394);
+      this.productName = this.initProductName();
+      mbzLo = 395;
+    } else if (this.version === 2) {
+      this.family = ZEN3ZEN4_FAMILY;
+      this.model = GENOA_MODEL;
+      this.stepping = 1;
+      this.productName = "Genoa";
+    } else {
+      throw new AttestationError(`Unsupported attestation report version: ${this.version}. Only version 2 (revision 1.55) and version 3+ are supported`);
+    }
+    try {
+      mbz(data, mbzLo, 416);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Reserved bytes in version section are not zeroed", { cause: e });
+    }
+    this.chipId = data.slice(416, 480);
+    this.committedTcb = view.getBigUint64(480, true);
+    try {
+      mbz64(this.committedTcb, "committed_tcb", 47, 16);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Committed TCB field is malformed", { cause: e });
+    }
+    this.currentBuild = view.getUint8(488);
+    this.currentMinor = view.getUint8(489);
+    this.currentMajor = view.getUint8(490);
+    try {
+      mbz(data, 491, 492);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Reserved bytes after current version are not zeroed", { cause: e });
+    }
+    this.committedBuild = view.getUint8(492);
+    this.committedMinor = view.getUint8(493);
+    this.committedMajor = view.getUint8(494);
+    try {
+      mbz(data, 495, 496);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Reserved bytes after committed version are not zeroed", { cause: e });
+    }
+    this.launchTcb = view.getBigUint64(496, true);
+    try {
+      mbz64(this.launchTcb, "launch_tcb", 47, 16);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Launch TCB field is malformed", { cause: e });
+    }
+    const mbzBeforeSig = this.version < 5 ? 504 : 520;
+    try {
+      mbz(data, mbzBeforeSig, SIGNATURE_OFFSET);
+    } catch (e) {
+      throw new AttestationError("Invalid attestation report: Reserved bytes before signature are not zeroed", { cause: e });
+    }
+    if (this.signatureAlgo === 1) {
+      try {
+        mbz(data, SIGNATURE_OFFSET + ECDSA_P384_SHA384_SIGNATURE_SIZE, REPORT_SIZE);
+      } catch (e) {
+        throw new AttestationError("Invalid attestation report: Reserved bytes after signature are not zeroed", { cause: e });
+      }
+    }
+    this.signedData = data.slice(0, SIGNATURE_OFFSET);
+    this.signature = data.slice(SIGNATURE_OFFSET, REPORT_SIZE);
+  }
+  initProductName() {
+    if (this.family === ZEN3ZEN4_FAMILY) {
+      if (this.model === MILAN_MODEL)
+        return "Milan";
+      if (this.model === GENOA_MODEL)
+        return "Genoa";
+    } else if (this.family === ZEN5_FAMILY) {
+      if (this.model === TURIN_MODEL)
+        return "Turin";
+    }
+    return "Unknown";
+  }
+};
+function findNonZero(data, lo, hi) {
+  for (let i = lo; i < hi; i++) {
+    if (data[i] !== 0)
+      return i;
+  }
+  return hi;
+}
+__name(findNonZero, "findNonZero");
+function mbz(data, lo, hi) {
+  const firstNonZero = findNonZero(data, lo, hi);
+  if (firstNonZero !== hi) {
+    const hexStr = Array.from(data.slice(lo, hi)).map((b) => b.toString(16).padStart(2, "0")).join("");
+    throw new AttestationError(`reserved bytes at offset 0x${lo.toString(16)}-0x${hi.toString(16)} contain non-zero data: ${hexStr}`);
+  }
+}
+__name(mbz, "mbz");
+function mbz64(data, base, hi, lo) {
+  const mask = (1n << BigInt(hi - lo + 1)) - 1n;
+  const bits = data >> BigInt(lo) & mask;
+  if (bits !== 0n) {
+    throw new AttestationError(`Reserved bits in ${base} field contain non-zero data: 0x${data.toString(16)}`);
+  }
+}
+__name(mbz64, "mbz64");
+
+// node_modules/@tinfoilsh/verifier/dist/sev/certs.js
+var ARK_CERT = `-----BEGIN CERTIFICATE-----
+MIIGYzCCBBKgAwIBAgIDAgAAMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
+BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
+BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
+Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
+Y2VzMRIwEAYDVQQDDAlBUkstR2Vub2EwHhcNMjIwMTI2MTUzNDM3WhcNNDcwMTI2
+MTUzNDM3WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
+BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
+ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJQVJLLUdlbm9hMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEA3Cd95S/uFOuRIskW9vz9VDBF69NDQF79oRhL
+/L2PVQGhK3YdfEBgpF/JiwWFBsT/fXDhzA01p3LkcT/7LdjcRfKXjHl+0Qq/M4dZ
+kh6QDoUeKzNBLDcBKDDGWo3v35NyrxbA1DnkYwUKU5AAk4P94tKXLp80oxt84ahy
+HoLmc/LqsGsp+oq1Bz4PPsYLwTG4iMKVaaT90/oZ4I8oibSru92vJhlqWO27d/Rx
+c3iUMyhNeGToOvgx/iUo4gGpG61NDpkEUvIzuKcaMx8IdTpWg2DF6SwF0IgVMffn
+vtJmA68BwJNWo1E4PLJdaPfBifcJpuBFwNVQIPQEVX3aP89HJSp8YbY9lySS6PlV
+EqTBBtaQmi4ATGmMR+n2K/e+JAhU2Gj7jIpJhOkdH9firQDnmlA2SFfJ/Cc0mGNz
+W9RmIhyOUnNFoclmkRhl3/AQU5Ys9Qsan1jT/EiyT+pCpmnA+y9edvhDCbOG8F2o
+xHGRdTBkylungrkXJGYiwGrR8kaiqv7NN8QhOBMqYjcbrkEr0f8QMKklIS5ruOfq
+lLMCBw8JLB3LkjpWgtD7OpxkzSsohN47Uom86RY6lp72g8eXHP1qYrnvhzaG1S70
+vw6OkbaaC9EjiH/uHgAJQGxon7u0Q7xgoREWA/e7JcBQwLg80Hq/sbRuqesxz7wB
+WSY254cCAwEAAaN+MHwwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSfXfn+Ddjz
+WtAzGiXvgSlPvjGoWzAPBgNVHRMBAf8EBTADAQH/MDoGA1UdHwQzMDEwL6AtoCuG
+KWh0dHBzOi8va2RzaW50Zi5hbWQuY29tL3ZjZWsvdjEvR2Vub2EvY3JsMEYGCSqG
+SIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZI
+AWUDBAICBQCiAwIBMKMDAgEBA4ICAQAdIlPBC7DQmvH7kjlOznFx3i21SzOPDs5L
+7SgFjMC9rR07292GQCA7Z7Ulq97JQaWeD2ofGGse5swj4OQfKfVv/zaJUFjvosZO
+nfZ63epu8MjWgBSXJg5QE/Al0zRsZsp53DBTdA+Uv/s33fexdenT1mpKYzhIg/cK
+tz4oMxq8JKWJ8Po1CXLzKcfrTphjlbkh8AVKMXeBd2SpM33B1YP4g1BOdk013kqb
+7bRHZ1iB2JHG5cMKKbwRCSAAGHLTzASgDcXr9Fp7Z3liDhGu/ci1opGmkp12QNiJ
+uBbkTU+xDZHm5X8Jm99BX7NEpzlOwIVR8ClgBDyuBkBC2ljtr3ZSaUIYj2xuyWN9
+5KFY49nWxcz90CFa3Hzmy4zMQmBe9dVyls5eL5p9bkXcgRMDTbgmVZiAf4afe8DL
+dmQcYcMFQbHhgVzMiyZHGJgcCrQmA7MkTwEIds1wx/HzMcwU4qqNBAoZV7oeIIPx
+dqFXfPqHqiRlEbRDfX1TG5NFVaeByX0GyH6jzYVuezETzruaky6fp2bl2bczxPE8
+HdS38ijiJmm9vl50RGUeOAXjSuInGR4bsRufeGPB9peTa9BcBOeTWzstqTUB/F/q
+aZCIZKr4X6TyfUuSDz/1JDAGl+lxdM0P9+lLaP9NahQjHCVf0zf1c1salVuGFk2w
+/wMz1R1BHg==
+-----END CERTIFICATE-----`;
+var ASK_CERT = `-----BEGIN CERTIFICATE-----
+MIIGiTCCBDigAwIBAgIDAgACMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
+BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
+BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
+Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
+Y2VzMRIwEAYDVQQDDAlBUkstR2Vub2EwHhcNMjIxMDMxMTMzMzQ4WhcNNDcxMDMx
+MTMzMzQ4WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
+BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
+ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJU0VWLUdlbm9hMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEAoHJhvk4Fwwkwb03AMfLySXJSXmEaCZMTRbLg
+Paj4oEzaD9tGfxCSw/nsCAiXHQaWUt++bnbjJO05TKT5d+Cdrz4/fiRBpbhf0xzv
+h11O+wJTBPj3uCzDm48vEZ8l5SXMO4wd/QqwsrejFERPD/Hdfv1mGCMW7ac0ug8t
+rDzqGe+l+p8NMjp/EqBDY2vd8hLaVLmS+XjAqlYVNRksh9aTzSYL19/cTrBDmqQ2
+y8k23zNl2lW6q/BtQOpWGVs3EWvBHb/Qnf3f3S9+lC4H2jdDy9yn7kqyTWq4WCBn
+E4qhYJRokulYtzMZM1Ilk4Z6RPkOTR1MJ4gdFtj7lKmrkSuOoJYmqhJIsQJ854lA
+bJybgU7zyzWAwu3uaslkYKUEAQf2ja5Hyl3IBqOzpqY31SpKzbl8NXveZybRMklw
+fe4iDLI25T9ku9CVetDYifCbdGeuHdTwZBBemW4NE57L7iEV8+zz8nxng8OMX//4
+pXntWqmQbEAnBLv2ToTgd1H2zYRthyDLc3V119/+FnTW17LK6bKzTCgEnCHQEcAt
+0hDQLLF799+2lZTxxfBEoduAZax6IjgAMCi6e1ZfKPJSkdvb2m3BwfP8bniG7+AE
+Jv1WOEmnBJc1pVQCttbJUodbi07Vfen5JRUqAvSM3ObWQOzSAGzsGnpIigwFpW6m
+9F7uYVUCAwEAAaOBozCBoDAdBgNVHQ4EFgQUssZ7pDW7HJVkHAmgQf/F3EmGFVow
+HwYDVR0jBBgwFoAUn135/g3Y81rQMxol74EpT74xqFswEgYDVR0TAQH/BAgwBgEB
+/wIBADAOBgNVHQ8BAf8EBAMCAQQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cHM6Ly9r
+ZHNpbnRmLmFtZC5jb20vdmNlay92MS9HZW5vYS9jcmwwRgYJKoZIhvcNAQEKMDmg
+DzANBglghkgBZQMEAgIFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgIFAKID
+AgEwowMCAQEDggIBAIgu3V2tQJOo0/6GvNmwLXbLDrsLKXqHUqdGyOZUpPHM3ujT
+aex1G+8bEgBswwBa+wNvl1SQqRqy2x2QwP+i//BcWr3lMrUxci4G7/P8hZBV821n
+rAUZtbvfqla5MrRH9AKJXWW/pmtd10czqCHkzdLQNZNjt2dnZHMQAMtGs1AtynRE
+HNwEBiH2KAt7gUc/sKWnSCipztKE76puN/XXbSx+Ws+VPiFw6CBAeI9dqnEiQ1tp
+EgqtWEtcKm7Ggb1XH6oWbISoowvc00/ADWfNom0xl6v2C6RIWYgUoZ2f7PCyV3Dt
+bu/fQfyyZvmtVLA4gB2Ehc6Omjy21Y55WY9IweHlKENMPEUVtRqOvRVI0ml9Wbal
+f049joCu2j33XPqwp3IrzevmPBDGpR2Stdm3K66a/g/BSY7Wc9/VeykP3RXlxY1T
+MMJ8F1lpg6Tmu+c+vow7cliyqOoayAnR71U8+rWrL3HRHheSVX8GPYOaDNBTt831
+Z027vDWv3811vMoxYxhuTRaokvNWCSzmJ2EWrPYHcHOtkjSFKN7ot0Rc70fIRZEY
+c2rb3ywLSicEq3JQCnnz6iCZ1tMfplzcrJ2LnW2F1C8yRV+okylyORlsaxOLKYOW
+jaDTSFaq1NIwodHp7X9fOG48uRuJWS8GmifD969sC4Ut2FJFoklceBVUNCHR
+-----END CERTIFICATE-----`;
+
+// node_modules/@tinfoilsh/verifier/dist/sev/cert-chain.js
+var SnpOid = {
+  STRUCT_VERSION: "1.3.6.1.4.1.3704.1.1",
+  PRODUCT_NAME: "1.3.6.1.4.1.3704.1.2",
+  BL_SPL: "1.3.6.1.4.1.3704.1.3.1",
+  TEE_SPL: "1.3.6.1.4.1.3704.1.3.2",
+  SNP_SPL: "1.3.6.1.4.1.3704.1.3.3",
+  SPL4: "1.3.6.1.4.1.3704.1.3.4",
+  SPL5: "1.3.6.1.4.1.3704.1.3.5",
+  SPL6: "1.3.6.1.4.1.3704.1.3.6",
+  SPL7: "1.3.6.1.4.1.3704.1.3.7",
+  UCODE: "1.3.6.1.4.1.3704.1.3.8",
+  HWID: "1.3.6.1.4.1.3704.1.4",
+  CSP_ID: "1.3.6.1.4.1.3704.1.5",
+  // Aliases for compatibility
+  BOOTLOADER: "1.3.6.1.4.1.3704.1.3.1",
+  TEE: "1.3.6.1.4.1.3704.1.3.2",
+  SNP: "1.3.6.1.4.1.3704.1.3.3"
+};
+var OID_RSASSA_PSS = "1.2.840.113549.1.1.10";
+var OID_EC_PUBLIC_KEY = "1.2.840.10045.2.1";
+var OID_SECP384R1 = "1.3.132.0.34";
+var CertificateChain = class _CertificateChain {
+  static {
+    __name(this, "CertificateChain");
+  }
+  constructor(ark, ask, vcek) {
+    this.ark = ark;
+    this.ask = ask;
+    this.vcek = vcek;
+  }
+  static async fromReport(report, vcekDer) {
+    if (report.productName !== "Genoa") {
+      throw new AttestationError(`Unsupported processor: ${report.productName}. This verifier only supports AMD EPYC Genoa processors`);
+    }
+    if (report.signerInfoParsed.signingKey !== ReportSigner.VcekReportSigner) {
+      throw new AttestationError("Unsupported signing key: This verifier only supports VCEK-signed attestation reports");
+    }
+    const ark = X509Certificate.parse(ARK_CERT);
+    const ask = X509Certificate.parse(ASK_CERT);
+    const vcekCert = X509Certificate.parse(vcekDer);
+    return new _CertificateChain(ark, ask, vcekCert);
+  }
+  async verifyChain() {
+    try {
+      this.validateArkFormat();
+      this.validateAskFormat();
+      this.validateVcekFormat();
+      const now = /* @__PURE__ */ new Date();
+      if (!this.ark.validForDate(now)) {
+        throw new AttestationError("AMD Root Key (ARK) certificate has expired or is not yet valid");
+      }
+      if (!this.ask.validForDate(now)) {
+        throw new AttestationError("AMD SEV Key (ASK) certificate has expired or is not yet valid");
+      }
+      if (!this.vcek.validForDate(now)) {
+        throw new AttestationError("VCEK certificate has expired or is not yet valid");
+      }
+      const arkSelfSigned = await this.ark.verify();
+      if (!arkSelfSigned) {
+        throw new AttestationError("AMD Root Key (ARK) certificate signature verification failed: Not properly self-signed");
+      }
+      const askSignedByArk = await this.ask.verify(this.ark);
+      if (!askSignedByArk) {
+        throw new AttestationError("AMD SEV Key (ASK) certificate signature verification failed: Not signed by ARK");
+      }
+      const vcekSignedByAsk = await this.vcek.verify(this.ask);
+      if (!vcekSignedByAsk) {
+        throw new AttestationError("VCEK certificate signature verification failed: Not signed by ASK");
+      }
+      return true;
+    } catch (e) {
+      wrapOrThrow(e, AttestationError, "AMD certificate chain verification failed");
+    }
+  }
+  validateVcekTcb(tcb) {
+    const blSplExt = this.vcek.extension(SnpOid.BL_SPL);
+    if (!blSplExt) {
+      throw new AttestationError("Invalid VCEK certificate: Missing bootloader security patch level (BL_SPL) extension");
+    }
+    const blSpl = this.decodeExtensionInteger(blSplExt.value);
+    if (blSpl !== tcb.blSpl) {
+      throw new AttestationError(`VCEK TCB mismatch: Bootloader SPL in certificate (${blSpl}) does not match report (${tcb.blSpl})`);
+    }
+    const teeSplExt = this.vcek.extension(SnpOid.TEE_SPL);
+    if (!teeSplExt) {
+      throw new AttestationError("Invalid VCEK certificate: Missing TEE security patch level (TEE_SPL) extension");
+    }
+    const teeSpl = this.decodeExtensionInteger(teeSplExt.value);
+    if (teeSpl !== tcb.teeSpl) {
+      throw new AttestationError(`VCEK TCB mismatch: TEE SPL in certificate (${teeSpl}) does not match report (${tcb.teeSpl})`);
+    }
+    const snpSplExt = this.vcek.extension(SnpOid.SNP_SPL);
+    if (!snpSplExt) {
+      throw new AttestationError("Invalid VCEK certificate: Missing SNP security patch level (SNP_SPL) extension");
+    }
+    const snpSpl = this.decodeExtensionInteger(snpSplExt.value);
+    if (snpSpl !== tcb.snpSpl) {
+      throw new AttestationError(`VCEK TCB mismatch: SNP SPL in certificate (${snpSpl}) does not match report (${tcb.snpSpl})`);
+    }
+    const ucodeExt = this.vcek.extension(SnpOid.UCODE);
+    if (!ucodeExt) {
+      throw new AttestationError("Invalid VCEK certificate: Missing microcode security patch level (UCODE) extension");
+    }
+    const ucodeSpl = this.decodeExtensionInteger(ucodeExt.value);
+    if (ucodeSpl !== tcb.ucodeSpl) {
+      throw new AttestationError(`VCEK TCB mismatch: Microcode SPL in certificate (${ucodeSpl}) does not match report (${tcb.ucodeSpl})`);
+    }
+  }
+  validateVcekHwid(chipId) {
+    const hwidExt = this.vcek.extension(SnpOid.HWID);
+    if (!hwidExt) {
+      throw new AttestationError("Invalid VCEK certificate: Missing hardware ID (HWID) extension");
+    }
+    if (!uint8ArrayEqual(hwidExt.value, chipId)) {
+      throw new AttestationError("VCEK hardware ID mismatch: Certificate HWID does not match the chip ID in the attestation report");
+    }
+  }
+  validateArkFormat() {
+    if (this.ark.version !== "v3") {
+      throw new AttestationError(`Invalid ARK certificate: Expected X.509 version v3, got ${this.ark.version}`);
+    }
+    if (!this.validateAmdLocation(this.ark.issuerDN)) {
+      throw new AttestationError("Invalid ARK certificate: Issuer is not a valid AMD organization");
+    }
+    if (!this.validateAmdLocation(this.ark.subjectDN)) {
+      throw new AttestationError("Invalid ARK certificate: Subject is not a valid AMD organization");
+    }
+    const cn = this.ark.subjectDN.get("CN");
+    if (cn !== "ARK-Genoa") {
+      throw new AttestationError(`Invalid ARK certificate: Expected common name "ARK-Genoa", got "${cn}"`);
+    }
+  }
+  validateAskFormat() {
+    if (this.ask.version !== "v3") {
+      throw new AttestationError(`Invalid ASK certificate: Expected X.509 version v3, got ${this.ask.version}`);
+    }
+    if (!this.validateAmdLocation(this.ask.issuerDN)) {
+      throw new AttestationError("Invalid ASK certificate: Issuer is not a valid AMD organization");
+    }
+    if (!this.validateAmdLocation(this.ask.subjectDN)) {
+      throw new AttestationError("Invalid ASK certificate: Subject is not a valid AMD organization");
+    }
+    const cn = this.ask.subjectDN.get("CN");
+    if (cn !== "SEV-Genoa") {
+      throw new AttestationError(`Invalid ASK certificate: Expected common name "SEV-Genoa", got "${cn}"`);
+    }
+  }
+  validateVcekFormat() {
+    if (this.vcek.version !== "v3") {
+      throw new AttestationError(`Invalid VCEK certificate: Expected X.509 version v3, got ${this.vcek.version}`);
+    }
+    if (!this.validateAmdLocation(this.vcek.issuerDN)) {
+      throw new AttestationError("Invalid VCEK certificate: Issuer is not a valid AMD organization");
+    }
+    if (!this.validateAmdLocation(this.vcek.subjectDN)) {
+      throw new AttestationError("Invalid VCEK certificate: Subject is not a valid AMD organization");
+    }
+    const cn = this.vcek.subjectDN.get("CN");
+    if (cn !== "SEV-VCEK") {
+      throw new AttestationError(`Invalid VCEK certificate: Expected common name "SEV-VCEK", got "${cn}"`);
+    }
+    const sigAlgOid = this.getSignatureAlgorithmOid(this.vcek);
+    if (sigAlgOid !== OID_RSASSA_PSS) {
+      throw new AttestationError("Invalid VCEK certificate: Signature algorithm must be RSASSA-PSS");
+    }
+    const { algorithm, curve } = this.getPublicKeyInfo(this.vcek);
+    if (algorithm !== OID_EC_PUBLIC_KEY) {
+      throw new AttestationError("Invalid VCEK certificate: Public key must be ECDSA");
+    }
+    if (curve !== OID_SECP384R1) {
+      throw new AttestationError("Invalid VCEK certificate: Public key curve must be secp384r1 (P-384)");
+    }
+    const cspIdExt = this.vcek.extension(SnpOid.CSP_ID);
+    if (cspIdExt) {
+      throw new AttestationError("Invalid VCEK certificate: CSP_ID extension should not be present (this looks like a VLEK certificate)");
+    }
+    const hwidExt = this.vcek.extension(SnpOid.HWID);
+    if (!hwidExt || hwidExt.value.length !== 64) {
+      throw new AttestationError("Invalid VCEK certificate: Missing or malformed hardware ID (HWID) extension");
+    }
+    const productNameExt = this.vcek.extension(SnpOid.PRODUCT_NAME);
+    if (!productNameExt) {
+      throw new AttestationError("Invalid VCEK certificate: Missing product name extension");
+    }
+    const expectedProductName = new Uint8Array([22, 5, 71, 101, 110, 111, 97]);
+    if (!uint8ArrayEqual(productNameExt.value, expectedProductName)) {
+      throw new AttestationError('Invalid VCEK certificate: Product name must be "Genoa"');
+    }
+  }
+  validateAmdLocation(name) {
+    const country = name.get("C");
+    const locality = name.get("L");
+    const state = name.get("ST");
+    const org = name.get("O");
+    const orgUnit = name.get("OU");
+    return country === "US" && locality === "Santa Clara" && state === "CA" && org === "Advanced Micro Devices" && orgUnit === "Engineering";
+  }
+  getSignatureAlgorithmOid(cert) {
+    const sigAlgObj = cert.root.subs[1];
+    return sigAlgObj.subs[0].toOID();
+  }
+  getPublicKeyInfo(cert) {
+    const tbsCert = cert.root.subs[0];
+    const spki = tbsCert.subs[6];
+    const algorithmSeq = spki.subs[0];
+    const algorithm = algorithmSeq.subs[0].toOID();
+    const curve = algorithmSeq.subs[1]?.toOID() || "";
+    return { algorithm, curve };
+  }
+  decodeExtensionInteger(value) {
+    const asn1 = ASN1Obj.parseBuffer(value);
+    return Number(asn1.toInteger());
+  }
+  get vcekPublicKey() {
+    return this.vcek.publicKeyObj;
+  }
+};
+
+// node_modules/@tinfoilsh/verifier/dist/sev/verify.js
+async function verifyReportSignature(vcekPublicKey, report) {
+  if (report.version < 2) {
+    throw new AttestationError(`Unsupported attestation report version ${report.version}. Minimum required version is 2`);
+  }
+  if (!(report.policy & 1n << BigInt(POLICY_RESERVED_1_BIT))) {
+    throw new AttestationError("Invalid attestation report: Policy field has invalid reserved bit");
+  }
+  if (report.policy >> 26n) {
+    throw new AttestationError("Invalid attestation report: Policy field has non-zero reserved bits");
+  }
+  if (report.signatureAlgo !== 1) {
+    throw new AttestationError(`Unsupported signature algorithm (${report.signatureAlgo}). Only ECDSA P-384 with SHA-384 (algorithm 1) is supported`);
+  }
+  const rBytesLE = report.signature.slice(0, 72);
+  const sBytesLE = report.signature.slice(72, 144);
+  const rBytesBE = reverseBytes(rBytesLE);
+  const sBytesBE = reverseBytes(sBytesLE);
+  const r = bytesToBigInt(stripLeadingZeros(rBytesBE));
+  const s = bytesToBigInt(stripLeadingZeros(sBytesBE));
+  const rRaw = bigIntToFixedBytes(r, 48);
+  const sRaw = bigIntToFixedBytes(s, 48);
+  const rawSignature = new Uint8Array(96);
+  rawSignature.set(rRaw, 0);
+  rawSignature.set(sRaw, 48);
+  const signedData = report.signedData.slice();
+  try {
+    const isValid = await crypto.subtle.verify({ name: KeyTypes.Ecdsa, hash: HashAlgorithms.SHA384 }, vcekPublicKey, rawSignature, signedData);
+    return isValid;
+  } catch (e) {
+    wrapOrThrow(e, AttestationError, "Failed to verify attestation report signature using VCEK public key");
+  }
+}
+__name(verifyReportSignature, "verifyReportSignature");
+async function verifyAttestation(chain, report) {
+  const isChainValid = await chain.verifyChain();
+  if (!isChainValid) {
+    throw new AttestationError("AMD certificate chain verification failed: The chain from ARK to ASK to VCEK could not be verified");
+  }
+  const vcekPublicKey = await chain.vcekPublicKey;
+  const isSignatureValid = await verifyReportSignature(vcekPublicKey, report);
+  if (!isSignatureValid) {
+    throw new AttestationError("Attestation report signature is invalid: The report was not signed by the expected VCEK key");
+  }
+  return true;
+}
+__name(verifyAttestation, "verifyAttestation");
+function reverseBytes(bytes) {
+  return new Uint8Array([...bytes].reverse());
+}
+__name(reverseBytes, "reverseBytes");
+function stripLeadingZeros(bytes) {
+  let start = 0;
+  while (start < bytes.length && bytes[start] === 0) {
+    start++;
+  }
+  if (start === bytes.length) {
+    return new Uint8Array([0]);
+  }
+  return bytes.slice(start);
+}
+__name(stripLeadingZeros, "stripLeadingZeros");
+function bytesToBigInt(bytes) {
+  if (bytes.length === 0) {
+    return 0n;
+  }
+  let result = 0n;
+  for (const byte of bytes) {
+    result = result << 8n | BigInt(byte);
+  }
+  return result;
+}
+__name(bytesToBigInt, "bytesToBigInt");
+function bigIntToFixedBytes(value, size) {
+  let hex = value.toString(16);
+  if (hex.length % 2) {
+    hex = "0" + hex;
+  }
+  const bytes = new Uint8Array(size);
+  const hexBytes = hex.length / 2;
+  const startOffset = size - hexBytes;
+  for (let i = 0; i < hexBytes; i++) {
+    bytes[startOffset + i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+__name(bigIntToFixedBytes, "bigIntToFixedBytes");
+
+// node_modules/@tinfoilsh/verifier/dist/sev/validation.js
+var defaultValidationOptions = {
+  guestPolicy: {
+    abiMinor: 0,
+    abiMajor: 0,
+    smt: true,
+    migrateMa: false,
+    debug: false,
+    singleSocket: false,
+    cxlAllowed: false,
+    memAes256Xts: false,
+    raplDis: false,
+    ciphertextHidingDram: false,
+    pageSwapDisabled: false
+  },
+  minimumGuestSvn: 0,
+  minimumBuild: 21,
+  minimumVersion: 1 << 8 | 55,
+  // 1.55
+  minimumTcb: {
+    blSpl: 7,
+    teeSpl: 0,
+    snpSpl: 14,
+    ucodeSpl: 72
+  },
+  minimumLaunchTcb: {
+    blSpl: 7,
+    teeSpl: 0,
+    snpSpl: 14,
+    ucodeSpl: 72
+  },
+  permitProvisionalFirmware: false,
+  platformInfo: {
+    smtEnabled: true,
+    tsmeEnabled: true,
+    eccEnabled: false,
+    raplDisabled: false,
+    ciphertextHidingDramEnabled: false,
+    aliasCheckComplete: false,
+    tioEnabled: false
+  },
+  requireAuthorKey: false,
+  requireIdBlock: false
+};
+function validatePolicy(reportPolicy, required) {
+  if (comparePolicyVersions(required, reportPolicy) > 0) {
+    throw new AttestationError(`Required ABI version (${required.abiMajor}.${required.abiMinor}) is greater than report's ABI version (${reportPolicy.abiMajor}.${reportPolicy.abiMinor})`);
+  }
+  if (!required.migrateMa && reportPolicy.migrateMa) {
+    throw new AttestationError("Security policy violation: Migration agent is enabled but not allowed");
+  }
+  if (!required.debug && reportPolicy.debug) {
+    throw new AttestationError("Security policy violation: Debug mode is enabled but not allowed. The enclave must have debug disabled for production use");
+  }
+  if (!required.smt && reportPolicy.smt) {
+    throw new AttestationError("Security policy violation: Simultaneous multithreading (SMT) is enabled but not allowed");
+  }
+  if (!required.cxlAllowed && reportPolicy.cxlAllowed) {
+    throw new AttestationError("Security policy violation: CXL (Compute Express Link) is enabled but not allowed");
+  }
+  if (!required.memAes256Xts && reportPolicy.memAes256Xts) {
+    throw new AttestationError("Security policy violation: AES-256-XTS memory encryption mode is enabled but not allowed");
+  }
+  if (required.singleSocket && !reportPolicy.singleSocket) {
+    throw new AttestationError("Security policy violation: Single socket mode is required but not enabled");
+  }
+  if (required.memAes256Xts && !reportPolicy.memAes256Xts) {
+    throw new AttestationError("Security policy violation: AES-256-XTS memory encryption mode is required but not enabled");
+  }
+  if (required.raplDis && !reportPolicy.raplDis) {
+    throw new AttestationError("Security policy violation: RAPL (power monitoring) must be disabled but is enabled");
+  }
+  if (required.ciphertextHidingDram && !reportPolicy.ciphertextHidingDram) {
+    throw new AttestationError("Security policy violation: DRAM ciphertext hiding is required but not enabled");
+  }
+  if (required.pageSwapDisabled && !reportPolicy.pageSwapDisabled) {
+    throw new AttestationError("Security policy violation: Page swap must be disabled but is enabled");
+  }
+}
+__name(validatePolicy, "validatePolicy");
+function comparePolicyVersions(required, report) {
+  if (required.abiMajor !== report.abiMajor) {
+    return required.abiMajor - report.abiMajor;
+  }
+  return required.abiMinor - report.abiMinor;
+}
+__name(comparePolicyVersions, "comparePolicyVersions");
+function tcbPartsToString(tcb) {
+  return `TCBParts(bootloader=${tcb.blSpl}, tee=${tcb.teeSpl}, snp=${tcb.snpSpl}, microcode=${tcb.ucodeSpl})`;
+}
+__name(tcbPartsToString, "tcbPartsToString");
+function validateReport(report, chain, options) {
+  if (options.guestPolicy) {
+    validatePolicy(report.policyParsed, options.guestPolicy);
+  }
+  if (options.minimumGuestSvn !== void 0) {
+    if (report.guestSvn < options.minimumGuestSvn) {
+      throw new AttestationError(`Guest SVN ${report.guestSvn} is less than minimum required ${options.minimumGuestSvn}`);
+    }
+  }
+  if (options.minimumBuild !== void 0) {
+    if (report.currentBuild < options.minimumBuild) {
+      throw new AttestationError(`Current SNP firmware build number ${report.currentBuild} is less than minimum required ${options.minimumBuild}`);
+    }
+    if (report.committedBuild < options.minimumBuild) {
+      throw new AttestationError(`Committed SNP firmware build number ${report.committedBuild} is less than minimum required ${options.minimumBuild}`);
+    }
+  }
+  if (options.minimumVersion !== void 0) {
+    const currentVersion = report.currentMajor << 8 | report.currentMinor;
+    const committedVersion = report.committedMajor << 8 | report.committedMinor;
+    if (currentVersion < options.minimumVersion) {
+      throw new AttestationError(`Current SNP firmware version ${report.currentMajor}.${report.currentMinor} is less than minimum required ${options.minimumVersion >> 8}.${options.minimumVersion & 255}`);
+    }
+    if (committedVersion < options.minimumVersion) {
+      throw new AttestationError(`Committed SNP firmware version ${report.committedMajor}.${report.committedMinor} is less than minimum required ${options.minimumVersion >> 8}.${options.minimumVersion & 255}`);
+    }
+  }
+  if (options.minimumTcb) {
+    const currentTcbParts = tcbFromInt(report.currentTcb);
+    const committedTcbParts = tcbFromInt(report.committedTcb);
+    const reportedTcbParts = tcbFromInt(report.reportedTcb);
+    if (!tcbMeetsMinimum(currentTcbParts, options.minimumTcb)) {
+      throw new AttestationError(`Current TCB ${tcbPartsToString(currentTcbParts)} does not meet minimum requirements ${tcbPartsToString(options.minimumTcb)}`);
+    }
+    if (!tcbMeetsMinimum(committedTcbParts, options.minimumTcb)) {
+      throw new AttestationError(`Committed TCB ${tcbPartsToString(committedTcbParts)} does not meet minimum requirements ${tcbPartsToString(options.minimumTcb)}`);
+    }
+    if (!tcbMeetsMinimum(reportedTcbParts, options.minimumTcb)) {
+      throw new AttestationError(`Reported TCB ${tcbPartsToString(reportedTcbParts)} does not meet minimum requirements ${tcbPartsToString(options.minimumTcb)}`);
+    }
+  }
+  chain.validateVcekTcb(tcbFromInt(report.reportedTcb));
+  if (options.minimumLaunchTcb) {
+    const launchTcbParts = tcbFromInt(report.launchTcb);
+    if (!tcbMeetsMinimum(launchTcbParts, options.minimumLaunchTcb)) {
+      throw new AttestationError(`Launch TCB ${tcbPartsToString(launchTcbParts)} does not meet minimum requirements ${tcbPartsToString(options.minimumLaunchTcb)}`);
+    }
+  }
+  if (options.reportData) {
+    if (report.reportData.length !== 64) {
+      throw new AttestationError(`Report data length is ${report.reportData.length}, expected 64 bytes`);
+    }
+    if (!uint8ArrayEqual(report.reportData, options.reportData)) {
+      throw new AttestationError(`Report data mismatch: got ${bytesToHex(report.reportData)}, expected ${bytesToHex(options.reportData)}`);
+    }
+  }
+  if (options.hostData) {
+    if (report.hostData.length !== 32) {
+      throw new AttestationError(`Host data length is ${report.hostData.length}, expected 32 bytes`);
+    }
+    if (!uint8ArrayEqual(report.hostData, options.hostData)) {
+      throw new AttestationError(`Host data mismatch: got ${bytesToHex(report.hostData)}, expected ${bytesToHex(options.hostData)}`);
+    }
+  }
+  if (options.measurement) {
+    if (report.measurement.length !== 48) {
+      throw new AttestationError(`Measurement length is ${report.measurement.length}, expected 48 bytes`);
+    }
+    if (!uint8ArrayEqual(report.measurement, options.measurement)) {
+      throw new AttestationError(`Measurement mismatch: got ${bytesToHex(report.measurement)}, expected ${bytesToHex(options.measurement)}`);
+    }
+  }
+  if (options.chipId) {
+    if (report.chipId.length !== 64) {
+      throw new AttestationError(`Chip ID length is ${report.chipId.length}, expected 64 bytes`);
+    }
+    if (!uint8ArrayEqual(report.chipId, options.chipId)) {
+      throw new AttestationError(`Chip ID mismatch: got ${bytesToHex(report.chipId)}, expected ${bytesToHex(options.chipId)}`);
+    }
+  }
+  if (options.imageId) {
+    if (report.imageId.length !== 16) {
+      throw new AttestationError(`Image ID length is ${report.imageId.length}, expected 16 bytes`);
+    }
+    if (!uint8ArrayEqual(report.imageId, options.imageId)) {
+      throw new AttestationError(`Image ID mismatch: got ${bytesToHex(report.imageId)}, expected ${bytesToHex(options.imageId)}`);
+    }
+  }
+  if (options.familyId) {
+    if (report.familyId.length !== 16) {
+      throw new AttestationError(`Family ID length is ${report.familyId.length}, expected 16 bytes`);
+    }
+    if (!uint8ArrayEqual(report.familyId, options.familyId)) {
+      throw new AttestationError(`Family ID mismatch: got ${bytesToHex(report.familyId)}, expected ${bytesToHex(options.familyId)}`);
+    }
+  }
+  if (options.reportId) {
+    if (report.reportId.length !== 32) {
+      throw new AttestationError(`Report ID length is ${report.reportId.length}, expected 32 bytes`);
+    }
+    if (!uint8ArrayEqual(report.reportId, options.reportId)) {
+      throw new AttestationError(`Report ID mismatch: got ${bytesToHex(report.reportId)}, expected ${bytesToHex(options.reportId)}`);
+    }
+  }
+  if (options.reportIdMa) {
+    if (report.reportIdMa.length !== 32) {
+      throw new AttestationError(`Report ID MA length is ${report.reportIdMa.length}, expected 32 bytes`);
+    }
+    if (!uint8ArrayEqual(report.reportIdMa, options.reportIdMa)) {
+      throw new AttestationError(`Report ID MA mismatch: got ${bytesToHex(report.reportIdMa)}, expected ${bytesToHex(options.reportIdMa)}`);
+    }
+  }
+  if (report.signerInfoParsed.signingKey === ReportSigner.VcekReportSigner) {
+    if (report.signerInfoParsed.maskChipKey && report.chipId.some((b) => b !== 0)) {
+      throw new AttestationError("Invalid attestation report: chip ID masking is enabled but chip ID field is not zeroed");
+    }
+    if (!report.signerInfoParsed.maskChipKey) {
+      chain.validateVcekHwid(report.chipId);
+    }
+  }
+  if (options.platformInfo) {
+    validatePlatformInfo(report.platformInfoParsed, options.platformInfo);
+  }
+  if (options.vmpl !== void 0) {
+    if (!(0 <= report.vmpl && report.vmpl <= 3)) {
+      throw new AttestationError(`VMPL ${report.vmpl} is not in valid range 0-3`);
+    }
+    if (report.vmpl !== options.vmpl) {
+      throw new AttestationError(`VMPL mismatch: got ${report.vmpl}, expected ${options.vmpl}`);
+    }
+  }
+  if (options.permitProvisionalFirmware) {
+    throw new AttestationError("Unsupported option: Provisional firmware validation is not yet implemented");
+  }
+  if (report.committedBuild !== report.currentBuild) {
+    throw new AttestationError(`Firmware version mismatch: Committed build (${report.committedBuild}) does not match current build (${report.currentBuild}). This may indicate provisional firmware`);
+  }
+  if (report.committedMinor !== report.currentMinor) {
+    throw new AttestationError(`Firmware version mismatch: Committed minor version (${report.committedMinor}) does not match current (${report.currentMinor})`);
+  }
+  if (report.committedMajor !== report.currentMajor) {
+    throw new AttestationError(`Firmware version mismatch: Committed major version (${report.committedMajor}) does not match current (${report.currentMajor})`);
+  }
+  if (report.committedTcb !== report.currentTcb) {
+    throw new AttestationError(`Firmware version mismatch: Committed TCB does not match current TCB. This may indicate provisional firmware`);
+  }
+  if (options.requireAuthorKey || options.requireIdBlock) {
+    throw new AttestationError("Unsupported option: ID-block and author key validation is not yet implemented");
+  }
+}
+__name(validateReport, "validateReport");
+function validatePlatformInfo(reportInfo, required) {
+  if (reportInfo.smtEnabled && !required.smtEnabled) {
+    throw new AttestationError("Platform policy violation: SMT (simultaneous multithreading) is enabled but not allowed");
+  }
+  if (!reportInfo.eccEnabled && required.eccEnabled) {
+    throw new AttestationError("Platform policy violation: ECC memory is required but not enabled");
+  }
+  if (!reportInfo.tsmeEnabled && required.tsmeEnabled) {
+    throw new AttestationError("Platform policy violation: TSME (transparent SME) is required but not enabled");
+  }
+  if (!reportInfo.raplDisabled && required.raplDisabled) {
+    throw new AttestationError("Platform policy violation: RAPL (power monitoring) must be disabled but is enabled");
+  }
+  if (!reportInfo.ciphertextHidingDramEnabled && required.ciphertextHidingDramEnabled) {
+    throw new AttestationError("Platform policy violation: DRAM ciphertext hiding is required but not enabled");
+  }
+  if (!reportInfo.aliasCheckComplete && required.aliasCheckComplete) {
+    throw new AttestationError("Platform policy violation: Memory alias check is required but has not completed");
+  }
+  if (!reportInfo.tioEnabled && required.tioEnabled) {
+    throw new AttestationError("Platform policy violation: TIO (trusted I/O) is required but not enabled");
+  }
+}
+__name(validatePlatformInfo, "validatePlatformInfo");
+
+// node_modules/@tinfoilsh/verifier/dist/attestation.js
+async function verifyAttestation2(doc, vcekBase64) {
+  if (doc.format === PredicateType.SevGuestV2) {
+    return verifySevAttestationV2(doc.body, base64ToBytes(vcekBase64));
+  } else {
+    throw new AttestationError(`Unsupported attestation document format: "${doc.format}". Only SEV-SNP Guest V2 format is supported`);
+  }
+}
+__name(verifyAttestation2, "verifyAttestation");
+async function verifySevAttestationV2(attestationDoc, vcekDer) {
+  const report = await verifySevReport(attestationDoc, true, vcekDer);
+  const measurement = {
+    type: PredicateType.SevGuestV2,
+    registers: [bytesToHex(report.measurement)]
+  };
+  const keys = report.reportData;
+  const tlsKeyFp = bytesToHex(keys.slice(0, 32));
+  const hpkePublicKey = bytesToHex(keys.slice(32, 64));
+  return {
+    measurement,
+    tlsPublicKeyFingerprint: tlsKeyFp,
+    hpkePublicKey
+  };
+}
+__name(verifySevAttestationV2, "verifySevAttestationV2");
+async function verifySevReport(attestationDoc, isCompressed, vcekDer) {
+  let attDocBytes;
+  try {
+    attDocBytes = base64ToBytes(attestationDoc);
+  } catch (e) {
+    throw new AttestationError("Failed to decode attestation document: Invalid base64 encoding", { cause: e });
+  }
+  if (isCompressed) {
+    attDocBytes = await decompressGzip(attDocBytes);
+  }
+  let report;
+  try {
+    report = new Report(attDocBytes);
+  } catch (e) {
+    throw new AttestationError("Failed to parse SEV-SNP attestation report", { cause: e });
+  }
+  const chain = await CertificateChain.fromReport(report, vcekDer);
+  let res;
+  try {
+    res = await verifyAttestation(chain, report);
+  } catch (e) {
+    wrapOrThrow(e, AttestationError, "Attestation cryptographic verification failed");
+  }
+  if (!res) {
+    throw new AttestationError("Attestation verification failed: Report signature or certificate chain is invalid");
+  }
+  try {
+    validateReport(report, chain, defaultValidationOptions);
+  } catch (e) {
+    wrapOrThrow(e, AttestationError, "Attestation policy validation failed");
+  }
+  return report;
+}
+__name(verifySevReport, "verifySevReport");
+function base64ToBytes(base64) {
+  const binaryString = atob(base64);
+  const bytes = new Uint8Array(binaryString.length);
+  for (let i = 0; i < binaryString.length; i++) {
+    bytes[i] = binaryString.charCodeAt(i);
+  }
+  return bytes;
+}
+__name(base64ToBytes, "base64ToBytes");
+async function decompressGzip(data) {
+  if (typeof DecompressionStream !== "undefined") {
+    const stream = new Response(data.buffer).body;
+    if (!stream) {
+      throw new Error("Failed to create stream from data");
+    }
+    const decompressedStream = stream.pipeThrough(new DecompressionStream("gzip"));
+    const decompressed = await new Response(decompressedStream).arrayBuffer();
+    return new Uint8Array(decompressed);
+  }
+  const { gunzipSync } = await import("zlib");
+  return new Uint8Array(gunzipSync(data));
+}
+__name(decompressGzip, "decompressGzip");
+
+// node_modules/@tinfoilsh/verifier/dist/bundle.js
+var GITHUB_PROXY = "https://github-proxy.tinfoil.sh";
+var KDS = "https://kds-proxy.tinfoil.sh";
+async function assembleAttestationBundle(enclaveHost, configRepo) {
+  const [attestation, digest, enclaveCert] = await Promise.all([
+    withRetry(async () => {
+      const doc = await fetchJson(`https://${enclaveHost}/.well-known/tinfoil-attestation`);
+      return { format: doc.format, body: doc.body };
+    }),
+    withRetry(async () => {
+      const { tag_name } = await fetchJson(`${GITHUB_PROXY}/repos/${configRepo}/releases/latest`);
+      return (await fetchText(`${GITHUB_PROXY}/${configRepo}/releases/download/${tag_name}/tinfoil.hash`)).trim();
+    }),
+    withRetry(async () => {
+      const data = await fetchJson(`https://${enclaveHost}/.well-known/tinfoil-certificate`);
+      return data.certificate;
+    })
+  ]);
+  const sigstoreBundle = await withRetry(async () => {
+    const data = await fetchJson(`${GITHUB_PROXY}/repos/${configRepo}/attestations/sha256:${digest}`);
+    if (!data.attestations?.[0]?.bundle) {
+      throw new FetchError(`No Sigstore bundle for ${configRepo} at digest ${digest}`);
+    }
+    return data.attestations[0].bundle;
+  });
+  let report;
+  try {
+    report = new Report(await decompressGzip(base64ToBytes(attestation.body)));
+  } catch (e) {
+    wrapOrThrow(e, AttestationError, "Failed to parse attestation report");
+  }
+  const vcek = await withRetry(async () => {
+    const tcb = tcbFromInt(report.reportedTcb);
+    const chip = bytesToHex(report.chipId);
+    const der = await fetchBinary(`${KDS}/vcek/v1/${report.productName}/${chip}?blSPL=${tcb.blSpl}&teeSPL=${tcb.teeSpl}&snpSPL=${tcb.snpSpl}&ucodeSPL=${tcb.ucodeSpl}`);
+    let bin = "";
+    for (let i = 0; i < der.length; i++)
+      bin += String.fromCharCode(der[i]);
+    return btoa(bin);
+  });
+  return {
+    domain: enclaveHost,
+    enclaveAttestationReport: attestation,
+    digest,
+    sigstoreBundle,
+    vcek,
+    enclaveCert
+  };
+}
+__name(assembleAttestationBundle, "assembleAttestationBundle");
+var MAX_RETRIES = 2;
+async function withRetry(fn) {
+  for (let i = 0; i <= MAX_RETRIES; i++) {
+    try {
+      return await fn();
+    } catch (e) {
+      if (i === MAX_RETRIES || !(e instanceof FetchError))
+        throw e;
+    }
+    await new Promise((r) => setTimeout(r, 500 * Math.pow(2, i)));
+  }
+  throw new Error("unreachable");
+}
+__name(withRetry, "withRetry");
+async function fetchOk(url) {
+  let response;
+  try {
+    response = await fetch(url);
+  } catch (e) {
+    throw new FetchError(`Network error: ${url}`, { cause: e });
+  }
+  if (!response.ok) {
+    throw new FetchError(`HTTP ${response.status}: ${url}`);
+  }
+  return response;
+}
+__name(fetchOk, "fetchOk");
+async function fetchJson(url) {
+  try {
+    return await (await fetchOk(url)).json();
+  } catch (e) {
+    wrapOrThrow(e, FetchError, `Invalid response from ${url}`);
+  }
+}
+__name(fetchJson, "fetchJson");
+async function fetchText(url) {
+  try {
+    return await (await fetchOk(url)).text();
+  } catch (e) {
+    wrapOrThrow(e, FetchError, `Invalid response from ${url}`);
+  }
+}
+__name(fetchText, "fetchText");
+async function fetchBinary(url) {
+  try {
+    return new Uint8Array(await (await fetchOk(url)).arrayBuffer());
+  } catch (e) {
+    wrapOrThrow(e, FetchError, `Invalid response from ${url}`);
+  }
+}
+__name(fetchBinary, "fetchBinary");
+
+// node_modules/@tinfoilsh/verifier/dist/sigstore-trusted-root.js
+var sigstore_trusted_root_default = {
+  "mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
+  "tlogs": [
+    {
+      "baseUrl": "https://rekor.sigstore.dev",
+      "hashAlgorithm": "SHA2_256",
+      "publicKey": {
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==",
+        "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+        "validFor": {
+          "start": "2021-01-12T11:53:27Z"
+        }
+      },
+      "logId": {
+        "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
+      }
+    },
+    {
+      "baseUrl": "https://log2025-1.rekor.sigstore.dev",
+      "hashAlgorithm": "SHA2_256",
+      "publicKey": {
+        "rawBytes": "MCowBQYDK2VwAyEAt8rlp1knGwjfbcXAYPYAkn0XiLz1x8O4t0YkEhie244=",
+        "keyDetails": "PKIX_ED25519",
+        "validFor": {
+          "start": "2025-09-23T00:00:00Z"
+        }
+      },
+      "logId": {
+        "keyId": "zxGZFVvd0FEmjR8WrFwMdcAJ9vtaY/QXf44Y1wUeP6A="
+      }
+    }
+  ],
+  "certificateAuthorities": [
+    {
+      "subject": {
+        "organization": "sigstore.dev",
+        "commonName": "sigstore"
+      },
+      "uri": "https://fulcio.sigstore.dev",
+      "certChain": {
+        "certificates": [
+          {
+            "rawBytes": "MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="
+          }
+        ]
+      },
+      "validFor": {
+        "start": "2021-03-07T03:20:29Z",
+        "end": "2022-12-31T23:59:59.999Z"
+      }
+    },
+    {
+      "subject": {
+        "organization": "sigstore.dev",
+        "commonName": "sigstore"
+      },
+      "uri": "https://fulcio.sigstore.dev",
+      "certChain": {
+        "certificates": [
+          {
+            "rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
+          },
+          {
+            "rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
+          }
+        ]
+      },
+      "validFor": {
+        "start": "2022-04-13T20:06:15Z"
+      }
+    }
+  ],
+  "ctlogs": [
+    {
+      "baseUrl": "https://ctfe.sigstore.dev/test",
+      "hashAlgorithm": "SHA2_256",
+      "publicKey": {
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbfwR+RJudXscgRBRpKX1XFDy3PyudDxz/SfnRi1fT8ekpfBd2O1uoz7jr3Z8nKzxA69EUQ+eFCFI3zeubPWU7w==",
+        "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+        "validFor": {
+          "start": "2021-03-14T00:00:00Z",
+          "end": "2022-10-31T23:59:59.999Z"
+        }
+      },
+      "logId": {
+        "keyId": "CGCS8ChS/2hF0dFrJ4ScRWcYrBY9wzjSbea8IgY2b3I="
+      }
+    },
+    {
+      "baseUrl": "https://ctfe.sigstore.dev/2022",
+      "hashAlgorithm": "SHA2_256",
+      "publicKey": {
+        "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==",
+        "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+        "validFor": {
+          "start": "2022-10-20T00:00:00Z"
+        }
+      },
+      "logId": {
+        "keyId": "3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4="
+      }
+    }
+  ],
+  "timestampAuthorities": [
+    {
+      "subject": {
+        "organization": "sigstore.dev",
+        "commonName": "sigstore-tsa-selfsigned"
+      },
+      "uri": "https://timestamp.sigstore.dev/api/v1/timestamp",
+      "certChain": {
+        "certificates": [
+          {
+            "rawBytes": "MIICEDCCAZagAwIBAgIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4ra2Z8hKNig2T9kFjCAToGG30jky+WQv3BzL+mKvh1SKNR/UwuwsfNCg4sryoYAd8E6isovVA3M4aoNdm9QDi50Z8nTEyvqgfDPtTIwXItfiW/AFf1V7uwkbkAoj0xxco2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFIn9eUOHz9BlRsMCRscsc1t9tOsDMB8GA1UdIwQYMBaAFJjsAe9/u1H/1JUeb4qImFMHic6/MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2gAMGUCMDtpsV/6KaO0qyF/UMsX2aSUXKQFdoGTptQGc0ftq1csulHPGG6dsmyMNd3JB+G3EQIxAOajvBcjpJmKb4Nv+2Taoj8Uc5+b6ih6FXCCKraSqupe07zqswMcXJTe1cExvHvvlw=="
+          },
+          {
+            "rawBytes": "MIIB9zCCAXygAwIBAgIUV7f0GLDOoEzIh8LXSW80OJiUp14wCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQUQNtfRT/ou3YATa6wB/kKTe70cfJwyRIBovMnt8RcJph/COE82uyS6FmppLLL1VBPGcPfpQPYJNXzWwi8icwhKQ6W/Qe2h3oebBb2FHpwNJDqo+TMaC/tdfkv/ElJB72jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSY7AHvf7tR/9SVHm+KiJhTB4nOvzAKBggqhkjOPQQDAwNpADBmAjEAwGEGrfGZR1cen1R8/DTVMI943LssZmJRtDp/i7SfGHmGRP6gRbuj9vOK3b67Z0QQAjEAuT2H673LQEaHTcyQSZrkp4mX7WwkmF+sVbkYY5mXN+RMH13KUEHHOqASaemYWK/E"
+          }
+        ]
+      },
+      "validFor": {
+        "start": "2025-07-04T00:00:00Z"
+      }
+    }
+  ]
+};
+
+// node_modules/@tinfoilsh/verifier/dist/sigstore.js
+var GitHubWorkflowRefPattern = class {
+  static {
+    __name(this, "GitHubWorkflowRefPattern");
+  }
+  constructor(pattern) {
+    this.pattern = typeof pattern === "string" ? new RegExp(pattern) : pattern;
+  }
+  verify(cert) {
+    const ext = cert.extGitHubWorkflowRef;
+    if (!ext) {
+      throw new AttestationError("Sigstore certificate verification failed: Missing GitHub workflow reference extension");
+    }
+    if (!this.pattern.test(ext.workflowRef)) {
+      throw new AttestationError(`Sigstore certificate verification failed: Workflow reference "${ext.workflowRef}" does not match expected pattern (must be a tagged release)`);
+    }
+  }
+};
+async function verifySigstoreBundle(bundleJson, digest, repo) {
+  try {
+    const { SigstoreVerifier, GITHUB_OIDC_ISSUER, AllOf, OIDCIssuer, GitHubWorkflowRepository } = await import("./c-F75VRKY4.mjs");
+    const verifier = new SigstoreVerifier();
+    await verifier.loadSigstoreRoot(sigstore_trusted_root_default);
+    const bundle = bundleJson;
+    if (bundle?.verificationMaterial?.x509CertificateChain) {
+      throw new AttestationError("Legacy x509CertificateChain bundle format is not supported; only the v0.3 single-certificate format is accepted");
+    }
+    const policy = new AllOf([
+      new OIDCIssuer(GITHUB_OIDC_ISSUER),
+      new GitHubWorkflowRepository(repo),
+      new GitHubWorkflowRefPattern(/^refs\/tags\//)
+    ]);
+    const { payloadType, payload: payloadBytes } = await verifier.verifyDsse(bundle, policy);
+    const payload = JSON.parse(new TextDecoder().decode(payloadBytes));
+    if (payloadType !== "application/vnd.in-toto+json") {
+      throw new AttestationError(`Unsupported Sigstore payload type: "${payloadType}". Only in-toto statements (application/vnd.in-toto+json) are supported`);
+    }
+    {
+      const allowed = /* @__PURE__ */ new Set(["_type", "subject", "predicateType", "predicate"]);
+      const extra = Object.keys(payload).filter((k) => !allowed.has(k));
+      if (extra.length > 0) {
+        throw new AttestationError(`In-toto statement has unknown top-level field(s): ${extra.sort().join(", ")}`);
+      }
+    }
+    const predicateType = payload.predicateType;
+    const predicateFields = payload.predicate;
+    if (digest !== payload.subject[0].digest.sha256) {
+      throw new AttestationError(`Release digest mismatch: The release digest from GitHub (${digest}) does not match the digest in the sigstore bundle (${payload.subject[0].digest.sha256})`);
+    }
+    let registers;
+    if (!predicateFields) {
+      throw new AttestationError("Invalid Sigstore bundle: Payload is missing the predicate field containing measurements");
+    }
+    if (predicateType === PredicateType.SnpTdxMultiplatformV1) {
+      if (!predicateFields.snp_measurement) {
+        throw new AttestationError("Invalid Sigstore bundle: SNP/TDX multiplatform predicate is missing the snp_measurement field");
+      }
+      registers = [predicateFields.snp_measurement];
+    } else {
+      throw new AttestationError(`Unsupported in-toto predicate type: "${predicateType}". Only SNP/TDX multiplatform V1 is supported`);
+    }
+    return {
+      type: predicateType,
+      registers
+    };
+  } catch (e) {
+    wrapOrThrow(e, AttestationError, "Sigstore code bundle verification failed");
+  }
+}
+__name(verifySigstoreBundle, "verifySigstoreBundle");
+
+// node_modules/@tinfoilsh/verifier/dist/dcode.js
+var B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Decode(input) {
+  const s = input.toUpperCase().replace(/=+$/, "");
+  if (!s)
+    return new Uint8Array(0);
+  const out = new Uint8Array(Math.floor(s.length * 5 / 8));
+  let bits = 0, val = 0, idx = 0;
+  for (const c of s) {
+    const i = B32.indexOf(c);
+    if (i < 0)
+      throw new AttestationError(`Invalid certificate data: Unexpected character "${c}" in base32-encoded field`);
+    val = val << 5 | i;
+    if ((bits += 5) >= 8)
+      out[idx++] = val >> (bits -= 8) & 255;
+  }
+  return out;
+}
+__name(base32Decode, "base32Decode");
+function decodeDomains(domains, prefix) {
+  const pattern = `.${prefix}.`;
+  const chunks = domains.filter((d) => d.includes(pattern)).sort((a, b) => +a.slice(0, 2) - +b.slice(0, 2)).map((d) => d.split(".")[0].slice(2)).join("");
+  if (!chunks)
+    throw new AttestationError(`Invalid certificate: Missing expected DNS names with prefix "${prefix}"`);
+  return base32Decode(chunks);
+}
+__name(decodeDomains, "decodeDomains");
+var bytesToHex2 = /* @__PURE__ */ __name((b) => [...b].map((x) => x.toString(16).padStart(2, "0")).join(""), "bytesToHex");
+
+// node_modules/@tinfoilsh/verifier/dist/cert-verify.js
+function extractSANs(cert) {
+  const sanExtension = cert.extension("2.5.29.17");
+  if (!sanExtension) {
+    return [];
+  }
+  const sans = [];
+  const asn1 = ASN1Obj.parseBuffer(sanExtension.value);
+  for (const generalName of asn1.subs) {
+    if (generalName.tag.number === 2 && !generalName.tag.constructed) {
+      sans.push(new TextDecoder().decode(generalName.value));
+    }
+  }
+  return sans;
+}
+__name(extractSANs, "extractSANs");
+function getParentDomain(domain) {
+  const parts = domain.split(".");
+  if (parts.length <= 2) {
+    return domain;
+  }
+  return parts.slice(1).join(".");
+}
+__name(getParentDomain, "getParentDomain");
+function domainMatchesSans(sans, expectedDomain) {
+  const parentDomain = getParentDomain(expectedDomain);
+  for (const san of sans) {
+    if (san === expectedDomain) {
+      return true;
+    }
+    if (san.startsWith("*.") && san.substring(2) === parentDomain && expectedDomain !== parentDomain) {
+      return true;
+    }
+  }
+  return false;
+}
+__name(domainMatchesSans, "domainMatchesSans");
+async function verifyCertificate(certPem, expectedDomain, attestationDoc, expectedHpkeKey) {
+  let cert;
+  try {
+    cert = X509Certificate.parse(certPem);
+  } catch (error) {
+    throw new AttestationError(`Failed to parse enclave TLS certificate: ${error.message}`, { cause: error });
+  }
+  const sans = extractSANs(cert);
+  if (sans.length === 0) {
+    throw new AttestationError("Invalid enclave certificate: No Subject Alternative Names found");
+  }
+  if (!domainMatchesSans(sans, expectedDomain)) {
+    throw new AttestationError(`Certificate domain mismatch: Certificate is not valid for "${expectedDomain}"`);
+  }
+  const hpkeSans = sans.filter((s) => s.includes(".hpke."));
+  if (hpkeSans.length === 0) {
+    throw new AttestationError("Invalid enclave certificate: No HPKE key embedded in Subject Alternative Names");
+  }
+  let hpkeKeyBytes;
+  try {
+    hpkeKeyBytes = decodeDomains(hpkeSans, "hpke");
+  } catch (error) {
+    throw new AttestationError(`Failed to extract HPKE key from certificate: ${error.message}`, { cause: error });
+  }
+  const hpkePublicKey = bytesToHex2(hpkeKeyBytes);
+  if (hpkePublicKey !== expectedHpkeKey) {
+    throw new AttestationError("HPKE key mismatch: The encryption key in the certificate does not match the attested key");
+  }
+  const hattSans = sans.filter((s) => s.includes(".hatt."));
+  if (hattSans.length === 0) {
+    throw new AttestationError("Invalid enclave certificate: No attestation hash embedded in Subject Alternative Names");
+  }
+  let hashBytes;
+  try {
+    hashBytes = decodeDomains(hattSans, "hatt");
+  } catch (error) {
+    throw new AttestationError(`Failed to extract attestation hash from certificate: ${error.message}`, { cause: error });
+  }
+  const certAttestationHash = new TextDecoder().decode(hashBytes);
+  const computedHash = await hashAttestationDocument(attestationDoc);
+  if (certAttestationHash !== computedHash) {
+    throw new AttestationError("Attestation hash mismatch: The hash in the certificate does not match the attestation document");
+  }
+  return {
+    hpkePublicKey,
+    attestationHash: computedHash,
+    dnsNames: sans
+  };
+}
+__name(verifyCertificate, "verifyCertificate");
+
+// node_modules/@tinfoilsh/verifier/dist/client.js
+var Verifier = class {
+  static {
+    __name(this, "Verifier");
+  }
+  constructor(options) {
+    if (!options.configRepo) {
+      throw new ConfigurationError("configRepo is required for Verifier");
+    }
+    this.serverURL = options.serverURL;
+    this.configRepo = options.configRepo;
+  }
+  async verify() {
+    if (!this.serverURL) {
+      throw new ConfigurationError("serverURL is required for verify(). Use verifyBundle() with an attestation bundle instead.");
+    }
+    const domain = new URL(this.serverURL).hostname;
+    const bundle = await assembleAttestationBundle(domain, this.configRepo);
+    return this.verifyBundle(bundle);
+  }
+  async verifyBundle(bundle) {
+    const { enclaveAttestationReport: attestationDoc, vcek, digest, sigstoreBundle, domain, enclaveCert } = bundle;
+    const steps = {
+      fetchDigest: { status: "success" },
+      // Already fetched by caller
+      verifyCode: { status: "pending" },
+      verifyEnclave: { status: "pending" },
+      compareMeasurements: { status: "pending" },
+      verifyCertificate: { status: "pending" }
+    };
+    try {
+      let amdVerification;
+      try {
+        amdVerification = await verifyAttestation2(attestationDoc, vcek);
+        steps.verifyEnclave = { status: "success" };
+      } catch (error) {
+        steps.verifyEnclave = { status: "failed", error: error.message };
+        this.saveFailedVerificationDocument(steps, domain);
+        throw error;
+      }
+      let codeMeasurements;
+      try {
+        codeMeasurements = await verifySigstoreBundle(sigstoreBundle, digest, this.configRepo);
+        steps.verifyCode = { status: "success" };
+      } catch (error) {
+        steps.verifyCode = { status: "failed", error: error.message };
+        this.saveFailedVerificationDocument(steps, domain);
+        throw error;
+      }
+      try {
+        compareMeasurements(codeMeasurements, amdVerification.measurement);
+        steps.compareMeasurements = { status: "success" };
+      } catch (error) {
+        steps.compareMeasurements = { status: "failed", error: error.message };
+        this.saveFailedVerificationDocument(steps, domain);
+        throw error;
+      }
+      try {
+        await verifyCertificate(enclaveCert, domain, attestationDoc, amdVerification.hpkePublicKey || "");
+        steps.verifyCertificate = { status: "success" };
+      } catch (error) {
+        steps.verifyCertificate = { status: "failed", error: error.message };
+        this.saveFailedVerificationDocument(steps, domain);
+        throw error;
+      }
+      this.verificationDocument = {
+        configRepo: this.configRepo,
+        enclaveHost: domain,
+        releaseDigest: digest,
+        codeMeasurement: codeMeasurements,
+        enclaveMeasurement: amdVerification,
+        tlsPublicKey: amdVerification.tlsPublicKeyFingerprint || "",
+        hpkePublicKey: amdVerification.hpkePublicKey || "",
+        codeFingerprint: await measurementFingerprint(codeMeasurements),
+        enclaveFingerprint: await measurementFingerprint(amdVerification.measurement),
+        selectedRouterEndpoint: domain,
+        securityVerified: true,
+        steps
+      };
+      return amdVerification;
+    } catch (error) {
+      if (!this.verificationDocument) {
+        this.saveFailedVerificationDocument(steps, domain);
+      }
+      throw error;
+    }
+  }
+  saveFailedVerificationDocument(steps, domain) {
+    this.verificationDocument = {
+      configRepo: this.configRepo,
+      enclaveHost: domain,
+      releaseDigest: "",
+      codeMeasurement: { type: "", registers: [] },
+      enclaveMeasurement: { measurement: { type: "", registers: [] } },
+      tlsPublicKey: "",
+      hpkePublicKey: "",
+      codeFingerprint: "",
+      enclaveFingerprint: "",
+      selectedRouterEndpoint: domain,
+      securityVerified: false,
+      steps
+    };
+  }
+  getVerificationDocument() {
+    return this.verificationDocument;
+  }
+};
+
+// node_modules/tinfoil/dist/env.js
+function isBun() {
+  return typeof process !== "undefined" && !!process.versions && !!process.versions.bun;
+}
+__name(isBun, "isBun");
+function isRealBrowser() {
+  if (typeof process !== "undefined" && process.versions && process.versions.node) {
+    return false;
+  }
+  if (isBun()) {
+    return false;
+  }
+  if (typeof globalThis.Deno !== "undefined") {
+    return false;
+  }
+  if (typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers") {
+    return false;
+  }
+  if (typeof caches !== "undefined" && caches.default !== void 0) {
+    return false;
+  }
+  if (typeof window !== "undefined" && typeof window.document !== "undefined") {
+    if (typeof navigator !== "undefined" && navigator.userAgent) {
+      return true;
+    }
+  }
+  return false;
+}
+__name(isRealBrowser, "isRealBrowser");
+
+export {
+  ConfigurationError,
+  FetchError,
+  AttestationError,
+  Verifier,
+  isBun,
+  isRealBrowser
+};