secretvm-verify 0.1.0

package/dist/cli.js

@@ -0,0 +1,318 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { checkSecretVm, checkCpuAttestation, checkTdxCpuAttestation, checkSevCpuAttestation, checkNvidiaGpuAttestation, detectCpuQuoteType, resolveSecretVmVersion, resolveAmdSevVersion, verifyWorkload, formatWorkloadResult, } from "./index.js";
+import { verifyAgent, checkAgent } from "./agent.js";
+const args = process.argv.slice(2);
+function getFlag(name) {
+    return args.includes(name);
+}
+function getFlagValue(name) {
+    const idx = args.indexOf(name);
+    if (idx >= 0 && idx + 1 < args.length)
+        return args[idx + 1];
+    return undefined;
+}
+function getPositional() {
+    return args.find((a) => !a.startsWith("--") && a !== "-v" && a !== "-rv" && a !== "-vw");
+}
+const raw = getFlag("--raw");
+const verbose = getFlag("--verbose") || getFlag("-v");
+const product = getFlagValue("--product") ?? "";
+const USAGE = `Usage: secretvm-verify <command> <value> [--product NAME] [--raw] [--verbose|-v]
+
+Commands:
+  --secretvm <url>                  Verify a Secret VM (CPU + GPU + TLS binding)
+  --cpu <file>                      Verify a CPU quote (auto-detect TDX vs SEV-SNP)
+  --tdx <file>                      Verify an Intel TDX quote
+  --sev <file>                      Verify an AMD SEV-SNP report
+  --gpu <file>                      Verify an NVIDIA GPU attestation
+  --resolve-version, -rv <file>     Resolve SecretVM version from TDX or AMD SEV-SNP quote
+  --verify-workload, -vw <file> --compose <file>
+                                    Verify TDX or AMD SEV-SNP workload against a docker-compose.yaml
+  --check-agent <id> --chain <name>
+                                    Resolve and verify an ERC-8004 agent on-chain
+  --agent <file>                    Verify an ERC-8004 agent from a metadata JSON file
+
+Options:
+  --chain NAME         Chain name for --check-agent (e.g. base, ethereum, arbitrum)
+  --product NAME       AMD product name (Genoa, Milan, Turin)
+  --raw                Output raw JSON result
+  --verbose, -v        Print all attestation report fields
+
+Examples:
+  secretvm-verify --secretvm yellow-krill.vm.scrtlabs.com
+  secretvm-verify --tdx cpu_quote.txt
+  secretvm-verify --sev amd_cpu_quote.txt --product Genoa
+  secretvm-verify --gpu gpu_attest.txt
+  secretvm-verify --cpu cpu_quote.txt --raw
+  secretvm-verify --resolve-version cpu_quote.txt
+  secretvm-verify --verify-workload cpu_quote.txt --compose docker-compose.yaml`;
+// Determine which command to run
+let result;
+if (getFlag("--secretvm")) {
+    const url = getFlagValue("--secretvm") ?? getPositional();
+    if (!url) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    if (!raw)
+        console.log(`Checking attestation for ${url} ...\n`);
+    result = await checkSecretVm(url, product);
+}
+else if (getFlag("--cpu")) {
+    const file = getFlagValue("--cpu") ?? getPositional();
+    if (!file) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    if (!raw)
+        console.log(`Verifying CPU quote from ${file} ...\n`);
+    result = await checkCpuAttestation(readFileSync(file, "utf8"), product);
+}
+else if (getFlag("--tdx")) {
+    const file = getFlagValue("--tdx") ?? getPositional();
+    if (!file) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    if (!raw)
+        console.log(`Verifying TDX quote from ${file} ...\n`);
+    result = await checkTdxCpuAttestation(readFileSync(file, "utf8"));
+}
+else if (getFlag("--sev")) {
+    const file = getFlagValue("--sev") ?? getPositional();
+    if (!file) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    if (!raw)
+        console.log(`Verifying AMD SEV-SNP report from ${file} ...\n`);
+    result = await checkSevCpuAttestation(readFileSync(file, "utf8"), product);
+}
+else if (getFlag("--gpu")) {
+    const file = getFlagValue("--gpu") ?? getPositional();
+    if (!file) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    if (!raw)
+        console.log(`Verifying NVIDIA GPU attestation from ${file} ...\n`);
+    result = await checkNvidiaGpuAttestation(readFileSync(file, "utf8"));
+}
+else if (getFlag("--resolve-version") || getFlag("-rv")) {
+    const file = getFlagValue("--resolve-version") ?? getFlagValue("-rv") ?? getPositional();
+    if (!file) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    const quoteData = readFileSync(file, "utf8");
+    const quoteType = detectCpuQuoteType(quoteData);
+    if (quoteType === "SEV-SNP") {
+        // Step 1: cryptographic quote verification
+        const quoteResult = await checkSevCpuAttestation(quoteData, product);
+        // Step 2: registry lookup
+        const version = resolveAmdSevVersion(quoteData);
+        if (raw) {
+            console.log(JSON.stringify({ quote: quoteResult, version }, null, 2));
+            process.exit(quoteResult.valid && !!version ? 0 : 1);
+        }
+        if (!quoteResult.valid) {
+            console.log("🚫 Quote cryptographic verification failed");
+            process.exit(1);
+        }
+        if (version) {
+            console.log(`✅ Authentic SecretVM confirmed`);
+            console.log(`Template: ${version.template_name}`);
+            console.log(`VM type:  ${version.vm_type}`);
+            console.log(`Version:  ${version.artifacts_ver}`);
+        }
+        else {
+            console.log("🚫 SecretVM artifacts not found in registry (unknown version)");
+        }
+        process.exit(quoteResult.valid && !!version ? 0 : 1);
+    }
+    else {
+        const quoteResult = await checkTdxCpuAttestation(quoteData);
+        const version = resolveSecretVmVersion(quoteData);
+        if (raw) {
+            console.log(JSON.stringify({ quote: quoteResult, version }, null, 2));
+            process.exit(quoteResult.valid && !!version ? 0 : 1);
+        }
+        if (!quoteResult.valid) {
+            console.log("🚫 Attestation doesn't belong to an authentic SecretVM");
+            process.exit(1);
+        }
+        if (version) {
+            console.log(`Template: ${version.template_name}`);
+            console.log(`Version:  ${version.artifacts_ver}`);
+        }
+        else {
+            console.log("No matching SecretVM version found in registry.");
+        }
+        process.exit(!!version ? 0 : 1);
+    }
+}
+else if (getFlag("--verify-workload") || getFlag("-vw")) {
+    const quoteFile = getFlagValue("--verify-workload") ?? getFlagValue("-vw") ?? getPositional();
+    const composeFile = getFlagValue("--compose");
+    if (!quoteFile || !composeFile) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    const quoteData = readFileSync(quoteFile, "utf8");
+    const composeData = readFileSync(composeFile, "utf8");
+    const quoteType = detectCpuQuoteType(quoteData);
+    if (quoteType === "SEV-SNP") {
+        // Step 1: cryptographic quote verification
+        const quoteResult = await checkSevCpuAttestation(quoteData, product);
+        if (raw) {
+            const workloadResult = verifyWorkload(quoteData, composeData);
+            console.log(JSON.stringify({ quote: quoteResult, workload: workloadResult }, null, 2));
+            process.exit(quoteResult.valid && workloadResult.status === "authentic_match" ? 0 : 1);
+        }
+        if (!quoteResult.valid) {
+            console.log("🚫 Quote cryptographic verification failed");
+            process.exit(1);
+        }
+        // Step 2: registry lookup — confirms this is a known SecretVM
+        const version = resolveAmdSevVersion(quoteData);
+        if (!version) {
+            console.log("🚫 SecretVM artifacts not found in registry (unknown version)");
+            process.exit(1);
+        }
+        console.log(`✅ Authentic SecretVM confirmed: ${version.vm_type}/${version.template_name} ${version.artifacts_ver}`);
+        // Step 3: workload (compose hash) verification
+        const workloadResult = verifyWorkload(quoteData, composeData);
+        if (workloadResult.status === "authentic_match") {
+            console.log("✅ Confirmed that the VM is running the specified docker-compose.yaml");
+        }
+        else {
+            console.log("🚫 Attestation does not match the specified docker-compose.yaml");
+        }
+        process.exit(workloadResult.status === "authentic_match" ? 0 : 1);
+    }
+    else {
+        const quoteResult = await checkTdxCpuAttestation(quoteData);
+        if (raw) {
+            const workloadResult = verifyWorkload(quoteData, composeData);
+            console.log(JSON.stringify({ quote: quoteResult, workload: workloadResult }, null, 2));
+            process.exit(quoteResult.valid && workloadResult.status === "authentic_match" ? 0 : 1);
+        }
+        if (!quoteResult.valid) {
+            console.log("🚫 Attestation doesn't belong to an authentic SecretVM");
+            process.exit(1);
+        }
+        const workloadResult = verifyWorkload(quoteData, composeData);
+        console.log(formatWorkloadResult(workloadResult));
+        process.exit(workloadResult.status === "authentic_match" ? 0 : 1);
+    }
+}
+else if (getFlag("--check-agent")) {
+    const id = getFlagValue("--check-agent");
+    const chain = getFlagValue("--chain");
+    if (!id || !chain) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    if (!raw)
+        console.log(`Resolving and verifying agent ${id} on ${chain} ...\n`);
+    result = await checkAgent(Number(id), chain);
+}
+else if (getFlag("--agent")) {
+    const file = getFlagValue("--agent") ?? getPositional();
+    if (!file) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    const metadata = JSON.parse(readFileSync(file, "utf8"));
+    if (!raw)
+        console.log(`Verifying agent "${metadata.name}" ...\n`);
+    result = await verifyAgent(metadata);
+}
+else {
+    // Legacy: bare URL defaults to --secretvm
+    const url = getPositional();
+    if (!url) {
+        console.log(USAGE);
+        process.exit(1);
+    }
+    if (!raw)
+        console.log(`Checking attestation for ${url} ...\n`);
+    result = await checkSecretVm(url, product);
+}
+// Output
+if (raw) {
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.valid ? 0 : 1);
+}
+console.log("Checks:");
+for (const [name, passed] of Object.entries(result.checks)) {
+    if (name === "gpu_quote_fetched" && !passed) {
+        console.log(`  ${"gpu:".padEnd(35)} GPU not present`);
+        continue;
+    }
+    const status = passed ? "PASS" : "FAIL";
+    console.log(`  ${(name + ":").padEnd(35)} ${status}`);
+}
+const report = result.report;
+// Secret VM specific fields
+if (report.cpu_type)
+    console.log(`\nCPU type: ${report.cpu_type}`);
+if (report.tls_fingerprint)
+    console.log(`TLS fingerprint: ${report.tls_fingerprint}`);
+// CPU fields (direct or nested under cpu)
+const cpu = report.cpu ?? report;
+if (cpu.report_data)
+    console.log(`Report data: ${cpu.report_data}`);
+if (cpu.measurement)
+    console.log(`Measurement: ${cpu.measurement}`);
+if (cpu.mr_td)
+    console.log(`MR TD: ${cpu.mr_td}`);
+if (cpu.tcb_status)
+    console.log(`TCB status: ${cpu.tcb_status}`);
+if (cpu.product)
+    console.log(`AMD product: ${cpu.product}`);
+if (cpu.chip_id)
+    console.log(`Chip ID: ${cpu.chip_id}`);
+if (cpu.fmspc)
+    console.log(`FMSPC: ${cpu.fmspc}`);
+// GPU fields (direct or nested under gpu)
+const gpu = report.gpu ?? report;
+if (gpu.overall_result !== undefined)
+    console.log(`\nGPU overall result: ${gpu.overall_result}`);
+if (gpu.gpus) {
+    for (const [gpuId, info] of Object.entries(gpu.gpus)) {
+        console.log(`\n${gpuId}:`);
+        console.log(`  Model: ${info.model}`);
+        console.log(`  Driver: ${info.driver_version}`);
+        console.log(`  Secure boot: ${info.secure_boot}`);
+    }
+}
+// Verbose: print all report fields
+if (verbose) {
+    console.log("\nAll attestation report fields:");
+    for (const [key, value] of Object.entries(report)) {
+        if (typeof value === "object" && value !== null) {
+            console.log(`  ${key}:`);
+            for (const [subKey, subValue] of Object.entries(value)) {
+                if (typeof subValue === "object" && subValue !== null) {
+                    console.log(`    ${subKey}: ${JSON.stringify(subValue)}`);
+                }
+                else {
+                    console.log(`    ${subKey}: ${subValue}`);
+                }
+            }
+        }
+        else {
+            console.log(`  ${key}: ${value}`);
+        }
+    }
+}
+if (result.errors.length > 0) {
+    console.log("\nErrors:");
+    for (const err of result.errors)
+        console.log(`  - ${err}`);
+}
+console.log(`\n${result.valid ? "PASSED" : "FAILED"}`);
+process.exit(result.valid ? 0 : 1);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAgB,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;AAEhD,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;gFA4BkE,CAAC;AAEjF,iCAAiC;AACjC,IAAI,MAAyB,CAAC;AAE9B,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,aAAa,EAAE,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,QAAQ,CAAC,CAAC;IAC/D,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;KAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,QAAQ,CAAC,CAAC;IAChE,MAAM,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;KAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,QAAQ,CAAC,CAAC;IAChE,MAAM,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;KAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC,IAAI,QAAQ,CAAC,CAAC;IACzE,MAAM,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7E,CAAC;KAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC,IAAI,QAAQ,CAAC,CAAC;IAC7E,MAAM,GAAG,MAAM,yBAAyB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;KAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;IACzF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,2CAA2C;QAC3C,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrE,0BAA0B;QAC1B,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;KAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,YAAY,CAAC,mBAAmB,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;IAC9F,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,2CAA2C;QAC3C,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,cAAc,GAAG,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,cAAc,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,8DAA8D;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACpH,+CAA+C;QAC/C,MAAM,cAAc,GAAG,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC9D,IAAI,cAAc,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,cAAc,GAAG,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,cAAc,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,cAAc,GAAG,cAAc,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;KAAM,IAAI,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC;IAC/E,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;KAAM,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,QAAQ,CAAC,IAAI,SAAS,CAAC,CAAC;IAClE,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;KAAM,CAAC;IACN,0CAA0C;IAC1C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,QAAQ,CAAC,CAAC;IAC/D,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS;AACT,IAAI,GAAG,EAAE,CAAC;IACR,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACvB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,IAAI,IAAI,KAAK,mBAAmB,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACtD,SAAS;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAE7B,4BAA4B;AAC5B,IAAI,MAAM,CAAC,QAAQ;IAAE,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AACnE,IAAI,MAAM,CAAC,eAAe;IAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtF,0CAA0C;AAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;AACjC,IAAI,GAAG,CAAC,WAAW;IAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACpE,IAAI,GAAG,CAAC,WAAW;IAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACpE,IAAI,GAAG,CAAC,KAAK;IAAE,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;AAClD,IAAI,GAAG,CAAC,UAAU;IAAE,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;AACjE,IAAI,GAAG,CAAC,OAAO;IAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5D,IAAI,GAAG,CAAC,OAAO;IAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;AACxD,IAAI,GAAG,CAAC,KAAK;IAAE,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;AAElD,0CAA0C;AAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;AACjC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;IAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;AACjG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,IAAI,OAAO,EAAE,CAAC;IACZ,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtD,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5D,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACvD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/cpu.d.ts

@@ -0,0 +1,9 @@
+import { AttestationResult } from "./types.js";
+/**
+ * Detect whether the quote is Intel TDX (hex) or AMD SEV-SNP (base64).
+ */
+export declare function detectCpuQuoteType(data: string): "TDX" | "SEV-SNP" | "unknown";
+/**
+ * Verify a CPU attestation quote, auto-detecting Intel TDX vs AMD SEV-SNP.
+ */
+export declare function checkCpuAttestation(data: string, product?: string): Promise<AttestationResult>;

package/dist/cpu.js

@@ -0,0 +1,54 @@
+import { makeResult } from "./types.js";
+import { checkTdxCpuAttestation } from "./tdx.js";
+import { checkSevCpuAttestation } from "./amd.js";
+/**
+ * Detect whether the quote is Intel TDX (hex) or AMD SEV-SNP (base64).
+ */
+export function detectCpuQuoteType(data) {
+    const text = data.trim();
+    // Try hex — TDX quotes: version=4, tee_type=0x81
+    try {
+        const buf = Buffer.from(text, "hex");
+        if (buf.length >= 8) {
+            const version = buf.readUInt16LE(0);
+            const teeType = buf.readUInt32LE(4);
+            if (version === 4 && teeType === 0x81)
+                return "TDX";
+        }
+    }
+    catch {
+        // not hex
+    }
+    // Try base64 — AMD SEV-SNP: version >= 2, sig_algo == 1
+    try {
+        const buf = Buffer.from(text, "base64");
+        if (buf.length >= 0x38) {
+            const version = buf.readUInt32LE(0);
+            const sigAlgo = buf.readUInt32LE(0x034);
+            if (version >= 2 && version <= 4 && sigAlgo === 1)
+                return "SEV-SNP";
+        }
+    }
+    catch {
+        // not base64
+    }
+    return "unknown";
+}
+/**
+ * Verify a CPU attestation quote, auto-detecting Intel TDX vs AMD SEV-SNP.
+ */
+export async function checkCpuAttestation(data, product = "") {
+    const quoteType = detectCpuQuoteType(data);
+    if (quoteType === "TDX") {
+        return checkTdxCpuAttestation(data);
+    }
+    if (quoteType === "SEV-SNP") {
+        return checkSevCpuAttestation(data, product);
+    }
+    return makeResult("unknown", {
+        errors: [
+            "Could not detect quote type (expected hex-encoded TDX or base64-encoded SEV-SNP)",
+        ],
+    });
+}
+//# sourceMappingURL=cpu.js.map

package/dist/cpu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpu.js","sourceRoot":"","sources":["../src/cpu.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAElD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAEzB,iDAAiD;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,UAAU;IACZ,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;QACtE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,aAAa;IACf,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,OAAO,GAAG,EAAE;IAEZ,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,sBAAsB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,UAAU,CAAC,SAAS,EAAE;QAC3B,MAAM,EAAE;YACN,kFAAkF;SACnF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export type { AttestationResult } from "./types.js";
+export { checkTdxCpuAttestation, parseTdxQuoteFields } from "./tdx.js";
+export type { TdxQuoteFields } from "./tdx.js";
+export { checkSevCpuAttestation } from "./amd.js";
+export { checkNvidiaGpuAttestation } from "./nvidia.js";
+export { checkCpuAttestation, detectCpuQuoteType } from "./cpu.js";
+export { checkSecretVm } from "./vm.js";
+export { resolveSecretVmVersion, resolveAmdSevVersion, verifyTdxWorkload, verifySevWorkload, verifyWorkload, formatWorkloadResult, } from "./workload.js";
+export type { WorkloadResult, WorkloadStatus } from "./workload.js";
+export { loadTdxRegistry, findMatchingArtifacts, pickNewestVersion, resolveVersion, } from "./artifacts.js";
+export type { TdxArtifactEntry } from "./artifacts.js";
+export { resolveAgent, verifyAgent, checkAgent } from "./agent.js";
+export type { AgentMetadata, AgentService } from "./types.js";
+export { getChainConfig, getRpcUrl, listChains } from "./chains.js";
+export type { ChainConfig } from "./chains.js";

package/dist/index.js

@@ -0,0 +1,10 @@
+export { checkTdxCpuAttestation, parseTdxQuoteFields } from "./tdx.js";
+export { checkSevCpuAttestation } from "./amd.js";
+export { checkNvidiaGpuAttestation } from "./nvidia.js";
+export { checkCpuAttestation, detectCpuQuoteType } from "./cpu.js";
+export { checkSecretVm } from "./vm.js";
+export { resolveSecretVmVersion, resolveAmdSevVersion, verifyTdxWorkload, verifySevWorkload, verifyWorkload, formatWorkloadResult, } from "./workload.js";
+export { loadTdxRegistry, findMatchingArtifacts, pickNewestVersion, resolveVersion, } from "./artifacts.js";
+export { resolveAgent, verifyAgent, checkAgent } from "./agent.js";
+export { getChainConfig, getRpcUrl, listChains } from "./chains.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EACH,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACH,eAAe,EACf,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/nvidia.d.ts

@@ -0,0 +1,2 @@
+import { AttestationResult } from "./types.js";
+export declare function checkNvidiaGpuAttestation(data: string): Promise<AttestationResult>;

package/dist/nvidia.js

@@ -0,0 +1,182 @@
+import crypto from "node:crypto";
+import { makeResult } from "./types.js";
+const NRAS_URL = "https://nras.attestation.nvidia.com/v4/attest/gpu";
+const NRAS_JWKS_URL = "https://nras.attestation.nvidia.com/.well-known/jwks.json";
+// ---------------------------------------------------------------------------
+// JWT helpers
+// ---------------------------------------------------------------------------
+function base64urlDecode(s) {
+    return Buffer.from(s + "=".repeat((4 - (s.length % 4)) % 4), "base64url");
+}
+function decodeJwtHeader(token) {
+    return JSON.parse(base64urlDecode(token.split(".")[0]).toString());
+}
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        throw new Error(`Invalid JWT: expected 3 parts`);
+    return JSON.parse(base64urlDecode(parts[1]).toString());
+}
+async function fetchJwks() {
+    const resp = await fetch(NRAS_JWKS_URL);
+    if (!resp.ok)
+        throw new Error(`JWKS fetch failed: ${resp.status}`);
+    const jwks = (await resp.json());
+    const keys = new Map();
+    for (const key of jwks.keys ?? []) {
+        if (key.kid)
+            keys.set(key.kid, key);
+    }
+    return keys;
+}
+function verifyJwtSignature(token, jwks) {
+    const header = decodeJwtHeader(token);
+    const { kid, alg } = header;
+    if (alg !== "ES384")
+        return false;
+    if (!jwks.has(kid))
+        return false;
+    const jwk = jwks.get(kid);
+    let pubKey;
+    const x5c = jwk.x5c ?? [];
+    if (x5c.length > 0) {
+        const cert = new crypto.X509Certificate(Buffer.from(x5c[0], "base64"));
+        pubKey = cert.publicKey;
+    }
+    else {
+        pubKey = crypto.createPublicKey({ key: jwk, format: "jwk" });
+    }
+    const parts = token.split(".");
+    const signedData = Buffer.from(`${parts[0]}.${parts[1]}`);
+    const sigRaw = base64urlDecode(parts[2]);
+    // ES384: raw R||S (48+48), convert to DER
+    const r = sigRaw.subarray(0, 48);
+    const s = sigRaw.subarray(48);
+    const derSig = ecdsaRsToDer(r, s);
+    const verifier = crypto.createVerify("SHA384");
+    verifier.update(signedData);
+    try {
+        return verifier.verify({ key: pubKey, dsaEncoding: "der" }, derSig);
+    }
+    catch {
+        return false;
+    }
+}
+function ecdsaRsToDer(r, s) {
+    function encodeInt(v) {
+        let i = 0;
+        while (i < v.length - 1 && v[i] === 0)
+            i++;
+        let trimmed = v.subarray(i);
+        if (trimmed[0] & 0x80) {
+            trimmed = Buffer.concat([Buffer.from([0x00]), trimmed]);
+        }
+        return Buffer.concat([Buffer.from([0x02, trimmed.length]), trimmed]);
+    }
+    const ri = encodeInt(r);
+    const si = encodeInt(s);
+    return Buffer.concat([Buffer.from([0x30, ri.length + si.length]), ri, si]);
+}
+// ---------------------------------------------------------------------------
+// Public
+// ---------------------------------------------------------------------------
+export async function checkNvidiaGpuAttestation(data) {
+    const errors = [];
+    const checks = {};
+    // Parse input
+    let attestationData;
+    try {
+        attestationData = JSON.parse(data);
+        checks.input_parsed = true;
+    }
+    catch (e) {
+        return makeResult("NVIDIA-GPU", {
+            checks: { input_parsed: false },
+            errors: [e.message],
+        });
+    }
+    // Submit to NRAS
+    let nrasResponse;
+    try {
+        const resp = await fetch(NRAS_URL, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json",
+            },
+            body: JSON.stringify(attestationData),
+        });
+        if (!resp.ok) {
+            const text = await resp.text();
+            errors.push(`NRAS returned ${resp.status}: ${text.slice(0, 200)}`);
+            checks.nras_submission = false;
+            return makeResult("NVIDIA-GPU", { checks, errors });
+        }
+        nrasResponse = (await resp.json());
+        checks.nras_submission = true;
+    }
+    catch (e) {
+        errors.push(`NRAS request failed: ${e.message}`);
+        checks.nras_submission = false;
+        return makeResult("NVIDIA-GPU", { checks, errors });
+    }
+    // Fetch JWKS
+    let jwks;
+    try {
+        jwks = await fetchJwks();
+    }
+    catch (e) {
+        errors.push(`Failed to fetch NVIDIA JWKS: ${e.message}`);
+        jwks = new Map();
+    }
+    const report = {};
+    let allSigsValid = true;
+    // Platform JWT
+    const jwtEntry = nrasResponse[0];
+    if (Array.isArray(jwtEntry) && jwtEntry[0] === "JWT") {
+        const platformToken = jwtEntry[1];
+        const sigValid = jwks.size > 0 ? verifyJwtSignature(platformToken, jwks) : false;
+        checks.platform_jwt_signature = sigValid;
+        if (!sigValid) {
+            allSigsValid = false;
+            errors.push("Platform JWT signature verification failed");
+        }
+        const claims = decodeJwtPayload(platformToken);
+        report.overall_result = claims["x-nvidia-overall-att-result"];
+        report.subject = claims.sub;
+        report.issuer = claims.iss;
+        report.nonce = claims.eat_nonce;
+    }
+    // Per-GPU JWTs
+    const gpuEntries = nrasResponse[1] ?? {};
+    const gpuReports = {};
+    if (typeof gpuEntries === "object" && !Array.isArray(gpuEntries)) {
+        for (const [gpuId, token] of Object.entries(gpuEntries)) {
+            const sigValid = jwks.size > 0 ? verifyJwtSignature(token, jwks) : false;
+            checks[`${gpuId}_jwt_signature`] = sigValid;
+            if (!sigValid) {
+                allSigsValid = false;
+                errors.push(`${gpuId} JWT signature verification failed`);
+            }
+            const claims = decodeJwtPayload(token);
+            gpuReports[gpuId] = {
+                model: claims.hwmodel,
+                oem_id: claims.oemid,
+                ueid: claims.ueid,
+                debug_status: claims.dbgstat,
+                secure_boot: claims.secboot,
+                driver_version: claims["x-nvidia-gpu-driver-version"],
+                vbios_version: claims["x-nvidia-gpu-vbios-version"],
+                attestation_report_parsed: claims["x-nvidia-gpu-attestation-report-parsed"],
+                attestation_report_signature_verified: claims["x-nvidia-gpu-attestation-report-signature-verified"],
+                attestation_report_nonce_match: claims["x-nvidia-gpu-attestation-report-nonce-match"],
+                arch_check: claims["x-nvidia-gpu-arch-check"],
+                measurements: claims.measres,
+            };
+        }
+    }
+    report.gpus = gpuReports;
+    const valid = !!report.overall_result && allSigsValid;
+    return makeResult("NVIDIA-GPU", { valid, checks, report, errors });
+}
+//# sourceMappingURL=nvidia.js.map

package/dist/nvidia.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nvidia.js","sourceRoot":"","sources":["../src/nvidia.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,QAAQ,GAAG,mDAAmD,CAAC;AACrE,MAAM,aAAa,GACjB,2DAA2D,CAAC;AAE9D,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAQ,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAe,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAa,EACb,IAAsB;IAEtB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC5B,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAE3B,IAAI,MAAwB,CAAC;IAC7B,MAAM,GAAG,GAAa,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,eAAe,CACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAC/B,CAAC;QACF,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAE1C,0CAA0C;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,SAAS,SAAS,CAAC,CAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,CAAC,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,CAAC,CAAC,CAAE,GAAG,IAAI,EAAE,CAAC;YACvB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY;IAEZ,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,cAAc;IACd,IAAI,eAAoB,CAAC;IACzB,IAAI,CAAC;QACH,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,YAAY,EAAE;YAC9B,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE;YAC/B,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;IACjB,IAAI,YAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;YAC/B,OAAO,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAU,CAAC;QAC5C,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;IAChC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,OAAO,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,aAAa;IACb,IAAI,IAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,YAAY,GAAG,IAAI,CAAC;IAExB,eAAe;IACf,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACrD,MAAM,aAAa,GAAW,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAClE,MAAM,CAAC,sBAAsB,GAAG,QAAQ,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC/C,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;QAC5B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;QAC3B,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,eAAe;IACf,MAAM,UAAU,GAA2B,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC1D,MAAM,CAAC,GAAG,KAAK,gBAAgB,CAAC,GAAG,QAAQ,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,YAAY,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACvC,UAAU,CAAC,KAAK,CAAC,GAAG;gBAClB,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,MAAM,EAAE,MAAM,CAAC,KAAK;gBACpB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,YAAY,EAAE,MAAM,CAAC,OAAO;gBAC5B,WAAW,EAAE,MAAM,CAAC,OAAO;gBAC3B,cAAc,EAAE,MAAM,CAAC,6BAA6B,CAAC;gBACrD,aAAa,EAAE,MAAM,CAAC,4BAA4B,CAAC;gBACnD,yBAAyB,EACvB,MAAM,CAAC,wCAAwC,CAAC;gBAClD,qCAAqC,EACnC,MAAM,CAAC,oDAAoD,CAAC;gBAC9D,8BAA8B,EAC5B,MAAM,CAAC,6CAA6C,CAAC;gBACvD,UAAU,EAAE,MAAM,CAAC,yBAAyB,CAAC;gBAC7C,YAAY,EAAE,MAAM,CAAC,OAAO;aAC7B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,UAAU,CAAC;IAEzB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,CAAC;IAEtD,OAAO,UAAU,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC"}

package/dist/rtmr.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Calculate RTMR3 from a docker-compose file content and rootfs_data.
+ *
+ * Mirrors portal logic exactly:
+ *   1. Parse docker-compose YAML and re-stringify (normalise)
+ *   2. SHA-256 of normalised YAML bytes  → log[0]
+ *   3. rootfs_data (hex)                 → log[1]
+ *   4. replayRtmr(log)
+ */
+export declare function calculateRtmr3(dockerCompose: Buffer | string, rootfsData: string): string;