secretvm-verify 0.3.9 → 0.5.0

package/README.md

@@ -4,7 +4,7 @@ Attestation verification SDK for confidential computing environments. Verifies I
 
 ## What it verifies
 
-- **Intel TDX** — Parses a TDX Quote v4, verifies the ECDSA-P256 signature chain (PCK -> Intermediate -> Root), validates QE report binding, and checks TCB status against Intel's Provisioning Certification Service.
+- **Intel TDX** — Performs full Intel DCAP quote verification, delegating the cryptographic checks to the upstream [`@teekit/qvl`](https://www.npmjs.com/package/@teekit/qvl) library. Verifies the PCK certificate chain against a pinned Intel SGX Root CA, the QE Identity, PCK CRL and Root CA CRL revocation, the TCB Info signature, the TCB status, the quote signature, and the QE report binding. Collateral (TCB Info, QE Identity, CRLs, issuer chains) is fetched from a Provisioning Certificate Caching Service (PCCS) — defaults to SCRT Labs' deployment.
 - **AMD SEV-SNP** — Parses a SEV-SNP attestation report, fetches the VCEK certificate from AMD's Key Distribution Service, verifies the ECDSA-P384 report signature, and validates the certificate chain (VCEK -> ASK -> ARK).
 - **NVIDIA GPU** — Submits GPU attestation evidence to NVIDIA's Remote Attestation Service (NRAS), verifies the returned JWT signatures against NVIDIA's published JWKS keys, and extracts per-GPU attestation claims.
 - **SecretVM workload** — Given a TDX or SEV-SNP quote and a `docker-compose.yaml`, determines whether the quote was produced by a known SecretVM image and verifies the exact compose file that was booted.
@@ -303,17 +303,76 @@ The library contacts these services during verification:
 
 | Service | Used by | Purpose |
 |---------|---------|---------|
-| [Intel PCS](https://api.trustedservices.intel.com) | TDX | TCB status lookup |
-| [AMD KDS](https://kdsintf.amd.com) | SEV-SNP | VCEK certificate and cert chain |
+| [SCRT PCCS](https://pccs.scrtlabs.com) | TDX | DCAP collateral (TCB Info, QE Identity, PCK CRL, Root CA CRL, issuer chains) |
+| [AMD KDS](https://kdsintf.amd.com) | SEV-SNP | VCEK certificate, AMD CA cert chain (ASK + ARK), CRL |
 | [NVIDIA NRAS](https://nras.attestation.nvidia.com) | GPU | GPU attestation verification |
 
-**Note:** AMD KDS has rate limits. If you encounter 429 errors, specify the `product` parameter to reduce the number of requests.
+## AMD KDS caching
+
+To minimize calls to `kdsintf.amd.com` (which is rate-limited and returns HTTP 429 under load) the AMD SEV-SNP verifier caches all three KDS responses to disk. The cache is on by default; nothing to enable.
+
+| Item | TTL | Cache key |
+|---|---|---|
+| VCEK certificate | 30 days | `(product, chip_id, ucode_SPL, snp_SPL, tee_SPL, bl_SPL)` — full TCB tuple |
+| AMD CA cert chain (ASK + ARK) | 30 days | `product` |
+| CRL | from the CRL's own X.509 `nextUpdate` field (typically ~7 months for AMD); falls back to 7 days if `nextUpdate` is missing or unparseable | `product` |
+
+The VCEK cache key includes the full TCB tuple because AMD issues a distinct VCEK per `(chip, TCB version)`. A microcode update on the same chip becomes a cache miss with the new key, fetching the updated VCEK as expected.
+
+**Cache location.** Default `~/.cache/secretvm-verify/amd/`. Override with the `SECRETVM_VERIFY_CACHE_DIR` environment variable; the library appends `/amd` to whatever you set:
+
+```sh
+export SECRETVM_VERIFY_CACHE_DIR=/var/cache/myapp
+# → entries land in /var/cache/myapp/amd/{vcek,cert_chain,crl}/
+```
+
+Each cached entry is two files: the payload (DER bytes for VCEK and CRL, PEM text for the cert chain) and a sidecar `<name>.expires` containing the Unix-epoch expiration time.
+
+**Inspect cached entries:**
+
+```sh
+ls -lR ~/.cache/secretvm-verify/amd/
+
+# Decode a specific VCEK
+openssl x509 -in ~/.cache/secretvm-verify/amd/vcek/<file> -inform DER -text -noout
+
+# Decode the CRL — see revoked serials and nextUpdate
+openssl crl -in ~/.cache/secretvm-verify/amd/crl/Genoa -inform DER -text -noout
+```
+
+**Network failure fallback.** If AMD KDS is unreachable or returns an error, the cache falls back to a stale entry rather than failing the verification. Better to verify with a slightly old CRL than to fail every SEV-SNP attestation while KDS is down.
+
+**Force a refresh** (skip the cache for this call, fetch fresh, write back to cache):
+
+CLI:
+```sh
+secretvm-verify --secretvm <url> --reload-amd-kds
+secretvm-verify --sev <quote.txt> --product Genoa --reload-amd-kds
+```
+
+Programmatic — pass `true` as the third argument:
+
+```js
+const result = await checkSevCpuAttestation(quote, "Genoa", /* reloadAmdKds */ true);
+const result = await checkSecretVm(url, "", /* reloadAmdKds */ true);
+const result = await checkCpuAttestation(quote, "Genoa", /* reloadAmdKds */ true);
+const result = await checkAgent(agentId, "base", /* reloadAmdKds */ true);
+```
+
+The `--reload-amd-kds` flag has no effect on Intel TDX verification (TDX doesn't cache; the upstream `@teekit/qvl` library manages its own ephemeral state).
+
+**To clear the cache entirely:**
+
+```sh
+rm -rf ~/.cache/secretvm-verify/amd
+```
 
 ## Requirements
 
 - Node.js >= 18 (uses built-in `crypto`, `fetch`)
-- `openssl` CLI (required for AMD SEV-SNP certificate chain verification)
-- `yaml` (npm dependency, included)
+- npm dependencies: [`@teekit/qvl`](https://www.npmjs.com/package/@teekit/qvl) (TDX quote verification), [`asn1js`](https://www.npmjs.com/package/asn1js) (parses the CRL's `nextUpdate` field for cache TTL), `ethers` (ERC-8004 agent resolution) — installed automatically.
+
+No system-level dependencies. AMD SEV-SNP certificate chains (RSA-PSS) are verified natively via `node:crypto`.
 
 ## License
 

package/dist/agent.d.ts

@@ -18,12 +18,18 @@ export declare function resolveAgent(agentId: number, chain: string): Promise<Ag
  * Discovers teequote and workload endpoints from the metadata, then runs
  * the full verification flow: TLS cert, CPU quote, TLS binding, GPU quote,
  * GPU binding, and workload verification.
+ *
+ * @param reloadAmdKds If true, bypass the local AMD KDS cache and re-fetch
+ *   VCEK / cert chain / CRL. No effect on TDX agents.
  */
-export declare function verifyAgent(metadata: AgentMetadata): Promise<AttestationResult>;
+export declare function verifyAgent(metadata: AgentMetadata, reloadAmdKds?: boolean): Promise<AttestationResult>;
 /**
  * End-to-end ERC-8004 agent verification.
  *
  * Resolves the agent's metadata from the on-chain registry, then runs
  * the full verification flow via verifyAgent.
+ *
+ * @param reloadAmdKds If true, bypass the local AMD KDS cache and re-fetch
+ *   VCEK / cert chain / CRL. No effect on TDX agents.
  */
-export declare function checkAgent(agentId: number, chain: string): Promise<AttestationResult>;
+export declare function checkAgent(agentId: number, chain: string, reloadAmdKds?: boolean): Promise<AttestationResult>;

package/dist/agent.js

@@ -1,11 +1,10 @@
-import crypto from "node:crypto";
-import tls from "node:tls";
 import { ethers } from "ethers";
 import { getChainConfig, getRpcUrl } from "./chains.js";
 import { makeResult } from "./types.js";
 import { checkCpuAttestation } from "./cpu.js";
 import { checkNvidiaGpuAttestation } from "./nvidia.js";
 import { verifyWorkload } from "./workload.js";
+import { extractDockerCompose, getTlsCertFingerprint } from "./url.js";
 const REGISTRY_ABI = [
     "function tokenURI(uint256 tokenId) view returns (string)",
     "function agentURI(uint256 agentId) view returns (string)",
@@ -28,44 +27,6 @@ function normalizeServices(raw) {
         };
     });
 }
-function getTlsCertFingerprint(host, port) {
-    return new Promise((resolve, reject) => {
-        const socket = tls.connect({ host, port, rejectUnauthorized: true }, () => {
-            const cert = socket.getPeerX509Certificate();
-            if (!cert) {
-                socket.destroy();
-                return reject(new Error("No certificate received"));
-            }
-            const fingerprint = crypto
-                .createHash("sha256")
-                .update(cert.raw)
-                .digest();
-            socket.destroy();
-            resolve(fingerprint);
-        });
-        socket.on("error", reject);
-        socket.setTimeout(10_000, () => {
-            socket.destroy();
-            reject(new Error("TLS connection timed out"));
-        });
-    });
-}
-function extractDockerCompose(raw) {
-    let text = raw.trim();
-    const preMatch = text.match(/<pre>([\s\S]*?)<\/pre>/i);
-    if (preMatch)
-        text = preMatch[1];
-    text = text
-        .replace(/&#(\d+);/g, (_, code) => String.fromCharCode(Number(code)))
-        .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
-        .replace(/&amp;/g, "&")
-        .replace(/&lt;/g, "<")
-        .replace(/&gt;/g, ">")
-        .replace(/&quot;/g, '"')
-        .replace(/&apos;/g, "'");
-    text = text.replace(/[\u200B\u200C\u200D\uFEFF]/g, "");
-    return text;
-}
 function findTeequoteEndpoint(services) {
     for (const s of services) {
         if (s.name.toLowerCase() === "teequote" && s.endpoint)
@@ -168,8 +129,11 @@ export async function resolveAgent(agentId, chain) {
  * Discovers teequote and workload endpoints from the metadata, then runs
  * the full verification flow: TLS cert, CPU quote, TLS binding, GPU quote,
  * GPU binding, and workload verification.
+ *
+ * @param reloadAmdKds If true, bypass the local AMD KDS cache and re-fetch
+ *   VCEK / cert chain / CRL. No effect on TDX agents.
  */
-export async function verifyAgent(metadata) {
+export async function verifyAgent(metadata, reloadAmdKds = false) {
     const errors = [];
     const checks = {};
     const report = {};
@@ -231,8 +195,12 @@ export async function verifyAgent(metadata) {
         checks.cpu_quote_fetched = false;
         return makeResult("ERC-8004", { checks, report, errors });
     }
-    const cpuResult = await checkCpuAttestation(cpuData);
+    const cpuResult = await checkCpuAttestation(cpuData, "", reloadAmdKds);
     checks.cpu_attestation_valid = cpuResult.valid;
+    // Propagate the inner DCAP/QVL verification verdict for prominent display.
+    if (cpuResult.checks.quote_verified !== undefined) {
+        checks.cpu_quote_verified = cpuResult.checks.quote_verified;
+    }
     report.cpu = cpuResult.report;
     report.cpu_type = cpuResult.attestationType;
     if (!cpuResult.valid)
@@ -340,8 +308,11 @@ export async function verifyAgent(metadata) {
  *
  * Resolves the agent's metadata from the on-chain registry, then runs
  * the full verification flow via verifyAgent.
+ *
+ * @param reloadAmdKds If true, bypass the local AMD KDS cache and re-fetch
+ *   VCEK / cert chain / CRL. No effect on TDX agents.
  */
-export async function checkAgent(agentId, chain) {
+export async function checkAgent(agentId, chain, reloadAmdKds = false) {
     const errors = [];
     const checks = {};
     let metadata;
@@ -354,7 +325,7 @@ export async function checkAgent(agentId, chain) {
         checks.agent_resolved = false;
         return makeResult("ERC-8004", { checks, errors });
     }
-    const result = await verifyAgent(metadata);
+    const result = await verifyAgent(metadata, reloadAmdKds);
     result.checks = { agent_resolved: true, ...result.checks };
     return result;
 }

package/dist/agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,YAAY,GAAG;IACnB,0DAA0D;IAC1D,0DAA0D;CAC3D,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,WAAW,KAAK,GAAG,CAAC,EAAE;YACpC,QAAQ;YACR,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,IAAY;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EACxC,GAAG,EAAE;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,WAAW,GAAG,MAAM;iBACvB,UAAU,CAAC,QAAQ,CAAC;iBACpB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;iBAChB,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC,CACF,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACvD,IAAI,QAAQ;QAAE,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IAClC,IAAI,GAAG,IAAI;SACR,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SACpE,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;SAClF,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAwB;IACpD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAwB;IACpD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,KAAa;IAEb,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,QAAQ,CAClC,WAAW,CAAC,eAAe,EAC3B,YAAY,EACZ,QAAQ,CACT,CAAC;IAEF,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,iDAAiD,OAAO,OAAO,WAAW,CAAC,IAAI,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,QAAiC,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,2DAA2D;QAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAC3C,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ,GAAG,QAAQ,CAAC;QACxB,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GACR,QAAQ,CAAC,cAAuC;QAChD,QAAQ,CAAC,eAAwC;QAClD,EAAE,CAAC;IAEL,OAAO;QACL,IAAI,EACF,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;YACvD,CAAC,CAAC,QAAQ,CAAC,IAAI;YACf,CAAC,CAAC,SAAS,OAAO,EAAE;QACxB,WAAW,EACT,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC7E,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACjD,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC;QACpE,KAAK,EAAE,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACtE,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACnE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC;QACnD,UAAU,EAAG,QAAQ,CAAC,UAAkC,IAAI,EAAE;QAC9D,GAAG,EAAE,QAAQ;KACd,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAuB;IAEvB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;IAElC,uBAAuB;IACvB,MAAM,iBAAiB,GAAG,QAAQ,CAAC,cAAc;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC3B,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACtD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACpE,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAE7B,iBAAiB;IACjB,MAAM,OAAO,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;QACnC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC;IAErB,MAAM,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,eAAe;QACjC,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC;QACpC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,iBAAiB,CAAC;YAC9C,CAAC,CAAC,GAAG,OAAO,iBAAiB,CAAC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAErD,iCAAiC;IACjC,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,MAAM,CAAC,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACjC,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAClC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACjC,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,CAAC,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAAC;IAC/C,MAAM,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;IAC9B,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAEvD,iBAAiB;IACjB,MAAM,aAAa,GAAW,SAAS,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACjE,IAAI,aAAa,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,WAAW,GAAG,SAAS,KAAK,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,+CAA+C,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;gBAC1E,uBAAuB,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC7D,CAAC;IAED,0BAA0B;IAC1B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;IACnC,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,CAAC,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAAC;QAC/C,MAAM,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAW,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,IAAI,aAAa,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,CAAC,WAAW,GAAG,UAAU,KAAK,QAAQ,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CACT,gDAAgD,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;oBAC5E,iBAAiB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE/B,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,CAAC,iBAAiB,GAAG,cAAc,CAAC,MAAM,KAAK,iBAAiB,CAAC;QACvE,MAAM,CAAC,QAAQ,GAAG,cAAc,CAAC;QACjC,IAAI,cAAc,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACtF,CAAC;aAAM,IAAI,cAAc,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,mBAAmB;IACnB,MAAM,cAAc,GAAG;QACrB,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,iBAAiB;QACxB,MAAM,CAAC,iBAAiB;QACxB,MAAM,CAAC,qBAAqB;QAC5B,MAAM,CAAC,WAAW;QAClB,CAAC,CAAC,MAAM,CAAC,iBAAiB;KAC3B,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACpD,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE5C,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,KAAa;IAEb,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,CAAC,MAAM,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAE3D,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAqB,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEvE,MAAM,YAAY,GAAG;IACnB,0DAA0D;IAC1D,0DAA0D;CAC3D,CAAC;AAEF,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,WAAW,KAAK,GAAG,CAAC,EAAE;YACpC,QAAQ;YACR,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAwB;IACpD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAwB;IACpD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,KAAa;IAEb,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,QAAQ,CAClC,WAAW,CAAC,eAAe,EAC3B,YAAY,EACZ,QAAQ,CACT,CAAC;IAEF,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,iDAAiD,OAAO,OAAO,WAAW,CAAC,IAAI,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,QAAiC,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,2DAA2D;QAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAC3C,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;SAAM,CAAC;QACN,IAAI,QAAQ,GAAG,QAAQ,CAAC;QACxB,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GACR,QAAQ,CAAC,cAAuC;QAChD,QAAQ,CAAC,eAAwC;QAClD,EAAE,CAAC;IAEL,OAAO;QACL,IAAI,EACF,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;YACvD,CAAC,CAAC,QAAQ,CAAC,IAAI;YACf,CAAC,CAAC,SAAS,OAAO,EAAE;QACxB,WAAW,EACT,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAC7E,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACjD,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC;QACpE,KAAK,EAAE,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACtE,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QACnE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC;QACnD,UAAU,EAAG,QAAQ,CAAC,UAAkC,IAAI,EAAE;QAC9D,GAAG,EAAE,QAAQ;KACd,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAuB,EACvB,YAAY,GAAG,KAAK;IAEpB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAwB,EAAE,CAAC;IAEvC,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;IAElC,uBAAuB;IACvB,MAAM,iBAAiB,GAAG,QAAQ,CAAC,cAAc;SAC9C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC3B,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACtD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACpE,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAE7B,iBAAiB;IACjB,MAAM,OAAO,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;QACnC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC;IAErB,MAAM,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,eAAe;QACjC,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC;QACpC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,iBAAiB,CAAC;YAC9C,CAAC,CAAC,GAAG,OAAO,iBAAiB,CAAC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAErD,iCAAiC;IACjC,IAAI,cAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,MAAM,CAAC,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACjC,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAClC,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACjC,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;IACvE,MAAM,CAAC,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAAC;IAC/C,2EAA2E;IAC3E,IAAI,SAAS,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,CAAC,kBAAkB,GAAG,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;IAC9D,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;IAC9B,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAEvD,iBAAiB;IACjB,MAAM,aAAa,GAAW,SAAS,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACjE,IAAI,aAAa,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,WAAW,GAAG,SAAS,KAAK,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,+CAA+C,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;gBAC1E,uBAAuB,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC7D,CAAC;IAED,0BAA0B;IAC1B,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,IAAI,CAAC;gBAClB,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC;IACnC,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,CAAC,qBAAqB,GAAG,SAAS,CAAC,KAAK,CAAC;QAC/C,MAAM,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAW,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,IAAI,aAAa,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,CAAC,WAAW,GAAG,UAAU,KAAK,QAAQ,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CACT,gDAAgD,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;oBAC5E,iBAAiB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAE/B,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,CAAC,iBAAiB,GAAG,cAAc,CAAC,MAAM,KAAK,iBAAiB,CAAC;QACvE,MAAM,CAAC,QAAQ,GAAG,cAAc,CAAC;QACjC,IAAI,cAAc,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACtF,CAAC;aAAM,IAAI,cAAc,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,mBAAmB;IACnB,MAAM,cAAc,GAAG;QACrB,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,iBAAiB;QACxB,MAAM,CAAC,iBAAiB;QACxB,MAAM,CAAC,qBAAqB;QAC5B,MAAM,CAAC,WAAW;QAClB,CAAC,CAAC,MAAM,CAAC,iBAAiB;KAC3B,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACpD,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE5C,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,KAAa,EACb,YAAY,GAAG,KAAK;IAEpB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC/B,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACzD,MAAM,CAAC,MAAM,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAE3D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/amd.d.ts

@@ -1,2 +1,2 @@
 import { AttestationResult } from "./types.js";
-export declare function checkSevCpuAttestation(dataOrUrl: string, product?: string): Promise<AttestationResult>;
+export declare function checkSevCpuAttestation(dataOrUrl: string, product?: string, reloadAmdKds?: boolean): Promise<AttestationResult>;

package/dist/amd.js

@@ -1,11 +1,60 @@
 import crypto from "node:crypto";
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
+import { fromBER, Integer, Sequence, UTCTime } from "asn1js";
+import { parseCrlRevokedSerials, normalizeSerialHex } from "@teekit/qvl/utils";
 import { isVmUrl, fetchCpuQuote } from "./url.js";
 import { makeResult } from "./types.js";
+import * as kdsCache from "./kdsCache.js";
 const AMD_KDS_BASE = "https://kdsintf.amd.com";
+/**
+ * Parse the `nextUpdate` field from a DER-encoded X.509 CRL.
+ *
+ * Returns the nextUpdate as a Date, or null if the CRL has no nextUpdate
+ * field or parsing fails. We use this to size the AMD CRL cache TTL to the
+ * CRL's own expiration window rather than a fixed value.
+ *
+ * X.509 CRL structure:
+ *   CertificateList ::= SEQUENCE {
+ *     tbsCertList SEQUENCE {
+ *       version Version OPTIONAL,        -- INTEGER
+ *       signature AlgorithmIdentifier,    -- SEQUENCE
+ *       issuer Name,                      -- SEQUENCE
+ *       thisUpdate Time,                  -- UTCTime or GeneralizedTime
+ *       nextUpdate Time OPTIONAL,         -- the field we want
+ *       ...
+ *     },
+ *     ...
+ *   }
+ *
+ * GeneralizedTime extends UTCTime in asn1js, so a single `instanceof UTCTime`
+ * check catches both encodings; both expose `toDate()`.
+ */
+function parseCrlNextUpdate(der) {
+    try {
+        const parsed = fromBER(der);
+        if (parsed.offset === -1)
+            return null;
+        const certList = parsed.result;
+        if (!(certList instanceof Sequence))
+            return null;
+        const tbsCertList = certList.valueBlock.value[0];
+        if (!(tbsCertList instanceof Sequence))
+            return null;
+        const children = tbsCertList.valueBlock.value;
+        let i = 0;
+        if (children[i] instanceof Integer)
+            i++; // optional version
+        i += 3; // signature AlgorithmIdentifier, issuer Name, thisUpdate Time
+        if (i >= children.length)
+            return null;
+        const nextUpdate = children[i];
+        if (nextUpdate instanceof UTCTime)
+            return nextUpdate.toDate();
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 const REPORT_SIZE = 0x4a0;
 const SIG_OFFSET = 0x2a0;
 const SIG_COMPONENT_SIZE = 72;
@@ -99,31 +148,134 @@ function vcekUrl(product, chipId, tcb) {
         `?blSPL=${tcb.bootLoader}&teeSPL=${tcb.tee}` +
         `&snpSPL=${tcb.snp}&ucodeSPL=${tcb.microcode}`);
 }
-async function fetchVcek(product, chipId, reportedTcb) {
+/** Stable cache key for the VCEK fetch — includes the full TCB tuple
+ * because AMD issues a distinct VCEK per (chip, ucode, snp, tee, bl) level. */
+function vcekCacheKey(product, chipId, tcb) {
+    return (`${product}_${chipId.toString("hex")}` +
+        `_bl${tcb.bootLoader}_tee${tcb.tee}` +
+        `_snp${tcb.snp}_uc${tcb.microcode}`);
+}
+async function fetchVcek(product, chipId, reportedTcb, reloadAmdKds = false) {
     const candidates = product ? [product] : ["Genoa", "Milan", "Turin"];
     for (const name of candidates) {
+        const cacheKey = vcekCacheKey(name, chipId, reportedTcb);
+        if (!reloadAmdKds) {
+            const cached = kdsCache.get("vcek", cacheKey);
+            if (cached) {
+                return { der: cached, product: name };
+            }
+        }
         const url = vcekUrl(name, chipId, reportedTcb);
-        const resp = await fetch(url);
+        let resp;
+        try {
+            resp = await fetch(url);
+        }
+        catch (e) {
+            // Network failure: fall back to a stale cached entry if we have one.
+            const stale = kdsCache.getStale("vcek", cacheKey);
+            if (stale)
+                return { der: stale, product: name };
+            throw e;
+        }
         if (resp.ok) {
             const der = Buffer.from(await resp.arrayBuffer());
+            kdsCache.put("vcek", cacheKey, der, kdsCache.TTL_VCEK_SECONDS);
             return { der, product: name };
         }
         if (resp.status === 429) {
+            // Last-ditch fallback: serve a stale cached entry rather than fail.
+            const stale = kdsCache.getStale("vcek", cacheKey);
+            if (stale)
+                return { der: stale, product: name };
             throw new Error("AMD KDS rate-limited (429). Retry later or specify product.");
         }
         if (product) {
+            const stale = kdsCache.getStale("vcek", cacheKey);
+            if (stale)
+                return { der: stale, product: name };
             throw new Error(`AMD KDS returned ${resp.status}`);
         }
     }
     throw new Error("Could not fetch VCEK for any known product (Genoa/Milan/Turin)");
 }
-async function fetchChainPem(product) {
+async function fetchChainPem(product, reloadAmdKds = false) {
+    if (!reloadAmdKds) {
+        const cached = kdsCache.get("cert_chain", product);
+        if (cached)
+            return cached.toString("utf8");
+    }
     const url = `${AMD_KDS_BASE}/vcek/v1/${product}/cert_chain`;
-    const resp = await fetch(url);
+    let resp;
+    try {
+        resp = await fetch(url);
+    }
+    catch (e) {
+        const stale = kdsCache.getStale("cert_chain", product);
+        if (stale)
+            return stale.toString("utf8");
+        throw e;
+    }
     if (!resp.ok) {
+        const stale = kdsCache.getStale("cert_chain", product);
+        if (stale)
+            return stale.toString("utf8");
         throw new Error(`AMD KDS cert_chain returned ${resp.status}`);
     }
-    return await resp.text();
+    const text = await resp.text();
+    kdsCache.put("cert_chain", product, Buffer.from(text, "utf8"), kdsCache.TTL_CHAIN_SECONDS);
+    return text;
+}
+/** Fetch the AMD VCEK CRL for a product, cache-first.
+ *
+ * The CRL is consulted to detect chips that AMD has revoked. The cache TTL
+ * is computed from the CRL's own X.509 `nextUpdate` field, so the cache
+ * naturally aligns with AMD's published refresh schedule. If the CRL has no
+ * `nextUpdate` (rare) or parsing fails, we fall back to a 7-day TTL.
+ * On network failure we fall back to a stale cached entry rather than
+ * failing every SEV verification while KDS is down.
+ */
+async function fetchCrl(product, reloadAmdKds = false) {
+    if (!reloadAmdKds) {
+        const cached = kdsCache.get("crl", product);
+        if (cached)
+            return cached;
+    }
+    const url = `${AMD_KDS_BASE}/vcek/v1/${product}/crl`;
+    let resp;
+    try {
+        resp = await fetch(url);
+    }
+    catch (e) {
+        const stale = kdsCache.getStale("crl", product);
+        if (stale)
+            return stale;
+        throw e;
+    }
+    if (!resp.ok) {
+        const stale = kdsCache.getStale("crl", product);
+        if (stale)
+            return stale;
+        throw new Error(`AMD KDS crl returned ${resp.status}`);
+    }
+    const der = Buffer.from(await resp.arrayBuffer());
+    // Use the CRL's own nextUpdate as the TTL when available; fall back to
+    // the 7-day default when it's missing or parsing fails.
+    let ttl = kdsCache.TTL_CRL_SECONDS;
+    const nextUpdate = parseCrlNextUpdate(der);
+    if (nextUpdate) {
+        const seconds = Math.floor((nextUpdate.getTime() - Date.now()) / 1000);
+        if (seconds > 0)
+            ttl = seconds;
+    }
+    kdsCache.put("crl", product, der, ttl);
+    return der;
+}
+/** Return true if the VCEK is NOT in the CRL (i.e. not revoked). */
+function checkVcekRevocation(vcekDer, crlDer) {
+    const cert = new crypto.X509Certificate(vcekDer);
+    const vcekSerial = normalizeSerialHex(cert.serialNumber);
+    const revoked = new Set(parseCrlRevokedSerials(crlDer));
+    return !revoked.has(vcekSerial);
 }
 function splitPem(pem) {
     const blocks = [];
@@ -134,45 +286,37 @@ function splitPem(pem) {
     }
     return blocks;
 }
-/** Verify VCEK → ASK → ARK chain using openssl CLI. */
-function verifyCertChainOpenssl(vcekDer, chainPem) {
-    const td = mkdtempSync(join(tmpdir(), "amd-"));
-    try {
-        // Convert VCEK DER to PEM
-        const vcekPem = execFileSync("openssl", [
-            "x509",
-            "-inform",
-            "DER",
-            "-outform",
-            "PEM",
-        ], { input: vcekDer }).toString();
-        const vcekPath = join(td, "vcek.pem");
-        writeFileSync(vcekPath, vcekPem);
-        const blocks = splitPem(chainPem);
-        if (blocks.length < 2) {
-            throw new Error(`Expected at least 2 certs in chain, got ${blocks.length}`);
-        }
-        const askPath = join(td, "ask.pem");
-        const arkPath = join(td, "ark.pem");
-        writeFileSync(askPath, blocks[0]);
-        writeFileSync(arkPath, blocks[1]);
-        try {
-            execFileSync("openssl", [
-                "verify",
-                "-CAfile",
-                arkPath,
-                "-untrusted",
-                askPath,
-                vcekPath,
-            ]);
-            return true;
-        }
-        catch {
+/** Verify VCEK → ASK → ARK certificate chain using Node's crypto module. */
+function verifyCertChain(vcekDer, chainPem) {
+    const blocks = splitPem(chainPem);
+    if (blocks.length < 2) {
+        return false;
+    }
+    const vcek = new crypto.X509Certificate(vcekDer);
+    const ask = new crypto.X509Certificate(blocks[0]);
+    const ark = new crypto.X509Certificate(blocks[1]);
+    const now = new Date();
+    // Check validity periods
+    for (const cert of [vcek, ask, ark]) {
+        if (now < new Date(cert.validFrom) || now > new Date(cert.validTo)) {
             return false;
         }
     }
-    finally {
-        rmSync(td, { recursive: true, force: true });
+    try {
+        // X509Certificate.verify() handles RSA-PSS and ECDSA automatically
+        // ARK is self-signed
+        if (!ark.verify(ark.publicKey))
+            return false;
+        // ASK signed by ARK
+        if (!ask.verify(ark.publicKey))
+            return false;
+        // VCEK signed by ASK
+        if (!vcek.verify(ask.publicKey))
+            return false;
+        return true;
+    }
+    catch {
+        return false;
     }
 }
 function verifyReportSignature(rpt, vcekDer) {
@@ -197,7 +341,7 @@ function verifyReportSignature(rpt, vcekDer) {
 // ---------------------------------------------------------------------------
 // Public
 // ---------------------------------------------------------------------------
-export async function checkSevCpuAttestation(dataOrUrl, product = "") {
+export async function checkSevCpuAttestation(dataOrUrl, product = "", reloadAmdKds = false) {
     const data = isVmUrl(dataOrUrl) ? await fetchCpuQuote(dataOrUrl) : dataOrUrl;
     const errors = [];
     const checks = {};
@@ -229,7 +373,7 @@ export async function checkSevCpuAttestation(dataOrUrl, product = "") {
     let vcekDer;
     let detectedProduct;
     try {
-        const result = await fetchVcek(product, rpt.chipId, rpt.reportedTcb);
+        const result = await fetchVcek(product, rpt.chipId, rpt.reportedTcb, reloadAmdKds);
         vcekDer = result.der;
         detectedProduct = result.product;
         checks.vcek_fetched = true;
@@ -239,10 +383,10 @@ export async function checkSevCpuAttestation(dataOrUrl, product = "") {
         checks.vcek_fetched = false;
         return makeResult("SEV-SNP", { checks, errors });
     }
-    // Verify cert chain
+    // Verify cert chain (VCEK -> ASK -> ARK)
     try {
-        const chainPem = await fetchChainPem(detectedProduct);
-        checks.cert_chain_valid = verifyCertChainOpenssl(vcekDer, chainPem);
+        const chainPem = await fetchChainPem(detectedProduct, reloadAmdKds);
+        checks.cert_chain_valid = verifyCertChain(vcekDer, chainPem);
         if (!checks.cert_chain_valid) {
             errors.push("Certificate chain verification failed (VCEK → ASK → ARK)");
         }
@@ -251,6 +395,20 @@ export async function checkSevCpuAttestation(dataOrUrl, product = "") {
         checks.cert_chain_valid = false;
         errors.push(`Failed to verify cert chain: ${e.message}`);
     }
+    // CRL revocation check — fetch the AMD VCEK CRL and confirm the leaf
+    // cert's serial number is not in the revoked list. Cached for 7 days.
+    try {
+        const crlDer = await fetchCrl(detectedProduct, reloadAmdKds);
+        checks.crl_check_passed = checkVcekRevocation(vcekDer, crlDer);
+        if (!checks.crl_check_passed) {
+            const cert = new crypto.X509Certificate(vcekDer);
+            errors.push(`VCEK serial ${cert.serialNumber} is revoked per AMD CRL`);
+        }
+    }
+    catch (e) {
+        checks.crl_check_passed = false;
+        errors.push(`CRL revocation check failed: ${e.message}`);
+    }
     // Verify report signature
     checks.report_signature_valid = verifyReportSignature(rpt, vcekDer);
     if (!checks.report_signature_valid) {
@@ -259,6 +417,7 @@ export async function checkSevCpuAttestation(dataOrUrl, product = "") {
     const valid = !!checks.report_parsed &&
         !!checks.vcek_fetched &&
         !!checks.cert_chain_valid &&
+        !!checks.crl_check_passed &&
         !!checks.report_signature_valid;
     const report = {
         version: rpt.version,