@premai/reticle 0.4.8 → 0.5.0

package/README.md

@@ -13,7 +13,7 @@ npm install @premai/reticle
 ```typescript
 import { ClientBuilder } from "@premai/reticle";
 
-const client = new ClientBuilder("https://attestation.example.com")
+const client = await new ClientBuilder("https://attestation.example.com")
   .build();
 
 // End-to-end attestation: discovers modules, generates nonces,
@@ -28,13 +28,14 @@ console.log("GPU:", result.modules().gpu());   // GpuModule.Nvidia or undefined
 
 ### `ClientBuilder`
 
-Creates and configures a `Client` instance.
+Creates and configures a `Client` instance. `build()` is async.
 
 ```typescript
-const client = new ClientBuilder(url)
+const client = await new ClientBuilder(url)
   .with_authorization("Bearer <token>")  // optional: set Authorization header
   .with_kds(new Kds(kdsUrl))             // optional: custom AMD KDS cache
   .with_pcs(new Pcs(pcsUrl))             // optional: custom Intel PCS cache
+  .with_policies_url(policiesUrl)        // optional: custom OPA policies index URL
   .build();
 ```
 
@@ -44,23 +45,52 @@ const client = new ClientBuilder(url)
 
 These methods handle nonce generation, request, and full cryptographic verification in a single call:
 
-| Method | Description |
-|---|---|
-| `client.attest(query?)` | Full attestation of all available modules (CPU + GPU) |
-| `client.attest_sev(query?)` | AMD SEV-SNP attestation only |
-| `client.attest_tdx(query?)` | Intel TDX attestation only |
-| `client.attest_nvidia(query?)` | NVIDIA GPU attestation only |
+| Method | Returns | Description |
+|---|---|---|
+| `client.attest()` | `Promise<AttestResult>` | Full attestation of all available modules (CPU + GPU) |
+| `client.attest_sev()` | `Promise<void>` | AMD SEV-SNP attestation only |
+| `client.attest_tdx()` | `Promise<void>` | Intel TDX attestation only |
+| `client.attest_nvidia()` | `Promise<ResponseHeaders>` | NVIDIA GPU attestation only |
+
+To pass custom query parameters, call `set_query` before attesting:
+
+```typescript
+const query = new QueryParams()
+  .with("model", "my-model")
+  .with("version", "1.0");
+
+client.set_query(query);
+await client.attest();
+```
 
 #### Low-level
 
 These methods fetch and parse attestation evidence (**discouraged**) — useful when you need to inspect raw data or implement custom validation:
 
-| Method | Description |
-|---|---|
-| `client.request_modules(query?)` | List available attestation modules on the server |
-| `client.request_sev(nonce, query)` | Fetch raw SEV-SNP attestation report |
-| `client.request_tdx(nonce, query)` | Fetch raw TDX quote |
-| `client.request_nvidia(nonce, query)` | Fetch raw NVIDIA EAT/JWT token |
+| Method | Returns | Description |
+|---|---|---|
+| `client.request_modules()` | `Promise<Modules>` | List available attestation modules on the server |
+| `client.request_sev(nonce: SevNonce)` | `Promise<ParsedAttestation>` | Fetch raw SEV-SNP attestation report |
+| `client.request_tdx(nonce: TdxNonce)` | `Promise<TdxQuote>` | Fetch raw TDX quote |
+| `client.request_nvidia(nonce: NvidiaNonce)` | `Promise<NvidiaAttestResult>` | Fetch raw NVIDIA EAT attestation result |
+
+### `AttestResult`
+
+Returned by `client.attest()`.
+
+| Method | Returns | Description |
+|---|---|---|
+| `result.modules()` | `Modules` | CPU and GPU module info |
+| `result.headers()` | `AttestHeaders` | HTTP response headers from attestation requests |
+
+`Modules` exposes:
+- `.cpu()` → `CpuModule` (`CpuModule.Sev` or `CpuModule.Tdx`)
+- `.gpu()` → `GpuModule | undefined` (`GpuModule.Nvidia` or `undefined`)
+- `.has_gpu()` → `boolean`
+
+`AttestHeaders` exposes:
+- `.cpu()` → `ResponseHeaders | undefined`
+- `.gpu()` → `ResponseHeaders | undefined`
 
 ### `QueryParams`
 
@@ -71,26 +101,33 @@ const query = new QueryParams()
   .with("model", "my-model")
   .with("version", "1.0");
 
-await client.attest(query);
+client.set_query(query);
 ```
 
-### Sub-module access
+### Low-level sub-module usage
 
-Lower-level types from the attestation modules are available under namespaces:
+Lower-level types are available as top-level named exports:
 
 ```typescript
-import { nvidia, sev } from "@premai/reticle";
+import {
+  fetch_keychain,
+  EATToken,
+  Kds,
+  NvidiaNonce,
+  SevNonce,
+} from "@premai/reticle";
 
 // NVIDIA: manual token parsing and verification
-const keychain = await nvidia.fetch_keychain();
-const token = nvidia.EATToken.parse(rawJwt);
-const claims = token.verify(keychain);
-claims.validate(nonce);
+const keychain = await fetch_keychain();
+const nonce = NvidiaNonce.generate();
+const token = EATToken.parse(rawJwt);
+const claims = token.verify(keychain, nonce);
 
 // AMD SEV-SNP: manual certificate chain verification
-const kds = new sev.Kds("https://kcds.prem.io");
+const kds = new Kds("https://kds.example.com");
+const sevNonce = SevNonce.generate();
 const chain = await kds.fetch_certificates(attestation);
-attestation.verify(chain, nonce);
+attestation.verify(chain, sevNonce);
 ```
 
 ## Memory management
@@ -98,7 +135,7 @@ attestation.verify(chain, nonce);
 WASM objects are not garbage-collected automatically. Call `.free()` when done, or use `using` (TypeScript 5.2+) for automatic disposal:
 
 ```typescript
-using client = new ClientBuilder(url).build();
+using client = await new ClientBuilder(url).build();
 using result = await client.attest();
 // automatically freed at end of scope
 ```

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@premai/reticle",
   "type": "module",
-  "version": "0.4.8",
+  "version": "0.5.0",
   "files": [
     "reticle_bg.wasm",
     "reticle.js",

package/reticle.d.ts

@@ -17,6 +17,20 @@ export class AttestResult {
     modules(): Modules;
 }
 
+export class AzureNonce {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    static generate(): AzureNonce;
+    to_hex(): string;
+}
+
+export class AzureQuote {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+}
+
 /**
  * A parsed certificate revocation list
  */
@@ -46,6 +60,7 @@ export class Client {
      * - Returns the list of attested modules
      */
     attest(): Promise<AttestResult>;
+    attest_azure(): Promise<void>;
     /**
      * Completes end-to-end nvidia attestation. Generates nonce and validates claims all in one
      */
@@ -58,6 +73,10 @@ export class Client {
      * Performs end-to-end tdx attestation. Generates nonce and validates claims all in one
      */
     attest_tdx(): Promise<void>;
+    /**
+     * Requests and parses an Azure Quote
+     */
+    request_azure(nonce: AzureNonce): Promise<AzureQuote>;
     /**
      * Gather available attestable modules from remote attestation endpoint
      */
@@ -79,7 +98,7 @@ export class Client {
      * or measurement checks on the attestation. If you want to perform end-to-end attestation
      * please refer to [`Self::attest_sev`]
      */
-    request_sev(nonce: SevNonce): Promise<ParsedAttestation>;
+    request_sev(nonce: SevNonce): Promise<SevQuote>;
     /**
      * Requests and parses a TDX quote
      *
@@ -124,6 +143,7 @@ export class Collateral {
 export enum CpuModule {
     Sev = 0,
     Tdx = 1,
+    Azure = 2,
 }
 
 export class DecodedClaims {
@@ -163,11 +183,11 @@ export enum GpuModule {
 export class Kds {
     free(): void;
     [Symbol.dispose](): void;
-    fetch_certificates(attestation: ParsedAttestation): Promise<VerifiedChain>;
+    fetch_certificates(attestation: SevQuote): Promise<VerifiedChain>;
     /**
      * Fetches the certificate revocation list from AMD's KDS
      */
-    fetch_crl(attestation: ParsedAttestation): Promise<CRL>;
+    fetch_crl(attestation: SevQuote): Promise<CRL>;
     constructor(cache_url: string);
 }
 
@@ -200,26 +220,6 @@ export class NvidiaNonce {
     to_hex(): string;
 }
 
-/**
- * Represents a parsed attestation report with some already
- * parsed commonly accessed fields
- */
-export class ParsedAttestation {
-    private constructor();
-    free(): void;
-    [Symbol.dispose](): void;
-    cpu_fam_id(): number;
-    cpu_mod_id(): number;
-    /**
-     * Parses and constructs a new attestation report from a stream of binary data
-     */
-    static new(bytes: Uint8Array): ParsedAttestation;
-    /**
-     * Verifies the attestation report against a certificate chain
-     */
-    verify(chain: VerifiedChain, nonce: SevNonce): void;
-}
-
 export class Pcs {
     free(): void;
     [Symbol.dispose](): void;
@@ -244,13 +244,6 @@ export class QueryParams {
     with(key: string, value: string): QueryParams;
 }
 
-export class QuoteVerifier {
-    free(): void;
-    [Symbol.dispose](): void;
-    constructor(collateral: Collateral, quote: TdxQuote);
-    verify(nonce: TdxNonce): void;
-}
-
 export class ResponseHeaders {
     private constructor();
     free(): void;
@@ -267,6 +260,22 @@ export class SevNonce {
     to_hex(): string;
 }
 
+/**
+ * Represents a parsed attestation report with some already
+ * parsed commonly accessed fields
+ */
+export class SevQuote {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    cpu_fam_id(): number;
+    cpu_mod_id(): number;
+    /**
+     * Parses and constructs a new attestation report from a stream of binary data
+     */
+    static new(bytes: Uint8Array): SevQuote;
+}
+
 export class TcbLevels {
     private constructor();
     free(): void;
@@ -274,9 +283,10 @@ export class TcbLevels {
 }
 
 export class TdxNonce {
+    private constructor();
     free(): void;
     [Symbol.dispose](): void;
-    constructor();
+    static generate(): TdxNonce;
     to_hex(): string;
 }
 
@@ -290,6 +300,12 @@ export class TdxQuote {
     static from_bytes(quote: Uint8Array): TdxQuote;
 }
 
+export class TdxQuoteVerifier {
+    free(): void;
+    [Symbol.dispose](): void;
+    constructor(collateral: Collateral);
+}
+
 /**
  * A chain which has been cryptographically verified
  */

package/reticle.js

@@ -5,5 +5,5 @@ import { __wbg_set_wasm } from "./reticle_bg.js";
 __wbg_set_wasm(wasm);
 wasm.__wbindgen_start();
 export {
-    AttestHeaders, AttestResult, CRL, Client, ClientBuilder, Collateral, CpuModule, DecodedClaims, EATToken, ExportPem, GatewayError, GpuModule, Kds, KeyChain, Modules, NvidiaAttestResult, NvidiaNonce, ParsedAttestation, Pcs, QueryParams, QuoteVerifier, ResponseHeaders, SevNonce, TcbLevels, TdxNonce, TdxQuote, VerifiedChain, fetch, fetch_keychain
+    AttestHeaders, AttestResult, AzureNonce, AzureQuote, CRL, Client, ClientBuilder, Collateral, CpuModule, DecodedClaims, EATToken, ExportPem, GatewayError, GpuModule, Kds, KeyChain, Modules, NvidiaAttestResult, NvidiaNonce, Pcs, QueryParams, ResponseHeaders, SevNonce, SevQuote, TcbLevels, TdxNonce, TdxQuote, TdxQuoteVerifier, VerifiedChain, fetch, fetch_keychain
 } from "./reticle_bg.js";