@zeke-02/tinfoil 0.0.5 → 0.0.7

package/dist/verifier.d.ts

@@ -5,6 +5,14 @@ export interface AttestationMeasurement {
     type: string;
     registers: string[];
 }
+/**
+ * Hardware measurement from TDX platform verification
+ */
+export interface HardwareMeasurement {
+    ID: string;
+    MRTD: string;
+    RTMR0: string;
+}
 /**
  * Attestation response containing cryptographic keys and measurements
  * At least one of tlsPublicKeyFingerprint or hpkePublicKey must be present
@@ -31,6 +39,12 @@ export interface VerificationDocument {
     releaseDigest: string;
     codeMeasurement: AttestationMeasurement;
     enclaveMeasurement: AttestationResponse;
+    tlsPublicKey: string;
+    hpkePublicKey: string;
+    hardwareMeasurement?: HardwareMeasurement;
+    codeFingerprint: string;
+    enclaveFingerprint: string;
+    selectedRouterEndpoint: string;
     securityVerified: boolean;
     steps: {
         fetchDigest: VerificationStepState;
@@ -42,29 +56,19 @@ export interface VerificationDocument {
         otherError?: VerificationStepState;
     };
 }
-export interface MeasurementComparisonResult {
-    match: boolean;
-    error?: Error;
-}
-export declare function compareMeasurementsDetailed(codeMeasurement: AttestationMeasurement, runtimeMeasurement: AttestationMeasurement): MeasurementComparisonResult;
-/**
- * Compare two measurements according to platform-specific rules
- * This is predicate function for comparing attestation measurements
- * taken from https://github.com/tinfoilsh/verifier/blob/main/attestation/attestation.go
- *
- * @param codeMeasurement - Expected measurement from code attestation
- * @param runtimeMeasurement - Actual measurement from runtime attestation
- * @returns true if measurements match according to platform rules
- */
-export declare function compareMeasurements(codeMeasurement: AttestationMeasurement, runtimeMeasurement: AttestationMeasurement): boolean;
 /**
  * Verifier performs attestation verification for Tinfoil enclaves
  *
- * The verifier loads a WebAssembly module that:
+ * The verifier loads a WebAssembly module (compiled from Go) that performs
+ * end-to-end attestation verification:
  * 1. Fetches the latest code release digest from GitHub
- * 2. Performs runtime attestation against the enclave
- * 3. Performs code attestation using the digest
- * 4. Compares measurements using platform-specific logic
+ * 2. Verifies code provenance using Sigstore/Rekor
+ * 3. Performs runtime attestation against the enclave
+ * 4. Verifies hardware measurements (for TDX platforms)
+ * 5. Compares code and runtime measurements using platform-specific logic
+ *
+ * Primary method: verify() - Returns AttestationResponse with cryptographic keys
+ * Verification details: getVerificationDocument() - Returns step-by-step results
  */
 export declare class Verifier {
     private static goInstance;
@@ -86,56 +90,52 @@ export declare class Verifier {
      */
     private static executeWithWasm;
     /**
-     * Fetch the latest release digest from GitHub
-     * @param configRepo - Repository name (e.g., "tinfoilsh/confidential-model-router")
-     * @returns The digest hash
-     */
-    fetchLatestDigest(configRepo?: string): Promise<string>;
-    /**
-     * Perform runtime attestation on the enclave
-     * @param enclaveHost - The enclave hostname
-     * @returns Attestation response with measurement and keys
-     */
-    verifyEnclave(enclaveHost?: string): Promise<AttestationResponse>;
-    /**
-     * Perform code attestation
-     * @param configRepo - Repository name
-     * @param digest - Code digest hash
-     * @returns Code measurement
-     */
-    verifyCode(configRepo: string, digest: string): Promise<{
-        measurement: AttestationMeasurement;
-    }>;
-    /**
-     * Perform attestation verification
+     * Perform end-to-end attestation verification
      *
-     * This method:
+     * This method performs all verification steps atomically via the Go WASM verify() function:
      * 1. Fetches the latest code digest from GitHub releases
-     * 2. Calls verifyCode to get the expected measurement for the code
-     * 3. Calls verifyEnclave to get the actual runtime measurement
-     * 4. Compares measurements using platform-specific logic (see `compareMeasurements()`)
-     * 5. Returns the attestation response if verification succeeds
+     * 2. Verifies code provenance using Sigstore/Rekor
+     * 3. Performs runtime attestation against the enclave
+     * 4. Verifies hardware measurements (for TDX platforms)
+     * 5. Compares code and runtime measurements using platform-specific logic
      *
      * The WASM runtime is automatically initialized and cleaned up within this method.
+     * A detailed verification document is saved and can be accessed via getVerificationDocument().
      *
-     * @throws Error if measurements don't match or verification fails
+     * @returns AttestationResponse containing cryptographic keys (TLS/HPKE) and enclave measurement
+     * @throws Error if measurements don't match or verification fails at any step
      */
     verify(): Promise<AttestationResponse>;
+    /**
+     * Save a failed verification document
+     */
+    private saveFailedVerificationDocument;
     /**
      * Internal verification logic that runs within WASM context
      */
     private verifyInternal;
     /**
-     * Returns the full verification document from the last successful verify() call
+     * Returns the verification document from the last verify() call
+     *
+     * The document contains detailed step-by-step verification results including:
+     * - Step status (pending/success/failed) for each verification phase
+     * - Measurements, fingerprints, and cryptographic keys
+     * - Error messages for any failed steps
+     *
+     * Available even if verification failed, allowing inspection of which step failed.
+     *
+     * @returns VerificationDocument with complete verification details, or undefined if verify() hasn't been called
      */
     getVerificationDocument(): VerificationDocument | undefined;
 }
 /**
  * Control WASM log output
  *
- * The Go WASM runtime outputs logs through a polyfilled fs.writeSync.
+ * The Go WASM runtime outputs logs (stdout/stderr) through a polyfilled fs.writeSync.
  * This function allows suppressing those logs without affecting other console output.
+ * By default, WASM logs are suppressed to reduce noise.
  *
  * @param suppress - Whether to suppress WASM logs (default: true)
+ * @returns void
  */
 export declare function suppressWasmLogs(suppress?: boolean): void;