Skip to main content

​
@spellguard/ctls

Cloud Transport Layer Security for attestation and verification.

​
Client Functions

FunctionDescription
fetchAndVerifyVerifier(url, hash)Fetch and verify Verifier attestation
verifyVerifierAttestation(doc, hash)Verify an attestation document
buildEvidence(options)Build evidence claims
signEvidence(evidence, key)Sign evidence with Ed25519

​
Server Functions

FunctionDescription
generateSessionKeys()Generate ephemeral session keys (RAM-only)
generateAttestationDocument(nonce)Generate Verifier attestation
verifyEvidence(evidence)Verify client evidence
registerAgent(agent)Register an authenticated agent
rotateChannelToken(agentId)Rotate an agent’s channel token

​
Usage Example

import {
  fetchAndVerifyVerifier,
  buildEvidence,
  signEvidence
} from '@spellguard/ctls';

// Client-side: Verify the Verifier
const verifier = await fetchAndVerifyVerifier(
  'https://verifier.example.com',
  'sha384:expected-image-hash...'
);

if (!verifier.verified) {
  throw new Error(`Verification failed: ${verifier.error}`);
}

// Build and sign evidence
const evidence = buildEvidence({
  agentId: 'my-agent',
  codeHash: 'sha256:...',
  endpoint: 'https://my-agent.com/_spellguard/receive',
  agentCardUrl: 'https://my-agent.com/.well-known/agent.json',
});

const signed = await signEvidence(evidence, privateKey);