Secure Enclaves

import { Tenzro } from 'tenzro';

const tenzro = new Tenzro();

const enclave = await tenzro.enclaves.create({
  name: 'secure-inference',
  type: 'amd-sev-snp', // or 'intel-tdx'
  size: 'medium',      // small, medium, large
  region: 'us-central1',
});

console.log('Enclave ID:', enclave.id);
console.log('Status:', enclave.status);

// Get attestation report
const attestation = await tenzro.enclaves.attest(enclave.id);

console.log('Report:', attestation.report);
console.log('Measurement:', attestation.measurement);
console.log('Platform:', attestation.platform);

// Verify attestation (client-side)
const isValid = await tenzro.enclaves.verifyAttestation(attestation, {
  expectedMeasurement: 'sha384:abc123...',
  trustedPlatformKeys: ['key1', 'key2'],
});

if (!isValid) {
  throw new Error('Attestation verification failed');
}

// Deploy a function to the enclave
const deployment = await tenzro.enclaves.deploy(enclave.id, {
  runtime: 'nodejs20',
  code: `
    export async function handler(input) {
      // This code runs inside the enclave
      const result = await processSecureData(input.data);
      return { result };
    }
  `,
  memory: 512,
});

// Invoke the enclave function
const result = await tenzro.enclaves.invoke(enclave.id, {
  function: 'handler',
  input: {
    data: encryptedData,
  },
});

// Generate keys inside enclave
const keyPair = await tenzro.enclaves.generateKey(enclave.id, {
  algorithm: 'ed25519',
  exportable: false, // Key never leaves enclave
});

// Sign data with enclave-protected key
const signature = await tenzro.enclaves.sign(enclave.id, {
  keyId: keyPair.id,
  data: dataToSign,
});

// Encrypt data with enclave key
const encrypted = await tenzro.enclaves.encrypt(enclave.id, {
  keyId: keyPair.id,
  plaintext: sensitiveData,
});

// Run AI inference on sensitive data
const response = await tenzro.enclaves.inference(enclave.id, {
  model: 'gemini-2.5-flash',
  messages: [
    { role: 'user', content: sensitivePrompt },
  ],
  // Data is decrypted only inside the enclave
  encryptedContext: encryptedPatientRecords,
});

// Response is encrypted before leaving enclave
const decryptedResponse = await decrypt(response.encrypted);

// List enclaves
const enclaves = await tenzro.enclaves.list();

// Get enclave details
const details = await tenzro.enclaves.get(enclaveId);

// Update enclave
await tenzro.enclaves.update(enclaveId, {
  size: 'large',
});

// Delete enclave
await tenzro.enclaves.delete(enclaveId);