@phala/dstack-sdk
Advanced tools
The dstack SDK provides a JavaScript/TypeScript client for secure communication with the dstack Trusted Execution Environment (TEE). This SDK enables applications to derive cryptographic keys, generate remote attestation quotes, and perform other security-critical operations within confidential computing environments.
npm install @phala/dstack-sdk
The dstack SDK enables secure communication with dstack Trusted Execution Environment (TEE) instances. dstack applications are defined using app-compose.json (based on the AppCompose structure) and deployed as containerized applications using Docker Compose.
dstack applications consist of:
app-compose.json defining app metadata, security settings, and Docker Compose content/var/run/dstack.sock)To use the SDK, your Docker Compose configuration must bind-mount the dstack socket:
# docker-compose.yml
services:
your-app:
image: your-app-image
volumes:
- /var/run/dstack.sock:/var/run/dstack.sock # dstack OS 0.5.x
# For dstack OS 0.3.x compatibility (deprecated):
# - /var/run/tappd.sock:/var/run/tappd.sock
First, ensure your dstack application is properly configured:
1. App Configuration (app-compose.json)
{
"manifest_version": 1,
"name": "my-secure-app",
"runner": "docker-compose",
"docker_compose_file": "services:\n app:\n build: .\n volumes:\n - /var/run/dstack.sock:/var/run/dstack.sock\n environment:\n - NODE_ENV=production",
"public_tcbinfo": true,
"kms_enabled": false,
"gateway_enabled": false
}
Note: The docker_compose_file field contains the actual Docker Compose YAML content as a string, not a file path.
import { DstackClient } from '@phala/dstack-sdk';
// Create client - automatically connects to /var/run/dstack.sock
const client = new DstackClient();
// For local development with simulator
const devClient = new DstackClient('http://localhost:8090');
// Get TEE instance information
const info = await client.info();
console.log('App ID:', info.app_id);
console.log('Instance ID:', info.instance_id);
console.log('App Name:', info.app_name);
console.log('TCB Info:', info.tcb_info);
// Derive deterministic keys for blockchain applications
const walletKey = await client.getKey('wallet/ethereum', 'mainnet');
console.log('Derived key (32 bytes):', walletKey.key); // secp256k1 private key
console.log('Signature chain:', walletKey.signature_chain); // Authenticity proof
// Generate remote attestation quote
const applicationData = JSON.stringify({
version: '1.0.0',
timestamp: Date.now(),
user_id: 'alice'
});
const quote = await client.getQuote(applicationData);
console.log('TDX Quote:', quote.quote);
console.log('Event Log:', quote.event_log);
// Verify measurement registers
const rtmrs = quote.replayRtmrs();
console.log('RTMR0-3:', rtmrs);
/var/run/dstack.sock (current)/var/run/tappd.sock (deprecated but supported)The SDK automatically detects the correct socket path, but you must ensure the appropriate volume binding in your Docker Compose configuration.
Generate fresh TLS certificates with optional Remote Attestation support. Important: getTlsKey() generates random keys on each call - it's designed specifically for TLS/SSL scenarios where fresh keys are required.
// Generate TLS certificate with different usage scenarios
const tlsKey = await client.getTlsKey({
subject: 'my-secure-service', // Certificate common name
altNames: ['localhost', '127.0.0.1'], // Additional valid domains/IPs
usageRaTls: true, // Include remote attestation
usageServerAuth: true, // Enable server authentication (default)
usageClientAuth: false // Disable client authentication
});
console.log('Private Key (PEM):', tlsKey.key);
console.log('Certificate Chain:', tlsKey.certificate_chain);
// ⚠️ WARNING: Each call generates a different key
const tlsKey1 = await client.getTlsKey();
const tlsKey2 = await client.getTlsKey();
// tlsKey1.key !== tlsKey2.key (always different!)
[!NOTE] This feature isn't available in the simulator. We recommend sticking with
report_datafor most cases since it's simpler and safer to use. If you're not super familiar with SGX/TDX attestation quotes, it's best to avoid adding data directly into quotes as it could cause verification issues.
Extend RTMR3 with custom events for audit trails:
// Emit custom events (requires dstack OS 0.5.0+)
await client.emitEvent('user-action', JSON.stringify({
action: 'transfer',
amount: 1000,
timestamp: Date.now()
}));
// Events are automatically included in subsequent quotes
const quote = await client.getQuote('audit-data');
const events = JSON.parse(quote.event_log);
import { toViemAccount, toViemAccountSecure } from '@phala/dstack-sdk/viem';
import { createWalletClient, http } from 'viem';
import { mainnet } from 'viem/chains';
const keyResult = await client.getKey('ethereum/main', 'wallet');
// Standard account creation
const account = toViemAccount(keyResult);
// Enhanced security with SHA256 hashing (recommended)
const secureAccount = toViemAccountSecure(keyResult);
const wallet = createWalletClient({
account: secureAccount,
chain: mainnet,
transport: http()
});
// Use wallet for transactions
const hash = await wallet.sendTransaction({
to: '0x...',
value: parseEther('0.1')
});
import { toKeypair, toKeypairSecure } from '@phala/dstack-sdk/solana';
import { Connection, PublicKey, Transaction, SystemProgram } from '@solana/web3.js';
const keyResult = await client.getKey('solana/main', 'wallet');
// Standard keypair creation
const keypair = toKeypair(keyResult);
// Enhanced security with SHA256 hashing (recommended)
const secureKeypair = toKeypairSecure(keyResult);
const connection = new Connection('https://api.mainnet-beta.solana.com');
// Create and send transaction
const transaction = new Transaction().add(
SystemProgram.transfer({
fromPubkey: secureKeypair.publicKey,
toPubkey: new PublicKey('...'),
lamports: 1000000
})
);
const signature = await connection.sendTransaction(transaction, [secureKeypair]);
Important: This feature is specifically for deployment-time security, not runtime SDK operations.
The SDK provides end-to-end encryption capabilities for securely transmitting sensitive environment variables during dstack application deployment. When deploying applications to TEE instances, sensitive configuration data (API keys, database credentials, private keys, etc.) needs to be securely transmitted from the deployment client to the TEE application.
During application deployment, sensitive data must traverse:
process.envThis ensures true end-to-end encryption where deployment infrastructure never sees plaintext secrets.
Your app-compose.json should specify which environment variables are allowed:
{
"manifest_version": 1,
"name": "secure-app",
"runner": "docker-compose",
"docker_compose_file": "services:\n app:\n build: .\n volumes:\n - /var/run/dstack.sock:/var/run/dstack.sock\n environment:\n - API_KEY\n - DATABASE_URL\n - PRIVATE_KEY",
"allowed_envs": ["API_KEY", "DATABASE_URL", "PRIVATE_KEY"],
"kms_enabled": true
}
import { encryptEnvVars, verifyEnvEncryptPublicKey, type EnvVar } from '@phala/dstack-sdk';
// 1. Define sensitive environment variables
const envVars: EnvVar[] = [
{ key: 'DATABASE_URL', value: 'postgresql://user:pass@host:5432/db' },
{ key: 'API_SECRET_KEY', value: 'your-secret-key' },
{ key: 'JWT_PRIVATE_KEY', value: '-----BEGIN PRIVATE KEY-----\n...' },
{ key: 'WALLET_MNEMONIC', value: 'abandon abandon abandon...' }
];
// 2. Obtain encryption public key from KMS API (dstack-vmm or Phala Cloud)
const response = await fetch('/prpc/GetAppEnvEncryptPubKey?json', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ app_id: 'your-app-id-hex' })
});
const { public_key, signature } = await response.json();
// 3. Verify KMS API authenticity to prevent man-in-the-middle attacks
const publicKeyBytes = new Uint8Array(Buffer.from(public_key, 'hex'));
const signatureBytes = new Uint8Array(Buffer.from(signature, 'hex'));
const trustedPubkey = verifyEnvEncryptPublicKey(publicKeyBytes, signatureBytes, 'your-app-id-hex');
if (!trustedPubkey) {
throw new Error('KMS API provided untrusted encryption key');
}
console.log('Verified KMS public key:', trustedPubkey);
// 4. Encrypt environment variables for secure deployment
const encryptedData = await encryptEnvVars(envVars, public_key);
console.log('Encrypted payload:', encryptedData);
// 5. Deploy with encrypted configuration
await deployDstackApp({
app_id: 'your-app-id-hex',
encrypted_env: encryptedData,
// ... other deployment parameters
});
The environment encryption system provides several security guarantees:
End-to-End Encryption: Environment variables are encrypted on the client side and can only be decrypted by the target dstack application inside the TEE. Even the deployment infrastructure cannot access the plaintext values.
KMS Authenticity Verification: The verifyEnvEncryptPublicKey function validates that the encryption public key comes from a trusted KMS (Key Management Service), preventing man-in-the-middle attacks during key exchange.
Forward Secrecy: Each encryption operation uses ephemeral X25519 keypairs, ensuring that compromising long-term keys cannot decrypt past communications.
Authenticated Encryption: AES-256-GCM provides both confidentiality and integrity protection, detecting any tampering with encrypted data.
The encryption process follows this cryptographic protocol:
ephemeral_pubkey(32) + iv(12) + encrypted_data + auth_tag(16)// Detailed encryption example
const envVars = [{ key: 'SECRET', value: 'sensitive-data' }];
const kmsPublicKey = '0xa1b2c3d4...'; // From trusted KMS API
const encrypted = await encryptEnvVars(envVars, kmsPublicKey);
// encrypted = "a1b2c3..." (hex string)
// Inside dstack application, the encrypted data is automatically decrypted
// and made available as environment variables:
console.log(process.env.SECRET); // "sensitive-data"
The verification function ensures the encryption public key comes from a legitimate KMS:
import { verifyEnvEncryptPublicKey } from '@phala/dstack-sdk';
/**
* Verify KMS-provided encryption public key authenticity
*
* @param publicKey - X25519 public key bytes (32 bytes)
* @param signature - secp256k1 signature from KMS (65 bytes)
* @param appId - Target application ID (hex string)
* @returns Compressed secp256k1 public key of KMS if valid, null if invalid
*/
const kmsIdentity = verifyEnvEncryptPublicKey(publicKeyBytes, signatureBytes, appId);
if (kmsIdentity) {
console.log('Trusted KMS identity:', kmsIdentity);
// Proceed with encryption using the verified public key
} else {
throw new Error('KMS signature verification failed - potential MITM attack');
}
The KMS signature covers the following message structure:
message = "dstack-env-encrypt-pubkey" + ":" + app_id + public_key
signature = secp256k1.sign(keccak256(message), kms_private_key)
This binds the encryption key to a specific application ID and prevents key substitution attacks.
The SDK implements secure key derivation using:
// Each path generates a unique, deterministic key
const wallet1 = await client.getKey('app1/wallet', 'ethereum');
const wallet2 = await client.getKey('app2/wallet', 'ethereum');
// wallet1.key !== wallet2.key (guaranteed different)
const sameWallet = await client.getKey('app1/wallet', 'ethereum');
// wallet1.key === sameWallet.key (guaranteed identical)
TDX quotes provide cryptographic proof of:
const applicationState = JSON.stringify({
version: '1.0.0',
config_hash: 'sha256:...',
timestamp: Date.now()
});
const quote = await client.getQuote(applicationState);
// Quote can be verified by external parties to confirm:
// 1. Application is running in genuine TEE
// 2. Application code matches expected measurements
// 3. Application state is authentic and unmodified
The encryption scheme uses:
For development without physical TDX hardware:
# Clone and build simulator
git clone https://github.com/Dstack-TEE/dstack.git
cd dstack/sdk/simulator
./build.sh
./dstack-simulator
# Set environment variable
export DSTACK_SIMULATOR_ENDPOINT=http://localhost:8090
const client = new DstackClient();
// Check if dstack service is available
const isAvailable = await client.isReachable();
if (!isAvailable) {
console.error('dstack service is not reachable');
process.exit(1);
}
new DstackClient(endpoint?: string)
Parameters:
endpoint (optional): Connection endpoint
/var/run/dstack.sockhttp://localhost:8090DSTACK_SIMULATOR_ENDPOINTProduction App Configuration:
The Docker Compose configuration is embedded in app-compose.json:
{
"manifest_version": 1,
"name": "production-app",
"runner": "docker-compose",
"docker_compose_file": "services:\n app:\n image: your-app\n volumes:\n - /var/run/dstack.sock:/var/run/dstack.sock\n environment:\n - NODE_ENV=production",
"public_tcbinfo": true
}
Important: The docker_compose_file contains YAML content as a string, ensuring the volume binding for /var/run/dstack.sock is included.
info(): Promise<InfoResponse>Retrieves comprehensive information about the TEE instance.
Returns: InfoResponse
app_id: Unique application identifierinstance_id: Unique instance identifierapp_name: Application name from configurationdevice_id: TEE device identifiertcb_info: Trusted Computing Base information
mrtd: Measurement of TEE domainrtmr0-3: Runtime Measurement Registersevent_log: Boot and runtime eventsos_image_hash: Operating system measurementcompose_hash: Application configuration hashapp_cert: Application certificate in PEM formatkey_provider_info: Key management configurationgetKey(path: string, purpose?: string): Promise<GetKeyResponse>Derives a deterministic secp256k1/K256 private key for blockchain and Web3 applications. This is the primary method for obtaining cryptographic keys for wallets, signing, and other deterministic key scenarios.
Parameters:
path: Unique identifier for key derivation (e.g., "wallet/ethereum", "signing/solana")purpose (optional): Additional context for key usage (default: "")Returns: GetKeyResponse
key: 32-byte secp256k1 private key as Uint8Array (suitable for Ethereum, Bitcoin, Solana, etc.)signature_chain: Array of cryptographic signatures proving key authenticityKey Characteristics:
Use Cases:
// Examples of deterministic key derivation
const ethWallet = await client.getKey('wallet/ethereum', 'mainnet');
const btcWallet = await client.getKey('wallet/bitcoin', 'mainnet');
const solWallet = await client.getKey('wallet/solana', 'mainnet');
// Same path always returns same key
const key1 = await client.getKey('my-app/signing');
const key2 = await client.getKey('my-app/signing');
// key1.key === key2.key (guaranteed identical)
// Different paths return different keys
const userA = await client.getKey('user/alice/wallet');
const userB = await client.getKey('user/bob/wallet');
// userA.key !== userB.key (guaranteed different)
getQuote(reportData: string | Buffer | Uint8Array): Promise<GetQuoteResponse>Generates a TDX attestation quote containing the provided report data.
Parameters:
reportData: Data to include in quote (max 64 bytes)Returns: GetQuoteResponse
quote: TDX quote as hex stringevent_log: JSON string of system eventsreplayRtmrs(): Function returning computed RTMR valuesUse Cases:
getTlsKey(options?: TlsKeyOptions): Promise<GetTlsKeyResponse>Generates a fresh, random TLS key pair with X.509 certificate for TLS/SSL connections. Important: This method generates different keys on each call - use getKey() for deterministic keys.
Parameters: TlsKeyOptions
path (optional): Path parameter (unused in current implementation)subject (optional): Certificate subject (Common Name) - typically the domain name (default: "")altNames (optional): Subject Alternative Names - additional domains/IPs for the certificate (default: [])usageRaTls (optional): Include TDX attestation quote in certificate extension for remote verification (default: false)usageServerAuth (optional): Enable server authentication - allows certificate to authenticate servers (default: true)usageClientAuth (optional): Enable client authentication - allows certificate to authenticate clients (default: false)Returns: GetTlsKeyResponse
key: Private key in PEM format (X.509/PKCS#8)certificate_chain: Certificate chain arrayKey Characteristics:
Certificate Usage Scenarios:
Standard HTTPS Server (usageServerAuth: true, usageClientAuth: false)
Remote Attestation Server (usageRaTls: true)
mTLS Client Certificate (usageServerAuth: false, usageClientAuth: true)
Dual-Purpose Certificate (usageServerAuth: true, usageClientAuth: true)
// Example 1: Standard HTTPS server certificate
const serverCert = await client.getTlsKey({
subject: 'api.example.com',
altNames: ['api.example.com', 'www.api.example.com', '10.0.0.1']
// usageServerAuth: true (default) - allows server authentication
// usageClientAuth: false (default) - no client authentication
});
// Example 2: Certificate with remote attestation (RA-TLS)
const attestedCert = await client.getTlsKey({
subject: 'secure-api.example.com',
usageRaTls: true // Include TDX quote for remote verification
// Clients can verify the TEE environment through the certificate
});
// Example 3: Mutual TLS (mTLS) certificate for client authentication
const clientCert = await client.getTlsKey({
subject: 'client.example.com',
usageServerAuth: false, // This certificate won't authenticate servers
usageClientAuth: true // Enable client authentication
});
// Example 4: Certificate for both server and client authentication
const dualUseCert = await client.getTlsKey({
subject: 'dual.example.com',
usageServerAuth: true, // Can authenticate as server
usageClientAuth: true // Can authenticate as client
});
// ⚠️ Each call generates different keys (unlike getKey)
const cert1 = await client.getTlsKey();
const cert2 = await client.getTlsKey();
// cert1.key !== cert2.key (always different)
// Use with Node.js HTTPS server
import https from 'https';
const server = https.createServer({
key: serverCert.key,
cert: serverCert.certificate_chain.join('\n')
}, app);
emitEvent(event: string, payload: string | Buffer | Uint8Array): Promise<void>Extends RTMR3 with a custom event for audit logging.
Parameters:
event: Event identifier stringpayload: Event dataRequirements:
isReachable(): Promise<boolean>Tests connectivity to the dstack service.
Returns: boolean indicating service availability
import { getComposeHash } from '@phala/dstack-sdk';
const appCompose = {
manifest_version: 1,
name: 'my-app',
runner: 'docker-compose',
docker_compose_file: 'docker-compose.yml'
};
const hash = getComposeHash(appCompose);
console.log('Configuration hash:', hash);
Verify the authenticity of encryption public keys provided by KMS APIs:
import { verifyEnvEncryptPublicKey } from '@phala/dstack-sdk';
// Example: Verify KMS-provided encryption key
const publicKey = Buffer.from('e33a1832c6562067ff8f844a61e51ad051f1180b66ec2551fb0251735f3ee90a', 'hex');
const signature = Buffer.from('8542c49081fbf4e03f62034f13fbf70630bdf256a53032e38465a27c36fd6bed7a5e7111652004aef37f7fd92fbfc1285212c4ae6a6154203a48f5e16cad2cef00', 'hex');
const appId = '0000000000000000000000000000000000000000';
const kmsIdentity = verifyEnvEncryptPublicKey(
new Uint8Array(publicKey),
new Uint8Array(signature),
appId
);
if (kmsIdentity) {
console.log('Trusted KMS identity:', kmsIdentity);
// Safe to use the public key for encryption
} else {
console.error('KMS signature verification failed');
// Potential man-in-the-middle attack
}
Key Management
Remote Attestation
TLS Configuration
Error Handling
The legacy deriveKey() method mixed two different use cases that have now been properly separated:
getKey(): Deterministic key derivation for Web3/blockchain (secp256k1)getTlsKey(): Random TLS certificate generation for HTTPS/SSL| Feature | getKey() | getTlsKey() |
|---|---|---|
| Purpose | Web3/Blockchain keys | TLS/SSL certificates |
| Key Generation | Deterministic (same input = same key) | Random (different every call) |
| Key Format | Raw 32-byte secp256k1 private key | PEM-formatted X.509 private key |
| Use Cases | Wallets, signing, DeFi, NFT | HTTPS servers, mTLS, secure APIs |
| Algorithm/Curve | ECDSA/secp256k1 (k256) | ECDSA/NIST P-256 |
| Returns | { key: Uint8Array, signature_chain } | { key: string (PEM), certificate_chain } |
| Reproducible | ✅ Yes (same path = same key) | ❌ No (random each time) |
| Blockchain Ready | ✅ Yes (Ethereum, Bitcoin, Solana) | ❌ No (TLS-specific format) |
| Certificate | ❌ No certificate | ✅ Yes (X.509 certificate chain) |
| RA-TLS Support | ❌ No | ✅ Yes (optional) |
Use getKey() when you need:
Use getTlsKey() when you need:
⚠️ BREAKING CHANGE: TappdClient is deprecated and will be removed. All users must migrate to DstackClient.
| Component | TappdClient (Old) | DstackClient (New) | Status |
|---|---|---|---|
| Socket Path | /var/run/tappd.sock | /var/run/dstack.sock | ✅ Updated |
| HTTP URL Format | http://localhost/prpc/Tappd.<Method> | http://localhost/<Method> | ✅ Simplified |
| K256 Key Method | DeriveK256Key(...) | GetKey(...) | ✅ Renamed |
| TLS Certificate Method | DeriveKey(...) | GetTlsKey(...) | ✅ Separated |
| TDX Quote (Hash) | TdxQuote(...) | ❌ Removed | ⚠️ No longer supported |
| TDX Quote (Raw) | RawQuote(...) | GetQuote(report_data) | ✅ Renamed |
// ❌ OLD - TappdClient.deriveKey() (DEPRECATED)
import { TappdClient } from '@phala/dstack-sdk';
const client = new TappdClient();
const result = await client.deriveKey('wallet/ethereum', 'mainnet');
// This actually returned deterministic keys (confusing!)
// ✅ NEW - DstackClient.getKey() (RECOMMENDED)
import { DstackClient } from '@phala/dstack-sdk';
const client = new DstackClient();
const result = await client.getKey('wallet/ethereum', 'mainnet');
// Clear intent: deterministic key for blockchain usage
// ❌ OLD - TappdClient.deriveKey() with TLS options (CONFUSING)
import { TappdClient } from '@phala/dstack-sdk';
const client = new TappdClient();
const result = await client.deriveKey('server', 'api.example.com', ['localhost']);
// Mixed deterministic keys with TLS concepts
// ✅ NEW - DstackClient.getTlsKey() (CLEAR PURPOSE)
import { DstackClient } from '@phala/dstack-sdk';
const client = new DstackClient();
const result = await client.getTlsKey({
subject: 'api.example.com',
altNames: ['localhost']
});
// Clear intent: random TLS certificate generation
// Before
import { TappdClient } from '@phala/dstack-sdk';
const client = new TappdClient();
// After
import { DstackClient } from '@phala/dstack-sdk';
const client = new DstackClient();
For Web3/Blockchain (95% of use cases):
// Before: deriveKey() for wallet/signing
const walletKey = await client.deriveKey('wallet', 'ethereum');
// After: getKey() for deterministic keys
const walletKey = await client.getKey('wallet', 'ethereum');
For TLS/SSL Certificates:
// Before: deriveKey() with subject/altNames
const tlsCert = await client.deriveKey('api', 'example.com', ['localhost']);
// After: getTlsKey() with proper options
const tlsCert = await client.getTlsKey({
subject: 'example.com',
altNames: ['localhost']
});
// Viem (Ethereum)
import { toViemAccountSecure } from '@phala/dstack-sdk/viem';
// Before
const keyResult = await tappdClient.deriveKey('wallet');
const account = toViemAccount(keyResult); // Basic security
// After
const keyResult = await dstackClient.getKey('wallet', 'ethereum');
const account = toViemAccountSecure(keyResult); // Enhanced security
// Solana
import { toKeypairSecure } from '@phala/dstack-sdk/solana';
// Before
const keyResult = await tappdClient.deriveKey('wallet');
const keypair = toKeypair(keyResult); // Basic security
// After
const keyResult = await dstackClient.getKey('wallet', 'solana');
const keypair = toKeypairSecure(keyResult); // Enhanced security
TappdClient will be removed in future versions⚠️ SECURITY VULNERABILITY: Legacy blockchain integration functions have security flaws:
toViemAccount(): Uses raw key material without proper hashing - VULNERABLEtoKeypair(): Uses raw key material without proper hashing - VULNERABLE✅ SECURE ALTERNATIVES: Always use the secure versions:
toViemAccountSecure(): Applies SHA256 hashing for enhanced securitytoKeypairSecure(): Applies SHA256 hashing for enhanced securityTappdClient remains functional for now but shows deprecation warningsDstackClient.deriveKey() throws an error - forcing migration to correct methodsDocker Volume Binding:
# Old (dstack OS 0.3.x)
volumes:
- /var/run/tappd.sock:/var/run/tappd.sock
# New (dstack OS 0.5.x)
volumes:
- /var/run/dstack.sock:/var/run/dstack.sock
Environment Variables:
# Old
TAPPD_SIMULATOR_ENDPOINT=http://localhost:8090
# New
DSTACK_SIMULATOR_ENDPOINT=http://localhost:8090
⚠️ MAJOR BREAKING CHANGE - TDX Quote Methods:
// ❌ OLD - TappdClient with hash algorithms (REMOVED)
const client = new TappdClient();
await client.tdxQuote('user-data', 'sha256'); // Hash applied automatically
await client.tdxQuote('user-data', 'keccak256'); // Multiple algorithms supported
await client.tdxQuote('user-data', 'raw'); // Raw mode
// ✅ NEW - DstackClient raw data only (BREAKING CHANGE)
const client = new DstackClient();
await client.getQuote('user-data'); // Raw data only, max 64 bytes
Critical Changes:
getQuote() only accepts raw data, no automatic hashinggetQuote()Migration Example:
// Old approach with automatic hashing
const result = await tappdClient.tdxQuote('my-application-data', 'sha256');
// New approach - manual hashing if needed
import { createHash } from 'crypto';
const hash = createHash('sha256').update('my-application-data').digest();
const result = await dstackClient.getQuote(hash); // hash is 32 bytes
Key Derivation Methods:
// Old internal method names (handled automatically by SDK)
// DeriveK256Key -> GetKey
// DeriveKey -> GetTlsKey
// RawQuote -> GetQuote
Infrastructure Updates:
/var/run/dstack.sockTAPPD_* to DSTACK_*Client Code Updates:
TappdClient with DstackClientderiveKey() calls with appropriate method:
getKey() for Web3/blockchain keys (deterministic)getTlsKey() for TLS certificates (random)tdxQuote() calls with getQuote()'sha256', 'keccak256', etc.)toViemAccount() with toViemAccountSecure() (Ethereum)toKeypair() with toKeypairSecure() (Solana)Testing:
toViemAccountSecure() onlytoKeypairSecure() onlyApache License 2.0
FAQs
dstack SDK
The npm package @phala/dstack-sdk receives a total of 2,150 weekly downloads. As such, @phala/dstack-sdk popularity was classified as popular.
We found that @phala/dstack-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket is launching experimental protection for the Hugging Face ecosystem, scanning for malware and malicious payload injections inside model files to prevent silent AI supply chain attacks.
Research
/Security News
The Socket Threat Research Team uncovered a coordinated campaign that floods the Chrome Web Store with 131 rebranded clones of a WhatsApp Web automation extension to spam Brazilian users.
Security News
ENISA’s 2025 Threat Landscape report highlights how AI is reshaping cyber attacks, driving phishing, model poisoning, and software supply chain risks.