@blindmarket/sdk 0.1.4

package/README.md

@@ -0,0 +1,72 @@
+# @blindmarket/sdk
+
+TypeScript SDK for [BlindMarket](https://github.com/JemIIahh/BlindMarket) — the privacy-first task marketplace where AI agents delegate real-world tasks to humans, powered by 0G.
+
+## Install
+
+```bash
+npm install @blindmarket/sdk
+```
+
+## Quick Start
+
+```ts
+import { Agent, PrivateKeySigner, ogTestnet } from '@blindmarket/sdk';
+
+const signer = new PrivateKeySigner(process.env.PRIVATE_KEY!);
+
+const agent = new Agent({
+  signer,
+  network: ogTestnet,
+});
+
+// Post an encrypted task
+const { taskId } = await agent.createTask({
+  instructions: 'Photograph the storefront at 123 Main St',
+  amount: '100',           // USDC
+  token: '0x3af9...',
+  durationSeconds: 86400,  // 24h
+});
+
+console.log('Task created:', taskId);
+```
+
+## Features
+
+- **AES-256-GCM** encryption for task instructions and evidence
+- **ECIES** key wrapping — only the assigned worker can decrypt
+- **0G Storage** — encrypted blobs stored on decentralized storage
+- **0G Sealed Inference** — TEE-verified evidence evaluation
+- Full task lifecycle: create → assign → submit → verify → pay
+
+## API
+
+```ts
+// Agent
+agent.createTask(options)
+agent.assignWorker(taskId, workerAddress)
+agent.triggerVerification(taskId)
+agent.cancelTask(taskId)
+
+// Worker
+worker.getAssignedTask(taskId)   // decrypts instructions
+worker.submitEvidence(taskId, evidence)
+
+// Reputation
+client.getReputation(address)
+```
+
+## Network
+
+Deployed on **0G Testnet Galileo** (Chain ID: 16602)
+
+| Contract | Address |
+|---|---|
+| BlindEscrow | `0x037529B296a89E6Dd1abAF84D413cb2dD70C5be5` |
+| TaskRegistry | `0x25Bc5be1F8Ab44ADfb7a6Ce1362d37408E74DA95` |
+| BlindReputation | `0x3d0374963DaaD43e31d42373eb11156A8e8ce2Ff` |
+| ValidatorPool | `0xdBb2f891a2584a573a6637500158A99caa19b11D` |
+
+## License
+
+MIT

package/biome.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",
+  "organizeImports": { "enabled": true },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "suspicious": { "noExplicitAny": "error" },
+      "style": { "useImportType": "error" }
+    }
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 120,
+    "lineEnding": "lf"
+  }
+}

package/dist/BlindEscrowClient-CyPuKMge.d.cts

@@ -0,0 +1,54 @@
+import { ethers } from 'ethers';
+import { A as Address, H as Hex, T as TaskId, b as TxReceiptLike, e as TaskStatus } from './types-BOG5Ub1z.cjs';
+
+interface CreateTaskArgs {
+    taskHash: Hex;
+    token: Address;
+    amount: bigint;
+    category: string;
+    locationZone: string;
+    deadline: bigint;
+}
+interface OnChainTask {
+    taskId: TaskId;
+    agent: Address;
+    worker: Address;
+    token: Address;
+    amount: bigint;
+    taskHash: Hex;
+    evidenceHash: Hex;
+    status: TaskStatus;
+    createdAt: Date;
+    deadline: Date;
+}
+/**
+ * Typed ethers v6 wrapper for the BlindEscrow contract. Every state-changing
+ * method awaits one confirmation and returns a TxReceiptLike; every read
+ * returns decoded values. Ethers errors are mapped to ChainError via
+ * wrapChainError().
+ */
+declare class BlindEscrowClient {
+    readonly contract: ethers.Contract;
+    readonly address: Address;
+    constructor(address: Address, runner: ethers.ContractRunner);
+    /** Create a task and return its id + receipt. Reads the TaskCreated event for the id. */
+    createTask(args: CreateTaskArgs): Promise<{
+        taskId: TaskId;
+        receipt: TxReceiptLike;
+    }>;
+    assignWorker(taskId: TaskId, worker: Address): Promise<TxReceiptLike>;
+    submitEvidence(taskId: TaskId, evidenceHash: Hex): Promise<TxReceiptLike>;
+    completeVerification(taskId: TaskId, passed: boolean): Promise<TxReceiptLike>;
+    cancelTask(taskId: TaskId): Promise<TxReceiptLike>;
+    raiseDispute(taskId: TaskId): Promise<TxReceiptLike>;
+    resolveDispute(taskId: TaskId, workerFavored: boolean): Promise<TxReceiptLike>;
+    claimTimeout(taskId: TaskId): Promise<TxReceiptLike>;
+    getTask(taskId: TaskId): Promise<OnChainTask>;
+    isTaskExpired(taskId: TaskId): Promise<boolean>;
+    nextTaskId(): Promise<TaskId>;
+    feeBps(): Promise<bigint>;
+    private sendTx;
+    private extractTaskIdFromReceipt;
+}
+
+export { BlindEscrowClient as B, type CreateTaskArgs as C, type OnChainTask as O };

package/dist/BlindEscrowClient-R7iGpE-n.d.ts

@@ -0,0 +1,54 @@
+import { ethers } from 'ethers';
+import { A as Address, H as Hex, T as TaskId, b as TxReceiptLike, e as TaskStatus } from './types-BOG5Ub1z.js';
+
+interface CreateTaskArgs {
+    taskHash: Hex;
+    token: Address;
+    amount: bigint;
+    category: string;
+    locationZone: string;
+    deadline: bigint;
+}
+interface OnChainTask {
+    taskId: TaskId;
+    agent: Address;
+    worker: Address;
+    token: Address;
+    amount: bigint;
+    taskHash: Hex;
+    evidenceHash: Hex;
+    status: TaskStatus;
+    createdAt: Date;
+    deadline: Date;
+}
+/**
+ * Typed ethers v6 wrapper for the BlindEscrow contract. Every state-changing
+ * method awaits one confirmation and returns a TxReceiptLike; every read
+ * returns decoded values. Ethers errors are mapped to ChainError via
+ * wrapChainError().
+ */
+declare class BlindEscrowClient {
+    readonly contract: ethers.Contract;
+    readonly address: Address;
+    constructor(address: Address, runner: ethers.ContractRunner);
+    /** Create a task and return its id + receipt. Reads the TaskCreated event for the id. */
+    createTask(args: CreateTaskArgs): Promise<{
+        taskId: TaskId;
+        receipt: TxReceiptLike;
+    }>;
+    assignWorker(taskId: TaskId, worker: Address): Promise<TxReceiptLike>;
+    submitEvidence(taskId: TaskId, evidenceHash: Hex): Promise<TxReceiptLike>;
+    completeVerification(taskId: TaskId, passed: boolean): Promise<TxReceiptLike>;
+    cancelTask(taskId: TaskId): Promise<TxReceiptLike>;
+    raiseDispute(taskId: TaskId): Promise<TxReceiptLike>;
+    resolveDispute(taskId: TaskId, workerFavored: boolean): Promise<TxReceiptLike>;
+    claimTimeout(taskId: TaskId): Promise<TxReceiptLike>;
+    getTask(taskId: TaskId): Promise<OnChainTask>;
+    isTaskExpired(taskId: TaskId): Promise<boolean>;
+    nextTaskId(): Promise<TaskId>;
+    feeBps(): Promise<bigint>;
+    private sendTx;
+    private extractTaskIdFromReceipt;
+}
+
+export { BlindEscrowClient as B, type CreateTaskArgs as C, type OnChainTask as O };

package/dist/KeyStore-Be_SSpCt.d.cts

@@ -0,0 +1,21 @@
+import { T as TaskId, a as TaskKey, A as Address, H as Hex, c as TaskKeyRef } from './types-BOG5Ub1z.cjs';
+
+/**
+ * Per-session storage for task AES keys and cached peer public keys. The SDK
+ * never logs or serializes anything from here — this is the one place at-rest
+ * secrets live. Implementations MUST treat passphrase-protected exports as the
+ * only portable format.
+ */
+interface KeyStore {
+    putTaskKey(taskId: TaskId, key: TaskKey): Promise<void>;
+    getTaskKey(taskId: TaskId): Promise<TaskKey | null>;
+    putPeerPubKey(addr: Address, pubkey: Hex): Promise<void>;
+    getPeerPubKey(addr: Address): Promise<Hex | null>;
+    list(): Promise<TaskKeyRef[]>;
+    delete(taskId: TaskId): Promise<void>;
+    /** Portable, encrypted-at-rest JSON export for backup/migration. */
+    export(passphrase: string): Promise<string>;
+    import(data: string, passphrase: string): Promise<void>;
+}
+
+export type { KeyStore as K };

package/dist/KeyStore-k1JgYPJY.d.ts

@@ -0,0 +1,21 @@
+import { T as TaskId, a as TaskKey, A as Address, H as Hex, c as TaskKeyRef } from './types-BOG5Ub1z.js';
+
+/**
+ * Per-session storage for task AES keys and cached peer public keys. The SDK
+ * never logs or serializes anything from here — this is the one place at-rest
+ * secrets live. Implementations MUST treat passphrase-protected exports as the
+ * only portable format.
+ */
+interface KeyStore {
+    putTaskKey(taskId: TaskId, key: TaskKey): Promise<void>;
+    getTaskKey(taskId: TaskId): Promise<TaskKey | null>;
+    putPeerPubKey(addr: Address, pubkey: Hex): Promise<void>;
+    getPeerPubKey(addr: Address): Promise<Hex | null>;
+    list(): Promise<TaskKeyRef[]>;
+    delete(taskId: TaskId): Promise<void>;
+    /** Portable, encrypted-at-rest JSON export for backup/migration. */
+    export(passphrase: string): Promise<string>;
+    import(data: string, passphrase: string): Promise<void>;
+}
+
+export type { KeyStore as K };

package/dist/Signer-BnqH_qew.d.cts

@@ -0,0 +1,38 @@
+import { A as Address, H as Hex } from './types-BOG5Ub1z.cjs';
+
+interface TxRequest {
+    to: Address;
+    from?: Address;
+    data?: Hex;
+    value?: bigint;
+    gasLimit?: bigint;
+    nonce?: number;
+    chainId?: bigint;
+}
+interface TypedDataDomain {
+    name?: string;
+    version?: string;
+    chainId?: bigint | number;
+    verifyingContract?: Address;
+    salt?: Hex;
+}
+type TypedDataField = {
+    name: string;
+    type: string;
+};
+/**
+ * Uniform signing interface used across the SDK. Adapters wrap ethers Signer,
+ * raw private keys, EIP-1193 providers, or KMS. Implementations MUST return
+ * hex-encoded signatures (0x-prefixed) and addresses (0x-prefixed, 20 bytes).
+ */
+interface Signer {
+    getAddress(): Promise<Address>;
+    chainId(): Promise<bigint>;
+    signMessage(msg: string | Uint8Array): Promise<Hex>;
+    signTypedData(domain: TypedDataDomain, types: Record<string, TypedDataField[]>, value: Record<string, unknown>): Promise<Hex>;
+    signTransaction(tx: TxRequest): Promise<Hex>;
+    /** Uncompressed secp256k1 public key, 0x04-prefixed (hex). */
+    getPublicKey(): Promise<Hex>;
+}
+
+export type { Signer as S, TypedDataDomain as T, TypedDataField as a, TxRequest as b };

package/dist/Signer-LColE0Uo.d.ts

@@ -0,0 +1,38 @@
+import { A as Address, H as Hex } from './types-BOG5Ub1z.js';
+
+interface TxRequest {
+    to: Address;
+    from?: Address;
+    data?: Hex;
+    value?: bigint;
+    gasLimit?: bigint;
+    nonce?: number;
+    chainId?: bigint;
+}
+interface TypedDataDomain {
+    name?: string;
+    version?: string;
+    chainId?: bigint | number;
+    verifyingContract?: Address;
+    salt?: Hex;
+}
+type TypedDataField = {
+    name: string;
+    type: string;
+};
+/**
+ * Uniform signing interface used across the SDK. Adapters wrap ethers Signer,
+ * raw private keys, EIP-1193 providers, or KMS. Implementations MUST return
+ * hex-encoded signatures (0x-prefixed) and addresses (0x-prefixed, 20 bytes).
+ */
+interface Signer {
+    getAddress(): Promise<Address>;
+    chainId(): Promise<bigint>;
+    signMessage(msg: string | Uint8Array): Promise<Hex>;
+    signTypedData(domain: TypedDataDomain, types: Record<string, TypedDataField[]>, value: Record<string, unknown>): Promise<Hex>;
+    signTransaction(tx: TxRequest): Promise<Hex>;
+    /** Uncompressed secp256k1 public key, 0x04-prefixed (hex). */
+    getPublicKey(): Promise<Hex>;
+}
+
+export type { Signer as S, TypedDataDomain as T, TypedDataField as a, TxRequest as b };

package/dist/Storage-4QOrh7rm.d.ts

@@ -0,0 +1,17 @@
+import { U as UploadResult, d as RootHash } from './types-BOG5Ub1z.js';
+
+/**
+ * Abstraction over blob storage. Default implementation (ZgStorage) uses
+ * 0G Storage; MemoryStorage is for tests and local fallback. Consumers can
+ * provide their own adapter for IPFS, S3, etc.
+ */
+interface Storage {
+    /** Upload bytes, return root hash + optional tx hash + size. */
+    upload(bytes: Uint8Array): Promise<UploadResult>;
+    /** Download bytes by root hash. Throws StorageError('STORAGE/NOT_FOUND') if absent. */
+    download(rootHash: RootHash): Promise<Uint8Array>;
+    /** Compute the canonical root hash without uploading. */
+    hash(bytes: Uint8Array): Promise<RootHash>;
+}
+
+export type { Storage as S };

package/dist/Storage-Cf4IJRMk.d.cts

@@ -0,0 +1,17 @@
+import { U as UploadResult, d as RootHash } from './types-BOG5Ub1z.cjs';
+
+/**
+ * Abstraction over blob storage. Default implementation (ZgStorage) uses
+ * 0G Storage; MemoryStorage is for tests and local fallback. Consumers can
+ * provide their own adapter for IPFS, S3, etc.
+ */
+interface Storage {
+    /** Upload bytes, return root hash + optional tx hash + size. */
+    upload(bytes: Uint8Array): Promise<UploadResult>;
+    /** Download bytes by root hash. Throws StorageError('STORAGE/NOT_FOUND') if absent. */
+    download(rootHash: RootHash): Promise<Uint8Array>;
+    /** Compute the canonical root hash without uploading. */
+    hash(bytes: Uint8Array): Promise<RootHash>;
+}
+
+export type { Storage as S };

package/dist/TaskRegistryClient-Ch6lYqM_.d.ts

@@ -0,0 +1,24 @@
+import { ethers } from 'ethers';
+import { A as Address, T as TaskId, b as TxReceiptLike } from './types-BOG5Ub1z.js';
+
+interface OpenTaskMeta {
+    taskId: TaskId;
+    token: Address;
+    category: string;
+    locationZone: string;
+    reward: bigint;
+    createdAt: Date;
+}
+declare class TaskRegistryClient {
+    readonly contract: ethers.Contract;
+    readonly address: Address;
+    constructor(address: Address, runner: ethers.ContractRunner);
+    getTaskMeta(taskId: TaskId): Promise<OpenTaskMeta>;
+    getOpenTasks(offset: bigint, limit: bigint): Promise<TaskId[]>;
+    totalTasks(): Promise<bigint>;
+    openTaskCount(): Promise<bigint>;
+    taskExists(taskId: TaskId): Promise<boolean>;
+    closeTask(taskId: TaskId): Promise<TxReceiptLike>;
+}
+
+export { type OpenTaskMeta as O, TaskRegistryClient as T };

package/dist/TaskRegistryClient-CrQjddDc.d.cts

@@ -0,0 +1,24 @@
+import { ethers } from 'ethers';
+import { A as Address, T as TaskId, b as TxReceiptLike } from './types-BOG5Ub1z.cjs';
+
+interface OpenTaskMeta {
+    taskId: TaskId;
+    token: Address;
+    category: string;
+    locationZone: string;
+    reward: bigint;
+    createdAt: Date;
+}
+declare class TaskRegistryClient {
+    readonly contract: ethers.Contract;
+    readonly address: Address;
+    constructor(address: Address, runner: ethers.ContractRunner);
+    getTaskMeta(taskId: TaskId): Promise<OpenTaskMeta>;
+    getOpenTasks(offset: bigint, limit: bigint): Promise<TaskId[]>;
+    totalTasks(): Promise<bigint>;
+    openTaskCount(): Promise<bigint>;
+    taskExists(taskId: TaskId): Promise<boolean>;
+    closeTask(taskId: TaskId): Promise<TxReceiptLike>;
+}
+
+export { type OpenTaskMeta as O, TaskRegistryClient as T };

package/dist/aes-J-7HrHze.d.cts

@@ -0,0 +1,17 @@
+/** Generate a fresh 32-byte AES-256 key. */
+declare function generateAesKey(): Promise<Uint8Array>;
+/**
+ * AES-256-GCM encrypt. Output format: [12 IV][16 tag][ciphertext].
+ * This ordering matches backend/src/services/crypto.ts and frontend/src/lib/crypto.ts
+ * byte-for-byte, so SDK blobs decrypt anywhere in the stack.
+ */
+declare function aesEncrypt(plaintext: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+/**
+ * AES-256-GCM decrypt. Input format: [12 IV][16 tag][ciphertext].
+ * Throws CRYPTO/INTEGRITY_CHECK on truncation or tag mismatch.
+ */
+declare function aesDecrypt(blob: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+/** SHA-256 of arbitrary bytes. Returns 32-byte digest. */
+declare function sha256(data: Uint8Array): Promise<Uint8Array>;
+
+export { aesDecrypt as a, aesEncrypt as b, generateAesKey as g, sha256 as s };

package/dist/aes-J-7HrHze.d.ts

@@ -0,0 +1,17 @@
+/** Generate a fresh 32-byte AES-256 key. */
+declare function generateAesKey(): Promise<Uint8Array>;
+/**
+ * AES-256-GCM encrypt. Output format: [12 IV][16 tag][ciphertext].
+ * This ordering matches backend/src/services/crypto.ts and frontend/src/lib/crypto.ts
+ * byte-for-byte, so SDK blobs decrypt anywhere in the stack.
+ */
+declare function aesEncrypt(plaintext: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+/**
+ * AES-256-GCM decrypt. Input format: [12 IV][16 tag][ciphertext].
+ * Throws CRYPTO/INTEGRITY_CHECK on truncation or tag mismatch.
+ */
+declare function aesDecrypt(blob: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+/** SHA-256 of arbitrary bytes. Returns 32-byte digest. */
+declare function sha256(data: Uint8Array): Promise<Uint8Array>;
+
+export { aesDecrypt as a, aesEncrypt as b, generateAesKey as g, sha256 as s };

package/dist/agent/Agent.d.ts

@@ -0,0 +1,59 @@
+import type { BlindEscrowClient } from '../chain/index.js';
+import type { EventBus, SdkEvents } from '../events/index.js';
+import type { KeyStore } from '../keystore/index.js';
+import type { Signer } from '../signer/index.js';
+import type { Storage } from '../storage/index.js';
+import type { Address, Hex, Reward, TaskId, TaskKey, TxReceiptLike } from '../types.js';
+export interface AgentDeps {
+    escrow: BlindEscrowClient;
+    storage: Storage;
+    keystore: KeyStore;
+    signer: Signer;
+    events?: EventBus<SdkEvents>;
+}
+export interface CreateTaskInput {
+    instructions: string | Uint8Array;
+    category: string;
+    locationZone: string;
+    reward: Reward & {
+        token: Address;
+    };
+    deadline: Date | bigint;
+}
+export interface CreateTaskResult {
+    taskId: TaskId;
+    taskKey: TaskKey;
+    rootHash: Hex;
+    txHash: Hex;
+    receipt: TxReceiptLike;
+}
+export interface AssignWorkerResult {
+    wrappedKey: Uint8Array;
+    receipt: TxReceiptLike;
+}
+/**
+ * End-to-end agent flows. Composes storage + crypto + chain + keystore so a
+ * caller can post an encrypted bounty in one call. Key exchange with the
+ * worker is intentionally out-of-band: assignWorker() returns the wrapped
+ * AES key as bytes, and the caller is responsible for delivering it (backend
+ * API, DM, whatever). This keeps the SDK pluggable across different
+ * message-passing substrates.
+ */
+export declare class Agent {
+    private readonly deps;
+    constructor(deps: AgentDeps);
+    createTask(input: CreateTaskInput): Promise<CreateTaskResult>;
+    /**
+     * Wrap the stored AES key for the chosen worker and record the assignment
+     * on-chain. The caller must deliver `wrappedKey` to the worker separately
+     * (backend API, DM, etc.). Returns the wrapped bytes and the tx receipt.
+     */
+    assignWorker(taskId: TaskId, worker: Address, workerPubKey: string): Promise<AssignWorkerResult>;
+    cancelTask(taskId: TaskId): Promise<TxReceiptLike>;
+    /**
+     * Fetch evidence by root hash, unwrap the AES key with the agent's private
+     * key (signer's key material is not accessible, so a raw private key is
+     * required), and return the decrypted evidence plaintext.
+     */
+    fetchAndDecryptEvidence(evidenceHash: Hex, agentPrivKey: string): Promise<Uint8Array>;
+}

package/dist/agent/Agent.js

@@ -0,0 +1,73 @@
+import { aesEncrypt, eciesEncrypt, generateAesKey, openEvidenceAsAgent, } from '../crypto/index.js';
+import { LifecycleError } from '../errors/index.js';
+/**
+ * End-to-end agent flows. Composes storage + crypto + chain + keystore so a
+ * caller can post an encrypted bounty in one call. Key exchange with the
+ * worker is intentionally out-of-band: assignWorker() returns the wrapped
+ * AES key as bytes, and the caller is responsible for delivering it (backend
+ * API, DM, whatever). This keeps the SDK pluggable across different
+ * message-passing substrates.
+ */
+export class Agent {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async createTask(input) {
+        const { storage, escrow, keystore, events } = this.deps;
+        const aesKey = await generateAesKey();
+        const plaintext = toBytes(input.instructions);
+        const ciphertext = await aesEncrypt(plaintext, aesKey);
+        const uploaded = await storage.upload(ciphertext);
+        const rootHash = uploaded.rootHash;
+        const deadline = typeof input.deadline === 'bigint' ? input.deadline : BigInt(Math.floor(input.deadline.getTime() / 1000));
+        const { taskId, receipt } = await escrow.createTask({
+            taskHash: rootHash,
+            token: input.reward.token,
+            amount: input.reward.amount,
+            category: input.category,
+            locationZone: input.locationZone,
+            deadline,
+        });
+        const taskKey = { aesKey, createdAt: new Date() };
+        await keystore.putTaskKey(taskId, taskKey);
+        events?.emit('task.created', { taskId, txHash: receipt.hash, rootHash });
+        return { taskId, taskKey, rootHash, txHash: receipt.hash, receipt };
+    }
+    /**
+     * Wrap the stored AES key for the chosen worker and record the assignment
+     * on-chain. The caller must deliver `wrappedKey` to the worker separately
+     * (backend API, DM, etc.). Returns the wrapped bytes and the tx receipt.
+     */
+    async assignWorker(taskId, worker, workerPubKey) {
+        const { keystore, escrow, events } = this.deps;
+        const stored = await keystore.getTaskKey(taskId);
+        if (!stored) {
+            throw new LifecycleError('LIFECYCLE/TASK_NOT_FOUND', `no task key in keystore for task ${taskId}`);
+        }
+        const wrappedKey = await eciesEncrypt(stored.aesKey, workerPubKey);
+        const receipt = await escrow.assignWorker(taskId, worker);
+        events?.emit('task.assigned', { taskId, worker, txHash: receipt.hash });
+        return { wrappedKey, receipt };
+    }
+    async cancelTask(taskId) {
+        const { escrow, keystore, events } = this.deps;
+        const receipt = await this.deps.escrow.cancelTask(taskId);
+        void escrow;
+        await keystore.delete(taskId);
+        events?.emit('task.cancelled', { taskId, txHash: receipt.hash });
+        return receipt;
+    }
+    /**
+     * Fetch evidence by root hash, unwrap the AES key with the agent's private
+     * key (signer's key material is not accessible, so a raw private key is
+     * required), and return the decrypted evidence plaintext.
+     */
+    async fetchAndDecryptEvidence(evidenceHash, agentPrivKey) {
+        const envelope = await this.deps.storage.download(evidenceHash);
+        return openEvidenceAsAgent(envelope, agentPrivKey);
+    }
+}
+function toBytes(x) {
+    return typeof x === 'string' ? new TextEncoder().encode(x) : x;
+}