@chainlink/cre-sdk 1.15.0 → 1.17.0-alpha.1

package/dist/sdk/cre/index.d.ts

@@ -1,12 +1,13 @@
 /**
  * Public API for the CRE SDK.
  */
-import { ClientCapability as EVMClient } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
-import { ClientCapability as SolanaClient } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
-import { ClientCapability as ConfidentialHTTPClient } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
-import { ClientCapability as HTTPClient } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
-import { HTTPCapability } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
-import { CronCapability } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
+import { ClientCapability as AptosClient, ClientRestrictor as AptosRestrictor } from '../../generated-sdk/capabilities/blockchain/aptos/v1alpha/client_sdk_gen';
+import { ClientCapability as EVMClient, ClientRestrictor as EVMRestrictor } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
+import { ClientCapability as SolanaClient, ClientRestrictor as SolanaRestrictor } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
+import { ClientCapability as ConfidentialHTTPClient, ClientRestrictor as ConfidentialHTTPRestrictor } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
+import { ClientCapability as HTTPClient, ClientRestrictor as HTTPClientRestrictor } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
+import { HTTPCapability, HTTPRestrictor } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
+import { CronCapability, CronRestrictor } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
 /**
  * Public exports for the CRE SDK.
  */
@@ -14,14 +15,17 @@ export { type Log as EVMLog, TxStatus, } from '../../generated/capabilities/bloc
 export { ReceiverContractExecutionStatus as SolanaReceiverContractExecutionStatus, TxStatus as SolanaTxStatus, } from '../../generated/capabilities/blockchain/solana/v1alpha/client_pb';
 export type { Payload as HTTPPayload } from '../../generated/capabilities/networking/http/v1alpha/trigger_pb';
 export type { Payload as CronPayload } from '../../generated/capabilities/scheduler/cron/v1/trigger_pb';
-export { ClientCapability as EVMClient, type WriteCreReportRequest, type WriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
-export { ClientCapability as SolanaClient, type WriteCreReportRequest as SolanaWriteCreReportRequest, type WriteCreReportRequestJson as SolanaWriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
-export { ClientCapability as ConfidentialHTTPClient } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
-export { ClientCapability as HTTPClient, type SendRequester as HTTPSendRequester, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
-export { HTTPCapability } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
-export { CronCapability } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
-export type { NodeRuntime, Runtime } from '../runtime';
-export { handler } from '../workflow';
+export { TeeType } from '../../generated/sdk/v1alpha/sdk_pb';
+export { ClientCapability as AptosClient, ClientRestrictor as AptosRestrictor, type WriteCreReportRequest as AptosWriteCreReportRequest, type WriteCreReportRequestJson as AptosWriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/aptos/v1alpha/client_sdk_gen';
+export { ClientCapability as EVMClient, ClientRestrictor as EVMRestrictor, type WriteCreReportRequest, type WriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
+export { ClientCapability as SolanaClient, ClientRestrictor as SolanaRestrictor, type WriteCreReportRequest as SolanaWriteCreReportRequest, type WriteCreReportRequestJson as SolanaWriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
+export { ClientCapability as ConfidentialHTTPClient, ClientRestrictor as ConfidentialHTTPRestrictor, } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
+export { ClientCapability as HTTPClient, ClientRestrictor as HTTPClientRestrictor, type SendRequester as HTTPSendRequester, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
+export { HTTPCapability, HTTPRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
+export { CronCapability, CronRestrictor, } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
+export type { NodeRuntime, Runtime, TeeRuntime } from '../runtime';
+export type { AnyTeeConstraint, NitroBinding, NitroRegion, OneOfTees, Region, TeeBinding, TeeConstraint, } from '../workflow';
+export { handler, handlerInTee, NITRO_REGIONS, REGIONS } from '../workflow';
 export declare const cre: {
     capabilities: {
         CronCapability: typeof CronCapability;
@@ -29,7 +33,18 @@ export declare const cre: {
         ConfidentialHTTPClient: typeof ConfidentialHTTPClient;
         HTTPClient: typeof HTTPClient;
         EVMClient: typeof EVMClient;
+        AptosClient: typeof AptosClient;
         SolanaClient: typeof SolanaClient;
     };
-    handler: <TRawTriggerOutput extends import("@bufbuild/protobuf").Message<string>, TTriggerOutput, TConfig, TResult>(trigger: import("../utils/triggers/trigger-interface").Trigger<TRawTriggerOutput, TTriggerOutput>, fn: import("../workflow").HandlerFn<TConfig, TTriggerOutput, TResult>) => import("../workflow").HandlerEntry<TConfig, TRawTriggerOutput, TTriggerOutput, TResult>;
+    restrictors: {
+        CronRestrictor: typeof CronRestrictor;
+        HTTPRestrictor: typeof HTTPRestrictor;
+        ConfidentialHTTPRestrictor: typeof ConfidentialHTTPRestrictor;
+        HTTPClientRestrictor: typeof HTTPClientRestrictor;
+        EVMRestrictor: typeof EVMRestrictor;
+        SolanaRestrictor: typeof SolanaRestrictor;
+        AptosRestrictor: typeof AptosRestrictor;
+    };
+    handler: <TRawTriggerOutput extends import("@bufbuild/protobuf").Message<string>, TTriggerOutput, TConfig, TResult, TRuntime = import("../runtime").Runtime<TConfig>>(trigger: import("../utils/triggers/trigger-interface").Trigger<TRawTriggerOutput, TTriggerOutput>, fn: import("../workflow").HandlerFn<TConfig, TTriggerOutput, TResult, TRuntime>, hooks?: import("../workflow").Hooks<TConfig, TTriggerOutput>) => import("../workflow").HandlerEntry<TConfig, TRawTriggerOutput, TTriggerOutput, TResult, TRuntime>;
+    handlerInTee: <TRawTriggerOutput extends import("@bufbuild/protobuf").Message<string>, TTriggerOutput, TConfig, TResult>(trigger: import("../utils/triggers/trigger-interface").Trigger<TRawTriggerOutput, TTriggerOutput>, fn: import("../workflow").HandlerFn<TConfig, TTriggerOutput, TResult, import("../runtime").TeeRuntime<TConfig>>, tees: import("../workflow").TeeConstraint, hooks?: import("../workflow").Hooks<TConfig, TTriggerOutput>) => import("../workflow").HandlerEntry<TConfig, TRawTriggerOutput, TTriggerOutput, TResult, import("../runtime").TeeRuntime<TConfig>>;
 };

package/dist/sdk/cre/index.js

@@ -1,31 +1,35 @@
 /**
  * Public API for the CRE SDK.
  */
-import { ClientCapability as EVMClient } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
-import { ClientCapability as SolanaClient } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
-import { ClientCapability as ConfidentialHTTPClient } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
-import { ClientCapability as HTTPClient } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
-import { HTTPCapability } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
-import { CronCapability } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
+import { ClientCapability as AptosClient, ClientRestrictor as AptosRestrictor, } from '../../generated-sdk/capabilities/blockchain/aptos/v1alpha/client_sdk_gen';
+import { ClientCapability as EVMClient, ClientRestrictor as EVMRestrictor, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
+import { ClientCapability as SolanaClient, ClientRestrictor as SolanaRestrictor, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
+import { ClientCapability as ConfidentialHTTPClient, ClientRestrictor as ConfidentialHTTPRestrictor, } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
+import { ClientCapability as HTTPClient, ClientRestrictor as HTTPClientRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
+import { HTTPCapability, HTTPRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
+import { CronCapability, CronRestrictor, } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
 import { prepareRuntime } from '../utils/prepare-runtime';
-import { handler } from '../workflow';
+import { handler, handlerInTee } from '../workflow';
 /**
  * Public exports for the CRE SDK.
  */
 export { TxStatus, } from '../../generated/capabilities/blockchain/evm/v1alpha/client_pb';
 export { ReceiverContractExecutionStatus as SolanaReceiverContractExecutionStatus, TxStatus as SolanaTxStatus, } from '../../generated/capabilities/blockchain/solana/v1alpha/client_pb';
+export { TeeType } from '../../generated/sdk/v1alpha/sdk_pb';
+// Aptos Capability
+export { ClientCapability as AptosClient, ClientRestrictor as AptosRestrictor, } from '../../generated-sdk/capabilities/blockchain/aptos/v1alpha/client_sdk_gen';
 // EVM Capability
-export { ClientCapability as EVMClient, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
+export { ClientCapability as EVMClient, ClientRestrictor as EVMRestrictor, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
 // Solana Capability
-export { ClientCapability as SolanaClient, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
+export { ClientCapability as SolanaClient, ClientRestrictor as SolanaRestrictor, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
 // Confidential HTTP Capability
-export { ClientCapability as ConfidentialHTTPClient } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
+export { ClientCapability as ConfidentialHTTPClient, ClientRestrictor as ConfidentialHTTPRestrictor, } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
 // HTTP Capability
-export { ClientCapability as HTTPClient, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
-export { HTTPCapability } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
+export { ClientCapability as HTTPClient, ClientRestrictor as HTTPClientRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
+export { HTTPCapability, HTTPRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
 // CRON Capability
-export { CronCapability } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
-export { handler } from '../workflow';
+export { CronCapability, CronRestrictor, } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
+export { handler, handlerInTee, NITRO_REGIONS, REGIONS } from '../workflow';
 prepareRuntime();
 export const cre = {
     capabilities: {
@@ -34,7 +38,18 @@ export const cre = {
         ConfidentialHTTPClient,
         HTTPClient,
         EVMClient,
+        AptosClient,
         SolanaClient,
     },
+    restrictors: {
+        CronRestrictor,
+        HTTPRestrictor,
+        ConfidentialHTTPRestrictor,
+        HTTPClientRestrictor,
+        EVMRestrictor,
+        SolanaRestrictor,
+        AptosRestrictor,
+    },
     handler,
+    handlerInTee,
 };

package/dist/sdk/impl/runtime-impl.d.ts

@@ -1,6 +1,6 @@
 import { type Message } from '@bufbuild/protobuf';
 import { type AwaitCapabilitiesRequest, type AwaitCapabilitiesResponse, type AwaitSecretsRequest, type AwaitSecretsResponse, type CapabilityRequest, type GetSecretsRequest, Mode, type Secret, type SecretRequest, type SecretRequestJson } from '../../generated/sdk/v1alpha/sdk_pb';
-import type { BaseRuntime, CallCapabilityParams, NodeRuntime, ReportRequest, ReportRequestJson, Runtime } from '..';
+import type { BaseRuntime, CallCapabilityParams, NodeRuntime, ReportRequest, ReportRequestJson, Runtime, TeeRuntime } from '..';
 import type { Report } from '../report';
 import { type ConsensusAggregation, type PrimitiveTypes, type UnwrapOptions } from '../utils';
 /**
@@ -44,7 +44,10 @@ export declare class BaseRuntimeImpl<C> implements BaseRuntime<C> {
     now(): Date;
     sleep(ms: number): void;
     log(message: string): void;
+    emitMetric(name: string, value: number, type: MetricType, labels?: Record<string, string>): boolean;
 }
+/** Ergonomic union for {@link BaseRuntimeImpl.emitMetric}. */
+export type MetricType = 'counter' | 'gauge';
 /**
  * It is used when a BFT guarantee cannot be provided automatically (e.g. calling a standard API).
  * You tell each node to perform a task on its own.
@@ -94,6 +97,25 @@ export declare class RuntimeImpl<C> extends BaseRuntimeImpl<C> implements Runtim
         result: () => Report;
     };
 }
+export declare class TeeRuntimeImpl<C> implements TeeRuntime<C> {
+    config: C;
+    nextCallId: number;
+    private readonly runtime;
+    constructor(config: C, nextCallId: number, helpers: RuntimeHelpers, maxResponseSize: bigint);
+    getSecret(request: SecretRequest | SecretRequestJson): {
+        result: () => Secret;
+    };
+    now(): Date;
+    log(message: string): void;
+    emitMetric(name: string, value: number, type: MetricType, labels?: Record<string, string>): boolean;
+    callCapability<I extends Message, O extends Message>({ capabilityId, method, payload, inputSchema, outputSchema, }: CallCapabilityParams<I, O>): {
+        result: () => O;
+    };
+    reportFromDon(input: ReportRequest | ReportRequestJson): {
+        result: () => Report;
+    };
+    usingTheDons(): Runtime<C>;
+}
 /**
  * Interface to the WASM host environment.
  * Provides low-level access to capabilities, secrets, and utilities.
@@ -115,4 +137,9 @@ export interface RuntimeHelpers {
     sleep(ms: number): void;
     /** Logs a message to the host environment. */
     log(message: string): void;
+    /**
+     * Emits a user metric to the host. Payload is a protobuf-encoded
+     * `workflows.v2.WorkflowUserMetric`. Returns false if the host rejected it.
+     */
+    emitMetric(payload: Uint8Array): boolean;
 }

package/dist/sdk/impl/runtime-impl.js

@@ -1,7 +1,8 @@
-import { create } from '@bufbuild/protobuf';
+import { create, toBinary } from '@bufbuild/protobuf';
 import { anyPack, anyUnpack } from '@bufbuild/protobuf/wkt';
 import { deserializeErrorFromString } from '../../capabilities/errors';
 import { AwaitCapabilitiesRequestSchema, AwaitSecretsRequestSchema, CapabilityRequestSchema, GetSecretsRequestSchema, Mode, SecretRequestSchema, SimpleConsensusInputsSchema, } from '../../generated/sdk/v1alpha/sdk_pb';
+import { UserMetricType, WorkflowUserMetricSchema, } from '../../generated/workflows/v2/workflow_user_metric_pb';
 import { ConsensusCapability } from '../../generated-sdk/capabilities/internal/consensus/v1alpha/consensus_sdk_gen';
 import { Value, } from '../utils';
 import { CapabilityRuntimeError, DonModeError, NodeModeError, SecretsError } from '../errors';
@@ -139,7 +140,20 @@ export class BaseRuntimeImpl {
     log(message) {
         this.helpers.log(message);
     }
+    emitMetric(name, value, type, labels) {
+        const metric = create(WorkflowUserMetricSchema, {
+            name,
+            value,
+            type: METRIC_TYPE_TO_PROTO[type],
+            labels: labels ?? {},
+        });
+        return this.helpers.emitMetric(toBinary(WorkflowUserMetricSchema, metric));
+    }
 }
+const METRIC_TYPE_TO_PROTO = {
+    counter: UserMetricType.COUNTER,
+    gauge: UserMetricType.GAUGE,
+};
 /**
  * It is used when a BFT guarantee cannot be provided automatically (e.g. calling a standard API).
  * You tell each node to perform a task on its own.
@@ -321,6 +335,43 @@ export class RuntimeImpl extends BaseRuntimeImpl {
         };
     }
 }
+export class TeeRuntimeImpl {
+    config;
+    nextCallId;
+    runtime;
+    constructor(config, nextCallId, helpers, maxResponseSize) {
+        this.config = config;
+        this.nextCallId = nextCallId;
+        this.runtime = new RuntimeImpl(config, nextCallId, helpers, maxResponseSize);
+    }
+    getSecret(request) {
+        return this.runtime.getSecret(request);
+    }
+    now() {
+        return this.runtime.now();
+    }
+    log(message) {
+        this.runtime.log(message);
+    }
+    emitMetric(name, value, type, labels) {
+        return this.runtime.emitMetric(name, value, type, labels);
+    }
+    callCapability({ capabilityId, method, payload, inputSchema, outputSchema, }) {
+        return this.runtime.callCapability({
+            capabilityId,
+            method,
+            payload,
+            inputSchema,
+            outputSchema,
+        });
+    }
+    reportFromDon(input) {
+        return this.runtime.report(input);
+    }
+    usingTheDons() {
+        return this.runtime;
+    }
+}
 function clearIgnoredFields(value, descriptor) {
     if (!descriptor || !value) {
         return;

package/dist/sdk/runtime.d.ts

@@ -1,10 +1,11 @@
 import type { Message } from '@bufbuild/protobuf';
 import type { GenMessage } from '@bufbuild/protobuf/codegenv2';
 import type { ReportRequest, ReportRequestJson } from '../generated/sdk/v1alpha/sdk_pb';
+import type { MetricType } from './impl/runtime-impl';
 import type { Report } from './report';
 import type { ConsensusAggregation, PrimitiveTypes, UnwrapOptions } from './utils';
 import type { SecretsProvider } from '.';
-export type { ReportRequest, ReportRequestJson };
+export type { ReportRequest, ReportRequestJson, MetricType };
 export type CallCapabilityParams<I extends Message, O extends Message> = {
     capabilityId: string;
     method: string;
@@ -23,6 +24,7 @@ export interface BaseRuntime<C> {
     };
     now(): Date;
     log(message: string): void;
+    emitMetric(name: string, value: number, type: MetricType, labels?: Record<string, string>): boolean;
 }
 /**
  * Runtime for Node mode execution.
@@ -30,6 +32,26 @@ export interface BaseRuntime<C> {
 export interface NodeRuntime<C> extends BaseRuntime<C> {
     readonly _isNodeRuntime: true;
 }
+/**
+ * Runtime for Tee mode execution.
+ */
+export interface TeeRuntime<C> extends BaseRuntime<C>, SecretsProvider {
+    /**
+     * Generates a report from the DON.
+     * Data requestsed throught this method will be routed outside of the TEE.
+     *
+     * @param input - Report request to generate a report from the DON
+     * @returns Report generated from the DON
+     */
+    reportFromDon(input: ReportRequest | ReportRequestJson): {
+        result: () => Report;
+    };
+    /**
+     * Returns the runtime that makes requests to the CRE DONs.
+     * Requests made through this runtime will therefore be routed outside of the TEE
+     */
+    usingTheDons(): Runtime<C>;
+}
 /**
  * Runtime for DON mode execution.
  */

package/dist/sdk/tee-constraints.d.ts

@@ -0,0 +1,68 @@
+import type { Requirements } from '../generated/sdk/v1alpha/sdk_pb';
+import { z } from 'zod';
+export declare const REGIONS: readonly ["us-west-2"];
+export declare const NITRO_REGIONS: readonly ["us-west-2"];
+declare const regionSchema: z.ZodEnum<["us-west-2"]>;
+declare const nitroRegionSchema: z.ZodEnum<["us-west-2"]>;
+declare const nitroBindingSchema: z.ZodObject<{
+    tee: z.ZodLiteral<"nitro">;
+    regions: z.ZodOptional<z.ZodArray<z.ZodEnum<["us-west-2"]>, "atleastone">>;
+}, "strict", z.ZodTypeAny, {
+    tee: "nitro";
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}, {
+    tee: "nitro";
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}>;
+declare const teeBindingSchema: z.ZodDiscriminatedUnion<"tee", [z.ZodObject<{
+    tee: z.ZodLiteral<"nitro">;
+    regions: z.ZodOptional<z.ZodArray<z.ZodEnum<["us-west-2"]>, "atleastone">>;
+}, "strict", z.ZodTypeAny, {
+    tee: "nitro";
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}, {
+    tee: "nitro";
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}>]>;
+declare const oneOfTeesSchema: z.ZodArray<z.ZodDiscriminatedUnion<"tee", [z.ZodObject<{
+    tee: z.ZodLiteral<"nitro">;
+    regions: z.ZodOptional<z.ZodArray<z.ZodEnum<["us-west-2"]>, "atleastone">>;
+}, "strict", z.ZodTypeAny, {
+    tee: "nitro";
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}, {
+    tee: "nitro";
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}>]>, "atleastone">;
+declare const anyTeeConstraintSchema: z.ZodObject<{
+    regions: z.ZodOptional<z.ZodArray<z.ZodEnum<["us-west-2"]>, "atleastone">>;
+}, "strict", z.ZodTypeAny, {
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}, {
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}>;
+export declare const teeConstraintSchema: z.ZodUnion<[z.ZodArray<z.ZodDiscriminatedUnion<"tee", [z.ZodObject<{
+    tee: z.ZodLiteral<"nitro">;
+    regions: z.ZodOptional<z.ZodArray<z.ZodEnum<["us-west-2"]>, "atleastone">>;
+}, "strict", z.ZodTypeAny, {
+    tee: "nitro";
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}, {
+    tee: "nitro";
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}>]>, "atleastone">, z.ZodObject<{
+    regions: z.ZodOptional<z.ZodArray<z.ZodEnum<["us-west-2"]>, "atleastone">>;
+}, "strict", z.ZodTypeAny, {
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}, {
+    regions?: ["us-west-2", ..."us-west-2"[]] | undefined;
+}>]>;
+export type Region = z.infer<typeof regionSchema>;
+export type NitroRegion = z.infer<typeof nitroRegionSchema>;
+export type NitroBinding = z.infer<typeof nitroBindingSchema>;
+export type TeeBinding = z.infer<typeof teeBindingSchema>;
+export type OneOfTees = z.infer<typeof oneOfTeesSchema>;
+export type AnyTeeConstraint = z.infer<typeof anyTeeConstraintSchema>;
+export type TeeConstraint = z.infer<typeof teeConstraintSchema>;
+export declare function buildTeeRequirements(input: TeeConstraint): Requirements;
+export {};

package/dist/sdk/tee-constraints.js

@@ -0,0 +1,59 @@
+import { create } from '@bufbuild/protobuf';
+import { RegionsSchema, RequirementsSchema, TeeSchema, TeeType, TeeTypesAndRegionsSchema, } from '../generated/sdk/v1alpha/sdk_pb';
+import { z } from 'zod';
+// --- Region schemas (source of truth) ---
+export const REGIONS = ['us-west-2'];
+export const NITRO_REGIONS = ['us-west-2'];
+const regionSchema = z.enum(REGIONS, {
+    message: `unknown region; expected one of: ${REGIONS.join(', ')}`,
+});
+const nitroRegionSchema = z.enum(NITRO_REGIONS, {
+    message: `aws nitro does not support this region; expected one of: ${NITRO_REGIONS.join(', ')}`,
+});
+// --- TeeConstraint schemas (types inferred from these) ---
+const nitroBindingSchema = z
+    .object({
+    tee: z.literal('nitro'),
+    regions: z.array(nitroRegionSchema).nonempty().optional(),
+})
+    .strict();
+const teeBindingSchema = z.discriminatedUnion('tee', [nitroBindingSchema]);
+const oneOfTeesSchema = z.array(teeBindingSchema).nonempty();
+const anyTeeConstraintSchema = z
+    .object({
+    regions: z.array(regionSchema).nonempty().optional(),
+})
+    .strict();
+export const teeConstraintSchema = z.union([oneOfTeesSchema, anyTeeConstraintSchema]);
+// --- Conversion to protobuf Requirements ---
+export function buildTeeRequirements(input) {
+    const parsed = teeConstraintSchema.parse(input);
+    if (Array.isArray(parsed)) {
+        const teeTypes = parsed.map((binding) => ({
+            type: teeTypeFromBinding(binding),
+            regions: binding.regions ?? [],
+        }));
+        return create(RequirementsSchema, {
+            tee: create(TeeSchema, {
+                item: {
+                    case: 'teeTypesAndRegions',
+                    value: create(TeeTypesAndRegionsSchema, { teeTypeAndRegions: teeTypes }),
+                },
+            }),
+        });
+    }
+    return create(RequirementsSchema, {
+        tee: create(TeeSchema, {
+            item: {
+                case: 'anyRegions',
+                value: create(RegionsSchema, { regions: parsed.regions ?? [] }),
+            },
+        }),
+    });
+}
+function teeTypeFromBinding(binding) {
+    switch (binding.tee) {
+        case 'nitro':
+            return TeeType.AWS_NITRO;
+    }
+}

package/dist/sdk/test/evm-contract-mock.js

@@ -1,5 +1,4 @@
 import { decodeFunctionData, encodeFunctionResult, } from 'viem';
-import { chainContractHandler } from './contract-mock-core';
 function bytesToHexAddress(bytes) {
     return `0x${Array.from(bytes)
         .map((b) => b.toString(16).padStart(2, '0'))
@@ -50,67 +49,66 @@ export function addContractMock(evmMock, options) {
     const mock = {};
     const normalizedAddress = options.address.toLowerCase();
     const previousCallContract = evmMock.callContract;
-    evmMock.callContract = chainContractHandler({
-        previous: previousCallContract,
-        matches: (req) => {
-            const toBytes = req.call?.to;
-            return !!toBytes && bytesToHexAddress(toBytes) === normalizedAddress;
-        },
-        noMatchError: (req) => `addContractMock: no mock registered for address ${req.call?.to ? bytesToHexAddress(req.call.to) : '(empty)'}`,
-        handle: (req) => {
-            const dataBytes = req.call?.data;
-            if (!dataBytes || dataBytes.length < 4) {
-                throw new Error('addContractMock: call data too short (need at least 4 bytes for selector)');
-            }
-            const callDataHex = bytesToHex(dataBytes);
-            let decoded;
-            try {
-                decoded = decodeFunctionData({
-                    abi: options.abi,
-                    data: callDataHex,
-                });
-            }
-            catch (e) {
-                if (previousCallContract)
-                    return previousCallContract(req);
-                throw new Error(`addContractMock: failed to decode function data for ${options.address}: ${e instanceof Error ? e.message : e}`);
-            }
-            const handler = mock[decoded.functionName];
-            if (typeof handler !== 'function') {
-                throw new Error(`addContractMock: no handler set for ${decoded.functionName} on ${options.address}`);
-            }
-            const result = handler(...(decoded.args ?? []));
-            const encoded = encodeFunctionResult({
+    evmMock.callContract = (req) => {
+        const toBytes = req.call?.to;
+        if (!toBytes || bytesToHexAddress(toBytes) !== normalizedAddress) {
+            if (previousCallContract)
+                return previousCallContract(req);
+            throw new Error(`addContractMock: no mock registered for address ${toBytes ? bytesToHexAddress(toBytes) : '(empty)'}`);
+        }
+        const dataBytes = req.call?.data;
+        if (!dataBytes || dataBytes.length < 4) {
+            throw new Error('addContractMock: call data too short (need at least 4 bytes for selector)');
+        }
+        const callDataHex = bytesToHex(dataBytes);
+        let decoded;
+        try {
+            decoded = decodeFunctionData({
                 abi: options.abi,
-                functionName: decoded.functionName,
-                result: result,
+                data: callDataHex,
             });
-            return {
-                data: hexToUint8Array(encoded),
-            };
-        },
-    });
+        }
+        catch (e) {
+            if (previousCallContract)
+                return previousCallContract(req);
+            throw new Error(`addContractMock: failed to decode function data for ${options.address}: ${e instanceof Error ? e.message : e}`);
+        }
+        const handler = mock[decoded.functionName];
+        if (typeof handler !== 'function') {
+            throw new Error(`addContractMock: no handler set for ${decoded.functionName} on ${options.address}`);
+        }
+        const result = handler(...(decoded.args ?? []));
+        const encoded = encodeFunctionResult({
+            abi: options.abi,
+            functionName: decoded.functionName,
+            result: result,
+        });
+        return {
+            data: hexToUint8Array(encoded),
+        };
+    };
     const previousWriteReport = evmMock.writeReport;
-    evmMock.writeReport = chainContractHandler({
-        previous: previousWriteReport,
-        matches: (req) => !!req.receiver && bytesToHexAddress(req.receiver) === normalizedAddress,
-        noMatchError: (req) => `addContractMock: no writeReport mock registered for receiver ${req.receiver ? bytesToHexAddress(req.receiver) : '(empty)'}`,
-        handle: (req) => {
-            if (typeof mock.writeReport !== 'function') {
-                throw new Error(`addContractMock: no writeReport handler set for ${options.address}`);
-            }
-            if (!req.report) {
-                throw new Error(`addContractMock: writeReport called without report for ${options.address}`);
-            }
-            if (!req.gasConfig) {
-                throw new Error(`addContractMock: writeReport called without gasConfig for ${options.address}`);
-            }
-            return mock.writeReport({
-                receiver: req.receiver,
-                report: req.report,
-                gasConfig: req.gasConfig,
-            });
-        },
-    });
+    evmMock.writeReport = (req) => {
+        const receiverBytes = req.receiver;
+        if (!receiverBytes || bytesToHexAddress(receiverBytes) !== normalizedAddress) {
+            if (previousWriteReport)
+                return previousWriteReport(req);
+            throw new Error(`addContractMock: no writeReport mock registered for receiver ${receiverBytes ? bytesToHexAddress(receiverBytes) : '(empty)'}`);
+        }
+        if (typeof mock.writeReport !== 'function') {
+            throw new Error(`addContractMock: no writeReport handler set for ${options.address}`);
+        }
+        if (!req.report) {
+            throw new Error(`addContractMock: writeReport called without report for ${options.address}`);
+        }
+        if (!req.gasConfig) {
+            throw new Error(`addContractMock: writeReport called without gasConfig for ${options.address}`);
+        }
+        return mock.writeReport({
+            receiver: req.receiver,
+            report: req.report,
+            gasConfig: req.gasConfig,
+        });
+    };
     return mock;
 }

package/dist/sdk/test/generated/capabilities/blockchain/aptos/v1alpha/aptos_mock_gen.d.ts

@@ -0,0 +1,25 @@
+import { type AccountAPTBalanceReply, type AccountAPTBalanceReplyJson, type AccountAPTBalanceRequest, type AccountTransactionsReply, type AccountTransactionsReplyJson, type AccountTransactionsRequest, type TransactionByHashReply, type TransactionByHashReplyJson, type TransactionByHashRequest, type ViewReply, type ViewReplyJson, type ViewRequest, type WriteReportReply, type WriteReportReplyJson, type WriteReportRequest } from '../../../../../../../generated/capabilities/blockchain/aptos/v1alpha/client_pb';
+/**
+ * Mock for ClientCapability. Use testInstance() to obtain an instance; do not construct directly.
+ * Set per-method properties (e.g. performAction) to define return values. If a method is invoked without a handler set, an error is thrown.
+ */
+export declare class AptosMock {
+    static readonly CAPABILITY_ID = "aptos@1.0.0";
+    /** Set to define the return value for AccountAPTBalance. May return a plain object (AccountAPTBalanceReplyJson) or the message type. */
+    accountAPTBalance?: (input: AccountAPTBalanceRequest) => AccountAPTBalanceReply | AccountAPTBalanceReplyJson;
+    /** Set to define the return value for View. May return a plain object (ViewReplyJson) or the message type. */
+    view?: (input: ViewRequest) => ViewReply | ViewReplyJson;
+    /** Set to define the return value for TransactionByHash. May return a plain object (TransactionByHashReplyJson) or the message type. */
+    transactionByHash?: (input: TransactionByHashRequest) => TransactionByHashReply | TransactionByHashReplyJson;
+    /** Set to define the return value for AccountTransactions. May return a plain object (AccountTransactionsReplyJson) or the message type. */
+    accountTransactions?: (input: AccountTransactionsRequest) => AccountTransactionsReply | AccountTransactionsReplyJson;
+    /** Set to define the return value for WriteReport. May return a plain object (WriteReportReplyJson) or the message type. */
+    writeReport?: (input: WriteReportRequest) => WriteReportReply | WriteReportReplyJson;
+    private constructor();
+    /**
+     * Returns the mock instance for this capability and the specified tags.
+     * Multiple calls with the same tag values return the same instance.
+     * Must be called within the test framework's test() method.
+     */
+    static testInstance(chainSelector: bigint): AptosMock;
+}