@chainlink/cre-sdk 1.17.0-alpha.3 → 1.17.0-alpha.4

package/dist/generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen.js

@@ -367,3 +367,119 @@ class ClientLogTrigger {
         return rawOutput;
     }
 }
+export class ClientRestrictor {
+    ChainSelector;
+    constructor(ChainSelector) {
+        this.ChainSelector = ChainSelector;
+    }
+    limitGetAccountInfoWithOpts(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetAccountInfoWithOpts',
+                maxCalls,
+            },
+        };
+    }
+    limitGetBalance(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetBalance',
+                maxCalls,
+            },
+        };
+    }
+    limitGetBlock(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetBlock',
+                maxCalls,
+            },
+        };
+    }
+    limitGetFeeForMessage(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetFeeForMessage',
+                maxCalls,
+            },
+        };
+    }
+    limitGetMultipleAccountsWithOpts(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetMultipleAccountsWithOpts',
+                maxCalls,
+            },
+        };
+    }
+    limitGetProgramAccounts(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetProgramAccounts',
+                maxCalls,
+            },
+        };
+    }
+    limitGetSignatureStatuses(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetSignatureStatuses',
+                maxCalls,
+            },
+        };
+    }
+    limitGetSlotHeight(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetSlotHeight',
+                maxCalls,
+            },
+        };
+    }
+    limitGetTransaction(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'GetTransaction',
+                maxCalls,
+            },
+        };
+    }
+    limitWriteReport(maxCalls) {
+        // Include all labels in capability ID for routing when specified
+        const capabilityId = `${ClientCapability.CAPABILITY_NAME}:ChainSelector:${this.ChainSelector}@${ClientCapability.CAPABILITY_VERSION}`;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'WriteReport',
+                maxCalls,
+            },
+        };
+    }
+}

package/dist/generated-sdk/capabilities/internal/consensus/v1alpha/consensus_sdk_gen.d.ts

@@ -1,4 +1,4 @@
-import { type ReportRequest, type ReportRequestJson, type SimpleConsensusInputs, type SimpleConsensusInputsJson } from '../../../../../generated/sdk/v1alpha/sdk_pb';
+import { type CapabilityRestrictionJson, type ReportRequest, type ReportRequestJson, type SimpleConsensusInputs, type SimpleConsensusInputsJson } from '../../../../../generated/sdk/v1alpha/sdk_pb';
 import { type Value } from '../../../../../generated/values/v1/values_pb';
 import type { Runtime } from '../../../../../sdk';
 import { Report } from '../../../../../sdk/report';
@@ -22,3 +22,7 @@ export declare class ConsensusCapability {
         result: () => Report;
     };
 }
+export declare class ConsensusRestrictor {
+    limitSimple(maxCalls: number): CapabilityRestrictionJson;
+    limitReport(maxCalls: number): CapabilityRestrictionJson;
+}

package/dist/generated-sdk/capabilities/internal/consensus/v1alpha/consensus_sdk_gen.js

@@ -68,3 +68,25 @@ export class ConsensusCapability {
         };
     }
 }
+export class ConsensusRestrictor {
+    limitSimple(maxCalls) {
+        const capabilityId = ConsensusCapability.CAPABILITY_ID;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'Simple',
+                maxCalls,
+            },
+        };
+    }
+    limitReport(maxCalls) {
+        const capabilityId = ConsensusCapability.CAPABILITY_ID;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'Report',
+                maxCalls,
+            },
+        };
+    }
+}

package/dist/generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen.d.ts

@@ -1,4 +1,5 @@
 import { type ConfidentialHTTPRequest, type ConfidentialHTTPRequestJson, type HTTPResponse } from '../../../../../generated/capabilities/networking/confidentialhttp/v1alpha/client_pb';
+import type { CapabilityRestrictionJson } from '../../../../../generated/sdk/v1alpha/sdk_pb';
 import type { Runtime } from '../../../../../sdk';
 import type { CapabilityInput } from '../../../../../sdk/utils/types/no-excess';
 /**
@@ -17,3 +18,6 @@ export declare class ClientCapability {
         result: () => HTTPResponse;
     };
 }
+export declare class ClientRestrictor {
+    limitSendRequest(maxCalls: number): CapabilityRestrictionJson;
+}

package/dist/generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen.js

@@ -41,3 +41,15 @@ export class ClientCapability {
         };
     }
 }
+export class ClientRestrictor {
+    limitSendRequest(maxCalls) {
+        const capabilityId = ClientCapability.CAPABILITY_ID;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'SendRequest',
+                maxCalls,
+            },
+        };
+    }
+}

package/dist/generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen.d.ts

@@ -1,5 +1,6 @@
 import { type Request, type RequestJson, type Response } from '../../../../../generated/capabilities/networking/http/v1alpha/client_pb';
-import type { NodeRuntime, Runtime } from '../../../../../sdk';
+import type { CapabilityRestrictionJson } from '../../../../../generated/sdk/v1alpha/sdk_pb';
+import type { NodeRuntime, Runtime, TeeRuntime } from '../../../../../sdk';
 import type { ConsensusAggregation, PrimitiveTypes, UnwrapOptions } from '../../../../../sdk/utils';
 import type { CapabilityInput } from '../../../../../sdk/utils/types/no-excess';
 export declare class SendRequester {
@@ -22,12 +23,21 @@ export declare class ClientCapability {
     static readonly CAPABILITY_ID = "http-actions@1.0.0-alpha";
     static readonly CAPABILITY_NAME = "http-actions";
     static readonly CAPABILITY_VERSION = "1.0.0-alpha";
+    sendRequest<TInput>(runtime: TeeRuntime<unknown>, input: CapabilityInput<TInput, Request, RequestJson>): {
+        result: () => Response;
+    };
     sendRequest<TInput>(runtime: NodeRuntime<unknown>, input: CapabilityInput<TInput, Request, RequestJson>): {
         result: () => Response;
     };
-    sendRequest<TArgs extends unknown[], TOutput>(runtime: Runtime<unknown>, fn: (sendRequester: SendRequester, ...args: TArgs) => TOutput, consensusAggregation: ConsensusAggregation<TOutput, true>, unwrapOptions?: TOutput extends PrimitiveTypes ? never : UnwrapOptions<TOutput>): (...args: TArgs) => {
+    sendRequest<TInput>(runtime: NodeRuntime<unknown> | TeeRuntime<unknown>, input: CapabilityInput<TInput, Request, RequestJson>): {
+        result: () => Response;
+    };
+    sendRequest<TArgs extends unknown[], TInput, TOutput = TInput>(runtime: Runtime<unknown>, fn: (sendRequester: SendRequester, ...args: TArgs) => TInput, consensusAggregation: ConsensusAggregation<TInput, TOutput, true>, unwrapOptions?: TInput extends PrimitiveTypes ? never : UnwrapOptions<TInput>): (...args: TArgs) => {
         result: () => TOutput;
     };
     private sendRequestCallHelper;
     private sendRequestSugarHelper;
 }
+export declare class ClientRestrictor {
+    limitSendRequest(maxCalls: number): CapabilityRestrictionJson;
+}

package/dist/generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen.js

@@ -68,3 +68,15 @@ export class ClientCapability {
         return runtime.runInNodeMode(wrappedFn, consensusAggregation, unwrapOptions);
     }
 }
+export class ClientRestrictor {
+    limitSendRequest(maxCalls) {
+        const capabilityId = ClientCapability.CAPABILITY_ID;
+        return {
+            method: {
+                id: capabilityId,
+                method: 'SendRequest',
+                maxCalls,
+            },
+        };
+    }
+}

package/dist/generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen.d.ts

@@ -36,4 +36,6 @@ declare class HTTPTrigger implements Trigger<Payload, Payload> {
      */
     adapt(rawOutput: Payload): Payload;
 }
+export declare class HTTPRestrictor {
+}
 export {};

package/dist/generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen.js

@@ -53,3 +53,5 @@ class HTTPTrigger {
         return rawOutput;
     }
 }
+export class HTTPRestrictor {
+}

package/dist/generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen.d.ts

@@ -36,4 +36,6 @@ declare class CronTrigger implements Trigger<Payload, Payload> {
      */
     adapt(rawOutput: Payload): Payload;
 }
+export declare class CronRestrictor {
+}
 export {};

package/dist/generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen.js

@@ -53,3 +53,5 @@ class CronTrigger {
         return rawOutput;
     }
 }
+export class CronRestrictor {
+}

package/dist/sdk/cre/index.d.ts

@@ -1,12 +1,13 @@
 /**
  * Public API for the CRE SDK.
  */
-import { ClientCapability as EVMClient } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
-import { ClientCapability as SolanaClient } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
-import { ClientCapability as ConfidentialHTTPClient } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
-import { ClientCapability as HTTPClient } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
-import { HTTPCapability } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
-import { CronCapability } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
+import { ClientCapability as AptosClient, ClientRestrictor as AptosRestrictor } from '../../generated-sdk/capabilities/blockchain/aptos/v1alpha/client_sdk_gen';
+import { ClientCapability as EVMClient, ClientRestrictor as EVMRestrictor } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
+import { ClientCapability as SolanaClient, ClientRestrictor as SolanaRestrictor } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
+import { ClientCapability as ConfidentialHTTPClient, ClientRestrictor as ConfidentialHTTPRestrictor } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
+import { ClientCapability as HTTPClient, ClientRestrictor as HTTPClientRestrictor } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
+import { HTTPCapability, HTTPRestrictor } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
+import { CronCapability, CronRestrictor } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
 /**
  * Public exports for the CRE SDK.
  */
@@ -14,14 +15,17 @@ export { type Log as EVMLog, TxStatus, } from '../../generated/capabilities/bloc
 export { ComparisonOperator as SolanaComparisonOperator, type CPIFilterConfigJson as SolanaCPIFilterConfigJson, type FilterLogTriggerRequestJson as SolanaFilterLogTriggerRequestJson, type Log as SolanaLog, ReceiverContractExecutionStatus as SolanaReceiverContractExecutionStatus, type SubkeyConfigJson as SolanaSubkeyConfigJson, TxStatus as SolanaTxStatus, type ValueComparatorJson as SolanaValueComparatorJson, } from '../../generated/capabilities/blockchain/solana/v1alpha/client_pb';
 export type { Payload as HTTPPayload } from '../../generated/capabilities/networking/http/v1alpha/trigger_pb';
 export type { Payload as CronPayload } from '../../generated/capabilities/scheduler/cron/v1/trigger_pb';
-export { ClientCapability as EVMClient, type WriteCreReportRequest, type WriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
-export { ClientCapability as SolanaClient, type WriteCreReportRequest as SolanaWriteCreReportRequest, type WriteCreReportRequestJson as SolanaWriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
-export { ClientCapability as ConfidentialHTTPClient } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
-export { ClientCapability as HTTPClient, type SendRequester as HTTPSendRequester, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
-export { HTTPCapability } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
-export { CronCapability } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
-export type { NodeRuntime, Runtime } from '../runtime';
-export { handler } from '../workflow';
+export { TeeType } from '../../generated/sdk/v1alpha/sdk_pb';
+export { ClientCapability as AptosClient, ClientRestrictor as AptosRestrictor, type WriteCreReportRequest as AptosWriteCreReportRequest, type WriteCreReportRequestJson as AptosWriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/aptos/v1alpha/client_sdk_gen';
+export { ClientCapability as EVMClient, ClientRestrictor as EVMRestrictor, type WriteCreReportRequest, type WriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
+export { ClientCapability as SolanaClient, ClientRestrictor as SolanaRestrictor, type WriteCreReportRequest as SolanaWriteCreReportRequest, type WriteCreReportRequestJson as SolanaWriteCreReportRequestJson, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
+export { ClientCapability as ConfidentialHTTPClient, ClientRestrictor as ConfidentialHTTPRestrictor, } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
+export { ClientCapability as HTTPClient, ClientRestrictor as HTTPClientRestrictor, type SendRequester as HTTPSendRequester, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
+export { HTTPCapability, HTTPRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
+export { CronCapability, CronRestrictor, } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
+export type { NodeRuntime, Runtime, TeeRuntime } from '../runtime';
+export type { AnyTeeConstraint, NitroBinding, NitroRegion, OneOfTees, Region, TeeBinding, TeeConstraint, } from '../workflow';
+export { handler, handlerInTee, NITRO_REGIONS, REGIONS } from '../workflow';
 export declare const cre: {
     capabilities: {
         CronCapability: typeof CronCapability;
@@ -29,7 +33,18 @@ export declare const cre: {
         ConfidentialHTTPClient: typeof ConfidentialHTTPClient;
         HTTPClient: typeof HTTPClient;
         EVMClient: typeof EVMClient;
+        AptosClient: typeof AptosClient;
         SolanaClient: typeof SolanaClient;
     };
-    handler: <TRawTriggerOutput extends import("@bufbuild/protobuf").Message<string>, TTriggerOutput, TConfig, TResult>(trigger: import("..").Trigger<TRawTriggerOutput, TTriggerOutput>, fn: import("../workflow").HandlerFn<TConfig, TTriggerOutput, TResult>) => import("../workflow").HandlerEntry<TConfig, TRawTriggerOutput, TTriggerOutput, TResult>;
+    restrictors: {
+        CronRestrictor: typeof CronRestrictor;
+        HTTPRestrictor: typeof HTTPRestrictor;
+        ConfidentialHTTPRestrictor: typeof ConfidentialHTTPRestrictor;
+        HTTPClientRestrictor: typeof HTTPClientRestrictor;
+        EVMRestrictor: typeof EVMRestrictor;
+        SolanaRestrictor: typeof SolanaRestrictor;
+        AptosRestrictor: typeof AptosRestrictor;
+    };
+    handler: <TRawTriggerOutput extends import("@bufbuild/protobuf").Message<string>, TTriggerOutput, TConfig, TResult, TRuntime = import("../runtime").Runtime<TConfig>>(trigger: import("..").Trigger<TRawTriggerOutput, TTriggerOutput>, fn: import("../workflow").HandlerFn<TConfig, TTriggerOutput, TResult, TRuntime>, hooks?: import("../workflow").Hooks<TConfig, TTriggerOutput>) => import("../workflow").HandlerEntry<TConfig, TRawTriggerOutput, TTriggerOutput, TResult, TRuntime>;
+    handlerInTee: <TRawTriggerOutput extends import("@bufbuild/protobuf").Message<string>, TTriggerOutput, TConfig, TResult>(trigger: import("..").Trigger<TRawTriggerOutput, TTriggerOutput>, fn: import("../workflow").HandlerFn<TConfig, TTriggerOutput, TResult, import("../runtime").TeeRuntime<TConfig>>, tees: import("../workflow").TeeConstraint, hooks?: import("../workflow").Hooks<TConfig, TTriggerOutput>) => import("../workflow").HandlerEntry<TConfig, TRawTriggerOutput, TTriggerOutput, TResult, import("../runtime").TeeRuntime<TConfig>>;
 };

package/dist/sdk/cre/index.js

@@ -1,31 +1,35 @@
 /**
  * Public API for the CRE SDK.
  */
-import { ClientCapability as EVMClient } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
-import { ClientCapability as SolanaClient } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
-import { ClientCapability as ConfidentialHTTPClient } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
-import { ClientCapability as HTTPClient } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
-import { HTTPCapability } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
-import { CronCapability } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
+import { ClientCapability as AptosClient, ClientRestrictor as AptosRestrictor, } from '../../generated-sdk/capabilities/blockchain/aptos/v1alpha/client_sdk_gen';
+import { ClientCapability as EVMClient, ClientRestrictor as EVMRestrictor, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
+import { ClientCapability as SolanaClient, ClientRestrictor as SolanaRestrictor, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
+import { ClientCapability as ConfidentialHTTPClient, ClientRestrictor as ConfidentialHTTPRestrictor, } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
+import { ClientCapability as HTTPClient, ClientRestrictor as HTTPClientRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
+import { HTTPCapability, HTTPRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
+import { CronCapability, CronRestrictor, } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
 import { prepareRuntime } from '../utils/prepare-runtime';
-import { handler } from '../workflow';
+import { handler, handlerInTee } from '../workflow';
 /**
  * Public exports for the CRE SDK.
  */
 export { TxStatus, } from '../../generated/capabilities/blockchain/evm/v1alpha/client_pb';
 export { ComparisonOperator as SolanaComparisonOperator, ReceiverContractExecutionStatus as SolanaReceiverContractExecutionStatus, TxStatus as SolanaTxStatus, } from '../../generated/capabilities/blockchain/solana/v1alpha/client_pb';
+export { TeeType } from '../../generated/sdk/v1alpha/sdk_pb';
+// Aptos Capability
+export { ClientCapability as AptosClient, ClientRestrictor as AptosRestrictor, } from '../../generated-sdk/capabilities/blockchain/aptos/v1alpha/client_sdk_gen';
 // EVM Capability
-export { ClientCapability as EVMClient, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
+export { ClientCapability as EVMClient, ClientRestrictor as EVMRestrictor, } from '../../generated-sdk/capabilities/blockchain/evm/v1alpha/client_sdk_gen';
 // Solana Capability
-export { ClientCapability as SolanaClient, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
+export { ClientCapability as SolanaClient, ClientRestrictor as SolanaRestrictor, } from '../../generated-sdk/capabilities/blockchain/solana/v1alpha/client_sdk_gen';
 // Confidential HTTP Capability
-export { ClientCapability as ConfidentialHTTPClient } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
+export { ClientCapability as ConfidentialHTTPClient, ClientRestrictor as ConfidentialHTTPRestrictor, } from '../../generated-sdk/capabilities/networking/confidentialhttp/v1alpha/client_sdk_gen';
 // HTTP Capability
-export { ClientCapability as HTTPClient, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
-export { HTTPCapability } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
+export { ClientCapability as HTTPClient, ClientRestrictor as HTTPClientRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/client_sdk_gen';
+export { HTTPCapability, HTTPRestrictor, } from '../../generated-sdk/capabilities/networking/http/v1alpha/http_sdk_gen';
 // CRON Capability
-export { CronCapability } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
-export { handler } from '../workflow';
+export { CronCapability, CronRestrictor, } from '../../generated-sdk/capabilities/scheduler/cron/v1/cron_sdk_gen';
+export { handler, handlerInTee, NITRO_REGIONS, REGIONS } from '../workflow';
 prepareRuntime();
 export const cre = {
     capabilities: {
@@ -34,7 +38,18 @@ export const cre = {
         ConfidentialHTTPClient,
         HTTPClient,
         EVMClient,
+        AptosClient,
         SolanaClient,
     },
+    restrictors: {
+        CronRestrictor,
+        HTTPRestrictor,
+        ConfidentialHTTPRestrictor,
+        HTTPClientRestrictor,
+        EVMRestrictor,
+        SolanaRestrictor,
+        AptosRestrictor,
+    },
     handler,
+    handlerInTee,
 };

package/dist/sdk/impl/runtime-impl.d.ts

@@ -1,6 +1,6 @@
 import { type Message } from '@bufbuild/protobuf';
 import { type AwaitCapabilitiesRequest, type AwaitCapabilitiesResponse, type AwaitSecretsRequest, type AwaitSecretsResponse, type CapabilityRequest, type GetSecretsRequest, Mode, type Secret, type SecretRequest, type SecretRequestJson } from '../../generated/sdk/v1alpha/sdk_pb';
-import type { BaseRuntime, CallCapabilityParams, NodeRuntime, ReportRequest, ReportRequestJson, Runtime } from '..';
+import type { BaseRuntime, CallCapabilityParams, NodeRuntime, ReportRequest, ReportRequestJson, Runtime, TeeRuntime } from '..';
 import type { Report } from '../report';
 import { type ConsensusAggregation, type PrimitiveTypes, type UnwrapOptions } from '../utils';
 /**
@@ -44,7 +44,10 @@ export declare class BaseRuntimeImpl<C> implements BaseRuntime<C> {
     now(): Date;
     sleep(ms: number): void;
     log(message: string): void;
+    emitMetric(name: string, value: number, type: MetricType, labels?: Record<string, string>): boolean;
 }
+/** Ergonomic union for {@link BaseRuntimeImpl.emitMetric}. */
+export type MetricType = 'counter' | 'gauge';
 /**
  * It is used when a BFT guarantee cannot be provided automatically (e.g. calling a standard API).
  * You tell each node to perform a task on its own.
@@ -75,7 +78,7 @@ export declare class RuntimeImpl<C> extends BaseRuntimeImpl<C> implements Runtim
      * 5. Runs consensus to aggregate observations
      * 6. Returns aggregated result
      */
-    runInNodeMode<TArgs extends unknown[], TOutput>(fn: (nodeRuntime: NodeRuntime<C>, ...args: TArgs) => TOutput, consensusAggregation: ConsensusAggregation<TOutput, true>, unwrapOptions?: TOutput extends PrimitiveTypes ? never : UnwrapOptions<TOutput>): (...args: TArgs) => {
+    runInNodeMode<TArgs extends unknown[], TInput, TOutput = TInput>(fn: (nodeRuntime: NodeRuntime<C>, ...args: TArgs) => TInput, consensusAggregation: ConsensusAggregation<TInput, TOutput, true>, unwrapOptions?: TInput extends PrimitiveTypes ? never : UnwrapOptions<TInput>): (...args: TArgs) => {
         result: () => TOutput;
     };
     private prepareConsensusInput;
@@ -94,6 +97,25 @@ export declare class RuntimeImpl<C> extends BaseRuntimeImpl<C> implements Runtim
         result: () => Report;
     };
 }
+export declare class TeeRuntimeImpl<C> implements TeeRuntime<C> {
+    config: C;
+    nextCallId: number;
+    private readonly runtime;
+    constructor(config: C, nextCallId: number, helpers: RuntimeHelpers, maxResponseSize: bigint);
+    getSecret(request: SecretRequest | SecretRequestJson): {
+        result: () => Secret;
+    };
+    now(): Date;
+    log(message: string): void;
+    emitMetric(name: string, value: number, type: MetricType, labels?: Record<string, string>): boolean;
+    callCapability<I extends Message, O extends Message>({ capabilityId, method, payload, inputSchema, outputSchema, }: CallCapabilityParams<I, O>): {
+        result: () => O;
+    };
+    reportFromDon(input: ReportRequest | ReportRequestJson): {
+        result: () => Report;
+    };
+    usingTheDons(): Runtime<C>;
+}
 /**
  * Interface to the WASM host environment.
  * Provides low-level access to capabilities, secrets, and utilities.
@@ -115,4 +137,9 @@ export interface RuntimeHelpers {
     sleep(ms: number): void;
     /** Logs a message to the host environment. */
     log(message: string): void;
+    /**
+     * Emits a user metric to the host. Payload is a protobuf-encoded
+     * `workflows.v2.WorkflowUserMetric`. Returns false if the host rejected it.
+     */
+    emitMetric(payload: Uint8Array): boolean;
 }

package/dist/sdk/impl/runtime-impl.js

@@ -1,7 +1,8 @@
-import { create } from '@bufbuild/protobuf';
+import { create, toBinary } from '@bufbuild/protobuf';
 import { anyPack, anyUnpack } from '@bufbuild/protobuf/wkt';
 import { deserializeErrorFromString } from '../../capabilities/errors';
 import { AwaitCapabilitiesRequestSchema, AwaitSecretsRequestSchema, CapabilityRequestSchema, GetSecretsRequestSchema, Mode, SecretRequestSchema, SimpleConsensusInputsSchema, } from '../../generated/sdk/v1alpha/sdk_pb';
+import { UserMetricType, WorkflowUserMetricSchema, } from '../../generated/workflows/v2/workflow_user_metric_pb';
 import { ConsensusCapability } from '../../generated-sdk/capabilities/internal/consensus/v1alpha/consensus_sdk_gen';
 import { Value, } from '../utils';
 import { CapabilityRuntimeError, DonModeError, NodeModeError, SecretsError } from '../errors';
@@ -139,7 +140,20 @@ export class BaseRuntimeImpl {
     log(message) {
         this.helpers.log(message);
     }
+    emitMetric(name, value, type, labels) {
+        const metric = create(WorkflowUserMetricSchema, {
+            name,
+            value,
+            type: METRIC_TYPE_TO_PROTO[type],
+            labels: labels ?? {},
+        });
+        return this.helpers.emitMetric(toBinary(WorkflowUserMetricSchema, metric));
+    }
 }
+const METRIC_TYPE_TO_PROTO = {
+    counter: UserMetricType.COUNTER,
+    gauge: UserMetricType.GAUGE,
+};
 /**
  * It is used when a BFT guarantee cannot be provided automatically (e.g. calling a standard API).
  * You tell each node to perform a task on its own.
@@ -204,7 +218,7 @@ export class RuntimeImpl extends BaseRuntimeImpl {
             descriptors: consensusAggregation.descriptor,
         });
         if (consensusAggregation.defaultValue) {
-            // Safe cast: ConsensusAggregation<T, true> implies T extends CreSerializable
+            // Safe cast: ConsensusAggregation<TInput, TOutput, true> implies TInput extends CreSerializable
             const defaultValue = Value.from(consensusAggregation.defaultValue).proto();
             clearIgnoredFields(defaultValue, consensusAggregation.descriptor);
             consensusInput.default = defaultValue;
@@ -212,7 +226,7 @@ export class RuntimeImpl extends BaseRuntimeImpl {
         return consensusInput;
     }
     captureObservation(consensusInput, observation, descriptor) {
-        // Safe cast: ConsensusAggregation<T, true> implies T extends CreSerializable
+        // Safe cast: ConsensusAggregation<TInput, TOutput, true> implies TInput extends CreSerializable
         const observationValue = Value.from(observation).proto();
         clearIgnoredFields(observationValue, descriptor);
         consensusInput.observation = {
@@ -239,9 +253,7 @@ export class RuntimeImpl extends BaseRuntimeImpl {
             result: () => {
                 const result = call.result();
                 const wrappedValue = Value.wrap(result);
-                return unwrapOptions
-                    ? wrappedValue.unwrapToType(unwrapOptions)
-                    : wrappedValue.unwrap();
+                return (unwrapOptions ? wrappedValue.unwrapToType(unwrapOptions) : wrappedValue.unwrap());
             },
         };
     }
@@ -321,6 +333,43 @@ export class RuntimeImpl extends BaseRuntimeImpl {
         };
     }
 }
+export class TeeRuntimeImpl {
+    config;
+    nextCallId;
+    runtime;
+    constructor(config, nextCallId, helpers, maxResponseSize) {
+        this.config = config;
+        this.nextCallId = nextCallId;
+        this.runtime = new RuntimeImpl(config, nextCallId, helpers, maxResponseSize);
+    }
+    getSecret(request) {
+        return this.runtime.getSecret(request);
+    }
+    now() {
+        return this.runtime.now();
+    }
+    log(message) {
+        this.runtime.log(message);
+    }
+    emitMetric(name, value, type, labels) {
+        return this.runtime.emitMetric(name, value, type, labels);
+    }
+    callCapability({ capabilityId, method, payload, inputSchema, outputSchema, }) {
+        return this.runtime.callCapability({
+            capabilityId,
+            method,
+            payload,
+            inputSchema,
+            outputSchema,
+        });
+    }
+    reportFromDon(input) {
+        return this.runtime.report(input);
+    }
+    usingTheDons() {
+        return this.runtime;
+    }
+}
 function clearIgnoredFields(value, descriptor) {
     if (!descriptor || !value) {
         return;

package/dist/sdk/runtime.d.ts

@@ -1,10 +1,11 @@
 import type { Message } from '@bufbuild/protobuf';
 import type { GenMessage } from '@bufbuild/protobuf/codegenv2';
 import type { ReportRequest, ReportRequestJson } from '../generated/sdk/v1alpha/sdk_pb';
+import type { MetricType } from './impl/runtime-impl';
 import type { Report } from './report';
 import type { ConsensusAggregation, PrimitiveTypes, UnwrapOptions } from './utils';
 import type { SecretsProvider } from '.';
-export type { ReportRequest, ReportRequestJson };
+export type { ReportRequest, ReportRequestJson, MetricType };
 export type CallCapabilityParams<I extends Message, O extends Message> = {
     capabilityId: string;
     method: string;
@@ -23,6 +24,7 @@ export interface BaseRuntime<C> {
     };
     now(): Date;
     log(message: string): void;
+    emitMetric(name: string, value: number, type: MetricType, labels?: Record<string, string>): boolean;
 }
 /**
  * Runtime for Node mode execution.
@@ -30,6 +32,26 @@ export interface BaseRuntime<C> {
 export interface NodeRuntime<C> extends BaseRuntime<C> {
     readonly _isNodeRuntime: true;
 }
+/**
+ * Runtime for Tee mode execution.
+ */
+export interface TeeRuntime<C> extends BaseRuntime<C>, SecretsProvider {
+    /**
+     * Generates a report from the DON.
+     * Data requestsed throught this method will be routed outside of the TEE.
+     *
+     * @param input - Report request to generate a report from the DON
+     * @returns Report generated from the DON
+     */
+    reportFromDon(input: ReportRequest | ReportRequestJson): {
+        result: () => Report;
+    };
+    /**
+     * Returns the runtime that makes requests to the CRE DONs.
+     * Requests made through this runtime will therefore be routed outside of the TEE
+     */
+    usingTheDons(): Runtime<C>;
+}
 /**
  * Runtime for DON mode execution.
  */
@@ -42,7 +64,7 @@ export interface Runtime<C> extends BaseRuntime<C>, SecretsProvider {
      * @param unwrapOptions - Optional unwrapping config for complex return types
      * @returns Wrapped function that returns aggregated result
      */
-    runInNodeMode<TArgs extends unknown[], TOutput>(fn: (nodeRuntime: NodeRuntime<C>, ...args: TArgs) => TOutput, consensusAggregation: ConsensusAggregation<TOutput, true>, unwrapOptions?: TOutput extends PrimitiveTypes ? never : UnwrapOptions<TOutput>): (...args: TArgs) => {
+    runInNodeMode<TArgs extends unknown[], TInput, TOutput = TInput>(fn: (nodeRuntime: NodeRuntime<C>, ...args: TArgs) => TInput, consensusAggregation: ConsensusAggregation<TInput, TOutput, true>, unwrapOptions?: TInput extends PrimitiveTypes ? never : UnwrapOptions<TInput>): (...args: TArgs) => {
         result: () => TOutput;
     };
     report(input: ReportRequest | ReportRequestJson): {