@le-space/ui 0.9.8 → 0.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/ui",
-  "version": "0.9.8",
+  "version": "0.10.0",
   "description": "Floating Aleph Relay Button UI components for Svelte and React.",
   "license": "MIT",
   "type": "module",
@@ -44,8 +44,8 @@
     "url": "https://github.com/NiKrause/relay-button/issues"
   },
   "dependencies": {
-    "@le-space/browser": "0.9.8",
-    "@le-space/core": "0.9.8",
+    "@le-space/browser": "0.10.0",
+    "@le-space/core": "0.10.0",
     "viem": "^2.53.1"
   },
   "peerDependencies": {

package/react/index.d.ts

@@ -1,4 +1,5 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
+import { AttestWasm } from '@le-space/attest-wasm/instance';
 
 type CrnSource = 'list' | 'aggregate';
 type CrnSourcePreference = 'auto' | 'aggregate' | 'list';
@@ -66,7 +67,17 @@ interface Crn {
     gpu_support?: boolean;
     system_usage?: CrnUsage | null;
     payment_receiver_address?: string | null;
+    /** Registered owner (corechannel aggregate). */
+    owner?: string | null;
     version?: string | null;
+    /** CPU features from the node's /about/usage/system, e.g. ["sev", "sev_es", "sev_snp"]. */
+    cpu_features?: string[] | null;
+    /** TEE properties from /about/usage/system; present on SEV-SNP nodes. */
+    tee?: {
+        sev_snp?: {
+            supported_vcpu_types?: string[];
+        };
+    } | null;
     city?: string | null;
     region?: string | null;
     country?: string | null;
@@ -186,7 +197,7 @@ interface RootfsResolution {
     gatewayError?: string | null;
 }
 
-type DeploymentProgressStage = "idle" | "validating" | "loading-manifest" | "verifying-rootfs" | "loading-pricing" | "loading-balance" | "selecting-crn" | "building-message" | "signing-message" | "broadcasting" | "notifying-crn" | "waiting-for-aleph" | "deployment-confirmed" | "deployment-rejected" | "publishing-bootstrap" | "building-delete-message" | "signing-delete-message" | "broadcasting-delete" | "delete-completed" | "refreshing-instances" | "completed" | "error";
+type DeploymentProgressStage = "idle" | "validating" | "loading-manifest" | "verifying-rootfs" | "loading-pricing" | "loading-balance" | "selecting-crn" | "building-message" | "signing-message" | "broadcasting" | "notifying-crn" | "preparing-confidential" | "attesting-guest" | "unlocking-guest" | "waiting-for-aleph" | "deployment-confirmed" | "deployment-rejected" | "publishing-bootstrap" | "building-delete-message" | "signing-delete-message" | "broadcasting-delete" | "delete-completed" | "refreshing-instances" | "completed" | "error";
 interface DeploymentProgressEvent {
     stage: DeploymentProgressStage;
     label: string;
@@ -221,6 +232,27 @@ interface SponsorRelayUcanStoreBootstrapInput {
     pwaOrigin: string;
     serviceOrigin: string;
 }
+interface SponsorRelayConfidentialStart {
+    /** STORE item hash of the LUKS-encrypted rootfs (aleph-confidential-rootfs, or the reusable workflow's confidential_rootfs_item_hash). */
+    rootfsItemHash: string;
+    /** Its size in MiB, if larger than the manifest's rootfs. */
+    rootfsSizeMiB?: number;
+    /** `wss://…/attest` of an attest relay (@le-space/attest-relay). */
+    relayUrl: string;
+    /**
+     * Loads the attestation WASM, e.g.
+     * `async () => { const m = await import('@le-space/attest-wasm/pkg/relay_button_attest.js'); await m.default(); return m }`.
+     */
+    loadWasm: () => Promise<AttestWasm>;
+    /** An SNP instance runtime by name (vm-images); the network's default if absent. */
+    runtimeName?: string;
+    /**
+     * localStorage key under which nodes AMD cannot vouch for (KDS has no VCEK
+     * for their chip) are remembered for a week and tried last. Omit it and
+     * they are remembered for the page only.
+     */
+    refusedNodesStorageKey?: string;
+}
 interface SponsorRelayProps {
     debug?: boolean;
     manifestUrl?: string;
@@ -241,6 +273,21 @@ interface SponsorRelayProps {
      * fallback. `localStorage.LE_SPACE_CRN_SOURCE` overrides this at runtime.
      */
     crnSource?: CrnSourcePreference;
+    /**
+     * Ask for a confidential VM (AMD SEV-SNP): only nodes that report SEV-SNP and
+     * run a patched aleph-vm are offered, and pricing uses Aleph's
+     * `instance_confidential` entry. The person can switch it in the panel too.
+     * Starting one needs `confidentialStart`; without it the panel refuses.
+     */
+    confidential?: boolean;
+    /**
+     * What a confidential start needs (relay-button#169): the encrypted rootfs,
+     * an attest relay, and the attestation WASM. The browser computes the
+     * launch measurements for the connected wallet, signs the INSTANCE with
+     * them, verifies the guest through the relay against AMD, and unlocks it
+     * with the passphrase the person enters, signed by their wallet.
+     */
+    confidentialStart?: SponsorRelayConfidentialStart;
     schedulerApiHost?: string;
     twoN6ApiHost?: string;
     /**
@@ -359,6 +406,12 @@ interface SponsorRelayState {
     instanceName: string;
     ucanStoreBootstrap: SponsorRelayUcanStoreBootstrapInput;
     tierId: string;
+    /** Confidential VM requested (AMD SEV-SNP); see the `confidential` prop. */
+    confidential: boolean;
+    /** Whether the host set `confidentialStart`, so a confidential VM can start. */
+    confidentialStartAvailable: boolean;
+    /** The encrypted rootfs's passphrase, held only until the unlock; never stored. */
+    confidentialPassphrase: string;
     showAdvanced: boolean;
     showInstances: boolean;
     showPasteManifest: boolean;
@@ -386,6 +439,12 @@ interface SponsorRelayState {
         hash: string;
         name: string | null;
         score: number | null;
+        /** ISO country code, when known. */
+        country: string | null;
+        /** aleph-vm version, when known. */
+        version: string | null;
+        /** Shortened owner / reward address: nodes of one operator share it. */
+        operator: string | null;
     }>;
     crnPinnedByUser: boolean;
     instances: CompactInstanceRecord[];
@@ -447,6 +506,16 @@ declare class SponsorRelayController {
     setUcanStoreBootstrapField(field: keyof SponsorRelayUcanStoreBootstrapInput, value: string): void;
     setTierId(tierId: string): void;
     private recomputePricingSummary;
+    /**
+     * Switch between a normal and a confidential VM. Pricing and the node list
+     * differ between the two, so both are loaded again.
+     */
+    setConfidential(confidential: boolean): Promise<void>;
+    /**
+     * The encrypted rootfs's passphrase for a confidential start. Kept in
+     * memory only until the unlock, then cleared; never persisted.
+     */
+    setConfidentialPassphrase(passphrase: string): void;
     /** Pin a specific CRN as the first deploy attempt (null = automatic). */
     selectCrn(hash: string | null): void;
     private queueManifestRefresh;