@t2000/cli 5.16.0 → 5.17.0

package/dist/index.js

@@ -27783,10 +27783,10 @@ async function finalize(response, opts) {
   return { status: response.status, body: body2, paid: opts.paid };
 }
 async function makeGrpcBuildClient(client) {
-  const { SuiGrpcClient: SuiGrpcClient2 } = await import("./grpc-OLWNGPHN.js");
+  const { SuiGrpcClient: SuiGrpcClient3 } = await import("./grpc-OLWNGPHN.js");
   const network = client.network === "testnet" ? "testnet" : "mainnet";
   const baseUrl = network === "testnet" ? "https://fullnode.testnet.sui.io" : "https://fullnode.mainnet.sui.io";
-  return new SuiGrpcClient2({ baseUrl, network });
+  return new SuiGrpcClient3({ baseUrl, network });
 }
 function atomicToHuman(raw, decimals) {
   return Number(raw) / 10 ** decimals;
@@ -28436,6 +28436,124 @@ async function listModels(opts) {
     privacy: m.privacy ?? m.privacy_tier
   }));
 }
+var RECEIPT_ANCHORED_SUFFIX = "::anchor::ReceiptAnchored";
+function fullnodeUrl(network) {
+  return network === "testnet" ? "https://fullnode.testnet.sui.io" : "https://fullnode.mainnet.sui.io";
+}
+async function verifyReceipt(receiptId, opts = {}) {
+  const base = opts.apiBase ?? DEFAULT_API_BASE;
+  const network = opts.network ?? "mainnet";
+  const checks = [];
+  let receipt = null;
+  try {
+    const res = await fetch(`${base}/aci/receipts/${encodeURIComponent(receiptId)}`);
+    if (res.ok) {
+      receipt = await res.json();
+    }
+  } catch {
+  }
+  if (!receipt?.event_log) {
+    checks.push({
+      name: "Receipt",
+      status: "fail",
+      detail: "receipt not found or malformed",
+      trust: "receipt-asserted"
+    });
+    return { receiptId, verified: false, anchorVerified: false, checks };
+  }
+  const wireHash = receipt.event_log.find((e) => e.type === "response.returned")?.wire_hash;
+  const workloadId = receipt.workload_id;
+  checks.push({
+    name: "Receipt",
+    status: wireHash && workloadId ? "pass" : "fail",
+    detail: wireHash ? `well-formed (${receipt.event_log.length} log entries, workload ${workloadId})` : "missing response wire_hash / workload_id",
+    trust: "receipt-asserted"
+  });
+  const upstreamEv = receipt.event_log.find((e) => e.type === "upstream.verified");
+  const upstreamOk = upstreamEv?.result === "verified";
+  checks.push({
+    name: "Confidential upstream",
+    status: upstreamEv ? upstreamOk ? "pass" : "fail" : "skip",
+    detail: upstreamEv ? `${upstreamEv.provider ?? upstreamEv.upstream_name ?? "upstream"}: ${upstreamEv.result ?? "unknown"}${upstreamEv.tcb_status ? ` (TCB ${upstreamEv.tcb_status})` : ""}` : "no upstream.verified event (routed/non-confidential?)",
+    trust: "receipt-asserted"
+  });
+  let anchorVerified = false;
+  let anchor;
+  let digest;
+  try {
+    const res = await fetch(`${base}/aci/anchor/${encodeURIComponent(receiptId)}`);
+    if (res.ok) {
+      const j = await res.json();
+      digest = j.txDigest;
+    }
+  } catch {
+  }
+  if (!digest) {
+    checks.push({
+      name: "Sui anchor",
+      status: "fail",
+      detail: `no anchor on record \u2014 POST ${base}/aci/anchor/${receiptId} to create one`,
+      trust: "trustless"
+    });
+  } else {
+    try {
+      const client = new SuiGrpcClient({ baseUrl: fullnodeUrl(network), network });
+      const tx = await client.core.getTransaction({
+        digest,
+        include: { events: true }
+      });
+      const txn = tx.$kind === "Transaction" ? tx.Transaction : tx.FailedTransaction;
+      const ev = (txn.events ?? []).find(
+        (e) => e.eventType.endsWith(RECEIPT_ANCHORED_SUFFIX)
+      );
+      const data = ev?.json ?? {};
+      const onChainReceipt = String(data.receipt_id ?? "");
+      const onChainWire = String(data.wire_hash ?? "");
+      const onChainWorkload = String(data.workload_id ?? "");
+      const matches = onChainReceipt === receiptId && onChainWire === wireHash && onChainWorkload === workloadId;
+      anchorVerified = matches;
+      anchor = {
+        txDigest: digest,
+        anchoredAtMs: data.anchored_at_ms ? String(data.anchored_at_ms) : void 0,
+        anchoredBy: data.anchored_by ? String(data.anchored_by) : void 0,
+        explorer: `https://suiscan.xyz/${network}/tx/${digest}`
+      };
+      checks.push({
+        name: "Sui anchor",
+        status: matches ? "pass" : "fail",
+        detail: matches ? `on-chain ReceiptAnchored matches (wire_hash + workload_id), tx ${digest}` : `on-chain event does NOT match the receipt (wire ${onChainWire || "absent"})`,
+        trust: "trustless"
+      });
+    } catch (e) {
+      checks.push({
+        name: "Sui anchor",
+        status: "fail",
+        detail: `could not read anchor tx ${digest}: ${e instanceof Error ? e.message : "error"}`,
+        trust: "trustless"
+      });
+    }
+  }
+  checks.push({
+    name: "Receipt signature",
+    status: "skip",
+    detail: receipt.signature ? "present (local recompute via RedPill keyset canonicalization = roadmap)" : "no signature on receipt",
+    trust: "roadmap"
+  });
+  return {
+    receiptId,
+    verified: Boolean(wireHash && workloadId) && anchorVerified,
+    anchorVerified,
+    checks,
+    wireHash,
+    workloadId,
+    upstream: upstreamEv ? {
+      provider: upstreamEv.provider ?? upstreamEv.upstream_name,
+      result: upstreamEv.result,
+      tcbStatus: upstreamEv.tcb_status
+    } : void 0,
+    anchor
+  };
+}
 var DEFAULT_CONFIG_DIR = join2(homedir(), ".t2000");
 function resolveConfigPath(configDir) {
   return join2(configDir ?? DEFAULT_CONFIG_DIR, "config.json");
@@ -28717,6 +28835,11 @@ var T2000 = class _T2000 extends import_index2.default {
   async models(opts) {
     return listModels(opts);
   }
+  /** Verify a confidential response by receipt id — checks the signed receipt
+   *  + its trustless on-chain Sui anchor. Fails closed on any mismatch. */
+  async verify(receiptId, opts) {
+    return verifyReceipt(receiptId, opts);
+  }
   // -- Swap --
   async swap(params) {
     this.limits.assert({
@@ -32473,8 +32596,77 @@ function registerChat(program3) {
   });
 }
 
-// src/commands/services/search.ts
+// src/commands/verify.ts
 var import_picocolors10 = __toESM(require_picocolors(), 1);
+function mark(check2) {
+  if (check2.status === "pass") {
+    return import_picocolors10.default.green("\u2713");
+  }
+  if (check2.status === "fail") {
+    return import_picocolors10.default.red("\u2717");
+  }
+  return import_picocolors10.default.dim("\u2022");
+}
+function trustTag(check2) {
+  if (check2.trust === "trustless") {
+    return import_picocolors10.default.green(" (trustless \xB7 read from Sui)");
+  }
+  if (check2.trust === "roadmap") {
+    return import_picocolors10.default.dim(" (roadmap)");
+  }
+  return import_picocolors10.default.dim(" (in signed receipt)");
+}
+function registerVerify(program3) {
+  program3.command("verify").argument("<receipt-id>", "A confidential receipt id (rcpt-\u2026)").description(
+    "Verify a confidential response by receipt id \u2014 checks the signed receipt + its trustless on-chain Sui anchor. Fails closed on any mismatch."
+  ).option("--api <url>", "API base URL (default https://api.t2000.ai/v1)").option("--testnet", "Read the anchor from Sui testnet (default mainnet)").action(async (receiptId, opts) => {
+    try {
+      const result = await verifyReceipt(receiptId, {
+        apiBase: opts.api,
+        network: opts.testnet ? "testnet" : "mainnet"
+      });
+      if (isJsonMode()) {
+        printJson(result);
+        if (!result.verified) {
+          process.exitCode = 1;
+        }
+        return;
+      }
+      printBlank();
+      printLine(import_picocolors10.default.bold(`Verifying ${receiptId}`));
+      printBlank();
+      for (const check2 of result.checks) {
+        printLine(`  ${mark(check2)} ${import_picocolors10.default.bold(check2.name)}${trustTag(check2)}`);
+        printLine(`      ${import_picocolors10.default.dim(check2.detail)}`);
+      }
+      printBlank();
+      if (result.anchor) {
+        printLine(import_picocolors10.default.dim(`  anchor: ${result.anchor.explorer}`));
+      }
+      if (result.verified) {
+        printLine(
+          import_picocolors10.default.green(
+            "  RESULT: \u2713 anchor-verified on Sui (tamper-evident, Sui-native)."
+          )
+        );
+        printLine(
+          import_picocolors10.default.dim(
+            "  Local DCAP-quote + receipt-signature recompute = roadmap (full no-trust)."
+          )
+        );
+      } else {
+        printLine(import_picocolors10.default.red("  RESULT: \u2717 NOT verified \u2014 see the failed check above."));
+        process.exitCode = 1;
+      }
+      printBlank();
+    } catch (error) {
+      handleError(error);
+    }
+  });
+}
+
+// src/commands/services/search.ts
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 
 // src/commands/services/catalog.ts
 var DEFAULT_GATEWAY_URL = "https://mpp.t2000.ai";
@@ -32576,9 +32768,9 @@ Examples:
 }
 function renderServiceLine(svc) {
   const minPrice = cheapestEndpointPrice(svc);
-  const priceTag = minPrice !== null ? import_picocolors10.default.green(`from $${minPrice}`) : import_picocolors10.default.dim("no pricing");
-  const catTag = svc.categories.length > 0 ? import_picocolors10.default.dim(`[${svc.categories.join(", ")}]`) : "";
-  printKeyValue(import_picocolors10.default.bold(svc.name), `${priceTag}  ${catTag}`);
+  const priceTag = minPrice !== null ? import_picocolors11.default.green(`from $${minPrice}`) : import_picocolors11.default.dim("no pricing");
+  const catTag = svc.categories.length > 0 ? import_picocolors11.default.dim(`[${svc.categories.join(", ")}]`) : "";
+  printKeyValue(import_picocolors11.default.bold(svc.name), `${priceTag}  ${catTag}`);
   printKeyValue("  url", svc.serviceUrl);
   printKeyValue("  about", svc.description);
   printBlank();
@@ -32592,7 +32784,7 @@ function cheapestEndpointPrice(svc) {
 }
 
 // src/commands/services/inspect.ts
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 function registerServicesInspect(parent) {
   parent.command("inspect").description("Show pricing + endpoints for an MPP service or endpoint URL").argument("<url>", "Service base URL or endpoint URL").option("--gateway <url>", "Override gateway base URL (default: https://mpp.t2000.ai)").addHelpText(
     "after",
@@ -32629,7 +32821,7 @@ Examples:
         return;
       }
       printBlank();
-      printKeyValue("Service", import_picocolors11.default.bold(service.name));
+      printKeyValue("Service", import_picocolors12.default.bold(service.name));
       printKeyValue("URL", service.serviceUrl);
       printKeyValue("About", service.description);
       if (service.categories.length > 0) {
@@ -32659,7 +32851,7 @@ Examples:
 function renderEndpoint(ep, serviceUrl) {
   const price = `$${ep.price}`;
   const label = `${ep.method} ${ep.path}`.padEnd(40);
-  printKeyValue(label, `${import_picocolors11.default.green(price)}  ${import_picocolors11.default.dim(ep.description)}`);
+  printKeyValue(label, `${import_picocolors12.default.green(price)}  ${import_picocolors12.default.dim(ep.description)}`);
   printKeyValue("  url", `${serviceUrl}${ep.path}`);
   printBlank();
 }
@@ -32682,7 +32874,7 @@ T2000_GATEWAY_URL or --gateway <url> for local development.
 }
 
 // src/commands/limit/show.ts
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 function registerLimitShow(parent) {
   parent.command("show").description("Show current spending limits").action(async (opts) => {
     try {
@@ -32705,10 +32897,10 @@ function registerLimitShow(parent) {
       }
       printBlank();
       if (limits.perTxUsd !== void 0) {
-        printKeyValue("Per-transaction", import_picocolors12.default.green(`$${limits.perTxUsd}`));
+        printKeyValue("Per-transaction", import_picocolors13.default.green(`$${limits.perTxUsd}`));
       }
       if (limits.dailyUsd !== void 0) {
-        printKeyValue("Daily (cumulative)", import_picocolors12.default.green(`$${limits.dailyUsd}`));
+        printKeyValue("Daily (cumulative)", import_picocolors13.default.green(`$${limits.dailyUsd}`));
       }
       printBlank();
       printInfo("Use `--force` on `t2 send` / `t2 swap` / `t2 pay` to override per-call.");
@@ -32720,7 +32912,7 @@ function registerLimitShow(parent) {
 }
 
 // src/commands/limit/set.ts
-var import_picocolors13 = __toESM(require_picocolors(), 1);
+var import_picocolors14 = __toESM(require_picocolors(), 1);
 function parseLimitSetArgs(opts) {
   const perTx = opts.perTx !== void 0 ? parseUsdFlag("--per-tx", opts.perTx) : void 0;
   const daily = opts.daily !== void 0 ? parseUsdFlag("--daily", opts.daily) : void 0;
@@ -32762,10 +32954,10 @@ Examples:
       printBlank();
       printSuccess("Spending limits updated.");
       if (next?.perTxUsd !== void 0) {
-        printKeyValue("Per-transaction", import_picocolors13.default.green(`$${next.perTxUsd}`));
+        printKeyValue("Per-transaction", import_picocolors14.default.green(`$${next.perTxUsd}`));
       }
       if (next?.dailyUsd !== void 0) {
-        printKeyValue("Daily (cumulative)", import_picocolors13.default.green(`$${next.dailyUsd}`));
+        printKeyValue("Daily (cumulative)", import_picocolors14.default.green(`$${next.dailyUsd}`));
       }
       printBlank();
       printInfo("Use `t2 limit show` to view; `t2 limit reset` to clear.");
@@ -32827,7 +33019,7 @@ function registerMcpStart(parent) {
   parent.command("start", { isDefault: true }).description("Start MCP server (stdio transport \u2014 for AI client integration)").option("--key <path>", "Custom wallet path (default ~/.t2000/wallet.key)").action(async (opts) => {
     let mod2;
     try {
-      mod2 = await import("./dist-UPUBYGXT.js");
+      mod2 = await import("./dist-7QRKMV5A.js");
     } catch {
       console.error("MCP server not installed. Run:\n  npm install -g @t2000/mcp");
       process.exit(1);
@@ -33790,6 +33982,7 @@ Examples:
   registerSwap(program3);
   registerPay(program3);
   registerChat(program3);
+  registerVerify(program3);
   registerServices(program3);
   registerLimit(program3);
   registerMcp(program3);