@t2000/mcp 5.15.1 → 5.17.0

package/dist/bin.js

@@ -78816,10 +78816,10 @@ async function finalize(response, opts) {
   return { status: response.status, body: body2, paid: opts.paid };
 }
 async function makeGrpcBuildClient(client) {
-  const { SuiGrpcClient: SuiGrpcClient2 } = await Promise.resolve().then(() => (init_grpc(), grpc_exports));
+  const { SuiGrpcClient: SuiGrpcClient3 } = await Promise.resolve().then(() => (init_grpc(), grpc_exports));
   const network = client.network === "testnet" ? "testnet" : "mainnet";
   const baseUrl = network === "testnet" ? "https://fullnode.testnet.sui.io" : "https://fullnode.mainnet.sui.io";
-  return new SuiGrpcClient2({ baseUrl, network });
+  return new SuiGrpcClient3({ baseUrl, network });
 }
 function atomicToHuman(raw, decimals) {
   return Number(raw) / 10 ** decimals;
@@ -79370,7 +79370,9 @@ function body(params, stream4) {
   return JSON.stringify({
     model: params.model,
     messages: params.messages,
-    ...stream4 ? { stream: true } : {},
+    // include_usage → the final stream chunk carries usage + x_receipt_id
+    // (the confidential attestation receipt) so we can surface it after a stream.
+    ...stream4 ? { stream: true, stream_options: { include_usage: true } } : {},
     ...params.maxTokens != null ? { max_tokens: params.maxTokens } : {},
     ...params.temperature != null ? { temperature: params.temperature } : {}
   });
@@ -79386,12 +79388,14 @@ async function chatCompletion(params) {
   if (!res.ok) {
     await failBody(res);
   }
+  const receiptId = res.headers.get("x-receipt-id") ?? void 0;
   const raw = await res.json();
   const content = raw?.choices?.[0]?.message?.content ?? "";
   return {
     content,
     model: raw?.model ?? params.model,
     usage: usageOf(raw),
+    receiptId,
     raw
   };
 }
@@ -79405,11 +79409,12 @@ async function* chatCompletionStream(params) {
   });
   if (!(res.ok && res.body)) {
     await failBody(res);
-    return;
+    return {};
   }
   const reader = res.body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
+  let receiptId;
   while (true) {
     const { done, value } = await reader.read();
     if (done) {
@@ -79425,10 +79430,13 @@ async function* chatCompletionStream(params) {
       }
       const data = trimmed.slice(5).trim();
       if (data === "[DONE]") {
-        return;
+        return { receiptId };
       }
       try {
         const json = JSON.parse(data);
+        if (json.x_receipt_id) {
+          receiptId = json.x_receipt_id;
+        }
         const delta = json.choices?.[0]?.delta?.content;
         if (typeof delta === "string" && delta) {
           yield delta;
@@ -79437,6 +79445,7 @@ async function* chatCompletionStream(params) {
       }
     }
   }
+  return { receiptId };
 }
 async function listModels(opts) {
   const base = opts?.apiBase ?? DEFAULT_API_BASE;
@@ -79457,6 +79466,124 @@ async function listModels(opts) {
     privacy: m.privacy ?? m.privacy_tier
   }));
 }
+var RECEIPT_ANCHORED_SUFFIX = "::anchor::ReceiptAnchored";
+function fullnodeUrl(network) {
+  return network === "testnet" ? "https://fullnode.testnet.sui.io" : "https://fullnode.mainnet.sui.io";
+}
+async function verifyReceipt(receiptId, opts = {}) {
+  const base = opts.apiBase ?? DEFAULT_API_BASE;
+  const network = opts.network ?? "mainnet";
+  const checks = [];
+  let receipt = null;
+  try {
+    const res = await fetch(`${base}/aci/receipts/${encodeURIComponent(receiptId)}`);
+    if (res.ok) {
+      receipt = await res.json();
+    }
+  } catch {
+  }
+  if (!receipt?.event_log) {
+    checks.push({
+      name: "Receipt",
+      status: "fail",
+      detail: "receipt not found or malformed",
+      trust: "receipt-asserted"
+    });
+    return { receiptId, verified: false, anchorVerified: false, checks };
+  }
+  const wireHash = receipt.event_log.find((e) => e.type === "response.returned")?.wire_hash;
+  const workloadId = receipt.workload_id;
+  checks.push({
+    name: "Receipt",
+    status: wireHash && workloadId ? "pass" : "fail",
+    detail: wireHash ? `well-formed (${receipt.event_log.length} log entries, workload ${workloadId})` : "missing response wire_hash / workload_id",
+    trust: "receipt-asserted"
+  });
+  const upstreamEv = receipt.event_log.find((e) => e.type === "upstream.verified");
+  const upstreamOk = upstreamEv?.result === "verified";
+  checks.push({
+    name: "Confidential upstream",
+    status: upstreamEv ? upstreamOk ? "pass" : "fail" : "skip",
+    detail: upstreamEv ? `${upstreamEv.provider ?? upstreamEv.upstream_name ?? "upstream"}: ${upstreamEv.result ?? "unknown"}${upstreamEv.tcb_status ? ` (TCB ${upstreamEv.tcb_status})` : ""}` : "no upstream.verified event (routed/non-confidential?)",
+    trust: "receipt-asserted"
+  });
+  let anchorVerified = false;
+  let anchor;
+  let digest;
+  try {
+    const res = await fetch(`${base}/aci/anchor/${encodeURIComponent(receiptId)}`);
+    if (res.ok) {
+      const j = await res.json();
+      digest = j.txDigest;
+    }
+  } catch {
+  }
+  if (!digest) {
+    checks.push({
+      name: "Sui anchor",
+      status: "fail",
+      detail: `no anchor on record \u2014 POST ${base}/aci/anchor/${receiptId} to create one`,
+      trust: "trustless"
+    });
+  } else {
+    try {
+      const client = new SuiGrpcClient({ baseUrl: fullnodeUrl(network), network });
+      const tx = await client.core.getTransaction({
+        digest,
+        include: { events: true }
+      });
+      const txn = tx.$kind === "Transaction" ? tx.Transaction : tx.FailedTransaction;
+      const ev = (txn.events ?? []).find(
+        (e) => e.eventType.endsWith(RECEIPT_ANCHORED_SUFFIX)
+      );
+      const data = ev?.json ?? {};
+      const onChainReceipt = String(data.receipt_id ?? "");
+      const onChainWire = String(data.wire_hash ?? "");
+      const onChainWorkload = String(data.workload_id ?? "");
+      const matches = onChainReceipt === receiptId && onChainWire === wireHash && onChainWorkload === workloadId;
+      anchorVerified = matches;
+      anchor = {
+        txDigest: digest,
+        anchoredAtMs: data.anchored_at_ms ? String(data.anchored_at_ms) : void 0,
+        anchoredBy: data.anchored_by ? String(data.anchored_by) : void 0,
+        explorer: `https://suiscan.xyz/${network}/tx/${digest}`
+      };
+      checks.push({
+        name: "Sui anchor",
+        status: matches ? "pass" : "fail",
+        detail: matches ? `on-chain ReceiptAnchored matches (wire_hash + workload_id), tx ${digest}` : `on-chain event does NOT match the receipt (wire ${onChainWire || "absent"})`,
+        trust: "trustless"
+      });
+    } catch (e) {
+      checks.push({
+        name: "Sui anchor",
+        status: "fail",
+        detail: `could not read anchor tx ${digest}: ${e instanceof Error ? e.message : "error"}`,
+        trust: "trustless"
+      });
+    }
+  }
+  checks.push({
+    name: "Receipt signature",
+    status: "skip",
+    detail: receipt.signature ? "present (local recompute via RedPill keyset canonicalization = roadmap)" : "no signature on receipt",
+    trust: "roadmap"
+  });
+  return {
+    receiptId,
+    verified: Boolean(wireHash && workloadId) && anchorVerified,
+    anchorVerified,
+    checks,
+    wireHash,
+    workloadId,
+    upstream: upstreamEv ? {
+      provider: upstreamEv.provider ?? upstreamEv.upstream_name,
+      result: upstreamEv.result,
+      tcbStatus: upstreamEv.tcb_status
+    } : void 0,
+    anchor
+  };
+}
 var DEFAULT_CONFIG_DIR = join$1(homedir(), ".t2000");
 function resolveConfigPath(configDir) {
   return join$1(configDir ?? DEFAULT_CONFIG_DIR, "config.json");
@@ -79729,7 +79856,8 @@ var T2000 = class _T2000 extends import_index2.default {
   async chat(params) {
     return chatCompletion(params);
   }
-  /** Streaming chat completion — async-iterate the assistant text deltas. */
+  /** Streaming chat completion — async-iterate the assistant text deltas;
+   *  the generator returns `{ receiptId }` (confidential attestation) at the end. */
   chatStream(params) {
     return chatCompletionStream(params);
   }
@@ -79737,6 +79865,11 @@ var T2000 = class _T2000 extends import_index2.default {
   async models(opts) {
     return listModels(opts);
   }
+  /** Verify a confidential response by receipt id — checks the signed receipt
+   *  + its trustless on-chain Sui anchor. Fails closed on any mismatch. */
+  async verify(receiptId, opts) {
+    return verifyReceipt(receiptId, opts);
+  }
   // -- Swap --
   async swap(params) {
     this.limits.assert({
@@ -80456,7 +80589,10 @@ function registerChatTools(server) {
               text: JSON.stringify({
                 model: res.model,
                 content: res.content,
-                usage: res.usage
+                usage: res.usage,
+                // Confidential (phala/*) → a TEE attestation receipt id,
+                // verifiable at /v1/aci/receipts/{id}.
+                receiptId: res.receiptId
               })
             }
           ]
@@ -80479,6 +80615,23 @@ function registerChatTools(server) {
       }
     }
   );
+  server.tool(
+    "t2000_verify",
+    "Verify a confidential response by its receipt id (the `receiptId` from a confidential t2000_chat). Checks the signed receipt + its trustless on-chain Sui anchor (reads the ReceiptAnchored event straight from a fullnode) and returns a per-check result that's `verified:false` on any forgery/mismatch. No key required.",
+    {
+      receiptId: external_exports.string().describe("A confidential receipt id (rcpt-\u2026)")
+    },
+    async ({ receiptId }) => {
+      try {
+        const result = await verifyReceipt(receiptId);
+        return {
+          content: [{ type: "text", text: JSON.stringify(result) }]
+        };
+      } catch (err) {
+        return errorResult(err);
+      }
+    }
+  );
 }
 
 // src/skills-prompts.ts
@@ -80552,7 +80705,7 @@ CRITICAL: When the user asks to use any external or paid API, names a provider (
 Spending is the user's own USDC and every t2000_pay call is bounded by maxPrice. For larger or multi-step spends, state the estimated cost first and proceed once the user is happy. Use t2000_balance to check funds. The v4 wallet is payments-only; savings / lending live on audric.ai.`;
 
 // src/index.ts
-var PKG_VERSION = "5.15.1" ;
+var PKG_VERSION = "5.17.0" ;
 console.log = (...args) => console.error("[log]", ...args);
 console.warn = (...args) => console.error("[warn]", ...args);
 async function startMcpServer(opts) {