@t2000/sdk 5.16.0 → 5.18.0

package/dist/index.cjs

@@ -13,6 +13,9 @@ var cryptography = require('@mysten/sui/cryptography');
 var promises = require('fs/promises');
 var path = require('path');
 var os = require('os');
+var secp256k1 = require('@noble/curves/secp256k1');
+var sha256 = require('@noble/hashes/sha256');
+var utils$1 = require('@noble/hashes/utils');
 var fs = require('fs');
 var suins = require('@mysten/suins');
 
@@ -1226,10 +1229,10 @@ async function finalize(response, opts) {
   return { status: response.status, body: body2, paid: opts.paid };
 }
 async function makeGrpcBuildClient(client) {
-  const { SuiGrpcClient: SuiGrpcClient2 } = await import('@mysten/sui/grpc');
+  const { SuiGrpcClient: SuiGrpcClient3 } = await import('@mysten/sui/grpc');
   const network = client.network === "testnet" ? "testnet" : "mainnet";
   const baseUrl = network === "testnet" ? "https://fullnode.testnet.sui.io" : "https://fullnode.mainnet.sui.io";
-  return new SuiGrpcClient2({ baseUrl, network });
+  return new SuiGrpcClient3({ baseUrl, network });
 }
 function atomicToHuman(raw, decimals) {
   return Number(raw) / 10 ** decimals;
@@ -2030,6 +2033,207 @@ async function listModels(opts) {
     privacy: m.privacy ?? m.privacy_tier
   }));
 }
+var RECEIPT_ANCHORED_SUFFIX = "::anchor::ReceiptAnchored";
+function fullnodeUrl(network) {
+  return network === "testnet" ? "https://fullnode.testnet.sui.io" : "https://fullnode.mainnet.sui.io";
+}
+function jcs(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (typeof value === "boolean") {
+    return value ? "true" : "false";
+  }
+  if (typeof value === "number") {
+    if (!Number.isInteger(value)) {
+      throw new Error("JCS: non-integer number");
+    }
+    return String(value);
+  }
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(jcs).join(",")}]`;
+  }
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${jcs(value[k])}`).join(",")}}`;
+}
+function verifyReceiptSignature(receipt, signingKeyHex) {
+  try {
+    const sig = receipt.signature;
+    if (sig?.algo !== "ecdsa-secp256k1" || !sig.value) {
+      return false;
+    }
+    const canonical = {
+      api_version: receipt.api_version ?? "",
+      receipt_id: receipt.receipt_id ?? "",
+      chat_id: receipt.chat_id ?? null,
+      workload_id: receipt.workload_id ?? "",
+      workload_keyset_digest: receipt.workload_keyset_digest ?? "",
+      endpoint: receipt.endpoint ?? "",
+      method: receipt.method ?? "",
+      served_at: receipt.served_at ?? 0,
+      event_log: receipt.event_log ?? [],
+      signature: { algo: sig.algo, key_id: sig.key_id ?? "" }
+    };
+    const prehash = sha256.sha256(new TextEncoder().encode(jcs(canonical)));
+    const sigBytes = utils$1.hexToBytes(sig.value);
+    if (sigBytes.length !== 65) {
+      return false;
+    }
+    let v = sigBytes[64];
+    if (v >= 27 && v <= 30) {
+      v -= 27;
+    }
+    if (v > 3) {
+      return false;
+    }
+    const recovered = secp256k1.secp256k1.Signature.fromCompact(sigBytes.slice(0, 64)).addRecoveryBit(v).recoverPublicKey(prehash).toHex(false);
+    const endorsed = utils$1.bytesToHex(utils$1.hexToBytes(signingKeyHex.replace(/^0x/, "")));
+    return recovered.toLowerCase() === endorsed.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+async function verifyReceipt(receiptId, opts = {}) {
+  const base = opts.apiBase ?? DEFAULT_API_BASE;
+  const network = opts.network ?? "mainnet";
+  const checks = [];
+  let receipt = null;
+  try {
+    const res = await fetch(`${base}/aci/receipts/${encodeURIComponent(receiptId)}`);
+    if (res.ok) {
+      receipt = await res.json();
+    }
+  } catch {
+  }
+  if (!receipt?.event_log) {
+    checks.push({
+      name: "Receipt",
+      status: "fail",
+      detail: "receipt not found or malformed",
+      trust: "receipt-asserted"
+    });
+    return { receiptId, verified: false, anchorVerified: false, checks };
+  }
+  const wireHash = receipt.event_log.find((e) => e.type === "response.returned")?.wire_hash;
+  const workloadId = receipt.workload_id;
+  checks.push({
+    name: "Receipt",
+    status: wireHash && workloadId ? "pass" : "fail",
+    detail: wireHash ? `well-formed (${receipt.event_log.length} log entries, workload ${workloadId})` : "missing response wire_hash / workload_id",
+    trust: "receipt-asserted"
+  });
+  const upstreamEv = receipt.event_log.find((e) => e.type === "upstream.verified");
+  const upstreamOk = upstreamEv?.result === "verified";
+  checks.push({
+    name: "Confidential upstream",
+    status: upstreamEv ? upstreamOk ? "pass" : "fail" : "skip",
+    detail: upstreamEv ? `${upstreamEv.provider ?? upstreamEv.upstream_name ?? "upstream"}: ${upstreamEv.result ?? "unknown"}${upstreamEv.tcb_status ? ` (TCB ${upstreamEv.tcb_status})` : ""}` : "no upstream.verified event (routed/non-confidential?)",
+    trust: "receipt-asserted"
+  });
+  let anchorVerified = false;
+  let anchor;
+  let digest;
+  try {
+    const res = await fetch(`${base}/aci/anchor/${encodeURIComponent(receiptId)}`);
+    if (res.ok) {
+      const j = await res.json();
+      digest = j.txDigest;
+    }
+  } catch {
+  }
+  if (!digest) {
+    checks.push({
+      name: "Sui anchor",
+      status: "fail",
+      detail: `no anchor on record \u2014 POST ${base}/aci/anchor/${receiptId} to create one`,
+      trust: "trustless"
+    });
+  } else {
+    try {
+      const client = new grpc.SuiGrpcClient({ baseUrl: fullnodeUrl(network), network });
+      const tx = await client.core.getTransaction({
+        digest,
+        include: { events: true }
+      });
+      const txn = tx.$kind === "Transaction" ? tx.Transaction : tx.FailedTransaction;
+      const ev = (txn.events ?? []).find(
+        (e) => e.eventType.endsWith(RECEIPT_ANCHORED_SUFFIX)
+      );
+      const data = ev?.json ?? {};
+      const onChainReceipt = String(data.receipt_id ?? "");
+      const onChainWire = String(data.wire_hash ?? "");
+      const onChainWorkload = String(data.workload_id ?? "");
+      const matches = onChainReceipt === receiptId && onChainWire === wireHash && onChainWorkload === workloadId;
+      anchorVerified = matches;
+      anchor = {
+        txDigest: digest,
+        anchoredAtMs: data.anchored_at_ms ? String(data.anchored_at_ms) : void 0,
+        anchoredBy: data.anchored_by ? String(data.anchored_by) : void 0,
+        explorer: `https://suiscan.xyz/${network}/tx/${digest}`
+      };
+      checks.push({
+        name: "Sui anchor",
+        status: matches ? "pass" : "fail",
+        detail: matches ? `on-chain ReceiptAnchored matches (wire_hash + workload_id), tx ${digest}` : `on-chain event does NOT match the receipt (wire ${onChainWire || "absent"})`,
+        trust: "trustless"
+      });
+    } catch (e) {
+      checks.push({
+        name: "Sui anchor",
+        status: "fail",
+        detail: `could not read anchor tx ${digest}: ${e instanceof Error ? e.message : "error"}`,
+        trust: "trustless"
+      });
+    }
+  }
+  let signatureForged = false;
+  let sigStatus = "skip";
+  let sigDetail = "no signature on receipt";
+  if (receipt.signature?.value) {
+    try {
+      const model = opts.model ?? "phala/glm-5.2";
+      const res = await fetch(
+        `${base}/aci/attestation?model=${encodeURIComponent(model)}`
+      );
+      const att = res.ok ? await res.json() : null;
+      if (!att?.signingKey) {
+        sigDetail = "could not fetch the attested keyset to check the signature";
+      } else if (att.workloadId && att.workloadId !== workloadId) {
+        sigDetail = `attested keyset is for a different workload \u2014 pass --model for ${workloadId}`;
+      } else {
+        const ok = verifyReceiptSignature(receipt, att.signingKey);
+        sigStatus = ok ? "pass" : "fail";
+        signatureForged = !ok;
+        sigDetail = ok ? `signed by the attested receipt key (${receipt.signature.key_id ?? "key"})` : "signature does NOT recover the attested receipt key \u2014 forged/altered";
+      }
+    } catch {
+      sigDetail = "signature check errored";
+    }
+  }
+  checks.push({
+    name: "Receipt signature",
+    status: sigStatus,
+    detail: sigDetail,
+    trust: sigStatus === "skip" ? "roadmap" : "trustless"
+  });
+  return {
+    receiptId,
+    verified: Boolean(wireHash && workloadId) && anchorVerified && !signatureForged,
+    anchorVerified,
+    checks,
+    wireHash,
+    workloadId,
+    upstream: upstreamEv ? {
+      provider: upstreamEv.provider ?? upstreamEv.upstream_name,
+      result: upstreamEv.result,
+      tcbStatus: upstreamEv.tcb_status
+    } : void 0,
+    anchor
+  };
+}
 var DEFAULT_CONFIG_DIR = path.join(os.homedir(), ".t2000");
 function resolveConfigPath(configDir) {
   return path.join(configDir ?? DEFAULT_CONFIG_DIR, "config.json");
@@ -2315,6 +2519,11 @@ var T2000 = class _T2000 extends eventemitter3.EventEmitter {
   async models(opts) {
     return listModels(opts);
   }
+  /** Verify a confidential response by receipt id — checks the signed receipt
+   *  + its trustless on-chain Sui anchor. Fails closed on any mismatch. */
+  async verify(receiptId, opts) {
+    return verifyReceipt(receiptId, opts);
+  }
   // -- Swap --
   async swap(params) {
     this.limits.assert({
@@ -3202,6 +3411,7 @@ exports.usdcToRaw = usdcToRaw;
 exports.validateAddress = validateAddress;
 exports.validateLabel = validateLabel;
 exports.verifyCetusRouteCoinMatch = verifyCetusRouteCoinMatch;
+exports.verifyReceipt = verifyReceipt;
 exports.walletExists = walletExists;
 exports.writeLimitsFile = writeLimitsFile;
 //# sourceMappingURL=index.cjs.map