@tangle-network/sandbox 0.60.16-develop.20261006031110.95c8cc9 → 0.60.16-develop.20261006041203.03ae563

package/dist/gpu-lease/index.d.ts

@@ -0,0 +1,503 @@
+//#region src/gpu-lease/intent.d.ts
+declare const INTENT_VERSION = 1;
+/** keccak256 of the canonical intent string. */
+declare function gpuLeaseIntentHash(input: {
+  intentVersion: number;
+  gpuClass: string;
+  durationSeconds: bigint | number;
+  confidentiality: number;
+  region: string;
+}): `0x${string}`;
+/** ABI shape of GpuLeaseRequest — mirrors the blueprint's sol! type. */
+declare const GPU_LEASE_REQUEST_ABI: never;
+interface GpuLeaseRequestParams {
+  intentVersion: number;
+  intentHash: `0x${string}`;
+  pricePerSecondWei: bigint;
+  durationSeconds: bigint;
+  confidentiality: number;
+  gpuClass: string;
+  region: string;
+  lessee: `0x${string}`;
+  leaseId: `0x${string}`;
+}
+/**
+ * ABI-encoded GpuLeaseRequest — the LEASE job calldata payload.
+ * Positional (ABI order) — order is pinned by the blueprint's generated
+ * encodeType in metadata/blueprint.json.
+ */
+declare function encodeGpuLeaseRequest(params: GpuLeaseRequestParams): `0x${string}`;
+//#endregion
+//#region src/gpu-lease/types.d.ts
+/**
+ * GPU lease client types — mirrors the gpu-lease-blueprint operator API
+ * (gpu-lease-blueprint/gpu-lease-blueprint-lib/src/api.rs) and the on-chain
+ * ABI (contracts/src/GpuLeaseBlueprint.sol sol! mirror).
+ *
+ * Every on-chain and off-chain surface is schemaVersioned; unknown versions
+ * fail closed (SPEC §3 of the blueprint).
+ */
+/** The only schema this client understands. */
+declare const GPU_LEASE_SCHEMA_VERSION: 1;
+interface ClassCapability {
+  id: string;
+  tee: boolean;
+  unit: string;
+  /** Indicative policy price (wei/second) — the binding price is the quote. */
+  pricePerSecond: string;
+  idleCount: number;
+}
+interface Capabilities {
+  schemaVersion: number;
+  compute: {
+    kind: string;
+    classes: ClassCapability[];
+  };
+}
+interface OperatorQuote {
+  schemaVersion: number;
+  gpuClass: string;
+  /** The operator's EVM address — who the escrow names (I5 binding).
+   * When the quote is signed this MUST equal the recovered signer (verified
+   * in quotes.ts); config-supplied values are interim-trust only. */
+  operatorAddress: `0x${string}`;
+  /** EIP-191 personal_sign over the canonical quote payload (0x RSV). */
+  signature?: `0x${string}`;
+  /** wei/second, from the operator's signed policy at request time. */
+  pricePerSecond: string;
+  durationSeconds: number;
+  confidentiality: number;
+  /** wei — pricePerSecond × durationSeconds exactly. */
+  escrowTotal: string;
+  /** Utilization the price was struck at (bps of 10_000) — the surge "why". */
+  utilizationBps: number;
+  /** keccak256(canonical intent) — binds the RFQ and the vault lease (I5). */
+  intentHash: `0x${string}`;
+  /** Unix seconds after which the quote is stale. */
+  validUntil: number;
+}
+interface LeaseStatus {
+  schemaVersion: number;
+  leaseId: `0x${string}`;
+  deviceId: string;
+  lessee: string;
+  /** Unix seconds — the chain-of-truth session end (parking meter). */
+  expiresAt: number;
+  endpoint: string;
+}
+interface SessionChallenge {
+  nonce: `0x${string}`;
+  /** The exact string the lessee must EIP-191 personal_sign. */
+  message: string;
+  expiresAt: number;
+}
+interface SessionCredential {
+  token: string;
+  leaseId: `0x${string}`;
+  scopes: string[];
+  expiresAt: number;
+}
+/** A validated, ready-to-escrow quote. */
+interface ValidatedQuote {
+  quote: OperatorQuote;
+  pricePerSecondWei: bigint;
+  escrowTotalWei: bigint;
+}
+/** A resolved lease handed to the caller by `gpuLease()`. */
+interface GpuLease {
+  leaseId: `0x${string}`;
+  /** Public endpoint descriptor (versioned union; v1 = local-attach). */
+  endpoint: string;
+  schemaVersion: number;
+  quote: ValidatedQuote;
+}
+interface RefundReceipt {
+  leaseId: `0x${string}`;
+  /** Exact wei refunded: pricePerSecond × remainingSeconds at settle time. */
+  refundWei: bigint;
+  operatorTakeWei: bigint;
+}
+//#endregion
+//#region src/gpu-lease/operators.d.ts
+interface QuoteParams {
+  gpuClass: string;
+  durationSeconds: number;
+  confidentiality?: number;
+  region?: string;
+}
+interface OperatorEndpoint {
+  /** Operator base URL, e.g. https://gpu.example.com */
+  baseUrl: string;
+  /** The operator's EVM address (escrow + job binding). */
+  address: `0x${string}`;
+  fetch?: typeof fetch;
+}
+/** JSON request body — named at the I/O boundary (anti-slop: no `unknown`). */
+type JsonRequestBody = Record<string, unknown>;
+declare class GpuLeaseOperatorClient {
+  private readonly endpoint;
+  constructor(endpoint: OperatorEndpoint);
+  capabilities(): Promise<Capabilities>;
+  quote(params: QuoteParams): Promise<OperatorQuote>;
+  leaseStatus(leaseId: `0x${string}`): Promise<LeaseStatus>;
+  sessionChallenge(leaseId: `0x${string}`, lessee: string): Promise<SessionChallenge>;
+  sessionVerify(nonce: `0x${string}`, signature: `0x${string}`): Promise<SessionCredential>;
+}
+//#endregion
+//#region src/gpu-lease/output.d.ts
+interface GpuLeaseOutputDecoded {
+  leaseId: `0x${string}`;
+  endpoint: string;
+  schemaVersion: number;
+}
+/** Decode + fail closed on unknown schemaVersion (blueprint SPEC §3). */
+declare function decodeGpuLeaseOutput(encoded: `0x${string}`): GpuLeaseOutputDecoded;
+//#endregion
+//#region src/gpu-lease/quotes.d.ts
+/** The exact string the operator signs — mirrors the blueprint's
+ * `canonical_quote_payload` byte-for-byte. Every priced field is bound. */
+declare function canonicalQuotePayload(quote: {
+  gpuClass: string;
+  pricePerSecond: string;
+  durationSeconds: number;
+  confidentiality: number;
+  escrowTotal: string;
+  intentHash: string;
+  validUntil: number;
+}): string;
+/** Offline EIP-191 recovery over the canonical payload. */
+declare function verifyOperatorQuote(quote: OperatorQuote): Promise<`0x${string}`>;
+type QuoteRejection = {
+  kind: "stale";
+  validUntil: number;
+  now: number;
+} | {
+  kind: "class-mismatch";
+  requested: string;
+  quoted: string;
+} | {
+  kind: "escrow-inconsistent";
+  expected: bigint;
+  actual: bigint;
+} | {
+  kind: "confidentiality-mismatch";
+  requested: number;
+  quoted: number;
+} | {
+  kind: "signature-mismatch";
+  claimed: string;
+  recovered: string;
+} | {
+  kind: "unsigned";
+  operator: string;
+};
+interface QuoteFilterInput {
+  requestedClass: string;
+  requestedDurationSeconds: number;
+  requestedConfidentiality: number;
+  now?: () => number;
+}
+/**
+ * Validate one quote. Fail-closed on every field the RFQ binds:
+ * class, duration-derived escrow, confidentiality, and expiry.
+ */
+declare function validateQuote(quote: OperatorQuote, input: QuoteFilterInput): ValidatedQuote | QuoteRejection;
+/**
+ * Collect validated quotes from N operators and rank cheapest-first.
+ * Operators that fail validation (or whose fetch rejects) are reported,
+ * never silently dropped — the buyer sees why an operator lost.
+ */
+declare function selectQuotes(quotes: {
+  operator: string;
+  quote: OperatorQuote;
+}[], input: QuoteFilterInput): {
+  ranked: {
+    operator: string;
+    validated: ValidatedQuote;
+  }[];
+  rejected: {
+    operator: string;
+    reason: QuoteRejection;
+  }[];
+};
+/**
+ * Enforce the signed RFQ envelope when present:
+ * - signature present => it MUST recover to the claimed operator address;
+ *   invalid signature => reject (config-trust is dead on this path).
+ * - no signature => the endpoint-config address is used (interim fallback);
+ *   strict mode rejects unsigned quotes outright.
+ */
+declare function validateQuoteIdentity(quote: OperatorQuote, opts?: {
+  strict?: boolean;
+}): Promise<ValidatedQuote | QuoteRejection>;
+//#endregion
+//#region src/gpu-lease/vault.d.ts
+declare const GPU_LEASE_VAULT_ABI: readonly [{
+  readonly name: "create";
+  readonly type: "function";
+  readonly stateMutability: "payable";
+  readonly inputs: readonly [{
+    readonly type: "address";
+    readonly name: "operator";
+  }, {
+    readonly type: "uint128";
+    readonly name: "pricePerSecond";
+  }, {
+    readonly type: "uint64";
+    readonly name: "durationSeconds";
+  }, {
+    readonly type: "bytes32";
+    readonly name: "intentHash";
+  }, {
+    readonly type: "uint8";
+    readonly name: "confidentiality";
+  }, {
+    readonly type: "bytes";
+    readonly name: "endpointInfo";
+  }];
+  readonly outputs: readonly [{
+    readonly type: "bytes32";
+    readonly name: "leaseId";
+  }];
+}, {
+  readonly name: "extend";
+  readonly type: "function";
+  readonly stateMutability: "payable";
+  readonly inputs: readonly [{
+    readonly type: "bytes32";
+    readonly name: "leaseId";
+  }, {
+    readonly type: "uint64";
+    readonly name: "addSeconds";
+  }];
+  readonly outputs: readonly [];
+}, {
+  readonly name: "release";
+  readonly type: "function";
+  readonly stateMutability: "nonpayable";
+  readonly inputs: readonly [{
+    readonly type: "bytes32";
+    readonly name: "leaseId";
+  }];
+  readonly outputs: readonly [];
+}, {
+  readonly name: "reap";
+  readonly type: "function";
+  readonly stateMutability: "nonpayable";
+  readonly inputs: readonly [{
+    readonly type: "bytes32";
+    readonly name: "leaseId";
+  }];
+  readonly outputs: readonly [];
+}, {
+  readonly name: "withdrawEarnings";
+  readonly type: "function";
+  readonly stateMutability: "nonpayable";
+  readonly inputs: readonly [];
+  readonly outputs: readonly [];
+}, {
+  readonly name: "totalEscrowed";
+  readonly type: "function";
+  readonly stateMutability: "view";
+  readonly inputs: readonly [];
+  readonly outputs: readonly [{
+    readonly type: "uint256";
+  }];
+}, {
+  readonly name: "operatorEarnings";
+  readonly type: "function";
+  readonly stateMutability: "view";
+  readonly inputs: readonly [];
+  readonly outputs: readonly [{
+    readonly type: "uint256";
+  }];
+}, {
+  readonly name: "leases";
+  readonly type: "function";
+  readonly stateMutability: "view";
+  readonly inputs: readonly [{
+    readonly type: "bytes32";
+  }];
+  readonly outputs: readonly [{
+    readonly type: "address";
+    readonly name: "operator";
+  }, {
+    readonly type: "address";
+    readonly name: "lessee";
+  }, {
+    readonly type: "uint128";
+    readonly name: "escrow";
+  }, {
+    readonly type: "uint128";
+    readonly name: "pricePerSecond";
+  }, {
+    readonly type: "uint64";
+    readonly name: "expiry";
+  }, {
+    readonly type: "bytes32";
+    readonly name: "intentHash";
+  }, {
+    readonly type: "uint8";
+    readonly name: "confidentiality";
+  }, {
+    readonly type: "uint8";
+    readonly name: "state";
+  }];
+}, {
+  readonly name: "LeaseCreated";
+  readonly type: "event";
+  readonly inputs: readonly [{
+    readonly type: "bytes32";
+    readonly name: "leaseId";
+    readonly indexed: true;
+  }, {
+    readonly type: "address";
+    readonly name: "operator";
+    readonly indexed: true;
+  }, {
+    readonly type: "address";
+    readonly name: "lessee";
+    readonly indexed: true;
+  }, {
+    readonly type: "uint128";
+    readonly name: "escrow";
+  }, {
+    readonly type: "uint128";
+    readonly name: "pricePerSecond";
+  }, {
+    readonly type: "uint64";
+    readonly name: "expiry";
+  }, {
+    readonly type: "bytes32";
+    readonly name: "intentHash";
+  }, {
+    readonly type: "uint8";
+    readonly name: "confidentiality";
+  }, {
+    readonly type: "bytes";
+    readonly name: "endpointInfo";
+  }, {
+    readonly type: "uint16";
+    readonly name: "schemaVersion";
+  }];
+}, {
+  readonly name: "LeaseReleased";
+  readonly type: "event";
+  readonly inputs: readonly [{
+    readonly type: "bytes32";
+    readonly name: "leaseId";
+    readonly indexed: true;
+  }, {
+    readonly type: "uint128";
+    readonly name: "refund";
+  }, {
+    readonly type: "uint128";
+    readonly name: "operatorTake";
+  }];
+}, {
+  readonly name: "LeaseReaped";
+  readonly type: "event";
+  readonly inputs: readonly [{
+    readonly type: "bytes32";
+    readonly name: "leaseId";
+    readonly indexed: true;
+  }, {
+    readonly type: "uint128";
+    readonly name: "operatorTake";
+  }, {
+    readonly type: "address";
+    readonly name: "caller";
+  }];
+}];
+/** Vault lease states (mirrors the contract). */
+declare const LEASE_STATE: {
+  readonly LIVE: 0;
+  readonly RELEASED: 1;
+  readonly REAPED: 2;
+};
+interface VaultLeaseView {
+  operator: `0x${string}`;
+  lessee: `0x${string}`;
+  escrowWei: bigint;
+  pricePerSecondWei: bigint;
+  /** Unix seconds — the chain clock is the parking meter's truth. */
+  expiry: bigint;
+  intentHash: `0x${string}`;
+  confidentiality: number;
+  state: number;
+}
+/**
+ * Exact refund projection (I3): pricePerSecond × max(expiry − now, 0).
+ * Exact by construction because escrow === price × paidSeconds in the vault.
+ */
+declare function projectRefundWei(lease: VaultLeaseView, nowSeconds: bigint): {
+  refundWei: bigint;
+  operatorTakeWei: bigint;
+};
+/** I2 from the client side: unpayable time can never be requested. */
+declare function maxAffordableSeconds(escrowWei: bigint, pricePerSecondWei: bigint): bigint;
+//#endregion
+//#region src/gpu-lease/resolver.d.ts
+/** Job ids — MUST match the blueprint router (sequential, no gaps). */
+declare const GPU_LEASE_JOBS: {
+  readonly LEASE: 0;
+  readonly RELEASE: 1;
+  readonly EXTEND: 2;
+  readonly REAP: 3;
+};
+interface GpuLeaseChain {
+  /** The buyer's address (the RFQ binds the requester — I5). */
+  readonly account: `0x${string}`;
+  /** Create the escrowed lease on the vault; returns the vault leaseId. */
+  createVaultLease(input: {
+    operator: `0x${string}`;
+    pricePerSecondWei: bigint;
+    durationSeconds: bigint;
+    intentHash: `0x${string}`;
+    confidentiality: number;
+    endpointInfo: string;
+    escrowWei: bigint;
+  }): Promise<`0x${string}`>;
+  /** Submit a job through tnt-core; resolves with the result payload. */
+  submitJob(jobId: number, encodedInput: `0x${string}`): Promise<`0x${string}`>;
+  /** Read a vault lease (chain clock truth for projections). */
+  readLease(leaseId: `0x${string}`): Promise<VaultLeaseView>;
+  /** The chain's current timestamp (unix seconds) — meter truth, not Date.now(). */
+  chainNow?(): Promise<bigint>;
+  /** Voluntary release on the vault; returns {refund, take} wei. */
+  releaseLease(leaseId: `0x${string}`): Promise<{
+    refundWei: bigint;
+    operatorTakeWei: bigint;
+  }>;
+}
+interface GpuLeaseOptions {
+  gpuClass: string;
+  durationSeconds: number;
+  confidentiality?: number;
+  region?: string;
+  /** Operators to request quotes from (multi-quote = the decentralized scheduler). */
+  operators: OperatorEndpoint[];
+  chain: GpuLeaseChain;
+  now?: () => number;
+}
+interface GpuLeaseOutcome {
+  lease: GpuLease;
+  /** Operators ranked cheapest-first. */
+  rankedOperators: string[];
+}
+/** Resolve a GPU lease end-to-end. Throws with the full picture on failure. */
+declare function gpuLease(options: GpuLeaseOptions): Promise<GpuLeaseOutcome>;
+/** Teardown: voluntary release with an exact-refund receipt (I3/I4). */
+declare function releaseGpuLease(leaseId: `0x${string}`, chain: GpuLeaseChain): Promise<RefundReceipt>;
+/**
+ * Refund projection for UI meters. Uses the chain clock when the injected
+ * chain provides `chainNow()`; otherwise requires an explicit timestamp.
+ * Never Date.now() — the drift lesson from the blueprint's own E2E.
+ */
+declare function projectGpuLeaseRefund(leaseId: `0x${string}`, chain: GpuLeaseChain, explicitNowSeconds?: bigint): Promise<{
+  refundWei: bigint;
+  operatorTakeWei: bigint;
+  nowSeconds: bigint;
+}>;
+//#endregion
+export { Capabilities, ClassCapability, GPU_LEASE_JOBS, GPU_LEASE_REQUEST_ABI, GPU_LEASE_SCHEMA_VERSION, GPU_LEASE_VAULT_ABI, GpuLease, GpuLeaseChain, GpuLeaseOperatorClient, GpuLeaseOptions, GpuLeaseOutcome, GpuLeaseOutputDecoded, GpuLeaseRequestParams, INTENT_VERSION, JsonRequestBody, LEASE_STATE, LeaseStatus, OperatorEndpoint, OperatorQuote, QuoteFilterInput, QuoteParams, QuoteRejection, RefundReceipt, SessionChallenge, SessionCredential, ValidatedQuote, VaultLeaseView, canonicalQuotePayload, decodeGpuLeaseOutput, encodeGpuLeaseRequest, gpuLease, gpuLeaseIntentHash, maxAffordableSeconds, projectGpuLeaseRefund, projectRefundWei, releaseGpuLease, selectQuotes, validateQuote, validateQuoteIdentity, verifyOperatorQuote };

package/dist/gpu-lease/index.js

@@ -0,0 +1,410 @@
+import { decodeAbiParameters, encodeAbiParameters, keccak256, parseAbi, parseAbiParameters, recoverMessageAddress, stringToHex } from "viem";
+//#region src/gpu-lease/intent.ts
+/**
+* Canonical GPU-lease intent + job ABI encoding — MUST match:
+*   gpu-lease-blueprint/gpu-lease-blueprint-lib/src/jobs/mod.rs (intent_hash)
+*   gpu-lease-blueprint/contracts/src/GpuLeaseBlueprint.sol (GpuLeaseRequest)
+*   gpu-lease-blueprint/metadata/blueprint.json (encodeType, generated).
+*/
+const INTENT_VERSION = 1;
+/** keccak256 of the canonical intent string. */
+function gpuLeaseIntentHash(input) {
+	return keccak256(stringToHex(`gpu-lease-intent|v${input.intentVersion}|${input.gpuClass}|${input.durationSeconds}|${input.confidentiality}|${input.region}`));
+}
+/** ABI shape of GpuLeaseRequest — mirrors the blueprint's sol! type. */
+const GPU_LEASE_REQUEST_ABI = parseAbiParameters("(uint8 intentVersion, bytes32 intentHash, uint128 pricePerSecond, uint64 durationSeconds, uint8 confidentiality, string gpuClass, string region, address lessee, bytes32 leaseId)");
+/**
+* ABI-encoded GpuLeaseRequest — the LEASE job calldata payload.
+* Positional (ABI order) — order is pinned by the blueprint's generated
+* encodeType in metadata/blueprint.json.
+*/
+function encodeGpuLeaseRequest(params) {
+	return encodeAbiParameters(GPU_LEASE_REQUEST_ABI, [[
+		params.intentVersion,
+		params.intentHash,
+		params.pricePerSecondWei,
+		params.durationSeconds,
+		params.confidentiality,
+		params.gpuClass,
+		params.region,
+		params.lessee,
+		params.leaseId
+	]]);
+}
+//#endregion
+//#region src/gpu-lease/types.ts
+/**
+* GPU lease client types — mirrors the gpu-lease-blueprint operator API
+* (gpu-lease-blueprint/gpu-lease-blueprint-lib/src/api.rs) and the on-chain
+* ABI (contracts/src/GpuLeaseBlueprint.sol sol! mirror).
+*
+* Every on-chain and off-chain surface is schemaVersioned; unknown versions
+* fail closed (SPEC §3 of the blueprint).
+*/
+/** The only schema this client understands. */
+const GPU_LEASE_SCHEMA_VERSION = 1;
+//#endregion
+//#region src/gpu-lease/operators.ts
+function assertKnownSchema(actual, where) {
+	if (actual !== 1) throw new Error(`${where}: unknown schemaVersion ${actual} (client understands ${GPU_LEASE_VERSION_TEXT}) — failing closed`);
+}
+const GPU_LEASE_VERSION_TEXT = String(1);
+async function getJson(endpoint, path) {
+	const res = await (endpoint.fetch ?? fetch)(new URL(path, endpoint.baseUrl).toString(), { headers: { accept: "application/json" } });
+	if (!res.ok) throw new Error(`GET ${path}: operator returned ${res.status}`);
+	const body = await res.json();
+	assertKnownSchema(body.schemaVersion, `GET ${path}`);
+	return body;
+}
+async function postJson(endpoint, path, payload, requireSchema = false) {
+	const res = await (endpoint.fetch ?? fetch)(new URL(path, endpoint.baseUrl).toString(), {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			accept: "application/json"
+		},
+		body: JSON.stringify(payload)
+	});
+	if (!res.ok) {
+		const detail = await res.text().catch(() => "");
+		throw new Error(`POST ${path}: operator returned ${res.status} ${detail.slice(0, 200)}`);
+	}
+	const body = await res.json();
+	if (requireSchema) assertKnownSchema(body.schemaVersion, `POST ${path}`);
+	return body;
+}
+var GpuLeaseOperatorClient = class {
+	constructor(endpoint) {
+		this.endpoint = endpoint;
+	}
+	capabilities() {
+		return getJson(this.endpoint, "/api/capabilities");
+	}
+	async quote(params) {
+		const quote = await postJson(this.endpoint, "/api/quote", {
+			gpuClass: params.gpuClass,
+			durationSeconds: params.durationSeconds,
+			confidentiality: params.confidentiality ?? 0,
+			...params.region !== void 0 ? { region: params.region } : {}
+		}, true);
+		return {
+			...quote,
+			operatorAddress: quote.operatorAddress ?? this.endpoint.address
+		};
+	}
+	leaseStatus(leaseId) {
+		return getJson(this.endpoint, `/api/leases/${leaseId.replace(/^0x/, "")}`);
+	}
+	sessionChallenge(leaseId, lessee) {
+		return postJson(this.endpoint, "/api/session/challenge", {
+			leaseId,
+			lessee
+		});
+	}
+	sessionVerify(nonce, signature) {
+		return postJson(this.endpoint, "/api/session/verify", {
+			nonce,
+			signature
+		});
+	}
+};
+//#endregion
+//#region src/gpu-lease/output.ts
+/**
+* GpuLeaseOutput decoding — the LEASE job result payload. The operator API
+* does NOT carry this (it is a job RESULT); it arrives from the chain via
+* the injected job client.
+*/
+const GPU_LEASE_OUTPUT_ABI = parseAbiParameters("(bytes32 leaseId, string endpoint, uint16 schemaVersion)");
+/** Decode + fail closed on unknown schemaVersion (blueprint SPEC §3). */
+function decodeGpuLeaseOutput(encoded) {
+	const [decoded] = decodeAbiParameters(GPU_LEASE_OUTPUT_ABI, encoded);
+	if (decoded.schemaVersion !== 1) throw new Error(`GpuLeaseOutput: unknown schemaVersion ${decoded.schemaVersion} — failing closed`);
+	return decoded;
+}
+//#endregion
+//#region src/gpu-lease/quotes.ts
+/**
+* Multi-operator RFQ: collect quotes, validate each against fail-closed
+* rules, rank by price. Pure — no I/O. Mirrors the validated-quote flow
+* proven in blueprint #1568 and the operator policy's ceiling semantics.
+*/
+/** The exact string the operator signs — mirrors the blueprint's
+* `canonical_quote_payload` byte-for-byte. Every priced field is bound. */
+function canonicalQuotePayload(quote) {
+	return `gpu-lease-quote|v1|${quote.gpuClass}|${quote.pricePerSecond}|${quote.durationSeconds}|${quote.confidentiality}|${quote.escrowTotal}|${quote.intentHash}|${quote.validUntil}`;
+}
+/** Offline EIP-191 recovery over the canonical payload. */
+async function verifyOperatorQuote(quote) {
+	return (await recoverMessageAddress({
+		message: canonicalQuotePayload(quote),
+		signature: quote.signature
+	})).toLowerCase();
+}
+/**
+* Validate one quote. Fail-closed on every field the RFQ binds:
+* class, duration-derived escrow, confidentiality, and expiry.
+*/
+function validateQuote(quote, input) {
+	const now = (input.now ?? Date.now)() / 1e3;
+	if (quote.gpuClass !== input.requestedClass) return {
+		kind: "class-mismatch",
+		requested: input.requestedClass,
+		quoted: quote.gpuClass
+	};
+	if (quote.confidentiality !== input.requestedConfidentiality) return {
+		kind: "confidentiality-mismatch",
+		requested: input.requestedConfidentiality,
+		quoted: quote.confidentiality
+	};
+	const price = BigInt(quote.pricePerSecond);
+	const expectedEscrow = price * BigInt(quote.durationSeconds);
+	const actualEscrow = BigInt(quote.escrowTotal);
+	if (expectedEscrow !== actualEscrow) return {
+		kind: "escrow-inconsistent",
+		expected: expectedEscrow,
+		actual: actualEscrow
+	};
+	if (quote.validUntil <= now) return {
+		kind: "stale",
+		validUntil: quote.validUntil,
+		now
+	};
+	return {
+		quote,
+		pricePerSecondWei: price,
+		escrowTotalWei: actualEscrow
+	};
+}
+/**
+* Collect validated quotes from N operators and rank cheapest-first.
+* Operators that fail validation (or whose fetch rejects) are reported,
+* never silently dropped — the buyer sees why an operator lost.
+*/
+function selectQuotes(quotes, input) {
+	const ranked = [];
+	const rejected = [];
+	for (const { operator, quote } of quotes) {
+		const result = validateQuote(quote, input);
+		if ("kind" in result) rejected.push({
+			operator,
+			reason: result
+		});
+		else ranked.push({
+			operator,
+			validated: result
+		});
+	}
+	ranked.sort((a, b) => {
+		if (a.validated.pricePerSecondWei !== b.validated.pricePerSecondWei) return a.validated.pricePerSecondWei < b.validated.pricePerSecondWei ? -1 : 1;
+		return a.validated.escrowTotalWei < b.validated.escrowTotalWei ? -1 : 1;
+	});
+	return {
+		ranked,
+		rejected
+	};
+}
+/**
+* Enforce the signed RFQ envelope when present:
+* - signature present => it MUST recover to the claimed operator address;
+*   invalid signature => reject (config-trust is dead on this path).
+* - no signature => the endpoint-config address is used (interim fallback);
+*   strict mode rejects unsigned quotes outright.
+*/
+async function validateQuoteIdentity(quote, opts = {}) {
+	const base = {
+		quote,
+		pricePerSecondWei: BigInt(quote.pricePerSecond),
+		escrowTotalWei: BigInt(quote.escrowTotal)
+	};
+	if (quote.signature) {
+		const recovered = await verifyOperatorQuote(quote).catch(() => null);
+		const claimed = quote.operatorAddress.toLowerCase();
+		if (recovered === null || recovered !== claimed) return {
+			kind: "signature-mismatch",
+			claimed,
+			recovered: recovered ?? "unrecoverable"
+		};
+		return base;
+	}
+	if (opts.strict) return {
+		kind: "unsigned",
+		operator: quote.operatorAddress
+	};
+	return base;
+}
+//#endregion
+//#region src/gpu-lease/vault.ts
+/**
+* Vault money semantics — the client mirror of GpuLeaseVault.sol
+* (gpu-lease-blueprint/contracts/src/GpuLeaseVault.sol), invariants I1–I5.
+* Exact integers everywhere; wei only, never floats.
+*/
+const GPU_LEASE_VAULT_ABI = parseAbi([
+	"function create(address operator, uint128 pricePerSecond, uint64 durationSeconds, bytes32 intentHash, uint8 confidentiality, bytes endpointInfo) external payable returns (bytes32 leaseId)",
+	"function extend(bytes32 leaseId, uint64 addSeconds) external payable",
+	"function release(bytes32 leaseId) external",
+	"function reap(bytes32 leaseId) external",
+	"function withdrawEarnings() external",
+	"function totalEscrowed() external view returns (uint256)",
+	"function operatorEarnings() external view returns (uint256)",
+	"function leases(bytes32) external view returns (address operator, address lessee, uint128 escrow, uint128 pricePerSecond, uint64 expiry, bytes32 intentHash, uint8 confidentiality, uint8 state)",
+	"event LeaseCreated(bytes32 indexed leaseId, address indexed operator, address indexed lessee, uint128 escrow, uint128 pricePerSecond, uint64 expiry, bytes32 intentHash, uint8 confidentiality, bytes endpointInfo, uint16 schemaVersion)",
+	"event LeaseReleased(bytes32 indexed leaseId, uint128 refund, uint128 operatorTake)",
+	"event LeaseReaped(bytes32 indexed leaseId, uint128 operatorTake, address caller)"
+]);
+/** Vault lease states (mirrors the contract). */
+const LEASE_STATE = {
+	LIVE: 0,
+	RELEASED: 1,
+	REAPED: 2
+};
+/**
+* Exact refund projection (I3): pricePerSecond × max(expiry − now, 0).
+* Exact by construction because escrow === price × paidSeconds in the vault.
+*/
+function projectRefundWei(lease, nowSeconds) {
+	const remaining = lease.expiry > nowSeconds ? lease.expiry - nowSeconds : 0n;
+	const refundWei = lease.pricePerSecondWei * remaining;
+	return {
+		refundWei,
+		operatorTakeWei: lease.escrowWei - refundWei
+	};
+}
+/** I2 from the client side: unpayable time can never be requested. */
+function maxAffordableSeconds(escrowWei, pricePerSecondWei) {
+	if (pricePerSecondWei <= 0n) throw new Error("pricePerSecond must be positive");
+	return escrowWei / pricePerSecondWei;
+}
+//#endregion
+//#region src/gpu-lease/resolver.ts
+/**
+* `gpuLease()` — the SPEC §5 resolver: collect + validate quotes → escrow on
+* the vault → LEASE job through tnt-core → teardown with an exact refund
+* receipt. Chain and job submission are INJECTED (transport-agnostic: works
+* with viem wallets, the TangleDriver, or test doubles).
+*/
+/** Job ids — MUST match the blueprint router (sequential, no gaps). */
+const GPU_LEASE_JOBS = {
+	LEASE: 0,
+	RELEASE: 1,
+	EXTEND: 2,
+	REAP: 3
+};
+/** Resolve a GPU lease end-to-end. Throws with the full picture on failure. */
+async function gpuLease(options) {
+	const { gpuClass, durationSeconds, region = "any" } = options;
+	const confidentiality = options.confidentiality ?? 0;
+	const collected = (await Promise.allSettled(options.operators.map(async (endpoint) => {
+		const quote = await new GpuLeaseOperatorClient(endpoint).quote({
+			gpuClass,
+			durationSeconds,
+			confidentiality,
+			region
+		});
+		return {
+			operator: endpoint.baseUrl,
+			quote
+		};
+	}))).flatMap((s) => s.status === "fulfilled" ? [s.value] : []);
+	if (collected.length === 0) throw new Error("gpuLease: no operator returned a quote");
+	const { ranked, rejected } = selectQuotes(collected, {
+		requestedClass: gpuClass,
+		requestedDurationSeconds: durationSeconds,
+		requestedConfidentiality: confidentiality,
+		now: options.now
+	});
+	if (ranked.length === 0) {
+		const reasons = rejected.map((r) => `${r.operator}: ${r.reason.kind}`).join(", ");
+		throw new Error(`gpuLease: every quote failed validation (${reasons})`);
+	}
+	let best;
+	for (const candidate of ranked) {
+		const identity = await validateQuoteIdentity(candidate.validated.quote);
+		if ("kind" in identity) {
+			rejected.push({
+				operator: candidate.operator,
+				reason: identity
+			});
+			continue;
+		}
+		best = {
+			...candidate,
+			validated: identity
+		};
+		break;
+	}
+	if (!best) {
+		const reasons = rejected.map((r) => `${r.operator}: ${r.reason.kind}`).join(", ");
+		throw new Error(`gpuLease: no quote passed identity verification (${reasons})`);
+	}
+	const operatorAddress = best.validated.quote.operatorAddress;
+	const intentHash = gpuLeaseIntentHash({
+		intentVersion: 1,
+		gpuClass,
+		durationSeconds,
+		confidentiality,
+		region
+	});
+	const leaseId = await options.chain.createVaultLease({
+		operator: operatorAddress,
+		pricePerSecondWei: best.validated.pricePerSecondWei,
+		durationSeconds: BigInt(durationSeconds),
+		intentHash,
+		confidentiality,
+		endpointInfo: "{}",
+		escrowWei: best.validated.escrowTotalWei
+	});
+	const encoded = encodeGpuLeaseRequest({
+		intentVersion: 1,
+		intentHash,
+		pricePerSecondWei: best.validated.pricePerSecondWei,
+		durationSeconds: BigInt(durationSeconds),
+		confidentiality,
+		gpuClass,
+		region,
+		lessee: options.chain.account,
+		leaseId
+	});
+	const output = decodeGpuLeaseOutput(await options.chain.submitJob(GPU_LEASE_JOBS.LEASE, encoded));
+	if (output.leaseId !== leaseId) throw new Error(`gpuLease: job returned leaseId ${output.leaseId}, expected the vault leaseId ${leaseId} (one identity across money and routing)`);
+	return {
+		lease: {
+			leaseId,
+			endpoint: output.endpoint,
+			schemaVersion: output.schemaVersion,
+			quote: best.validated
+		},
+		rankedOperators: ranked.map((r) => r.operator)
+	};
+}
+/** Teardown: voluntary release with an exact-refund receipt (I3/I4). */
+async function releaseGpuLease(leaseId, chain) {
+	const { refundWei, operatorTakeWei } = await chain.releaseLease(leaseId);
+	return {
+		leaseId,
+		refundWei,
+		operatorTakeWei
+	};
+}
+/**
+* Refund projection for UI meters. Uses the chain clock when the injected
+* chain provides `chainNow()`; otherwise requires an explicit timestamp.
+* Never Date.now() — the drift lesson from the blueprint's own E2E.
+*/
+async function projectGpuLeaseRefund(leaseId, chain, explicitNowSeconds) {
+	const lease = await chain.readLease(leaseId);
+	let nowSeconds = explicitNowSeconds;
+	if (nowSeconds === void 0) {
+		if (!chain.chainNow) throw new Error("projectGpuLeaseRefund: chain has no chainNow() — pass explicitNowSeconds");
+		nowSeconds = await chain.chainNow();
+	}
+	const { refundWei, operatorTakeWei } = projectRefundWei(lease, nowSeconds);
+	return {
+		refundWei,
+		operatorTakeWei,
+		nowSeconds
+	};
+}
+//#endregion
+export { GPU_LEASE_JOBS, GPU_LEASE_REQUEST_ABI, GPU_LEASE_SCHEMA_VERSION, GPU_LEASE_VAULT_ABI, GpuLeaseOperatorClient, INTENT_VERSION, LEASE_STATE, canonicalQuotePayload, decodeGpuLeaseOutput, encodeGpuLeaseRequest, gpuLease, gpuLeaseIntentHash, maxAffordableSeconds, projectGpuLeaseRefund, projectRefundWei, releaseGpuLease, selectQuotes, validateQuote, validateQuoteIdentity, verifyOperatorQuote };

package/dist/index.d.ts

@@ -870,8 +870,8 @@ declare const manageSandboxesInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -1199,8 +1199,8 @@ declare const manageSandboxesInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -1538,8 +1538,8 @@ declare const manageSandboxesInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -1862,8 +1862,8 @@ declare const manageSandboxesInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -2191,8 +2191,8 @@ declare const manageSandboxesInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -2625,8 +2625,8 @@ declare const MANAGE_SANDBOXES_PARAMETERS: z.core.ZodStandardJSONSchemaPayload<z
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -2954,8 +2954,8 @@ declare const MANAGE_SANDBOXES_PARAMETERS: z.core.ZodStandardJSONSchemaPayload<z
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -3293,8 +3293,8 @@ declare const MANAGE_SANDBOXES_PARAMETERS: z.core.ZodStandardJSONSchemaPayload<z
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -3617,8 +3617,8 @@ declare const MANAGE_SANDBOXES_PARAMETERS: z.core.ZodStandardJSONSchemaPayload<z
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;
@@ -3946,8 +3946,8 @@ declare const MANAGE_SANDBOXES_PARAMETERS: z.core.ZodStandardJSONSchemaPayload<z
           off: "off";
         }>>;
         logs: z.ZodOptional<z.ZodEnum<{
-          off: "off";
           on: "on";
+          off: "off";
         }>>;
       }, z.core.$strict>>;
       idempotencyKey: z.ZodOptional<z.ZodString>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/sandbox",
-  "version": "0.60.16-develop.20261006031110.95c8cc9",
+  "version": "0.60.16-develop.20261006041203.03ae563",
   "description": "Client SDK for the Tangle Sandbox platform - build AI agent applications with dev containers",
   "type": "module",
   "sideEffects": [
@@ -152,10 +152,10 @@
     "yjs": "13.6.30",
     "@products/sandbox-test-utils": "0.0.0",
     "@repo/shared": "0.0.0",
+    "@tangle-network/agent-profile-materialize": "0.20.9",
+    "@tangle-network/sdk": "3.3.41",
     "@tangle-network/cli-agent-registry": "0.5.0",
     "@tangle-network/runtime-contracts": "0.14.0",
-    "@tangle-network/sdk": "3.3.41",
-    "@tangle-network/agent-profile-materialize": "0.20.9",
     "@tangle-network/sse-core": "0.0.0"
   },
   "scripts": {