enigma-memory 0.1.18 → 0.1.22

package/packages/inference-runtime/src/code.js

@@ -0,0 +1,407 @@
+import { randomUUID } from 'node:crypto';
+import { spawn } from 'node:child_process';
+
+export const ENIGMA_CODE_SESSION_SCHEMA = 'enigma.code_session.v1';
+const TERMINAL = new Set(['stopped', 'burned', 'failed']);
+const DEFAULT_ALLOWED_COMMANDS = Object.freeze(['node', 'npm', 'npx']);
+const WRITE_FILE_PROGRAM = `
+const fs=require('node:fs');const path=require('node:path');
+const root='/workspace';const relative=process.argv[1];const target=path.resolve(root,relative);
+if(!target.startsWith(root+'/'))throw new Error('path escapes workspace');
+fs.mkdirSync(path.dirname(target),{recursive:true});const chunks=[];
+process.stdin.on('data',c=>chunks.push(c));process.stdin.on('end',()=>fs.writeFileSync(target,Buffer.concat(chunks),{mode:0o660}));
+`;
+const LIST_FILES_PROGRAM = `
+const fs=require('node:fs');const path=require('node:path');const root='/workspace';const out=[];
+function walk(dir,depth=0){if(depth>24)throw new Error('workspace nesting limit exceeded');for(const e of fs.readdirSync(dir,{withFileTypes:true})){if(out.length>=2000)throw new Error('workspace file limit exceeded');const p=path.join(dir,e.name);if(e.isDirectory())walk(p,depth+1);else if(e.isFile()){const s=fs.statSync(p);out.push({path:path.relative(root,p).replaceAll('\\\\','/'),bytes:s.size,modifiedAt:s.mtimeMs})}}}
+walk(root);process.stdout.write(JSON.stringify(out.sort((a,b)=>a.path.localeCompare(b.path))));
+`;
+const READ_FILE_PROGRAM = `
+const fs=require('node:fs');const path=require('node:path');const root='/workspace';const target=path.resolve(root,process.argv[1]);
+if(!target.startsWith(root+'/'))throw new Error('path escapes workspace');process.stdout.write(fs.readFileSync(target).toString('base64'));
+`;
+
+function requiredString(value, field, maxLength = 1_000_000) {
+  if (typeof value !== 'string' || !value.trim()) throw new TypeError(`${field} must be a non-empty string`);
+  if (value.length > maxLength) throw new TypeError(`${field} exceeds ${maxLength} characters`);
+  return value;
+}
+
+function boundedInteger(value, field, minimum, maximum, fallback) {
+  const candidate = value === undefined ? fallback : value;
+  if (!Number.isInteger(candidate) || candidate < minimum || candidate > maximum) {
+    throw new TypeError(`${field} must be an integer from ${minimum} to ${maximum}`);
+  }
+  return candidate;
+}
+
+function safeRelativePath(value, field = 'path') {
+  const normalized = requiredString(value, field, 512).replaceAll('\\', '/').split('/').filter((part) => part && part !== '.').join('/');
+  if (!normalized || normalized.split('/').some((part) => part === '..') || normalized.startsWith('/') || /^[A-Za-z]:/.test(normalized)) {
+    throw new TypeError(`${field} must remain inside the sandbox workspace`);
+  }
+  return normalized;
+}
+
+function publicSession(session) {
+  return {
+    schema: ENIGMA_CODE_SESSION_SCHEMA,
+    id: session.id,
+    provider: session.provider.id,
+    status: session.status,
+    language: session.language,
+    image: session.image,
+    imageId: session.imageId,
+    network: 'none',
+    createdAt: session.createdAt,
+    expiresAt: session.expiresAt,
+    eventCursor: session.events.length,
+    isolation: {
+      boundary: 'oci-container',
+      rootFilesystem: 'read-only',
+      capabilities: 'none',
+      noNewPrivileges: true,
+      workspace: 'ephemeral-tmpfs',
+    },
+  };
+}
+
+function addEvent(session, type, data = {}) {
+  const event = Object.freeze({ cursor: session.events.length + 1, type, at: Date.now(), ...data });
+  session.events.push(event);
+  if (session.events.length > 2_000) session.events.splice(0, session.events.length - 2_000);
+  return event;
+}
+
+function runProcess(binary, args, options = {}) {
+  const timeoutMs = options.timeoutMs || 30_000;
+  const maxOutputBytes = options.maxOutputBytes || 2 * 1024 * 1024;
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, args, {
+      windowsHide: true,
+      stdio: [options.stdin === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+      env: options.env || process.env,
+    });
+    let stdout = Buffer.alloc(0);
+    let stderr = Buffer.alloc(0);
+    let settled = false;
+    let timedOut = false;
+    options.onSpawn?.(child);
+    const append = (current, chunk, stream) => {
+      options.onOutput?.(stream, chunk.toString('utf8'));
+      if (current.length >= maxOutputBytes) return current;
+      return Buffer.concat([current, chunk.subarray(0, maxOutputBytes - current.length)]);
+    };
+    child.stdout.on('data', (chunk) => { stdout = append(stdout, chunk, 'stdout'); });
+    child.stderr.on('data', (chunk) => { stderr = append(stderr, chunk, 'stderr'); });
+    child.once('error', (error) => {
+      if (!settled) {
+        settled = true;
+        clearTimeout(timer);
+        reject(error);
+      }
+    });
+    if (options.stdin !== undefined) child.stdin.end(options.stdin);
+    const timer = setTimeout(() => {
+      if (!settled) {
+        timedOut = true;
+        child.kill('SIGKILL');
+      }
+    }, timeoutMs);
+    child.once('exit', (code, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({
+        child,
+        code,
+        signal,
+        timedOut,
+        stdout: stdout.toString('utf8'),
+        stderr: stderr.toString('utf8'),
+      });
+    });
+  });
+}
+
+export function createOciSandboxProvider(options = {}) {
+  const id = String(options.id || 'oci-isolated-code');
+  const binary = String(options.binary || process.env.ENIGMA_OCI_RUNTIME || 'docker');
+  const image = String(options.image || process.env.ENIGMA_CODE_SANDBOX_IMAGE || 'node:24-bookworm-slim');
+  const pullPolicy = options.pullPolicy || 'missing';
+  if (!['never', 'missing', 'always'].includes(pullPolicy)) throw new TypeError('pullPolicy must be never, missing, or always');
+  const maxFileBytes = boundedInteger(options.maxFileBytes, 'maxFileBytes', 1_024, 32 * 1024 * 1024, 4 * 1024 * 1024);
+  const maxWorkspaceBytes = boundedInteger(options.maxWorkspaceBytes, 'maxWorkspaceBytes', maxFileBytes, 256 * 1024 * 1024, 32 * 1024 * 1024);
+  const memoryBytes = boundedInteger(options.memoryBytes, 'memoryBytes', 64 * 1024 * 1024, 8 * 1024 * 1024 * 1024, 512 * 1024 * 1024);
+  const pidsLimit = boundedInteger(options.pidsLimit, 'pidsLimit', 8, 512, 64);
+  const cpus = Number(options.cpus ?? 1);
+  if (!Number.isFinite(cpus) || cpus <= 0 || cpus > 16) throw new TypeError('cpus must be from 0.1 to 16');
+  const allowedCommands = new Set(options.allowedCommands || DEFAULT_ALLOWED_COMMANDS);
+  let prepared = null;
+
+  async function cli(args, config = {}) {
+    const result = await runProcess(binary, args, config);
+    if (result.code !== 0) {
+      const detail = (result.timedOut ? 'container engine command timed out' : result.stderr || result.stdout || `exit ${result.code}`).trim().slice(0, 2_000);
+      throw new Error(`OCI runtime failed: ${detail}`);
+    }
+    return result;
+  }
+
+  async function prepare() {
+    if (prepared) return prepared;
+    prepared = (async () => {
+      await cli(['version', '--format', '{{.Server.Version}}'], { timeoutMs: 20_000, maxOutputBytes: 16_384 });
+      if (pullPolicy === 'always') await cli(['pull', image], { timeoutMs: 10 * 60_000 });
+      let inspection;
+      try {
+        inspection = await cli(['image', 'inspect', '--format', '{{.Id}}', image], { timeoutMs: 20_000 });
+      } catch (error) {
+        if (pullPolicy !== 'missing') throw new Error(`sandbox image ${image} is unavailable and pulling is disabled`);
+        await cli(['pull', image], { timeoutMs: 10 * 60_000 });
+        inspection = await cli(['image', 'inspect', '--format', '{{.Id}}', image], { timeoutMs: 20_000 });
+      }
+      const imageId = requiredString(inspection.stdout, 'image id', 256).trim();
+      if (!/^sha256:[a-f0-9]{64}$/i.test(imageId)) throw new Error('OCI runtime returned an invalid image id');
+      if (options.expectedImageId && imageId !== options.expectedImageId) throw new Error('sandbox image digest does not match expectedImageId');
+      return { image, imageId };
+    })().catch((error) => { prepared = null; throw error; });
+    return prepared;
+  }
+
+  async function exec(containerName, args, config = {}) {
+    return cli(['exec', '--user', '1000:1000', '--workdir', '/workspace', ...(config.interactive ? ['-i'] : []), containerName, ...args], config);
+  }
+
+  return Object.freeze({
+    id,
+    languages: Object.freeze(['javascript']),
+    allowedCommands: Object.freeze([...allowedCommands]),
+    prepare,
+    async createWorkspace() {
+      const pinned = await prepare();
+      const name = `enigma-code-${randomUUID()}`;
+      await cli([
+        'create', '--name', name,
+        '--label', 'com.enigma.runtime=code-sandbox',
+        '--network', 'none',
+        '--read-only',
+        '--pids-limit', String(pidsLimit),
+        '--memory', String(memoryBytes),
+        '--memory-swap', String(memoryBytes),
+        '--cpus', String(cpus),
+        '--cap-drop', 'ALL',
+        '--security-opt', 'no-new-privileges:true',
+        '--ipc', 'none',
+        '--ulimit', 'nofile=256:256',
+        '--tmpfs', `/workspace:rw,nosuid,nodev,exec,uid=1000,gid=1000,mode=0770,size=${maxWorkspaceBytes}`,
+        '--tmpfs', '/tmp:rw,nosuid,nodev,noexec,uid=1000,gid=1000,mode=0770,size=67108864',
+        '--user', '1000:1000',
+        '--workdir', '/workspace',
+        '--env', 'HOME=/tmp',
+        '--env', 'TMPDIR=/tmp',
+        '--entrypoint', 'node',
+        pinned.imageId,
+        '-e', 'setInterval(()=>{},2147483647)',
+      ], { timeoutMs: 30_000 });
+      try {
+        await cli(['start', name], { timeoutMs: 30_000 });
+        return { containerName: name, ...pinned };
+      } catch (error) {
+        await runProcess(binary, ['rm', '-f', name], { timeoutMs: 20_000 }).catch(() => {});
+        throw error;
+      }
+    },
+    async writeFile(workspace, relativePath, data) {
+      if (!Buffer.isBuffer(data)) data = Buffer.from(data);
+      if (data.length > maxFileBytes) throw new TypeError(`file exceeds ${maxFileBytes} bytes`);
+      const current = await this.listArtifacts(workspace);
+      const oldBytes = current.find((file) => file.path === relativePath)?.bytes || 0;
+      const total = current.reduce((sum, file) => sum + file.bytes, 0) - oldBytes + data.length;
+      if (total > maxWorkspaceBytes) throw new TypeError('sandbox workspace quota exceeded');
+      await exec(workspace.containerName, ['node', '-e', WRITE_FILE_PROGRAM, relativePath], {
+        interactive: true,
+        stdin: data,
+        timeoutMs: 30_000,
+      });
+    },
+    execute(workspace, request, hooks = {}) {
+      const command = Array.isArray(request.command) && request.command.length
+        ? request.command.map(String)
+        : ['node', safeRelativePath(request.entry || 'main.js', 'entry')];
+      const executable = requiredString(command[0], 'command', 128);
+      if (!allowedCommands.has(executable)) throw new TypeError(`sandbox command is not allowed: ${executable}`);
+      for (const argument of command.slice(1)) {
+        if (argument.includes('\0') || argument.length > 8_192) throw new TypeError('sandbox command contains an invalid argument');
+      }
+      const timeoutMs = boundedInteger(request.timeoutMs, 'timeoutMs', 100, 120_000, 10_000);
+      const maxOutputBytes = boundedInteger(request.maxOutputBytes, 'maxOutputBytes', 1_024, 2 * 1024 * 1024, 256 * 1024);
+      let activeChild = null;
+      const completion = runProcess(binary, [
+        'exec', '--user', '1000:1000', '--workdir', '/workspace', workspace.containerName, ...command,
+      ], {
+        timeoutMs,
+        maxOutputBytes,
+        onOutput: hooks.onOutput,
+        onSpawn(child) { activeChild = child; },
+      }).then(async (result) => {
+        if (result.timedOut) {
+          await runProcess(binary, ['kill', workspace.containerName], { timeoutMs: 10_000 }).catch(() => {});
+        }
+        return { code: result.code, signal: result.signal, timedOut: result.timedOut };
+      });
+      return { get child() { return activeChild; }, completion };
+    },
+    async listArtifacts(workspace) {
+      const result = await exec(workspace.containerName, ['node', '-e', LIST_FILES_PROGRAM], { timeoutMs: 30_000, maxOutputBytes: 8 * 1024 * 1024 });
+      const files = JSON.parse(result.stdout || '[]');
+      return files.filter((file) => file && typeof file.path === 'string' && Number.isFinite(file.bytes));
+    },
+    async readArtifact(workspace, relativePath) {
+      const result = await exec(workspace.containerName, ['node', '-e', READ_FILE_PROGRAM, relativePath], { timeoutMs: 30_000, maxOutputBytes: Math.ceil(maxFileBytes * 1.4) });
+      const data = Buffer.from(result.stdout, 'base64');
+      if (data.length > maxFileBytes) throw new Error('artifact exceeds readable file limit');
+      return data;
+    },
+    async stop(workspace) {
+      await cli(['stop', '--time', '2', workspace.containerName], { timeoutMs: 10_000 });
+    },
+    async destroy(workspace) {
+      await cli(['rm', '-f', '--volumes', workspace.containerName], { timeoutMs: 20_000 });
+      const verification = await runProcess(binary, ['container', 'inspect', workspace.containerName], {
+        timeoutMs: 20_000,
+        maxOutputBytes: 16_384,
+      });
+      if (verification.code === 0) throw new Error('OCI cleanup verification failed: container still exists');
+      const detail = `${verification.stderr}\n${verification.stdout}`;
+      if (!/no such (?:object|container)/i.test(detail)) {
+        throw new Error(`OCI cleanup verification failed: ${detail.trim().slice(0, 1_000)}`);
+      }
+    },
+  });
+}
+
+export function createCodeSandboxRuntime(options = {}) {
+  const provider = options.provider || createOciSandboxProvider(options.oci || {});
+  if (!provider || typeof provider.createWorkspace !== 'function' || typeof provider.execute !== 'function') {
+    throw new TypeError('code sandbox provider requires createWorkspace() and execute()');
+  }
+  const ttlMs = boundedInteger(options.ttlMs, 'ttlMs', 60_000, 24 * 60 * 60_000, 60 * 60_000);
+  const sessions = new Map();
+
+  async function getSession(id, { allowTerminal = false } = {}) {
+    const session = sessions.get(requiredString(id, 'session id', 512));
+    if (!session) throw new Error('code session not found');
+    if (session.status === 'cleanup_failed' && !allowTerminal) throw new Error('code session cleanup failed; retry burn');
+    if (Date.now() >= session.expiresAt && session.status !== 'burned') await burn(session.id, 'expired');
+    if (!allowTerminal && TERMINAL.has(session.status)) throw new Error(`code session is ${session.status}`);
+    return session;
+  }
+
+  async function burn(id, reason = 'requested') {
+    const session = sessions.get(requiredString(id, 'session id', 512));
+    if (!session) throw new Error('code session not found');
+    if (session.status === 'burned') return publicSession(session);
+    session.activeRun?.child?.kill('SIGKILL');
+    session.activeRun = null;
+    try {
+      await provider.destroy(session.workspace);
+    } catch (error) {
+      session.status = 'cleanup_failed';
+      addEvent(session, 'cleanup.failed', { message: error.message });
+      const cleanupError = new Error(`sandbox cleanup failed; retry burn: ${error.message}`);
+      cleanupError.code = 'cleanup_failed';
+      throw cleanupError;
+    }
+    session.status = 'burned';
+    addEvent(session, 'session.burned', { reason });
+    return publicSession(session);
+  }
+
+  return Object.freeze({
+    async available() {
+      try { await provider.prepare?.(); return { available: true, provider: provider.id }; }
+      catch (error) { return { available: false, provider: provider.id, error: error.message }; }
+    },
+    async create(input = {}) {
+      const language = String(input.language || 'javascript').toLowerCase();
+      if (!(provider.languages || []).includes(language)) throw new TypeError(`unsupported sandbox language: ${language}`);
+      const workspace = await provider.createWorkspace({ language });
+      const now = Date.now();
+      const session = {
+        id: randomUUID(), provider, language, workspace, status: 'ready', createdAt: now, expiresAt: now + ttlMs,
+        image: workspace.image || null, imageId: workspace.imageId || null, events: [], activeRun: null,
+      };
+      sessions.set(session.id, session);
+      addEvent(session, 'session.ready');
+      return publicSession(session);
+    },
+    async upload(id, input = {}) {
+      const session = await getSession(id);
+      if (session.status === 'running') throw new Error('cannot upload while code is running');
+      const relativePath = safeRelativePath(input.path);
+      const encoding = input.encoding || 'utf8';
+      if (encoding !== 'utf8' && encoding !== 'base64') throw new TypeError('encoding must be utf8 or base64');
+      const data = Buffer.from(requiredString(input.data, 'data'), encoding);
+      await provider.writeFile(session.workspace, relativePath, data);
+      addEvent(session, 'file.created', { path: relativePath, bytes: data.length });
+      return { ok: true, path: relativePath, bytes: data.length };
+    },
+    async execute(id, input = {}) {
+      const session = await getSession(id);
+      if (session.status === 'running') throw new Error('code session is already running');
+      session.status = 'running';
+      addEvent(session, 'command.start', { command: input.command || ['node', input.entry || 'main.js'] });
+      try {
+        const run = provider.execute(session.workspace, input, {
+          onOutput(stream, data) { addEvent(session, 'command.output', { stream, data }); },
+        });
+        session.activeRun = run;
+        const result = await run.completion;
+        session.activeRun = null;
+        if (result.timedOut) {
+          session.status = 'failed';
+          addEvent(session, 'error', { ...result, message: 'sandbox execution timed out and the container was terminated' });
+          return { ok: false, ...result, artifacts: [], session: publicSession(session) };
+        }
+        session.status = 'ready';
+        const artifacts = await provider.listArtifacts(session.workspace);
+        addEvent(session, result.code === 0 ? 'done' : 'error', { ...result, artifacts });
+        return { ok: result.code === 0, ...result, artifacts, session: publicSession(session) };
+      } catch (error) {
+        session.activeRun = null;
+        session.status = 'failed';
+        addEvent(session, 'error', { message: error.message });
+        throw error;
+      }
+    },
+    async events(id, after = 0) {
+      const session = await getSession(id, { allowTerminal: true });
+      const cursor = Number.isInteger(after) && after >= 0 ? after : 0;
+      return { session: publicSession(session), events: session.events.filter((event) => event.cursor > cursor) };
+    },
+    async artifacts(id) {
+      const session = await getSession(id, { allowTerminal: true });
+      if (session.status === 'burned') return [];
+      return provider.listArtifacts(session.workspace);
+    },
+    async artifact(id, relativePath) {
+      const session = await getSession(id);
+      return provider.readArtifact(session.workspace, safeRelativePath(relativePath));
+    },
+    async stop(id) {
+      const session = await getSession(id, { allowTerminal: true });
+      if (session.status === 'burned') return publicSession(session);
+      session.activeRun?.child?.kill('SIGKILL');
+      session.activeRun = null;
+      await provider.stop?.(session.workspace);
+      session.status = 'stopped';
+      addEvent(session, 'session.stopped');
+      return publicSession(session);
+    },
+    burn,
+    async close() {
+      await Promise.all([...sessions.values()].filter((session) => session.status !== 'burned').map((session) => burn(session.id, 'runtime-close')));
+    },
+  });
+}

package/packages/inference-runtime/src/contracts.js

@@ -0,0 +1,162 @@
+export const ENIGMA_PROTOCOL_VERSION = '2026-08-25';
+
+function deepFreeze(value) {
+  if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value;
+  for (const child of Object.values(value)) deepFreeze(child);
+  return Object.freeze(value);
+}
+
+export const ENIGMA_PLATFORM_CONTRACT = deepFreeze({
+  brand: {
+    product: 'Enigma Cortex',
+    assistant: 'Enigma',
+    privateHandoffScheme: 'enigma://private',
+    adaptiveRouter: 'Enigma Weave',
+    trainingPlane: 'Enigma Reflex',
+  },
+  privacy: {
+    modes: ['off', 'smart', 'strict'],
+    smartDecisions: ['local', 'remote-redacted', 'private-route', 'block'],
+    promptRetention: false,
+    outputRetention: false,
+    rawUsageRows: false,
+    networkPrivacy: 'transport-dependent',
+  },
+  endpoints: {
+    health: 'GET /api/health',
+    models: 'GET /v1/models',
+    chat: 'POST /v1/chat/completions',
+    images: 'POST /v1/images/generations',
+    imageModels: 'GET /v1/images/models',
+    videoQueue: 'POST /v1/videos/queue',
+    videoRetrieve: 'POST /v1/videos/retrieve',
+    videoModels: 'GET /v1/videos/models',
+    browserSessions: 'POST /v1/browser/sessions',
+    browserSession: '/v1/browser/sessions/:sessionId',
+    codeSessions: 'POST /v1/code/sessions',
+    codeSession: '/v1/code/sessions/:sessionId',
+    usage: 'GET /v1/usage',
+    credits: 'GET /v1/credits',
+    apiKeys: '/v1/api-keys',
+    quote: 'POST /v1/payments/quote',
+    x402: 'POST /v1/x402/chat/completions',
+    mcp: 'POST /mcp',
+    oauthProtectedResource: 'GET /.well-known/oauth-protected-resource/mcp',
+    oauthServer: 'GET /.well-known/oauth-authorization-server',
+  },
+  chat: {
+    request: {
+      required: ['model', 'messages'],
+      optional: [
+        'temperature',
+        'max_tokens',
+        'stream',
+        'privacy_mode',
+        'privacy_proof',
+        'reasoning_effort',
+        'connectors',
+        'web_search',
+      ],
+    },
+    stream: {
+      transport: 'server-sent-events',
+      terminalFrame: '[DONE]',
+      eventTypes: ['delta', 'thinking', 'citation', 'privacy', 'route', 'usage', 'receipt'],
+    },
+  },
+  images: {
+    formats: ['webp', 'png', 'jpeg'],
+    width: { min: 256, max: 2048 },
+    height: { min: 256, max: 2048 },
+    variants: { min: 1, max: 4 },
+    retention: 'caller-controlled',
+  },
+  video: {
+    lifecycle: ['queued', 'running', 'succeeded', 'failed', 'cancelled', 'expired'],
+    inputs: ['text', 'image'],
+    output: 'video/mp4',
+    retrieval: 'poll-or-provider-webhook',
+  },
+  browser: {
+    lifecycle: ['created', 'starting', 'ready', 'burning', 'burned', 'failed'],
+    controls: ['navigate', 'click', 'type', 'keypress', 'scroll', 'back', 'forward', 'reload'],
+    maxTabs: 5,
+    burnClears: ['cookies', 'cache', 'history', 'downloads', 'temporary-profile'],
+    ssrfPolicy: 'resolve-and-deny-private-special-use-addresses',
+  },
+  code: {
+    lifecycle: ['created', 'ready', 'running', 'waiting-approval', 'stopped', 'burned', 'failed'],
+    events: [
+      'session.ready',
+      'command.start',
+      'command.output',
+      'file.created',
+      'file.modified',
+      'approval.requested',
+      'preview.ready',
+      'done',
+      'error',
+    ],
+    isolation: 'ephemeral-workspace-plus-provider-enforced-resource-policy',
+  },
+  oauth: {
+    grantTypes: ['authorization_code', 'refresh_token'],
+    responseTypes: ['code'],
+    tokenEndpointAuthMethods: ['none', 'client_secret_basic', 'client_secret_post'],
+    codeChallengeMethods: ['S256'],
+    dynamicClientRegistration: 'policy-gated',
+    nativeRedirectSchemes: ['enigma-ios'],
+    accessTokenTransport: 'authorization-bearer-header',
+    scopes: [
+      'mcp:invoke',
+      'models:invoke',
+      'images:generate',
+      'video:generate',
+      'code:execute',
+      'browser:control',
+      'usage:read',
+      'credits:create',
+      'offline_access',
+    ],
+    mcpScope: 'mcp:invoke',
+  },
+  credits: {
+    representation: 'accountless-pseudonymous-ledger',
+    custody: 'ephemeral-access-token-plus-rotating-one-time-recovery-code',
+    credentialVerifierStorage: 'salted-scrypt-hashes-only',
+    ledgerStorage: 'pseudonymous-vault-ids-balances-reservations-ledger-entries-and-timestamps',
+    balanceUnit: 'microcredits',
+    fundingBoundary: 'payment records link the pseudonymous vault to the funding rail',
+  },
+  settlement: {
+    rails: ['solana-usdc-transfer', 'solana-token-burn', 'stripe-subscription', 'x402-v2'],
+    verification: 'finalized-chain-evidence-or-verified-stripe-webhook',
+    x402: {
+      paymentRequiredStatus: 402,
+      requestHeader: 'PAYMENT-SIGNATURE',
+      requiredHeader: 'PAYMENT-REQUIRED',
+      responseHeader: 'PAYMENT-RESPONSE',
+      settlementBeforeExecution: true,
+      privacyBoundary: 'public-chain-unless-caller-selects-a-real-private-settlement-route',
+    },
+  },
+  mcp: {
+    transport: 'streamable-http',
+    resource: '/mcp',
+    tools: [
+      'enigma_health',
+      'enigma_routing_contract',
+      'enigma_list_models',
+      'enigma_start_private_session',
+      'enigma_call_private_completion',
+      'enigma_quote_completion',
+      'enigma_create_x402_completion_request',
+      'enigma_generate_image',
+    ],
+    privatePromptBoundary: 'sensitive prompts are entered inside Enigma, never in the host tool arguments',
+  },
+});
+
+export function platformContract() {
+  return ENIGMA_PLATFORM_CONTRACT;
+}