privateer-agent 0.12.19 → 0.12.21

package/src/mcp/catalog.ts

@@ -375,6 +375,47 @@ export const MCP_CATALOG: CatalogEntry[] = [
     hosted: false,
     docsUrl: "https://dev.epicgames.com/documentation/unreal-engine/unreal-mcp-in-unreal-editor",
   },
+  {
+    // Godot ships no MCP server of its own. This is the "Godot MCP Native" editor
+    // plugin (MIT, Godot Asset Library) — chosen because it serves streamable HTTP
+    // from INSIDE the editor process, which is the same shape as the Unreal entry
+    // above and needs nothing installed on the machine outside Godot itself.
+    //
+    // Deliberately NOT one of the npx-launched Godot servers: those shell out to the
+    // `godot` BINARY headlessly (a second, non-interactive copy of the project rather
+    // than the editor the user is looking at), and every one of them is configured by
+    // a GODOT_PATH env var — a filesystem path, which is neither a token nor a
+    // placeholder arg, so this catalog has no `needs` that could ask for it honestly.
+    //
+    // Two things differ from Unreal, and they are the only two:
+    //  1. THE PLUGIN IS NOT PART OF THE ENGINE. Install "Godot MCP Native" from the
+    //     Asset Library and enable it in Project → Project Settings → Plugins. Until
+    //     that is done the port is simply closed, which looks identical to "Godot is
+    //     not running" — so the setup guide below matters more here than it does for
+    //     Unreal, where the plugin ships with 5.8.
+    //  2. ITS BIND ADDRESS IS NOT DOCUMENTED UPSTREAM. Unreal's is (loopback, plus an
+    //     Origin check); this one's is not, so the honest claim is only that WE dial
+    //     127.0.0.1 — never that the editor cannot be reached from the LAN. Its own
+    //     `auth_enabled` is off by default (user://mcp_settings.cfg), which is the
+    //     knob to turn on when the machine sits on a network you don't trust.
+    //
+    // Everything else matches Unreal: nothing to authorize on the wire we use (hence
+    // localHttp + auth:"none"), it answers only while the editor is open, and the port
+    // is editable (`http_port`) — hence needs:"url", confirm the endpoint.
+    id: "godot",
+    name: "godot",
+    label: "Godot Engine",
+    blurb: "Drive the Godot editor — scenes, nodes, scripts, resources.",
+    transport: "http",
+    url: "http://127.0.0.1:9080/mcp",
+    localHttp: true,
+    needs: "url",
+    // Same reason as Unreal: hostedCapable() derives its answer from `oauth`, so
+    // http-with-no-auth would otherwise read as hostable. An enclave cannot reach a
+    // loopback port on the user's desk.
+    hosted: false,
+    docsUrl: "https://github.com/yurineko73/Godot-MCP-Native",
+  },
 ];
 
 export function catalogEntry(id: string): CatalogEntry | undefined {

package/src/providers/phala/aci-verifier/VENDORED.md

@@ -1,39 +1,63 @@
-# Vendored: `@dstack/aci-verifier`
+# Vendored: the ACI verifier
 
-Faithful copy of the zero-dependency TypeScript ACI verifier from
+Copy of the zero-dependency TypeScript ACI verifier from
 [Dstack-TEE/private-ai-gateway](https://github.com/Dstack-TEE/private-ai-gateway)
 (`clients/verifier-ts/src`), Apache-2.0. It is `private: true` upstream (not on
 npm), so it is vendored here rather than installed.
 
-Provides the pieces `PhalaProvider` needs:
-- **`verifyReportBinding`** (`report.ts`) — §10.1 checks 2–6 (crypto binding of the
-  attestation report to the attested keyset for a supplied nonce). NOT the hardware
-  TDX quote (check 1) — that is layered on with `@phala/dcap-qvl` in the provider.
-- **`openE2eeChannel`** (`e2ee-channel.ts`) — the ACI E2EE channel:
+Current drop: commit `1a044e960fbec8ab20f38524bc93aa0ced83d5b0` — the `aci/1`
+protocol, which is what `inference.phala.com` actually serves as of 2026-08-24.
+
+Provides the pieces the Phala sealed transport needs:
+- **`verifyReportBinding`** (`report.ts`) — §9.1 checks 2–3: the served keyset
+  canonicalizes to the digest that the attestation statement for our nonce hashes
+  into `report_data`, and the keyset has not expired. NOT the hardware TDX quote
+  (check 1) — that is layered on with `@phala/dcap-qvl` in `../../phalaSeal.ts`.
+- **`openE2eeChannel`** (`e2ee-channel.ts`) — the E2EE v2 channel:
   `x25519-aes-256-gcm-hkdf-sha256`, per-field seal/open, `X-E2EE-*` headers.
 
-## Local adaptation (the only change from upstream)
-- Relative import specifiers had their `.js` extension stripped (`'./jcs.js'` →
-  `'./jcs'`) so Metro + TS (`moduleResolution: bundler`) resolve to the `.ts` files.
+## Protocol note: what `aci/1` changed
+The previous drop verified a *keyset endorsement*: the keyset carried a
+`workload_identity` key, that key signed the keyset digest, and `workload_id` was
+the digest of the identity key. `aci/1` removes all three. The keyset is now bound
+straight into `report_data` — the statement is
+`{"keyset_digest":…,"nonce":…,"purpose":"aci.report_data.v1"}` — so the hardware
+quote is the only signature over it, and per-key custody (`evidence.key_custody`,
+the dstack-KMS chain) is explicitly policy/caller territory (§9.1 checks 5–6),
+which we do not check.
+
+Practical consequence: a client written against the old shape does not degrade,
+it *crashes* — `workload_keyset.workload_identity` is simply absent. That is what
+broke sealed `phala/*` turns with `sealed shim: Cannot read properties of
+undefined (reading 'public_key')` before this drop.
+
+## Local adaptations (the only changes from upstream)
+1. Relative import specifiers had their `.js` extension stripped (`'./jcs.js'` →
+   `'./jcs'`) so Metro + TS (`moduleResolution: bundler`) resolve to the `.ts` files.
+2. `jcs.ts` is kept as its own module. Upstream folded JCS into `crypto.ts` as a
+   sort-and-`JSON.stringify` helper; ours is the stricter RFC 8785 implementation
+   from the earlier drop (it *rejects* non-integer numbers rather than
+   mis-serializing them), and the E2EE AAD builders depend on it. `digest.ts`,
+   `receipt.ts`, and `session.ts` therefore import `jcsBytes` from `./jcs`
+   instead of `./crypto`.
+3. `report.ts` carries only `verifyReportBinding`. Upstream's `verifyQuote` and
+   `verifyComposeMeasurement` are omitted: `../../phalaSeal.ts` owns the quote (it
+   also gates TCB status and pins the measurements) and `../measurements.ts` owns
+   the event-log replay across all four RTMRs, not just RTMR3. Omitting them keeps
+   this tree dependency-free and `@phala/dcap-qvl` off every startup's import path.
+4. `e2ee.ts` and `e2ee-channel.ts` are carried forward from the earlier drop.
+   Upstream moved E2EE out of the verifier package ("specified by §6 but not
+   constructed by this verifier"); the wire format itself is unchanged and still
+   specified in `spec/e2ee-v2.md`, and the gateway still advertises
+   `supported_e2ee_versions: ["2"]`.
+5. `transcript.ts` (upstream's one-call `verifyService` + verdict rendering) is not
+   vendored — `phalaSeal.ts` composes its own verdict and enclave identity.
 
 Everything else is byte-for-byte upstream. The crypto runs on `globalThis.crypto`
-(Web Crypto: X25519, HKDF, AES-GCM, Ed25519, `getRandomValues`). In privateer-agent
-(Node ≥ 22) these are all native — **no polyfills needed** (unlike the treeview RN app,
-which bridges them via `react-native-quick-crypto`). Re-pull from upstream to update;
-re-apply only the `.js`-extension strip.
-
-## What lives OUTSIDE this directory (and why)
-`../reportBinding.ts` — `verifyAciReportBinding`, the algorithm dispatch for §10.1
-checks 2–6. Callers use it instead of importing `verifyReportBinding` from here.
-
-Upstream's verifier is Web-Crypto-only, so it throws `UnsupportedAlgorithmError` on
-an `ecdsa-secp256k1` keyset endorsement — which §4.3 explicitly permits alongside
-ed25519, and which the deployed `inference.phala.com` gateway actually uses. Rather
-than patch this tree (and re-patch it on every re-pull), the dispatch sits outside:
-ed25519 delegates here verbatim, secp256k1 takes a parallel path over `@noble/curves`,
-and any other algorithm still throws. Nothing here changed, so the re-pull recipe
-above stays exactly the `.js`-extension strip.
-
-If upstream ever adds secp256k1 (or a check 7) to `report.ts`, collapse
-`reportBinding.ts` back to a straight re-export — `tests/phalaReportBinding.test.ts`
-pins the behaviour either way.
+(Web Crypto: X25519, HKDF, AES-GCM, Ed25519, SHA-384, `getRandomValues`). In
+privateer-agent (Node ≥ 22) these are all native — **no polyfills needed** (unlike
+the treeview RN app, which bridges them via `react-native-quick-crypto`).
+
+Re-pull recipe: copy `clients/verifier-ts/src/*.ts`, strip the `.js` extensions,
+then re-apply adaptations 2–5. `tests/phalaReportBinding.test.ts` pins the binding
+behaviour against a real report captured from the live gateway.

package/src/providers/phala/aci-verifier/crypto.ts

@@ -1,10 +1,11 @@
 /**
  * Cryptographic primitives, all via the Web Crypto API (`globalThis.crypto`) so
- * the same code runs in browsers and in Node 20+ with no third-party deps.
- * Only SHA-256 and Ed25519 verification are needed for Level 1.
+ * the same code runs in browsers and in Node 20+ with no dependencies. ACI's
+ * only signature algorithm is Ed25519 and its only hash is SHA-256 (spec
+ * Appendix B) — both are in Web Crypto, so nothing needs injecting.
  */
 
-import { AciFormatError, UnsupportedAlgorithmError } from './errors';
+import { AciFormatError } from './errors';
 
 const subtle = globalThis.crypto.subtle;
 
@@ -23,20 +24,45 @@ export function fromHex(hex: string): Uint8Array {
   }
   const out = new Uint8Array(h.length / 2);
   for (let i = 0; i < out.length; i++) {
-    const byte = Number.parseInt(h.substr(i * 2, 2), 16);
+    const byte = Number.parseInt(h.slice(i * 2, i * 2 + 2), 16);
     if (Number.isNaN(byte)) {
-      throw new AciFormatError(`invalid hex at offset ${i * 2}: "${h.substr(i * 2, 2)}"`);
+      throw new AciFormatError(`invalid hex at offset ${i * 2}: "${h.slice(i * 2, i * 2 + 2)}"`);
     }
     out[i] = byte;
   }
   return out;
 }
 
+/** Encode bytes as standard base64 (RFC 4648 §4, with padding) — the `_b64` field form (Appendix A). */
+export function toBase64(bytes: Uint8Array): string {
+  let bin = '';
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+
+/** Decode standard base64 to the exact underlying bytes. */
+export function fromBase64(b64: string): Uint8Array {
+  let bin: string;
+  try {
+    bin = atob(b64);
+  } catch {
+    throw new AciFormatError('invalid base64');
+  }
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
 /** SHA-256 of the given bytes. */
 export async function sha256(bytes: Uint8Array): Promise<Uint8Array> {
   return new Uint8Array(await subtle.digest('SHA-256', bytes as BufferSource));
 }
 
+/** SHA-384 of the given bytes — the dstack RTMR replay hash (§9.1 policy). */
+export async function sha384(bytes: Uint8Array): Promise<Uint8Array> {
+  return new Uint8Array(await subtle.digest('SHA-384', bytes as BufferSource));
+}
+
 /** Lowercase-hex SHA-256 of the given bytes. */
 export async function sha256Hex(bytes: Uint8Array): Promise<string> {
   return toHex(await sha256(bytes));
@@ -44,16 +70,16 @@ export async function sha256Hex(bytes: Uint8Array): Promise<string> {
 
 /**
  * `sha256:<lowercase-hex>` digest string of the given bytes — the ACI digest
- * form (§3) used for `workload_id`, keyset digests, and body hashes.
+ * form (Appendix A) used for keyset digests, body hashes, and session ids.
  */
 export async function sha256Prefixed(bytes: Uint8Array): Promise<string> {
   return 'sha256:' + (await sha256Hex(bytes));
 }
 
 /**
- * Verify an Ed25519 signature (RFC 8032, §4.3/§8.5) over `message`.
- * `publicKeyRaw` is the 32-byte raw key; `signature` the 64-byte value.
- * Returns false on a bad signature or malformed key — never throws for those.
+ * Verify an Ed25519 signature (RFC 8032) over `message`. `publicKeyRaw` is the
+ * 32-byte raw key; `signature` the 64-byte value. Returns false on a bad
+ * signature or malformed key — never throws for those.
  */
 export async function verifyEd25519(
   publicKeyRaw: Uint8Array,
@@ -75,21 +101,3 @@ export async function verifyEd25519(
     return false;
   }
 }
-
-/**
- * Verify a signature by ACI signature `algo`, dispatching on the algorithm the
- * attested keyset entry declares. Only `ed25519` is verifiable here; every other
- * algorithm (including `ecdsa-secp256k1`) raises {@link UnsupportedAlgorithmError}.
- */
-export async function verifySignature(
-  algo: string,
-  publicKeyRaw: Uint8Array,
-  signature: Uint8Array,
-  message: Uint8Array,
-  context: string,
-): Promise<boolean> {
-  if (algo === 'ed25519') {
-    return verifyEd25519(publicKeyRaw, signature, message);
-  }
-  throw new UnsupportedAlgorithmError(algo, context);
-}

package/src/providers/phala/aci-verifier/digest.ts

@@ -1,116 +1,52 @@
 /**
- * The ACI digest and canonical-signing-bytes constructions (§4.1, §4.2, §4.3,
- * §4.4, §4.7, §8.5, §9.2). Each returns the exact bytes/strings the spec pins in
- * spec/test-vectors.md, so they double as the byte-for-byte reference.
+ * The ACI digest constructions (Appendix A, §3.1, §3.2). Artifacts the service builds
+ * are hashed as the exact served bytes; the attestation statement is the one
+ * report payload a verifier constructs itself, as a fixed byte template whose
+ * inputs are restricted so no JSON escaping is ever needed.
  */
 
 import { jcsBytes } from './jcs';
-import type { JcsValue } from './jcs';
 import { sha256Hex, sha256Prefixed } from './crypto';
-import type { PublicKey, WorkloadKeyset, Receipt, SessionRecord } from './types';
+import { AciFormatError } from './errors';
 
-/**
- * `workload_id` — the stable name of a workload (§4.1):
- * `"sha256:" || hex(sha256(JCS(public_key)))`.
- */
-export async function computeWorkloadId(publicKey: PublicKey): Promise<string> {
-  return sha256Prefixed(jcsBytes({ algo: publicKey.algo, public_key: publicKey.public_key }));
-}
+const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
+const NONCE_RE = /^[0-9a-f]{64}$/;
 
-/**
- * `workload_keyset_digest` (§4.2): `"sha256:" || hex(sha256(JCS(keyset)))`,
- * over the whole keyset object as given.
- */
-export async function computeKeysetDigest(keyset: WorkloadKeyset): Promise<string> {
-  return sha256Prefixed(jcsBytes(keyset as JcsValue));
+/** `workload_keyset_digest` (§3.1): sha256 over the keyset's JCS form. */
+export async function computeKeysetDigest(keyset: unknown): Promise<string> {
+  return sha256Prefixed(jcsBytes(keyset));
 }
 
 /**
- * The attestation statement (§4.4) whose JCS is hashed into `report_data`.
- * `nonce` is the request's decoded value, or JSON `null` when the query
- * parameter was omitted (never the string `"null"`); pass `undefined`/`null` for
- * the omitted case.
+ * The exact attestation-statement bytes (§3.2) for a keyset digest and the
+ * nonce the client sent — `null`/`undefined` when the query parameter was
+ * omitted, which puts the JSON literal `null` in the template. Inputs outside
+ * the spec-pinned formats throw {@link AciFormatError}.
  */
 export function attestationStatement(
-  workloadId: string,
-  workloadKeysetDigest: string,
+  keysetDigest: string,
   nonce: string | null | undefined,
-): JcsValue {
-  return {
-    purpose: 'aci.report_data.v1',
-    workload_id: workloadId,
-    workload_keyset_digest: workloadKeysetDigest,
-    nonce: nonce ?? null,
-  };
+): Uint8Array {
+  if (!DIGEST_RE.test(keysetDigest)) {
+    throw new AciFormatError(`keyset digest is not sha256:<64-hex>: "${keysetDigest}"`);
+  }
+  if (nonce != null && !NONCE_RE.test(nonce)) {
+    throw new AciFormatError('nonce must be exactly 64 lowercase hex characters (§3.2)');
+  }
+  const noncePart = nonce == null ? 'null' : `"${nonce}"`;
+  return new TextEncoder().encode(
+    `{"keyset_digest":"${keysetDigest}","nonce":${noncePart},"purpose":"aci.report_data.v1"}`,
+  );
 }
 
 /**
- * `report_data` (§4.4): `hex(sha256(JCS(attestation_statement)))` — the raw
- * 32-byte digest as lowercase hex, with no `sha256:` prefix (it names a bare
- * report-data slot, not an ACI digest string).
+ * `report_data` (§3.2): SHA-256 of the attestation statement, as bare lowercase
+ * hex (it fills a report-data slot, not an ACI digest string). The TEE places
+ * these 32 bytes zero-padded to 64 in the quote's report-data field.
  */
 export async function computeReportData(
-  workloadId: string,
-  workloadKeysetDigest: string,
+  keysetDigest: string,
   nonce: string | null | undefined,
 ): Promise<string> {
-  return sha256Hex(jcsBytes(attestationStatement(workloadId, workloadKeysetDigest, nonce)));
-}
-
-/** JCS bytes of the keyset endorsement payload (§4.3), signed by the identity key. */
-export function keysetEndorsementPayload(workloadKeysetDigest: string): Uint8Array {
-  return jcsBytes({
-    purpose: 'aci.keyset.endorsement.v1',
-    workload_keyset_digest: workloadKeysetDigest,
-  });
-}
-
-/** JCS bytes of the keyset revocation payload (§4.7), signed by the identity key. */
-export function keysetRevocationPayload(workloadKeysetDigest: string): Uint8Array {
-  return jcsBytes({
-    purpose: 'aci.keyset.revocation.v1',
-    workload_keyset_digest: workloadKeysetDigest,
-  });
-}
-
-/**
- * Canonical bytes a receipt signature covers (§8.5): the JCS of the whole
- * receipt with only `signature.value` removed (`algo` and `key_id`, and any
- * other signature fields, are retained). Unknown top-level fields and events are
- * preserved by canonicalizing the object as given (§3.2).
- */
-export function receiptSigningBytes(receipt: Receipt): Uint8Array {
-  const { value: _omitted, ...signatureWithoutValue } = receipt.signature;
-  const forSigning: JcsValue = {
-    ...(receipt as unknown as { [k: string]: JcsValue }),
-    signature: signatureWithoutValue as unknown as JcsValue,
-  };
-  return jcsBytes(forSigning);
-}
-
-/**
- * The content-addressing material for a session id (§9.2). The wire record omits
- * absent optional fields; the material restores `endpoint`, `identity`, and
- * `evidence.digest` as JSON `null`, and timestamps / raw evidence bytes are
- * excluded entirely.
- */
-export function sessionMaterial(record: SessionRecord): JcsValue {
-  return {
-    upstream_name: record.upstream_name,
-    endpoint: record.endpoint ?? null,
-    verifier_id: record.verifier_id,
-    identity: record.identity ?? null,
-    channel_binding: record.channel_binding,
-    claims: record.claims,
-    evidence_digest: record.evidence?.digest ?? null,
-  };
-}
-
-/**
- * `session_id` (§9.2): `"as_" || hex(sha256(JCS(material)))`. Recomputing this
- * from a fetched record and comparing it to the id the signed receipt committed
- * to is what makes the session tamper-evident — there is no session signature.
- */
-export async function computeSessionId(record: SessionRecord): Promise<string> {
-  return 'as_' + (await sha256Hex(jcsBytes(sessionMaterial(record))));
+  return sha256Hex(attestationStatement(keysetDigest, nonce));
 }

package/src/providers/phala/aci-verifier/e2ee-channel.ts

@@ -41,7 +41,9 @@ export async function openE2eeChannel(
   if (!verification.ok || verification.workloadKeysetDigest !== report.workload_keyset_digest) {
     throw new Error('openE2eeChannel: report is not verified — call verifyReportBinding and check .ok');
   }
-  const keys = (report.attestation.workload_keyset.e2ee_public_keys ?? []) as Array<{
+  // Read the keys off the ESTABLISHED keyset — the object whose JCS the
+  // verifier hashed to the digest the quote signed — not the report's copy.
+  const keys = (verification.keyset?.e2ee_public_keys ?? []) as Array<{
     algo: string;
     public_key: string;
   }>;

package/src/providers/phala/aci-verifier/errors.ts

@@ -2,8 +2,7 @@
  * Errors raised by the verifier for conditions that are *not* ordinary
  * verification failures. A failed check (bad signature, wrong hash) is reported
  * as `ok: false` in the result objects — never thrown — so callers cannot ignore
- * it by forgetting a try/catch. These errors mean "the input is malformed or the
- * algorithm is outside this verifier's Level 1 / Web Crypto scope".
+ * it by forgetting a try/catch. These errors mean "the input is malformed".
  */
 
 /** Base class for every error this package throws. */
@@ -14,28 +13,10 @@ export class AciError extends Error {
   }
 }
 
-/** A JCS input violated the ACI subset (e.g. a non-integer number) or a hex/field value would not parse. */
+/** An input value would not parse (hex, base64, JSON) or violates a spec-pinned format. */
 export class AciFormatError extends AciError {
   constructor(message: string) {
     super(message);
     this.name = 'AciFormatError';
   }
 }
-
-/**
- * A signature or identity algorithm that ACI defines but this Web-Crypto-only
- * verifier cannot check. `ecdsa-secp256k1` is the expected case: the curve is
- * absent from the Web Crypto API, so verify it against the reference
- * implementation or a Level 2 verifier profile instead.
- */
-export class UnsupportedAlgorithmError extends AciError {
-  readonly algorithm: string;
-  constructor(algorithm: string, context: string) {
-    super(
-      `unsupported algorithm "${algorithm}" for ${context}: this verifier supports only ed25519 via the Web Crypto API. ` +
-        `secp256k1 is out of scope — verify it against the reference implementation or a Level 2 profile.`,
-    );
-    this.name = 'UnsupportedAlgorithmError';
-    this.algorithm = algorithm;
-  }
-}

package/src/providers/phala/aci-verifier/index.ts

@@ -1,43 +1,39 @@
 /**
- * @dstack/aci-verifier — a zero-dependency ACI Level 1 verifier.
+ * @phala/aci-verifier — a zero-dependency ACI verifier for the browser and node.
  *
- * Level 1 (receipt verification, §10.2) is fully implemented against an
- * established keyset. {@link verifyReportBinding} adds the cryptographic-binding
- * checks of Level 2 (§10.1 checks 2–6); the hardware quote, key custody, and
- * provenance checks (§10.1 checks 1, 7–10) are verifier-profile territory and
- * out of scope here. All crypto is Web Crypto (Ed25519, SHA-256); `ecdsa-secp256k1`
- * is unsupported (not in the Web Crypto API) and raises a clear error.
+ * Report binding (§9.1 checks 2–3) establishes the workload keyset: the served
+ * keyset canonicalizes to the digest the attestation statement hashes into
+ * `report_data`, which the hardware quote signs. Everything downstream — the
+ * E2EE key we seal to, receipt signing keys, TLS pins — is a member of that one
+ * quote-bound object, so nothing else needs its own signature. Receipt
+ * verification (§9.3) runs against an established keyset. All crypto here is
+ * Web Crypto (Ed25519, SHA-256/384); the quote itself is ../../phalaSeal.ts.
  */
 
-// Canonicalization (§3)
+// Canonicalization (Appendix A)
 export { canonicalize, jcsBytes } from './jcs';
 export type { JcsValue } from './jcs';
 
 // Crypto primitives (Web Crypto only)
 export {
   sha256,
+  sha384,
   sha256Hex,
   sha256Prefixed,
   verifyEd25519,
-  verifySignature,
   toHex,
   fromHex,
+  toBase64,
+  fromBase64,
 } from './crypto';
 
-// Digest & canonical-signing-bytes constructions (§4, §8.5, §9.2)
-export {
-  computeWorkloadId,
-  computeKeysetDigest,
-  attestationStatement,
-  computeReportData,
-  keysetEndorsementPayload,
-  keysetRevocationPayload,
-  receiptSigningBytes,
-  sessionMaterial,
-  computeSessionId,
-} from './digest';
+// Digest constructions (Appendix A, §3.1, §3.2)
+export { computeKeysetDigest, attestationStatement, computeReportData } from './digest';
+
+// Attested sessions: content addressing and evidence (§8, §9.3)
+export { computeSessionId, checkSessionApiVersion, checkSessionEvidence } from './session';
 
-// E2EE AAD builders (§7.3)
+// E2EE v2 AAD builders (spec/e2ee-v2.md §6)
 export {
   requestAad,
   requestAadString,
@@ -46,39 +42,37 @@ export {
 } from './e2ee';
 export type { AadCommon } from './e2ee';
 
-// E2EE channel to a verified workload — encrypt requests, decrypt replies (§7)
+// E2EE v2 channel to a verified workload — encrypt requests, decrypt replies
 export { openE2eeChannel } from './e2ee-channel';
 export type { E2eeChannel } from './e2ee-channel';
 
-// Level 1 receipt verification (§10.2)
+// Receipt verification (§9.3)
 export {
   verifyReceipt,
   findEvent,
   hashBody,
   checkRequestBodyHash,
-  checkResponseWireHash,
-  checkResponseCleartextHash,
+  checkResponseBodyHash,
 } from './receipt';
 
-// Level 2 report-binding checks (§10.1 checks 2–6, no hardware quote)
+// Report binding (§9.1 checks 2–3)
 export { verifyReportBinding } from './report';
 export type { ReportBindingOptions } from './report';
 
 // Errors
-export { AciError, AciFormatError, UnsupportedAlgorithmError } from './errors';
+export { AciError, AciFormatError } from './errors';
 
 // Wire & result types
 export type {
-  PublicKey,
-  WorkloadIdentity,
-  ReceiptSigningKey,
+  KeysetKey,
+  TlsKeyPin,
   WorkloadKeyset,
-  ReceiptSignature,
-  ReceiptEvent,
-  Receipt,
-  Endorsement,
+  SourceProvenance,
   Attestation,
   AttestationReport,
+  ReceiptEnvelope,
+  ReceiptEvent,
+  ReceiptPayload,
   SessionEvidence,
   SessionRecord,
   Check,

package/src/providers/phala/aci-verifier/jcs.ts

@@ -63,7 +63,12 @@ function serializeObject(obj: { [key: string]: JcsValue | undefined }): string {
   return out + '}';
 }
 
-/** Canonicalize and encode to UTF-8 bytes — the form fed to SHA-256 and signatures. */
-export function jcsBytes(value: JcsValue): Uint8Array {
-  return new TextEncoder().encode(canonicalize(value));
+/**
+ * Canonicalize and encode to UTF-8 bytes — the form fed to SHA-256 and
+ * signatures. Takes `unknown` because the values that get canonicalized are
+ * parsed server JSON (a keyset, a receipt document); anything outside the ACI
+ * subset is rejected by {@link canonicalize} rather than mis-serialized.
+ */
+export function jcsBytes(value: unknown): Uint8Array {
+  return new TextEncoder().encode(canonicalize(value as JcsValue));
 }