privateer-agent 0.6.10 → 0.8.0

package/src/{daemon → harbor}/service.ts

@@ -1,28 +1,35 @@
-// Install the resident daemon as a per-user OS service so it auto-starts at login
+// Install the resident harbor as a per-user OS service so it auto-starts at login
 // and survives the terminal closing — the difference between "the CLI is running"
-// and "the daemon is reachable from the app even when no CLI is". macOS → launchd
+// and "the harbor is reachable from the app even when no CLI is". macOS → launchd
 // user agent; Linux → systemd --user unit. No root: everything lives under the
 // user's own home and login session.
 //
 // ORDERING NOTE: this module is import-safe (node builtins + our paths only, no Pi),
-// so the daemon CLI can load it without going through boot.ts.
+// so the harbor CLI can load it without going through boot.ts.
 import { existsSync, mkdirSync, writeFileSync, rmSync, readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { join, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { globalDir } from "../config/paths.ts";
-import { daemonIsRunning } from "./ipc.ts";
+import { harborIsRunning } from "./ipc.ts";
 
-const LABEL = "pro.privateer.daemon"; // launchd label / reverse-dns id
-const UNIT = "privateer-daemon.service"; // systemd --user unit name
+const LABEL = "pro.privateer.harbor"; // launchd label / reverse-dns id
+const UNIT = "privateer-harbor.service"; // systemd --user unit name
 
-// Absolute path to the node launcher that boots + runs the daemon (bin/privateer-daemon.mjs).
+// Pre-rename service identity ("daemon"). Kept ONLY so install/uninstall can evict a
+// service a user installed before the harbor rename — otherwise it lingers as an
+// orphaned launchd agent / systemd unit still running the old launcher. Never written,
+// only torn down.
+const OLD_LABEL = "pro.privateer.daemon";
+const OLD_UNIT = "privateer-daemon.service";
+
+// Absolute path to the node launcher that boots + runs the harbor (bin/privateer-harbor.mjs).
 // Resolved from THIS module so it's correct for both a dev checkout and a global npm
-// install (…/node_modules/privateer-agent/bin/privateer-daemon.mjs).
-function daemonLauncherPath(): string {
-  const here = dirname(fileURLToPath(import.meta.url)); // …/src/daemon
-  return resolve(here, "../../bin/privateer-daemon.mjs");
+// install (…/node_modules/privateer-agent/bin/privateer-harbor.mjs).
+function harborLauncherPath(): string {
+  const here = dirname(fileURLToPath(import.meta.url)); // …/src/harbor
+  return resolve(here, "../../bin/privateer-harbor.mjs");
 }
 
 // The node binary to bake into the unit. We use the CURRENT interpreter (>=22, the
@@ -32,12 +39,12 @@ function nodeBinaryPath(): string {
   return process.execPath;
 }
 
-function daemonLogPath(): string {
-  return join(globalDir(), "daemon.log");
+function harborLogPath(): string {
+  return join(globalDir(), "harbor.log");
 }
 
 // Env we forward into the service so a non-default home / server URL survives. Kept
-// tiny and explicit — the daemon reads the rest from ~/.privateer.
+// tiny and explicit — the harbor reads the rest from ~/.privateer.
 function forwardedEnv(): Record<string, string> {
   const env: Record<string, string> = {};
   if (process.env.PRIVATEER_HOME) env.PRIVATEER_HOME = process.env.PRIVATEER_HOME;
@@ -56,13 +63,13 @@ function xmlEscape(s: string): string {
 }
 
 function launchdPlist(): string {
-  const args = [nodeBinaryPath(), daemonLauncherPath(), "run"];
+  const args = [nodeBinaryPath(), harborLauncherPath(), "run"];
   const envVars = forwardedEnv();
   const argXml = args.map((a) => `    <string>${xmlEscape(a)}</string>`).join("\n");
   const envXml = Object.entries(envVars)
     .map(([k, v]) => `    <key>${xmlEscape(k)}</key>\n    <string>${xmlEscape(v)}</string>`)
     .join("\n");
-  const log = xmlEscape(daemonLogPath());
+  const log = xmlEscape(harborLogPath());
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -86,7 +93,18 @@ ${envVars.PRIVATEER_HOME || envVars.PRIVATEER_SERVER_URL ? `  <key>EnvironmentVa
 `;
 }
 
+// Evict a pre-rename launchd agent (pro.privateer.daemon) if one is installed, so the
+// harbor rename doesn't leave the old service running the old launcher alongside it.
+function evictOldLaunchd(): void {
+  const oldPlist = join(homedir(), "Library", "LaunchAgents", `${OLD_LABEL}.plist`);
+  if (existsSync(oldPlist)) {
+    spawnSync("launchctl", ["unload", "-w", oldPlist], { stdio: "ignore" });
+    rmSync(oldPlist, { force: true });
+  }
+}
+
 function installLaunchd(): void {
+  evictOldLaunchd();
   const plist = launchAgentPath();
   mkdirSync(dirname(plist), { recursive: true });
   writeFileSync(plist, launchdPlist());
@@ -100,6 +118,7 @@ function installLaunchd(): void {
 }
 
 function uninstallLaunchd(): void {
+  evictOldLaunchd();
   const plist = launchAgentPath();
   if (existsSync(plist)) {
     spawnSync("launchctl", ["unload", "-w", plist], { stdio: "ignore" });
@@ -115,12 +134,12 @@ function systemdUnitPath(): string {
 }
 
 function systemdUnit(): string {
-  const exec = [nodeBinaryPath(), daemonLauncherPath(), "run"].map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ");
+  const exec = [nodeBinaryPath(), harborLauncherPath(), "run"].map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ");
   const envLines = Object.entries(forwardedEnv())
     .map(([k, v]) => `Environment=${k}=${v}`)
     .join("\n");
   return `[Unit]
-Description=Privateer resident agent daemon (routines + app-driven task spawns)
+Description=Privateer resident agent harbor (routines + app-driven task spawns)
 After=network-online.target
 Wants=network-online.target
 
@@ -136,7 +155,20 @@ WantedBy=default.target
 `;
 }
 
+// Evict a pre-rename systemd --user unit (privateer-daemon.service) if present, so the
+// harbor rename doesn't leave the old unit enabled alongside the new one.
+function evictOldSystemd(): void {
+  const base = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  const oldUnit = join(base, "systemd", "user", OLD_UNIT);
+  if (existsSync(oldUnit)) {
+    spawnSync("systemctl", ["--user", "disable", "--now", OLD_UNIT], { stdio: "ignore" });
+    rmSync(oldUnit, { force: true });
+    spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
+  }
+}
+
 function installSystemd(): void {
+  evictOldSystemd();
   const unit = systemdUnitPath();
   mkdirSync(dirname(unit), { recursive: true });
   writeFileSync(unit, systemdUnit());
@@ -152,6 +184,7 @@ function installSystemd(): void {
 }
 
 function uninstallSystemd(): void {
+  evictOldSystemd();
   const unit = systemdUnitPath();
   spawnSync("systemctl", ["--user", "disable", "--now", UNIT], { stdio: "ignore" });
   if (existsSync(unit)) rmSync(unit, { force: true });
@@ -182,7 +215,7 @@ export function serviceInfo(): ServiceInfo {
     supported: platform === "darwin" || platform === "linux",
     installed: !!unitPath && existsSync(unitPath),
     unitPath,
-    logPath: daemonLogPath(),
+    logPath: harborLogPath(),
   };
 }
 
@@ -191,7 +224,7 @@ export function installService(): ServiceInfo {
   const platform = process.platform;
   if (platform === "darwin") installLaunchd();
   else if (platform === "linux") installSystemd();
-  else throw new Error(`Auto-start isn't supported on ${platform}. Run \`privateer daemon\` yourself, or keep a terminal open.`);
+  else throw new Error(`Auto-start isn't supported on ${platform}. Run \`privateer harbor\` yourself, or keep a terminal open.`);
   return serviceInfo();
 }
 
@@ -203,15 +236,15 @@ export function uninstallService(): ServiceInfo {
   return serviceInfo();
 }
 
-// Human-readable status line for `privateer daemon status`: whether the service is
-// installed AND whether a daemon is actually answering on the IPC socket right now.
+// Human-readable status line for `privateer harbor status`: whether the service is
+// installed AND whether a harbor is actually answering on the IPC socket right now.
 export async function statusReport(): Promise<string> {
   const info = serviceInfo();
-  const live = await daemonIsRunning();
+  const live = await harborIsRunning();
   const lines = [
-    `platform:  ${info.platform}${info.supported ? "" : " (auto-start unsupported — run `privateer daemon` manually)"}`,
+    `platform:  ${info.platform}${info.supported ? "" : " (auto-start unsupported — run `privateer harbor` manually)"}`,
     `service:   ${info.installed ? `installed (${info.unitPath})` : "not installed"}`,
-    `daemon:    ${live ? "running (answering IPC)" : "not reachable"}`,
+    `harbor:    ${live ? "running (answering IPC)" : "not reachable"}`,
     `logs:      ${info.logPath}`,
   ];
   // Surface a stale-unit hint: file present but nothing answering usually means it
@@ -220,11 +253,11 @@ export async function statusReport(): Promise<string> {
   return lines.join("\n");
 }
 
-// Best-effort read of the tail of the daemon log (for a `status --log` affordance or
+// Best-effort read of the tail of the harbor log (for a `status --log` affordance or
 // error surfacing). Returns "" if absent.
-export function tailDaemonLog(maxBytes = 4_000): string {
+export function tailHarborLog(maxBytes = 4_000): string {
   try {
-    const buf = readFileSync(daemonLogPath(), "utf8");
+    const buf = readFileSync(harborLogPath(), "utf8");
     return buf.length > maxBytes ? buf.slice(buf.length - maxBytes) : buf;
   } catch {
     return "";

package/src/main.ts

@@ -4,7 +4,7 @@
 //
 // Phase 1 skeleton: this prints the resolved boot state so `npm start` proves
 // the boot chain end-to-end (env pinned, dispatcher installed) without a TUI.
-// Phases 4/6 replace the body with the daemon/relay wiring and the pi-tui app.
+// Phases 4/6 replace the body with the harbor/relay wiring and the pi-tui app.
 
 import "./boot.ts";
 

package/src/mcp/catalog.ts

@@ -130,6 +130,112 @@ export const MCP_CATALOG: CatalogEntry[] = [
     args: ["-y", "@modelcontextprotocol/server-memory"],
     needs: "none",
   },
+
+  // ── Remote, browser-authorized (OAuth) ──────────────────────────────────────
+  {
+    id: "sentry",
+    name: "sentry",
+    label: "Sentry",
+    blurb: "Errors, issues, and releases. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.sentry.dev/mcp",
+    oauth: true,
+    needs: "oauth",
+  },
+  {
+    id: "atlassian",
+    name: "atlassian",
+    label: "Jira & Confluence",
+    blurb: "Atlassian issues and pages. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.atlassian.com/v1/sse",
+    oauth: true,
+    needs: "oauth",
+  },
+  {
+    id: "stripe",
+    name: "stripe",
+    label: "Stripe",
+    blurb: "Payments, customers, and invoices. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.stripe.com",
+    oauth: true,
+    needs: "oauth",
+  },
+  {
+    id: "asana",
+    name: "asana",
+    label: "Asana",
+    blurb: "Tasks and projects. Sign in via browser.",
+    transport: "http",
+    url: "https://mcp.asana.com/sse",
+    oauth: true,
+    needs: "oauth",
+  },
+
+  // ── Local, token-authorized ─────────────────────────────────────────────────
+  {
+    id: "brave-search",
+    name: "brave-search",
+    label: "Brave Search",
+    blurb: "Web and local search results.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-brave-search"],
+    env: { BRAVE_API_KEY: "" },
+    needs: "token",
+    fill: "BRAVE_API_KEY",
+    credUrl: "https://brave.com/search/api/",
+  },
+  {
+    id: "google-maps",
+    name: "google-maps",
+    label: "Google Maps",
+    blurb: "Places, directions, and geocoding.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-google-maps"],
+    env: { GOOGLE_MAPS_API_KEY: "" },
+    needs: "token",
+    fill: "GOOGLE_MAPS_API_KEY",
+    credUrl: "https://console.cloud.google.com/google/maps-apis/credentials",
+  },
+  {
+    id: "supabase",
+    name: "supabase",
+    label: "Supabase",
+    blurb: "Query and manage your Supabase project.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@supabase/mcp-server-supabase@latest"],
+    env: { SUPABASE_ACCESS_TOKEN: "" },
+    needs: "token",
+    fill: "SUPABASE_ACCESS_TOKEN",
+    credUrl: "https://supabase.com/dashboard/account/tokens",
+  },
+  {
+    id: "figma",
+    name: "figma",
+    label: "Figma",
+    blurb: "Read designs, frames, and components.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "figma-developer-mcp", "--stdio"],
+    env: { FIGMA_API_KEY: "" },
+    needs: "token",
+    fill: "FIGMA_API_KEY",
+    credUrl: "https://www.figma.com/developers/api#access-tokens",
+  },
+  {
+    id: "sequential-thinking",
+    name: "sequential-thinking",
+    label: "Sequential Thinking",
+    blurb: "A step-by-step reasoning scratchpad.",
+    transport: "stdio",
+    command: "npx",
+    args: ["-y", "@modelcontextprotocol/server-sequential-thinking"],
+    needs: "none",
+  },
 ];
 
 export function catalogEntry(id: string): CatalogEntry | undefined {

package/src/providers/account.ts

@@ -22,6 +22,13 @@ import {
 } from "../auth/privateer.ts";
 import { interpretReport, teePosture, tierFromTeePosture, type PrivacyTier } from "pi-privacy";
 import { ACCOUNT_DEFAULT_MODEL_ID, ACCOUNT_NEAR_MODEL_ID, ensurePiDefaultModel } from "./defaultModel.ts";
+import {
+  sealedEnabled,
+  sealedProviderFor,
+  sealedShimBase,
+  ensureSealedShim,
+  attestSealed,
+} from "./sealedShim.ts";
 
 // Seed/fallback catalog: registered synchronously so the account provider has real
 // models the instant it loads (before the live /api/models fetch resolves) — in
@@ -73,7 +80,9 @@ const VALID_TIERS = new Set<PrivacyTier>([
 // upgrades it to tee-verified live via attestation (accountPosture). Everything
 // else with no server signal is "standard": we don't assert ZDR we can't back.
 function tierFromPrefix(modelId: string): PrivacyTier {
-  return modelId.startsWith("near/") || modelId.startsWith("tinfoil/") ? "tee-unverified" : "standard";
+  return modelId.startsWith("near/") || modelId.startsWith("tinfoil/") || modelId.startsWith("phala/")
+    ? "tee-unverified"
+    : "standard";
 }
 
 function normalizeTier(tier: string | undefined, modelId: string): PrivacyTier {
@@ -248,13 +257,26 @@ export async function accountPosture(modelId: string): Promise<AccountPosture> {
   if (privateerChannel(modelId) === "zdr") {
     return { tier: "zdr-policy" };
   }
-  // Honest labelling for the non-NEAR enclaves. Tinfoil and Phala publish real
-  // attestations, but the server proxies the inference, so from here we cannot bind a
-  // quote to the connection actually carrying our tokens — only the account's word
-  // that it did. That's `tee-unverified` (yellow "confidential compute, unconfirmed"),
-  // never the green tee-verified we reserve for a quote we checked ourselves. A user
-  // who wants the verified shield sets TINFOIL_API_KEY and runs `tinfoil/*` direct,
-  // where pi-privacy attests the enclave client-side.
+  // Sealed (EHBP) path. When sealed mode is on and the model has a Node sealed
+  // client (tinfoil/*), inference goes through the blind relay with the body
+  // HPKE-sealed to the enclave, and we attest that enclave client-side with the SAME
+  // SecureClient that carries the tokens. A green ready() is a quote WE checked,
+  // bound to the HPKE key we seal to — so it earns tee-verified. A failure stays
+  // tee-unverified with the reason surfaced (never a silent green). See
+  // docs/tee-privateer-tinfoil-ehbp.md.
+  const sealedProvider = sealedEnabled() ? sealedProviderFor(modelId) : null;
+  if (sealedProvider) {
+    const att = await attestSealed(sealedProvider);
+    return att.ok ? { tier: "tee-verified" } : { tier: "tee-unverified", error: att.error };
+  }
+  // Honest labelling for the non-NEAR enclaves without sealed mode. Tinfoil and Phala
+  // publish real attestations, but the server proxies the inference in cleartext, so
+  // from here we cannot bind a quote to the connection actually carrying our tokens —
+  // only the account's word that it did. That's `tee-unverified` (yellow "confidential
+  // compute, unconfirmed"), never the green tee-verified we reserve for a quote we
+  // checked ourselves. Turn on sealed mode (PRIVATEER_SEALED=1) for the verified
+  // shield, or set TINFOIL_API_KEY and run `tinfoil/*` direct (pi-privacy attests
+  // client-side over the TLS binding).
   if (!modelId.startsWith("near/")) {
     return { tier: "tee-unverified" };
   }
@@ -299,15 +321,40 @@ export function makeAccountProvider() {
     on?: (event: string, handler: (e: unknown, ctx: unknown) => void) => void;
   }): void => {
     if (typeof pi.registerProvider !== "function") return;
-    const register = (ids: string[]): void =>
+    // A model entry, with a per-model baseUrl override for sealed models once the
+    // EHBP shim is listening: `tinfoil/*` then route through the loopback shim (which
+    // seals to the blind relay) instead of the cleartext `/api/agent/v1` proxy.
+    // Everything else keeps the provider baseUrl below. Until the shim is up (or when
+    // sealed mode is off) sealed models fall back to the cleartext path — and the
+    // badge stays honestly `tee-unverified` (see accountPosture).
+    const modelEntry = (id: string) => {
+      const base = seedModel(id);
+      const provider = sealedEnabled() ? sealedProviderFor(id) : null;
+      const shim = sealedShimBase();
+      return provider && shim ? { ...base, baseUrl: `${shim}/${provider}/v1` } : base;
+    };
+    let lastIds: string[] = DEFAULT_MODELS;
+    const register = (ids: string[]): void => {
+      lastIds = ids;
       pi.registerProvider!("privateer", {
         name: "Privateer account",
         baseUrl: `${serverBaseUrl()}/api/agent/v1`,
         api: "openai-completions",
         oauth: privateerOAuthProvider,
-        models: ids.map(seedModel),
+        models: ids.map(modelEntry),
       });
+    };
     register(DEFAULT_MODELS); // immediate: provider exists this tick
+    // Bring up the sealed shim, then re-register so sealed models pick up their shim
+    // baseUrl. Registration re-runs anyway after the catalog fetch; this just makes
+    // sure the switch lands even if the fetch is slow or fails.
+    if (sealedEnabled()) {
+      void ensureSealedShim()
+        .then(() => register(lastIds))
+        .catch(() => {
+          /* shim failed to start → sealed models stay on the cleartext path */
+        });
+    }
     // Refine to the live catalog. fetchAccountCatalog also populates accountTierMap
     // as a side effect, so the /models picker can shield each row without re-fetching.
     void fetchAccountCatalog()
@@ -322,7 +369,7 @@ export function makeAccountProvider() {
     // auth.json entry (see the LIFECYCLE HAZARD note in src/auth/privateer.ts). So a
     // signed-in user who quits and relaunches lands on privateer/* with no key at
     // all, and the first prompt dead-ends on "No API key found for privateer." — even
-    // though the banner says "connected". The REPL (cli/chat.ts) and the daemon
+    // though the banner says "connected". The REPL (cli/chat.ts) and the harbor
     // already spawn one at startup; this gives the TUI the same seed.
     pi.on?.("session_start", (_e, ctx) => void armAccountCredential(ctx));
   };

package/src/providers/catalog.ts

@@ -2,9 +2,9 @@
 // becomes reachable under Pi. Written after verifying (2026-07-07) that:
 //   - pi-ai ships STATIC model catalogs for its 14 built-in providers, so they're
 //     selectable once a key is present — privateer emits NO models.json entry for them;
-//   - the `pi-privacy` extension registers the 6 privacy providers (tinfoil, nearai,
-//     venice, ollama, custom, privateer-api) at load — privateer emits NO entry for
-//     them either;
+//   - the `pi-privacy` extension registers the privacy providers (tinfoil, nearai,
+//     venice, ollama, and — since pi-privacy 0.7 — `privateer`, its posture-aware
+//     public dev-key surface) at load — privateer emits NO entry for them either;
 //   - so the ONLY provider this generator must emit is `qwen` (config-only,
 //     non-privacy, no built-in catalog), and `privateer` (the account OAuth channel)
 //     is handled in code, not config (Phase 4).
@@ -66,9 +66,11 @@ export const PROVIDERS: ProviderEntry[] = [
   { id: "tinfoil", source: "pi-privacy" },
   { id: "venice", source: "pi-privacy" },
   { id: "custom", source: "pi-privacy" },
-  // Public developer-API surface (sk-priv-… key). Registered by the pi-privacy
-  // extension like the others; distinct from the in-app `privateer` account channel.
-  { id: "privateer-api", source: "pi-privacy" },
+  // The in-app account OAuth channel. NOTE: since pi-privacy 0.7 the extension ALSO
+  // registers a `privateer` provider (its posture-aware public sk-priv- dev-key surface,
+  // floored to zdr-policy) — but makeAccountProvider runs AFTER pi-privacy in the
+  // extension list and re-registers the same id, so the account channel wins. There is
+  // no longer a separate `privateer-api` id (renamed to `privateer` upstream).
   { id: "privateer", source: "account" },
 ];
 

package/src/providers/defaultModel.ts

@@ -1,6 +1,6 @@
 // The single source of truth for "which model do we default to?" — shared by every
 // entry point that has to pick a model when the user hasn't named one: the REPL
-// (cli/chat.ts), the daemon (routines), the channels runner, and the login-time hook
+// (cli/chat.ts), the harbor (routines), the channels runner, and the login-time hook
 // that seeds Pi's TUI default (ensurePiDefaultModel).
 //
 // The bug this fixes: each of those sites used to hardcode `openrouter/openai/gpt-4o-

package/src/providers/phala/aci-verifier/VENDORED.md

@@ -0,0 +1,23 @@
+# Vendored: `@dstack/aci-verifier`
+
+Faithful copy of the zero-dependency TypeScript ACI verifier from
+[Dstack-TEE/private-ai-gateway](https://github.com/Dstack-TEE/private-ai-gateway)
+(`clients/verifier-ts/src`), Apache-2.0. It is `private: true` upstream (not on
+npm), so it is vendored here rather than installed.
+
+Provides the pieces `PhalaProvider` needs:
+- **`verifyReportBinding`** (`report.ts`) — §10.1 checks 2–6 (crypto binding of the
+  attestation report to the attested keyset for a supplied nonce). NOT the hardware
+  TDX quote (check 1) — that is layered on with `@phala/dcap-qvl` in the provider.
+- **`openE2eeChannel`** (`e2ee-channel.ts`) — the ACI E2EE channel:
+  `x25519-aes-256-gcm-hkdf-sha256`, per-field seal/open, `X-E2EE-*` headers.
+
+## Local adaptation (the only change from upstream)
+- Relative import specifiers had their `.js` extension stripped (`'./jcs.js'` →
+  `'./jcs'`) so Metro + TS (`moduleResolution: bundler`) resolve to the `.ts` files.
+
+Everything else is byte-for-byte upstream. The crypto runs on `globalThis.crypto`
+(Web Crypto: X25519, HKDF, AES-GCM, Ed25519, `getRandomValues`). In privateer-agent
+(Node ≥ 22) these are all native — **no polyfills needed** (unlike the treeview RN app,
+which bridges them via `react-native-quick-crypto`). Re-pull from upstream to update;
+re-apply only the `.js`-extension strip.

package/src/providers/phala/aci-verifier/crypto.ts

@@ -0,0 +1,95 @@
+/**
+ * Cryptographic primitives, all via the Web Crypto API (`globalThis.crypto`) so
+ * the same code runs in browsers and in Node 20+ with no third-party deps.
+ * Only SHA-256 and Ed25519 verification are needed for Level 1.
+ */
+
+import { AciFormatError, UnsupportedAlgorithmError } from './errors';
+
+const subtle = globalThis.crypto.subtle;
+
+/** Lowercase-hex encode bytes. */
+export function toHex(bytes: Uint8Array): string {
+  let out = '';
+  for (const b of bytes) out += b.toString(16).padStart(2, '0');
+  return out;
+}
+
+/** Decode hex (optionally `0x`-prefixed) to bytes. */
+export function fromHex(hex: string): Uint8Array {
+  const h = hex.startsWith('0x') || hex.startsWith('0X') ? hex.slice(2) : hex;
+  if (h.length % 2 !== 0) {
+    throw new AciFormatError(`hex string has odd length: ${hex.length} chars`);
+  }
+  const out = new Uint8Array(h.length / 2);
+  for (let i = 0; i < out.length; i++) {
+    const byte = Number.parseInt(h.substr(i * 2, 2), 16);
+    if (Number.isNaN(byte)) {
+      throw new AciFormatError(`invalid hex at offset ${i * 2}: "${h.substr(i * 2, 2)}"`);
+    }
+    out[i] = byte;
+  }
+  return out;
+}
+
+/** SHA-256 of the given bytes. */
+export async function sha256(bytes: Uint8Array): Promise<Uint8Array> {
+  return new Uint8Array(await subtle.digest('SHA-256', bytes as BufferSource));
+}
+
+/** Lowercase-hex SHA-256 of the given bytes. */
+export async function sha256Hex(bytes: Uint8Array): Promise<string> {
+  return toHex(await sha256(bytes));
+}
+
+/**
+ * `sha256:<lowercase-hex>` digest string of the given bytes — the ACI digest
+ * form (§3) used for `workload_id`, keyset digests, and body hashes.
+ */
+export async function sha256Prefixed(bytes: Uint8Array): Promise<string> {
+  return 'sha256:' + (await sha256Hex(bytes));
+}
+
+/**
+ * Verify an Ed25519 signature (RFC 8032, §4.3/§8.5) over `message`.
+ * `publicKeyRaw` is the 32-byte raw key; `signature` the 64-byte value.
+ * Returns false on a bad signature or malformed key — never throws for those.
+ */
+export async function verifyEd25519(
+  publicKeyRaw: Uint8Array,
+  signature: Uint8Array,
+  message: Uint8Array,
+): Promise<boolean> {
+  let key: CryptoKey;
+  try {
+    key = await subtle.importKey('raw', publicKeyRaw as BufferSource, { name: 'Ed25519' }, false, [
+      'verify',
+    ]);
+  } catch {
+    // A key that will not import cannot verify anything.
+    return false;
+  }
+  try {
+    return await subtle.verify({ name: 'Ed25519' }, key, signature as BufferSource, message as BufferSource);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Verify a signature by ACI signature `algo`, dispatching on the algorithm the
+ * attested keyset entry declares. Only `ed25519` is verifiable here; every other
+ * algorithm (including `ecdsa-secp256k1`) raises {@link UnsupportedAlgorithmError}.
+ */
+export async function verifySignature(
+  algo: string,
+  publicKeyRaw: Uint8Array,
+  signature: Uint8Array,
+  message: Uint8Array,
+  context: string,
+): Promise<boolean> {
+  if (algo === 'ed25519') {
+    return verifyEd25519(publicKeyRaw, signature, message);
+  }
+  throw new UnsupportedAlgorithmError(algo, context);
+}