zk-credits 0.2.3 → 0.2.5

package/README.md

@@ -7,7 +7,7 @@ are founder-provisioned test credits, and the circuit is not independently
 audited.
 
 ```bash
-npm install --global zk-credits@0.2.3
+npm install --global zk-credits@0.2.5
 ```
 
 ## Pinned pilot versions
@@ -17,11 +17,11 @@ not mix versions between the sidecar, the adapter package, and the gateway:
 
 | Package | Version |
 | --- | --- |
-| `zk-credits` (this sidecar) | `0.2.3` |
+| `zk-credits` (this sidecar) | `0.2.5` |
 | `@zk-credits/x402-zk-prepaid` (adapter) | `0.1.0` |
 | `@zk-credits/shared` | `0.1.0` |
 
-The pinned Base Sepolia trial version is `0.2.3`. It uses the non-streaming
+The pinned Base Sepolia trial version is `0.2.5`. It uses the non-streaming
 `POST /v1/chat/completions` path below, includes the loopback Responses bridge
 for Codex, and acquires the pinned private proving bundle through the local
 GitHub CLI session. It also synchronizes V2 Base events and checks the gateway
@@ -79,9 +79,11 @@ still receives the class. A rejected request consumes no credit.
    owner-only permissions. Missing GitHub access or any mismatch stops setup.
    It syncs public Base events from the pinned V2 bond and deployment block,
    validates that the resulting witness resolves the activated credential,
-   and asks the gateway whether the resulting root is known. The witness and
-   event cache remain local. The package does not accept a supplied witness
-   file for this V2 deployment.
+   and asks the gateway's public `POST /v1/root-known` endpoint whether the
+   resulting root is known. This check sends no admin token and returns only
+   `{ "known": boolean }`; the protected admin endpoints remain unavailable
+   to setup. The witness and event cache remain local. The package does not
+   accept a supplied witness file for this V2 deployment.
 
    The package ships `circuits/manifest.json`, which fixes the immutable
    release identity, the SHA-256 of the archive and each proving artifact, and
@@ -104,7 +106,8 @@ still receives the class. A rejected request consumes no credit.
    zk-credits setup codex
    ```
 
-   Then run `zk-credits codex` to open Codex with the local sidecar.
+   No gateway admin token is required. Then run `zk-credits codex` to open
+   Codex with the local sidecar.
 
 The sidecar binds `127.0.0.1:3210` only. It does not modify `~/.cline` or
 `~/.codex`.

package/dist/cli.js

@@ -24,6 +24,7 @@ import { createSidecarServer } from './sidecar.js';
 import { runBaseRegisteredTrialExchange } from './base-registered-trial.js';
 import { loadCircuitManifest } from './artifact-bundle.js';
 import { BASE_SEPOLIA_NETWORK } from '@zk-credits/x402-zk-prepaid';
+import { requireGatewayKnownRoot as checkGatewayKnownRoot } from './gateway-root-check.js';
 const DEFAULT_GATEWAY_URL = 'https://zk-credits-gateway.onrender.com';
 const DEFAULT_PORT = 3210;
 function stateDirectory() {
@@ -260,36 +261,7 @@ async function readGatewayJson(url, headers) {
     }
 }
 async function requireGatewayKnownRoot(root) {
-    const origin = gatewayOrigin();
-    const token = process.env.BILLING_INTERNAL_TOKEN?.trim() || await readHiddenValue('Gateway admin token: ');
-    if (!token)
-        throw new Error('Base Sepolia V2 setup requires gateway admin access to check the activated credential root');
-    let response;
-    try {
-        response = await fetch(new URL('/v1/admin/root-known', origin), {
-            method: 'POST',
-            headers: {
-                accept: 'application/json',
-                authorization: `Bearer ${token}`,
-                'content-type': 'application/json',
-            },
-            body: JSON.stringify({ root }),
-            signal: AbortSignal.timeout(10_000),
-        });
-    }
-    catch {
-        throw new Error('The gateway could not confirm that the activated credential root is known');
-    }
-    let body;
-    try {
-        body = await response.json();
-    }
-    catch {
-        body = undefined;
-    }
-    if (response.status !== 200 || !isRecord(body) || body.known !== true) {
-        throw new Error('The activated credential root is not in the gateway known-root set; stop setup and reconcile the V2 activation');
-    }
+    await checkGatewayKnownRoot(root, gatewayOrigin());
 }
 async function gatewayReadiness(origin) {
     const response = await readGatewayJson(new URL('/ready', origin), { accept: 'application/json' });

package/dist/codex-profile.js

@@ -23,6 +23,7 @@ export function renderCodexProfile(options) {
     const model = options.model?.trim() || DEFAULT_CODEX_MODEL;
     return [
         `model = ${tomlString(model)}`,
+        'model_reasoning_effort = "none"',
         'model_provider = "zk_credits"',
         '',
         '[model_providers.zk_credits]',

package/dist/gateway-root-check.d.ts

@@ -0,0 +1,2 @@
+/** Public setup check. It sends the public root only and never needs an admin credential. */
+export declare function requireGatewayKnownRoot(root: string, origin: URL, fetcher?: typeof fetch): Promise<void>;

package/dist/gateway-root-check.js

@@ -0,0 +1,28 @@
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+/** Public setup check. It sends the public root only and never needs an admin credential. */
+export async function requireGatewayKnownRoot(root, origin, fetcher = fetch) {
+    let response;
+    try {
+        response = await fetcher(new URL('/v1/root-known', origin), {
+            method: 'POST',
+            headers: { accept: 'application/json', 'content-type': 'application/json' },
+            body: JSON.stringify({ root }),
+            signal: AbortSignal.timeout(10_000),
+        });
+    }
+    catch {
+        throw new Error('The gateway could not confirm that the activated credential root is known');
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = undefined;
+    }
+    if (response.status !== 200 || !isRecord(body) || body.known !== true) {
+        throw new Error('The activated credential root is not in the gateway known-root set; stop setup and reconcile the V2 activation');
+    }
+}

package/dist/responses-bridge.js

@@ -91,6 +91,21 @@ function responseTools(value) {
             tools.push({ type: 'function', function: definition });
             continue;
         }
+        // Codex sends its local freeform apply_patch tool with every Responses
+        // request. Chat Completions cannot execute that tool, so validate this
+        // known declaration and omit it from the provider request.
+        if (tool.type === 'custom') {
+            if (!hasOnlyKeys(tool, ['type', 'name', 'description', 'format'])
+                || tool.name !== 'apply_patch'
+                || (tool.description !== undefined && typeof tool.description !== 'string')
+                || !isRecord(tool.format)
+                || !hasOnlyKeys(tool.format, ['type', 'syntax', 'definition'])
+                || tool.format.type !== 'grammar'
+                || tool.format.syntax !== 'lark'
+                || typeof tool.format.definition !== 'string')
+                return undefined;
+            continue;
+        }
         // Codex includes these tool declarations in each Responses request. The
         // fixed service class has no web-search executor and accepts only direct
         // function tools, so validate their known shape and drop them.
@@ -151,8 +166,9 @@ export function translateResponsesRequest(body) {
         return { ok: false, error: 'unsupported_include' };
     }
     if (body.reasoning !== undefined
-        && (!isRecord(body.reasoning) || !hasOnlyKeys(body.reasoning, ['summary'])
-            || (body.reasoning.summary !== undefined && !['auto', 'concise', 'detailed'].includes(String(body.reasoning.summary))))) {
+        && (!isRecord(body.reasoning) || !hasOnlyKeys(body.reasoning, ['effort', 'summary'])
+            || (body.reasoning.effort !== undefined && body.reasoning.effort !== 'none')
+            || (body.reasoning.summary !== undefined && !['none', 'auto', 'concise', 'detailed'].includes(String(body.reasoning.summary))))) {
         return { ok: false, error: 'unsupported_reasoning_controls' };
     }
     if (body.parallel_tool_calls !== undefined && typeof body.parallel_tool_calls !== 'boolean') {

package/dist/zk-credits.js

@@ -80687,6 +80687,7 @@ function renderCodexProfile(options) {
   const model = options.model?.trim() || DEFAULT_CODEX_MODEL;
   return [
     `model = ${tomlString(model)}`,
+    'model_reasoning_effort = "none"',
     'model_provider = "zk_credits"',
     "",
     "[model_providers.zk_credits]",
@@ -82873,6 +82874,11 @@ function responseTools(value) {
       tools.push({ type: "function", function: definition });
       continue;
     }
+    if (tool.type === "custom") {
+      if (!hasOnlyKeys(tool, ["type", "name", "description", "format"]) || tool.name !== "apply_patch" || tool.description !== void 0 && typeof tool.description !== "string" || !isRecord3(tool.format) || !hasOnlyKeys(tool.format, ["type", "syntax", "definition"]) || tool.format.type !== "grammar" || tool.format.syntax !== "lark" || typeof tool.format.definition !== "string")
+        return void 0;
+      continue;
+    }
     if (tool.type === "web_search") {
       if (!hasOnlyKeys(tool, ["type", "external_web_access"]) || tool.external_web_access !== void 0 && typeof tool.external_web_access !== "boolean")
         return void 0;
@@ -82937,7 +82943,7 @@ function translateResponsesRequest(body) {
   if (body.include !== void 0 && (!Array.isArray(body.include) || body.include.some((value) => value !== "reasoning.encrypted_content"))) {
     return { ok: false, error: "unsupported_include" };
   }
-  if (body.reasoning !== void 0 && (!isRecord3(body.reasoning) || !hasOnlyKeys(body.reasoning, ["summary"]) || body.reasoning.summary !== void 0 && !["auto", "concise", "detailed"].includes(String(body.reasoning.summary)))) {
+  if (body.reasoning !== void 0 && (!isRecord3(body.reasoning) || !hasOnlyKeys(body.reasoning, ["effort", "summary"]) || body.reasoning.effort !== void 0 && body.reasoning.effort !== "none" || body.reasoning.summary !== void 0 && !["none", "auto", "concise", "detailed"].includes(String(body.reasoning.summary)))) {
     return { ok: false, error: "unsupported_reasoning_controls" };
   }
   if (body.parallel_tool_calls !== void 0 && typeof body.parallel_tool_calls !== "boolean") {
@@ -83477,6 +83483,35 @@ async function runBaseRegisteredTrialExchange(options) {
 
 // dist/cli.js
 import { BASE_SEPOLIA_NETWORK as BASE_SEPOLIA_NETWORK2 } from "@zk-credits/x402-zk-prepaid";
+
+// dist/gateway-root-check.js
+function isRecord5(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+async function requireGatewayKnownRoot(root, origin, fetcher = fetch) {
+  let response;
+  try {
+    response = await fetcher(new URL("/v1/root-known", origin), {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ root }),
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    throw new Error("The gateway could not confirm that the activated credential root is known");
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    body = void 0;
+  }
+  if (response.status !== 200 || !isRecord5(body) || body.known !== true) {
+    throw new Error("The activated credential root is not in the gateway known-root set; stop setup and reconcile the V2 activation");
+  }
+}
+
+// dist/cli.js
 var DEFAULT_GATEWAY_URL = "https://zk-credits-gateway.onrender.com";
 var DEFAULT_PORT = 3210;
 function stateDirectory() {
@@ -83672,7 +83707,7 @@ var GATEWAY_COUNTER_NAMES = [
 ];
 var GATEWAY_CLAIM_COUNT_NAMES = ["reserved", "ready", "committed", "cancelled"];
 var GATEWAY_READINESS_CHECK_NAMES = /* @__PURE__ */ new Set(["launchControl", "database", "baseRoot", "baseRpc", "verifierAssets", "provider"]);
-function isRecord5(value) {
+function isRecord6(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function safeCount(value) {
@@ -83699,42 +83734,15 @@ async function readGatewayJson(url, headers) {
     return { status: null };
   }
 }
-async function requireGatewayKnownRoot(root) {
-  const origin = gatewayOrigin();
-  const token = process.env.BILLING_INTERNAL_TOKEN?.trim() || await readHiddenValue("Gateway admin token: ");
-  if (!token)
-    throw new Error("Base Sepolia V2 setup requires gateway admin access to check the activated credential root");
-  let response;
-  try {
-    response = await fetch(new URL("/v1/admin/root-known", origin), {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        authorization: `Bearer ${token}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({ root }),
-      signal: AbortSignal.timeout(1e4)
-    });
-  } catch {
-    throw new Error("The gateway could not confirm that the activated credential root is known");
-  }
-  let body;
-  try {
-    body = await response.json();
-  } catch {
-    body = void 0;
-  }
-  if (response.status !== 200 || !isRecord5(body) || body.known !== true) {
-    throw new Error("The activated credential root is not in the gateway known-root set; stop setup and reconcile the V2 activation");
-  }
+async function requireGatewayKnownRoot2(root) {
+  await requireGatewayKnownRoot(root, gatewayOrigin());
 }
 async function gatewayReadiness(origin) {
   const response = await readGatewayJson(new URL("/ready", origin), { accept: "application/json" });
-  const report = isRecord5(response.body) ? response.body : void 0;
+  const report = isRecord6(response.body) ? response.body : void 0;
   const checks = Array.isArray(report?.checks) ? report.checks : [];
-  const failedChecks = checks.flatMap((check) => isRecord5(check) && check.ok === true ? [] : [isRecord5(check) && typeof check.name === "string" && GATEWAY_READINESS_CHECK_NAMES.has(check.name) ? check.name : "unknown"]);
-  const hasLaunchCheck = checks.some((check) => isRecord5(check) && check.name === "launchControl" && check.ok === true);
+  const failedChecks = checks.flatMap((check) => isRecord6(check) && check.ok === true ? [] : [isRecord6(check) && typeof check.name === "string" && GATEWAY_READINESS_CHECK_NAMES.has(check.name) ? check.name : "unknown"]);
+  const hasLaunchCheck = checks.some((check) => isRecord6(check) && check.name === "launchControl" && check.ok === true);
   return {
     status: response.status,
     passed: response.status === 200 && report?.ready === true && failedChecks.length === 0 && hasLaunchCheck,
@@ -83746,12 +83754,12 @@ async function gatewayTrialSnapshot(origin, token) {
     accept: "application/json",
     authorization: `Bearer ${token}`
   });
-  const body = isRecord5(response.body) ? response.body : void 0;
-  const launch = isRecord5(body?.launchControl) ? body.launchControl : void 0;
-  const base = isRecord5(body?.base) ? body.base : void 0;
-  const spend = isRecord5(body?.spend) ? body.spend : void 0;
-  const rawMetrics = isRecord5(body?.metrics) ? body.metrics : void 0;
-  const rawClaims = isRecord5(body?.claims) ? body.claims : void 0;
+  const body = isRecord6(response.body) ? response.body : void 0;
+  const launch = isRecord6(body?.launchControl) ? body.launchControl : void 0;
+  const base = isRecord6(body?.base) ? body.base : void 0;
+  const spend = isRecord6(body?.spend) ? body.spend : void 0;
+  const rawMetrics = isRecord6(body?.metrics) ? body.metrics : void 0;
+  const rawClaims = isRecord6(body?.claims) ? body.claims : void 0;
   const metrics = {};
   const claims = {};
   let countersValid = Boolean(rawMetrics && rawClaims);
@@ -84039,7 +84047,7 @@ async function main() {
           const provider = await witnessProviderForSource(source, join7(stateDirectory(), "base-event-sync.json"));
           const witness = validateBaseCreditWitness(await provider.witnessForCredential(credential));
           if (manifest.deployment)
-            await requireGatewayKnownRoot(witness.root);
+            await requireGatewayKnownRoot2(witness.root);
         },
         chooseCandidate: chooseSetupCandidate
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zk-credits",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Loopback x402 zk-prepaid transport for private Base API credits.",
   "homepage": "https://feature-zk-api-credits-gadillacers-projects.vercel.app",
   "repository": {