feat: add TLSNotary alpha.15 proving modes

package.json

@@ -72,7 +72,7 @@
     },
     "dependencies": {
         "@csfloat/cs2-inspect-serializer": "^1.1.0",
-        "@csfloat/tlsn-wasm": "0.1.0-alpha.14",
+        "@csfloat/tlsn-wasm": "0.1.0-alpha.15",
         "buffer": "^6.0.3",
         "comlink": "^4.4.2"
     }

src/environment.dev.ts

@@ -1,8 +1,8 @@
 export const environment = {
     csfloat_base_api_url: 'http://localhost:8080/api',
     notary: {
-        tlsn: 'https://notary.csfloat.com',
-        ws: 'wss://notary.csfloat.com/proxy',
+        tlsn: 'http://localhost:7047',
+        ws: 'ws://localhost:7047/proxy',
         loggingLevel: 'Error',
     },
     reverse_watch_base_api_url: 'http://localhost:3434/api',

src/environment.staging.ts

@@ -1,8 +1,8 @@
 export const environment = {
     csfloat_base_api_url: 'https://csfloat.build/api',
     notary: {
-        tlsn: 'https://notary.csfloat.com',
-        ws: 'wss://notary.csfloat.com/proxy',
+        tlsn: 'https://notary.csfloat.com/v15',
+        ws: 'wss://notary.csfloat.com/v15/proxy',
         loggingLevel: 'Error',
     },
     reverse_watch_base_api_url: 'https://reverse.watch/api',

src/environment.ts

@@ -1,8 +1,8 @@
 export const environment = {
     csfloat_base_api_url: 'https://csfloat.com/api',
     notary: {
-        tlsn: 'https://notary.csfloat.com',
-        ws: 'wss://notary.csfloat.com/proxy',
+        tlsn: 'https://notary.csfloat.com/v15',
+        ws: 'wss://notary.csfloat.com/v15/proxy',
         loggingLevel: 'Warn',
     },
     reverse_watch_base_api_url: 'https://reverse.watch/api',

src/lib/notary/types.ts

@@ -1,5 +1,7 @@
 import {NetworkSetting} from '@csfloat/tlsn-wasm';
 
+export type NotaryProverMode = 'proxy' | 'mpc';
+
 export enum ProofType {
     TRADE_OFFERS = 'trade_offers',
     TRADE_OFFER = 'trade_offer',
@@ -71,6 +73,9 @@ export type NotaryProveRequest = {
 
             // Optionally override the network setting for proving
             network_setting?: NetworkSetting;
+
+            // Proxy-TLS is the default. MPC retains the legacy browser TCP-proxy flow.
+            prover_mode?: NotaryProverMode;
         };
     } & ProveRequestPayloads[T];
 }[ProofType];

src/offscreen/handlers/notary_prove.ts

@@ -7,10 +7,11 @@ import {
 import {getSteamRequestURL} from '../../lib/notary/utils';
 import * as Comlink from 'comlink';
 import {environment} from '../../environment';
-import type {LoggingLevel, Method, Prover as TProver, Reveal} from '@csfloat/tlsn-wasm';
+import type {IoChannel, LoggingLevel, Method, Prover as TProver, ProverMode, Reveal} from '@csfloat/tlsn-wasm';
 import {NotarySessionClient} from './notary_session_client';
 import {Remote} from 'comlink';
 import {wait} from '../../lib/utils/snips';
+import {WebSocketIoChannel} from '../io_channel';
 
 const {init, Prover}: any = Comlink.wrap(new Worker(new URL('../worker.ts', import.meta.url)));
 
@@ -65,36 +66,51 @@ export const TLSNProveOffscreenHandler = new ClosableOffscreenHandler<
 
         const session = await NotarySessionClient.create(maxRecvData, maxSentData, maybeNotaryToken);
 
+        let verifierChannel: WebSocketIoChannel | undefined;
+        let serverChannel: WebSocketIoChannel | undefined;
         try {
+            const proverMode: ProverMode = request.notary_request.meta?.prover_mode === 'mpc' ? 'Mpc' : 'Proxy';
+
             // Create and setup prover
             const prover = (await new Prover({
                 server_name: 'api.steampowered.com',
+                mode: proverMode,
                 max_recv_data: maxRecvData,
                 max_sent_data: maxSentData,
+                max_sent_records: undefined,
+                max_recv_data_online: undefined,
+                max_recv_records_online: undefined,
                 network: request.notary_request.meta?.network_setting ?? 'Latency',
                 defer_decryption_from_start: true,
+                client_auth: undefined,
+                root_certs: undefined,
             })) as Remote<TProver>;
 
             let verifierUrl = `${environment.notary.tlsn}/verifier?sessionId=${session.getID()}`;
             if (maybeNotaryToken) {
                 verifierUrl += `&token=${maybeNotaryToken}`;
             }
 
-            await prover.setup(verifierUrl);
+            verifierChannel = await WebSocketIoChannel.connect(toWebSocketUrl(verifierUrl));
+            await prover.setup(Comlink.proxy(verifierChannel));
 
             // Convert headers to Map<string, number[]> for WASM
             const headerMap = new Map<string, number[]>();
             for (const [key, value] of Object.entries(headers)) {
                 headerMap.set(key, Buffer.from(value).toJSON().data);
             }
 
-            let wsUrl = `${environment.notary.ws}`;
-            if (maybeNotaryToken) {
-                wsUrl += `?token=${maybeNotaryToken}`;
+            let serverIo: IoChannel | undefined;
+            if (proverMode === 'Mpc') {
+                let wsUrl = `${environment.notary.ws}`;
+                if (maybeNotaryToken) {
+                    wsUrl += `?token=${maybeNotaryToken}`;
+                }
+                serverChannel = await WebSocketIoChannel.connect(wsUrl);
+                serverIo = Comlink.proxy(serverChannel);
             }
 
-            // Send HTTP request via proxy
-            await prover.send_request(wsUrl, {
+            await prover.send_request(serverIo, {
                 uri: serverURL,
                 method: 'GET' as Method,
                 headers: headerMap,
@@ -118,6 +134,7 @@ export const TLSNProveOffscreenHandler = new ClosableOffscreenHandler<
 
             return await completedPromise;
         } finally {
+            await Promise.allSettled([verifierChannel?.close(), serverChannel?.close()]);
             session.close();
         }
     },
@@ -129,6 +146,10 @@ export const TLSNProveOffscreenHandler = new ClosableOffscreenHandler<
     }
 );
 
+function toWebSocketUrl(url: string): string {
+    return url.replace(/^http:/, 'ws:').replace(/^https:/, 'wss:');
+}
+
 /**
  * Estimates the total request byte size over the wire if sent over HTTP 1.1
  *

src/offscreen/io_channel.test.ts

@@ -0,0 +1,97 @@
+import {afterEach, beforeEach, describe, expect, it} from 'vitest';
+import {WebSocketIoChannel} from './io_channel';
+
+class FakeWebSocket extends EventTarget {
+    static readonly CONNECTING = 0;
+    static readonly OPEN = 1;
+    static readonly CLOSING = 2;
+    static readonly CLOSED = 3;
+    static latest?: FakeWebSocket;
+
+    readonly sent: Uint8Array[] = [];
+    binaryType: BinaryType = 'blob';
+    readyState = FakeWebSocket.CONNECTING;
+
+    constructor(readonly url: string) {
+        super();
+        FakeWebSocket.latest = this;
+    }
+
+    open(): void {
+        this.readyState = FakeWebSocket.OPEN;
+        this.dispatchEvent(new Event('open'));
+    }
+
+    message(data: ArrayBuffer): void {
+        const event = new Event('message');
+        Object.defineProperty(event, 'data', {value: data});
+        this.dispatchEvent(event);
+    }
+
+    send(data: ArrayBufferView | ArrayBuffer): void {
+        const bytes =
+            data instanceof ArrayBuffer
+                ? new Uint8Array(data)
+                : new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+        this.sent.push(new Uint8Array(bytes));
+    }
+
+    close(): void {
+        if (this.readyState === FakeWebSocket.CLOSED) {
+            return;
+        }
+        this.readyState = FakeWebSocket.CLOSED;
+        this.dispatchEvent(new Event('close'));
+    }
+}
+
+const originalWebSocket = globalThis.WebSocket;
+
+describe('WebSocketIoChannel', () => {
+    beforeEach(() => {
+        FakeWebSocket.latest = undefined;
+        globalThis.WebSocket = FakeWebSocket as unknown as typeof WebSocket;
+    });
+
+    afterEach(() => {
+        globalThis.WebSocket = originalWebSocket;
+    });
+
+    it('rejects when the socket closes before opening', async () => {
+        const channelPromise = WebSocketIoChannel.connect('wss://notary.test/verifier');
+        const socket = FakeWebSocket.latest!;
+
+        socket.close();
+
+        await expect(channelPromise).rejects.toThrow('closed before opening');
+    });
+
+    it('queues binary messages and returns EOF on close', async () => {
+        const channelPromise = WebSocketIoChannel.connect('wss://notary.test/verifier');
+        const socket = FakeWebSocket.latest!;
+        socket.open();
+        const channel = await channelPromise;
+
+        socket.message(new Uint8Array([1, 2, 3]).buffer);
+        await expect(channel.read()).resolves.toEqual(new Uint8Array([1, 2, 3]));
+
+        const pendingRead = channel.read();
+        socket.close();
+        await expect(pendingRead).resolves.toBeNull();
+        await expect(channel.read()).resolves.toBeNull();
+    });
+
+    it('preserves write order and rejects writes after close', async () => {
+        const channelPromise = WebSocketIoChannel.connect('wss://notary.test/verifier');
+        const socket = FakeWebSocket.latest!;
+        socket.open();
+        const channel = await channelPromise;
+
+        await channel.write(new Uint8Array([1]));
+        await channel.write(new Uint8Array([2]));
+        expect(socket.sent).toEqual([new Uint8Array([1]), new Uint8Array([2])]);
+
+        await channel.close();
+        await expect(channel.write(new Uint8Array([3]))).rejects.toThrow('closed');
+    });
+});