docs(tee): document confidentiality flows and operator setup

.github/workflows/checks.yml

@@ -7,6 +7,34 @@ on:
   workflow_dispatch:
 
 jobs:
+  tnt_core_sync:
+    name: tnt-core sync
+    runs-on: ubuntu-latest
+    steps:
+      - name: Cancel Previous Runs
+        uses: styfle/cancel-workflow-action@0.11.0
+        with:
+          access_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/checkout@v3
+
+      - name: Checkout tnt-core main
+        uses: actions/checkout@v3
+        with:
+          repository: tangle-network/tnt-core
+          ref: main
+          path: tnt-core
+
+      - name: Use Node.js 22.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+
+      - name: Validate docs against tnt-core
+        run: node ./scripts/check-tnt-core-sync.mjs
+        env:
+          TNT_CORE_DIR: ${{ github.workspace }}/tnt-core
+
   lint:
     name: lint
     runs-on: ubuntu-latest
@@ -81,7 +109,17 @@ jobs:
       - name: Link Checker
         uses: lycheeverse/lychee-action@v1.9.0
         with:
-          args: --verbose --no-progress './**/*.md' './**/*.html' './**/*.mdx'
+          token: ${{ secrets.GITHUB_TOKEN }}
+          args: >-
+            --verbose
+            --no-progress
+            --max-concurrency 16
+            --max-retries 5
+            --retry-wait-time 2
+            --accept '100..=103,200..=299,403,429'
+            './**/*.md'
+            './**/*.html'
+            './**/*.mdx'
           fail: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package.json

@@ -11,6 +11,7 @@
     "build:sitemap": "next-sitemap --config next-sitemap.config.js",
     "build:pagefind": "pagefind --site .next/server/pages --output-path dist/_pagefind",
     "export": "next export",
+    "check:tnt-core-sync": "node ./scripts/check-tnt-core-sync.mjs",
     "lint": "next lint && yarn format",
     "schema": "turbo-gen ./public/schema.json",
     "format": "prettier --write \"{components,pages}/**/*.{mdx,ts,js,jsx,tsx,json}\" ",

pages/developers/api/reference/ITangleServices.mdx

@@ -16,29 +16,37 @@ Service lifecycle management interface
 #### requestService
 
 ```solidity
-function requestService(uint64 blueprintId, address[] operators, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount) external payable returns (uint64 requestId)
+function requestService(uint64 blueprintId, address[] operators, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount, enum Types.ConfidentialityPolicy confidentiality) external payable returns (uint64 requestId)
 ```
 
 Request a new service
 
 #### requestServiceWithExposure
 
 ```solidity
-function requestServiceWithExposure(uint64 blueprintId, address[] operators, uint16[] exposureBps, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount) external payable returns (uint64 requestId)
+function requestServiceWithExposure(uint64 blueprintId, address[] operators, uint16[] exposureBps, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount, enum Types.ConfidentialityPolicy confidentiality) external payable returns (uint64 requestId)
 ```
 
 Request a service with explicit exposure commitments
 
 #### requestServiceWithSecurity
 
 ```solidity
-function requestServiceWithSecurity(uint64 blueprintId, address[] operators, struct Types.AssetSecurityRequirement[] securityRequirements, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount) external payable returns (uint64 requestId)
+function requestServiceWithSecurity(uint64 blueprintId, address[] operators, struct Types.AssetSecurityRequirement[] securityRequirements, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount, enum Types.ConfidentialityPolicy confidentiality) external payable returns (uint64 requestId)
 ```
 
 Request a service with multi-asset security requirements
 
 _Each operator must provide security commitments matching these requirements when approving_
 
+#### getServiceRequestResourceRequirements
+
+```solidity
+function getServiceRequestResourceRequirements(uint64 requestId) external view returns (struct Types.ResourceCommitment[])
+```
+
+Get resource requirements for a service request
+
 #### approveService
 
 ```solidity
@@ -57,6 +65,22 @@ Approve a service request with multi-asset security commitments
 
 _Commitments must match the security requirements specified in the request_
 
+#### approveServiceWithBls
+
+```solidity
+function approveServiceWithBls(uint64 requestId, uint8 stakingPercent, uint256[4] blsPubkey) external
+```
+
+Approve a service request with BLS public key for aggregated signature verification
+
+#### approveServiceWithCommitmentsAndBls
+
+```solidity
+function approveServiceWithCommitmentsAndBls(uint64 requestId, struct Types.AssetSecurityCommitment[] commitments, uint256[4] blsPubkey) external
+```
+
+Approve a service request with both security commitments and BLS public key
+
 #### rejectService
 
 ```solidity
@@ -101,6 +125,14 @@ function terminateService(uint64 serviceId) external
 
 Terminate a service (as owner)
 
+#### terminateServiceForNonPayment
+
+```solidity
+function terminateServiceForNonPayment(uint64 serviceId) external
+```
+
+Permissionlessly terminate an unpaid subscription after grace period
+
 #### addPermittedCaller
 
 ```solidity
@@ -361,13 +393,13 @@ Get current service count
 #### ServiceRequested
 
 ```solidity
-event ServiceRequested(uint64 requestId, uint64 blueprintId, address requester)
+event ServiceRequested(uint64 requestId, uint64 blueprintId, address requester, enum Types.ConfidentialityPolicy confidentiality)
 ```
 
 #### ServiceRequestedWithSecurity
 
 ```solidity
-event ServiceRequestedWithSecurity(uint64 requestId, uint64 blueprintId, address requester)
+event ServiceRequestedWithSecurity(uint64 requestId, uint64 blueprintId, address requester, enum Types.ConfidentialityPolicy confidentiality)
 ```
 
 #### ServiceApproved
@@ -385,7 +417,7 @@ event ServiceRejected(uint64 requestId, address operator)
 #### ServiceActivated
 
 ```solidity
-event ServiceActivated(uint64 serviceId, uint64 requestId, uint64 blueprintId)
+event ServiceActivated(uint64 serviceId, uint64 requestId, uint64 blueprintId, enum Types.ConfidentialityPolicy confidentiality)
 ```
 
 #### ServiceTerminated
@@ -394,6 +426,12 @@ event ServiceActivated(uint64 serviceId, uint64 requestId, uint64 blueprintId)
 event ServiceTerminated(uint64 serviceId)
 ```
 
+#### ServiceTerminatedForNonPayment
+
+```solidity
+event ServiceTerminatedForNonPayment(uint64 serviceId, address triggeredBy, uint64 dueAt, uint64 graceEndsAt, uint256 requiredAmount, uint256 escrowBalance)
+```
+
 #### OperatorJoinedService
 
 ```solidity

pages/developers/api/reference/generated/ITangleServices.mdx

@@ -16,29 +16,37 @@ Service lifecycle management interface
 #### requestService
 
 ```solidity
-function requestService(uint64 blueprintId, address[] operators, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount) external payable returns (uint64 requestId)
+function requestService(uint64 blueprintId, address[] operators, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount, enum Types.ConfidentialityPolicy confidentiality) external payable returns (uint64 requestId)
 ```
 
 Request a new service
 
 #### requestServiceWithExposure
 
 ```solidity
-function requestServiceWithExposure(uint64 blueprintId, address[] operators, uint16[] exposureBps, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount) external payable returns (uint64 requestId)
+function requestServiceWithExposure(uint64 blueprintId, address[] operators, uint16[] exposureBps, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount, enum Types.ConfidentialityPolicy confidentiality) external payable returns (uint64 requestId)
 ```
 
 Request a service with explicit exposure commitments
 
 #### requestServiceWithSecurity
 
 ```solidity
-function requestServiceWithSecurity(uint64 blueprintId, address[] operators, struct Types.AssetSecurityRequirement[] securityRequirements, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount) external payable returns (uint64 requestId)
+function requestServiceWithSecurity(uint64 blueprintId, address[] operators, struct Types.AssetSecurityRequirement[] securityRequirements, bytes config, address[] permittedCallers, uint64 ttl, address paymentToken, uint256 paymentAmount, enum Types.ConfidentialityPolicy confidentiality) external payable returns (uint64 requestId)
 ```
 
 Request a service with multi-asset security requirements
 
 _Each operator must provide security commitments matching these requirements when approving_
 
+#### getServiceRequestResourceRequirements
+
+```solidity
+function getServiceRequestResourceRequirements(uint64 requestId) external view returns (struct Types.ResourceCommitment[])
+```
+
+Get resource requirements for a service request
+
 #### approveService
 
 ```solidity
@@ -57,6 +65,22 @@ Approve a service request with multi-asset security commitments
 
 _Commitments must match the security requirements specified in the request_
 
+#### approveServiceWithBls
+
+```solidity
+function approveServiceWithBls(uint64 requestId, uint8 stakingPercent, uint256[4] blsPubkey) external
+```
+
+Approve a service request with BLS public key for aggregated signature verification
+
+#### approveServiceWithCommitmentsAndBls
+
+```solidity
+function approveServiceWithCommitmentsAndBls(uint64 requestId, struct Types.AssetSecurityCommitment[] commitments, uint256[4] blsPubkey) external
+```
+
+Approve a service request with both security commitments and BLS public key
+
 #### rejectService
 
 ```solidity
@@ -101,6 +125,14 @@ function terminateService(uint64 serviceId) external
 
 Terminate a service (as owner)
 
+#### terminateServiceForNonPayment
+
+```solidity
+function terminateServiceForNonPayment(uint64 serviceId) external
+```
+
+Permissionlessly terminate an unpaid subscription after grace period
+
 #### addPermittedCaller
 
 ```solidity
@@ -361,13 +393,13 @@ Get current service count
 #### ServiceRequested
 
 ```solidity
-event ServiceRequested(uint64 requestId, uint64 blueprintId, address requester)
+event ServiceRequested(uint64 requestId, uint64 blueprintId, address requester, enum Types.ConfidentialityPolicy confidentiality)
 ```
 
 #### ServiceRequestedWithSecurity
 
 ```solidity
-event ServiceRequestedWithSecurity(uint64 requestId, uint64 blueprintId, address requester)
+event ServiceRequestedWithSecurity(uint64 requestId, uint64 blueprintId, address requester, enum Types.ConfidentialityPolicy confidentiality)
 ```
 
 #### ServiceApproved
@@ -385,7 +417,7 @@ event ServiceRejected(uint64 requestId, address operator)
 #### ServiceActivated
 
 ```solidity
-event ServiceActivated(uint64 serviceId, uint64 requestId, uint64 blueprintId)
+event ServiceActivated(uint64 serviceId, uint64 requestId, uint64 blueprintId, enum Types.ConfidentialityPolicy confidentiality)
 ```
 
 #### ServiceTerminated
@@ -394,6 +426,12 @@ event ServiceActivated(uint64 serviceId, uint64 requestId, uint64 blueprintId)
 event ServiceTerminated(uint64 serviceId)
 ```
 
+#### ServiceTerminatedForNonPayment
+
+```solidity
+event ServiceTerminatedForNonPayment(uint64 serviceId, address triggeredBy, uint64 dueAt, uint64 graceEndsAt, uint256 requiredAmount, uint256 escrowBalance)
+```
+
 #### OperatorJoinedService
 
 ```solidity

pages/developers/blueprints/_meta.ts

@@ -2,6 +2,7 @@ import { Meta } from "nextra";
 
 const meta: Meta = {
   introduction: "Introduction",
+  "execution-confidentiality": "Execution Confidentiality",
   "use-cases": "Use Cases",
   "service-lifecycle": "Service Lifecycle",
   "pricing-and-payments": "Pricing & Payments",