@frontiercompute/zap1-attest

Zcash-rooted attestation SDK. Submit events to a ZAP1 service, poll until they anchor on Zcash mainnet, and independently verify leaves against the anchored Merkle root.

Renamed from @frontiercompute/openclaw-zap1. The OpenClaw plugin integration is preserved as an optional subpath: @frontiercompute/zap1-attest/openclaw.

Install

npm install @frontiercompute/zap1-attest

Node 18+ (uses globalThis.fetch and crypto.subtle). No runtime dependencies.

30-second quickstart

import { Zap1Client, sha256Hex } from "@frontiercompute/zap1-attest";

const client = new Zap1Client({
  baseUrl: "https://pay.frontiercompute.io",
  apiKey: process.env.ZAP1_API_KEY,
});

const { leaf_hash } = await client.createEvent({
  event_type: "AGENT_ACTION",
  wallet_hash: "my-agent-001",
  agent_id: "my-agent-001",
  action_type: "tool_call",
  input_hash: await sha256Hex("list_files /home"),
  output_hash: await sha256Hex("12 entries"),
});

// Block until the leaf is anchored on Zcash mainnet (or timeout).
const anchored = await client.waitForAnchor(leaf_hash, { timeoutMs: 600_000 });
console.log("anchored in tx", anchored.txid, "at height", anchored.height);

API

new Zap1Client(options)

| Option | Type | Default | |-----------|-------------------|--------------------------------------| | baseUrl | string | https://pay.frontiercompute.io | | apiKey | string | required for createEvent | | fetch | typeof fetch | globalThis.fetch | | retry | RetryOptions | { maxRetries: 3, baseDelayMs: 200, maxDelayMs: 2000 } |

Methods

• createEvent(event) - POST /event, retries on 5xx and network errors.
• anchorStatus() - GET /anchor/status.
• anchorHistory() - GET /anchor/history.
• verifyLeaf(leafHash) - GET /verify/{leaf}/check.
• proofBundle(leafHash) - GET /verify/{leaf}/proof.json.
• waitForAnchor(leafHash, { timeoutMs, intervalMs, signal }) - poll until anchored === true or timeout.

Policy helper

import { evaluatePolicy } from "@frontiercompute/zap1-attest";

const result = evaluatePolicy("send_funds", input, {
  blockedTools: ["shell_exec"],
  restrictedTools: ["send_funds"],
});
if (!result.allowed) throw new Error(result.reason);

OpenClaw plugin adapter

// my-plugin/index.ts
import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
import { registerZap1Hooks } from "@frontiercompute/zap1-attest/openclaw";

export default definePluginEntry({
  id: "zap1",
  name: "zap1-attest",
  description: "Zcash attestation for OpenClaw agents.",
  register(api) {
    registerZap1Hooks(api);
  },
});

The adapter registers the 8 attestation hooks (message:sent, message:received, message:preprocessed, message:transcribed, agent:bootstrap, session:patch, gateway:startup, command) and evaluates blockedTools / restrictedTools before execution.

Live service

• Explorer: https://ctaz.frontiercompute.cash
• Reference service: http://127.0.0.1:3080 (self-host) or https://pay.frontiercompute.io (shared endpoint).

Verify a leaf independently

curl https://pay.frontiercompute.io/verify/{leaf_hash}/check
curl https://pay.frontiercompute.io/verify/{leaf_hash}/proof.json

A valid proof returns the Merkle path, the anchored root, and the Zcash mainnet txid plus block height that carries that root in a ZAP1 memo.

Deprecation

@frontiercompute/openclaw-zap1 is deprecated in favor of this package. All versions 0.3.x onward of the old package point users here. No API changes between the old 0.2.1 and this 0.2.0 for the core client surface; the OpenClaw wiring moved under /openclaw.

License

MIT