Image generation

{
  "model": "flux2-klein-4b-q4",
  "width": 1024,
  "height": 1024,
  "seed": 1234,
  "prompt_bytes": 43,
  "request_id": "6b1f2f0e-3f7a-4c52-9b8e-2a6f4f0d9c11",
  "use_credits": true,
  "max_price": 0.01
}

{
  "protocol": "image-v1",
  "request_id": "<request_id>",
  "model": "flux2-klein-4b-q4",
  "model_revision": "<from reserve>",
  "model_sha256": "<from reserve>",
  "width": 1024,
  "height": 1024,
  "seed": 1234,
  "prompt": { "encoding": "base64", "bytes": 43, "data": "<base64 of the UTF-8 prompt>" }
}

{
  "reservation_token": "<from reserve>",
  "enc": {
    "ciphertext": "<base64>",
    "client_ephemeral_pubkey": "<base58>",
    "client_response_pubkey": "<base58 response public key>",
    "algorithm": "x25519-xchacha20poly1305-hkdf-v2",
    "encoding": "base64"
  }
}

{
  "object": "image.job",
  "job_id": "6b1f2f0e-3f7a-4c52-9b8e-2a6f4f0d9c11",
  "request_id": "6b1f2f0e-3f7a-4c52-9b8e-2a6f4f0d9c11",
  "status": "queued",
  "quote_usd": 0.006292,
  "poll_url": "/v1/images/generations/6b1f2f0e-3f7a-4c52-9b8e-2a6f4f0d9c11",
  "estimated_seconds": 300,
  "poll_interval_seconds": 5
}

// Node 20+. npm i @noble/curves@1 @noble/ciphers@1 @noble/hashes@1 bs58@5
import { createHash, randomUUID } from "node:crypto";
import { writeFileSync } from "node:fs";
import { ed25519, x25519 } from "@noble/curves/ed25519";
import { xchacha20poly1305 } from "@noble/ciphers/chacha";
import { sha256 } from "@noble/hashes/sha256";
import { hkdf } from "@noble/hashes/hkdf";
import bs58 from "bs58";

const BASE = "https://grid.x402compute.cc";
const MODEL = "flux2-klein-4b-q4";
const ALGO = "x25519-xchacha20poly1305-hkdf-v2";
const te = new TextEncoder();

// ---- sealing (x25519 + HKDF-SHA256 + XChaCha20-Poly1305, response key bound in the AAD) ----
const deriveKey = (shared, info) => hkdf(sha256, shared, te.encode("sgl-e2e-v2-salt"), te.encode(info), 32);

export function sealPrompt(reserve, { requestId, width, height, seed, prompt }) {
  const promptBytes = Buffer.byteLength(prompt, "utf8");
  // Exact plaintext: key order is fixed, no whitespace.
  const plaintext = te.encode(JSON.stringify({
    protocol: "image-v1",
    request_id: requestId,
    model: MODEL,
    model_revision: reserve.model_revision,
    model_sha256: reserve.model_sha256,
    width,
    height,
    seed,
    prompt: { encoding: "base64", bytes: promptBytes, data: Buffer.from(prompt, "utf8").toString("base64") },
  }));
  const resp = x25519.utils.randomPrivateKey(); // opens the result later
  const respPub = bs58.encode(x25519.getPublicKey(resp));
  const eph = x25519.utils.randomPrivateKey();
  const ephPub = bs58.encode(x25519.getPublicKey(eph));
  const nodePub = reserve.node_x25519_pubkey;
  const key = deriveKey(x25519.getSharedSecret(eph, bs58.decode(nodePub)), "sgl-e2e-v2-input");
  const aad = te.encode(`sgl-aad/v2/input|node=${nodePub}|eph=${ephPub}|resp=${respPub}`);
  const nonce = crypto.getRandomValues(new Uint8Array(24));
  const sealed = Buffer.concat([nonce, xchacha20poly1305(key, nonce, aad).encrypt(plaintext)]);
  return {
    respSecret: resp,
    enc: {
      ciphertext: sealed.toString("base64"),
      client_ephemeral_pubkey: ephPub,
      client_response_pubkey: respPub,
      algorithm: ALGO,
      encoding: "base64",
    },
  };
}

export function openResult(respSecret, sealedResult) {
  const respPub = bs58.encode(x25519.getPublicKey(respSecret));
  const nodeEph = sealedResult.ephemeral_public_key;
  const key = deriveKey(x25519.getSharedSecret(respSecret, bs58.decode(nodeEph)), "sgl-e2e-v2-output");
  const aad = te.encode(`sgl-aad/v2/output|resp=${respPub}|eph=${nodeEph}`);
  const blob = Buffer.from(sealedResult.ciphertext, "base64");
  const plain = Buffer.from(xchacha20poly1305(key, blob.subarray(0, 24), aad).decrypt(blob.subarray(24)));
  const nl = plain.indexOf(0x0a); // JSON header line, newline, then PNG bytes
  return { header: JSON.parse(plain.subarray(0, nl).toString("utf8")), png: plain.subarray(nl + 1) };
}

// ---- node signature checks ----
export function verifyKeybind(r) {
  // "SGL-NODE-KEYBIND-v1" 0x00 node_id(16) ed25519(32) x25519(32) key_version(u32 LE)
  const kv = Buffer.alloc(4);
  kv.writeUInt32LE(r.key_version);
  const blob = Buffer.concat([
    te.encode("SGL-NODE-KEYBIND-v1"), Buffer.from([0]),
    Buffer.from(r.node_id.replace(/-/g, ""), "hex"),
    bs58.decode(r.node_ed25519_pubkey), bs58.decode(r.node_x25519_pubkey), kv,
  ]);
  return ed25519.verify(bs58.decode(r.node_x25519_pubkey_sig), blob, bs58.decode(r.node_ed25519_pubkey));
}

export function verifyResultSignature(r, jobId, poll) {
  const digest = createHash("sha256").update(poll.sealed_result.ciphertext).digest("hex");
  const msg = te.encode(`sgl-result-v1\n${jobId}\nimage\n${digest}`);
  return ed25519.verify(bs58.decode(poll.result_envelope_signature), msg, bs58.decode(r.node_ed25519_pubkey));
}

// ---- the three requests ----
async function main() {
  const headers = { "X-API-Key": process.env.SGL_API_KEY, "Content-Type": "application/json" };
  const prompt = "A red hot-air balloon over a calm mountain lake at sunrise, photographic";
  const [width, height, seed] = [1024, 1024, null];
  const requestId = randomUUID(); // lowercase UUIDv4, becomes the job id

  // 1. Reserve (metadata only, the prompt never leaves your machine unsealed)
  const res = await fetch(`${BASE}/v1/images/reserve`, {
    method: "POST", headers,
    body: JSON.stringify({
      model: MODEL, width, height, prompt_bytes: Buffer.byteLength(prompt, "utf8"),
      request_id: requestId, use_credits: true, max_price: 0.01,
    }),
  });
  if (!res.ok) throw new Error(`reserve ${res.status}: ${await res.text()}`);
  const reserve = await res.json();
  if (!verifyKeybind(reserve)) throw new Error("node key binding invalid, refusing to seal");

  // 2. Seal and submit
  const { enc, respSecret } = sealPrompt(reserve, { requestId, width, height, seed, prompt });
  const sub = await fetch(`${BASE}/v1/images/generations`, {
    method: "POST", headers, body: JSON.stringify({ reservation_token: reserve.reservation_token, enc }),
  });
  if (sub.status !== 202) throw new Error(`submit ${sub.status}: ${await sub.text()}`);
  const job = await sub.json();

  // 3. Poll every 5 seconds, verify, open
  for (;;) {
    await new Promise((r) => setTimeout(r, 5000));
    const poll = await (await fetch(BASE + job.poll_url, { headers })).json();
    if (poll.status === "failed" || poll.status === "expired") throw new Error(`job ${poll.status}`);
    if (poll.status !== "completed") continue;
    if (poll.node_id !== reserve.node_id) throw new Error("completed by a different node");
    if (!verifyResultSignature(reserve, job.job_id, poll)) throw new Error("result signature invalid");
    const { header, png } = openResult(respSecret, poll.sealed_result);
    if (header.image.sha256 !== createHash("sha256").update(png).digest("hex")) throw new Error("image hash mismatch");
    writeFileSync("out.png", png);
    console.log(`saved out.png (${png.length} bytes), cost ${poll.usage?.cost_usd} USD`);
    return;
  }
}

if (process.env.SGL_API_KEY) await main();