feat(flashtestations-sdk): add source locator retrieval from BlockBui…

[Melvillian]

…lderPolicy contract

PR Scope

Description

This commit implements retrieval of source locators (e.g., GitHub URLs) for workload source code by querying the BlockBuilderPolicy contract's getWorkloadMetadata function. The implementation adds a new getSourceLocators method to RpcClient, includes the getWorkloadMetadata ABI definition, and integrates source locators throughout the verification flow. This enables users to trace back to the exact source code repositories and commits used to build TEE workloads, enhancing transparency and reproducibility of flashtestation verifications.

How Has This Been Tested?

Manually

(Optional) Feedback Focus

If you go to examples/verifyBlock.ts and change

// Verify if the latest block was built by the specified TEE workload
    const result = await verifyFlashtestationInBlock(
      workloadId,
      'latest', // Use 'latest' to check the most recent block
      {
        chainId: 1301, // Unichain Sepolia testnet
        // Optional: provide custom RPC URL
        // rpcUrl: 'https://sepolia.unichain.org',
      }
    );

to instead be (see the rpcUrl arg)

// Verify if the latest block was built by the specified TEE workload
    const result = await verifyFlashtestationInBlock(
      workloadId,
      'latest', // Use 'latest' to check the most recent block
      {
        chainId: 33611633, // Unichain experimental
        rpcUrl: '<PASTE YOUR UNICHAIN EXPERIMENTAL RPC HERE>',
      }
    );

and then run

npx tsx examples/verifyBlock.ts

you should see that it correctly verifies the block was built using flashtestations, because we've got flashtestations working on experimental.

[graphite-app]

Graphite Automations

"Request reviewers once CI passes on sdks monorepo" took an action on this PR • (10/30/25)

3 reviewers were added and 1 assignee was added to this PR based on Siyu Jiang (See-You John)'s automation.