Confidential relay types, WorkflowExecution proto fields, and package move

go.mod

@@ -41,7 +41,7 @@ require (
 	github.com/smartcontractkit/chain-selectors v1.0.89
 	github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.10
 	github.com/smartcontractkit/chainlink-protos/billing/go v0.0.0-20251024234028-0988426d98f4
-	github.com/smartcontractkit/chainlink-protos/cre/go v0.0.0-20260226130359-963f935e0396
+	github.com/smartcontractkit/chainlink-protos/cre/go v0.0.0-20260320153346-314ec8dbe5a4
 	github.com/smartcontractkit/chainlink-protos/linking-service/go v0.0.0-20251002192024-d2ad9222409b
 	github.com/smartcontractkit/chainlink-protos/node-platform v0.0.0-20260205130626-db2a2aab956b
 	github.com/smartcontractkit/chainlink-protos/storage-service v0.3.0

pkg/capabilities/actions/confidentialrelay/types.go → pkg/capabilities/v2/actions/confidentialrelay/types.go

@@ -16,10 +16,12 @@ type SecretIdentifier struct {
 
 // SecretsRequestParams is the JSON-RPC params for "confidential.secrets.get".
 type SecretsRequestParams struct {
-	WorkflowID       string             `json:"workflow_id"`
-	Secrets          []SecretIdentifier `json:"secrets"`
-	EnclavePublicKey string             `json:"enclave_public_key"`
-	Attestation      string             `json:"attestation,omitempty"`
+	WorkflowID          string             `json:"workflow_id"`
+	Owner               string             `json:"owner"`                         // Ethereum address (hex, 0x-prefixed)
+	ExecutionID         string             `json:"execution_id"`                  // 32 bytes, hex-encoded
+	Secrets             []SecretIdentifier `json:"secrets"`
+	EnclavePublicKey    string             `json:"enclave_public_key"`
+	Attestation         string             `json:"attestation,omitempty"`
 }
 
 // SecretEntry is a single secret in the relay DON's response.
@@ -30,10 +32,10 @@ type SecretEntry struct {
 }
 
 // SecretsResponseResult is the JSON-RPC result for "confidential.secrets.get".
+// The enclave uses its own config for MasterPublicKey and threshold (config.T),
+// so the relay handler only returns the encrypted shares per secret.
 type SecretsResponseResult struct {
-	Secrets         []SecretEntry `json:"secrets"`
-	MasterPublicKey string        `json:"master_public_key"`
-	Threshold       int           `json:"threshold"`
+	Secrets []SecretEntry `json:"secrets"`
 }
 
 // CapabilityRequestParams is the JSON-RPC params for "confidential.capability.execute".