@elizaos/agent 2.0.0-beta.2 → 2.0.11-beta.6

package/services/signing-policy.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Transaction signing policy engine.
+ * Evaluates requests against chain/contract/value/rate/method/replay rules.
+ */
+export interface SigningPolicy {
+    allowedChainIds: number[];
+    allowedContracts: string[];
+    deniedContracts: string[];
+    maxTransactionValueWei: string;
+    maxTransactionsPerHour: number;
+    maxTransactionsPerDay: number;
+    allowedMethodSelectors: string[];
+    humanConfirmationThresholdWei: string;
+    requireHumanConfirmation: boolean;
+}
+export interface SigningRequest {
+    requestId: string;
+    chainId: number;
+    to: string;
+    value: string;
+    data: string;
+    nonce?: number;
+    gasLimit?: string;
+    maxFeePerGas?: string;
+    maxPriorityFeePerGas?: string;
+    createdAt: number;
+}
+export type PolicyDecision = {
+    allowed: boolean;
+    reason: string;
+    requiresHumanConfirmation: boolean;
+    matchedRule: string;
+};
+export declare function createDefaultPolicy(): SigningPolicy;
+export declare class SigningPolicyEvaluator {
+    private policy;
+    private requestLog;
+    private processedRequestIds;
+    constructor(policy?: SigningPolicy);
+    updatePolicy(policy: SigningPolicy): void;
+    getPolicy(): SigningPolicy;
+    evaluate(request: SigningRequest): PolicyDecision;
+    /** Record after signing completes (for replay + rate tracking). */
+    recordRequest(requestId: string): void;
+}
+//# sourceMappingURL=signing-policy.d.ts.map

package/services/signing-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-policy.d.ts","sourceRoot":"","sources":["../../src/services/signing-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,6BAA6B,EAAE,MAAM,CAAC;IACtC,wBAAwB,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,EAAE,OAAO,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAgB,mBAAmB,IAAI,aAAa,CAYnD;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAuD;IACzE,OAAO,CAAC,mBAAmB,CAAqB;gBAEpC,MAAM,CAAC,EAAE,aAAa;IAIlC,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAIzC,SAAS,IAAI,aAAa;IAI1B,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc;IAsJjD,mEAAmE;IACnE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;CAYvC"}

package/services/task-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-executor.d.ts","sourceRoot":"","sources":["../../src/services/task-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE3D,8CAA8C;AAC9C,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,uDAAuD;IACvD,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAE3D,0CAA0C;IAC1C,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAErE,2BAA2B;IAC3B,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,kCAAkC;AAClC,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,SAAS,CAAwC;IAEzD,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAItC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI9B,6CAA6C;IAC7C,YAAY,CACV,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE,aAAa,GACrB,YAAY,GAAG,SAAS;IAa3B,MAAM,IAAI,YAAY,EAAE;IAIxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;CAG5C"}

package/services/tee-boot-gate-state.d.ts

@@ -0,0 +1,29 @@
+/**
+ * In-process holder for the one-time TEE boot-gate decision (plan §4.1).
+ *
+ * The boot path evaluates the gate exactly once (see
+ * `runtime/eliza.ts` → `runTeeBootGate`). Modules that guard real secret
+ * paths — agent-wallet key reveal/bridge, remote plugin sync — cannot reach
+ * that closure-local decision, so the boot path publishes it here and those
+ * modules consult `teeBootGateBlocksSecrets()`.
+ *
+ * Inert by default: the singleton starts unset. Non-TEE / local-only boots
+ * either never set a gate or set one whose `required === false`, so
+ * `teeBootGateBlocksSecrets()` returns false and gated paths behave exactly as
+ * they did before TEE gating existed.
+ */
+import type { TeeBootGate } from "./tee-boot-gate.ts";
+/** Publish the one-time boot-gate decision for cross-module consumption. */
+export declare function setTeeBootGateState(gate: TeeBootGate): void;
+/** The published boot-gate decision, or undefined when none has been set. */
+export declare function getTeeBootGateState(): TeeBootGate | undefined;
+/** Reset the singleton. Tests only — production sets the gate exactly once. */
+export declare function clearTeeBootGateState(): void;
+/**
+ * True ONLY when a gate is set, the policy requires trusted TEE evidence, and
+ * that evidence is not trusted (secrets disabled). When no gate is set, or the
+ * policy is not required, or secrets are enabled, this returns false — so the
+ * default (non-TEE) case is fully inert.
+ */
+export declare function teeBootGateBlocksSecrets(): boolean;
+//# sourceMappingURL=tee-boot-gate-state.d.ts.map

package/services/tee-boot-gate-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-boot-gate-state.d.ts","sourceRoot":"","sources":["../../src/services/tee-boot-gate-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAE3D;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,IAAI,WAAW,GAAG,SAAS,CAE7D;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAMlD"}

package/services/tee-boot-gate-state.js

@@ -0,0 +1,38 @@
+/**
+ * In-process holder for the one-time TEE boot-gate decision (plan §4.1).
+ *
+ * The boot path evaluates the gate exactly once (see
+ * `runtime/eliza.ts` → `runTeeBootGate`). Modules that guard real secret
+ * paths — agent-wallet key reveal/bridge, remote plugin sync — cannot reach
+ * that closure-local decision, so the boot path publishes it here and those
+ * modules consult `teeBootGateBlocksSecrets()`.
+ *
+ * Inert by default: the singleton starts unset. Non-TEE / local-only boots
+ * either never set a gate or set one whose `required === false`, so
+ * `teeBootGateBlocksSecrets()` returns false and gated paths behave exactly as
+ * they did before TEE gating existed.
+ */
+let currentGate;
+/** Publish the one-time boot-gate decision for cross-module consumption. */
+export function setTeeBootGateState(gate) {
+    currentGate = gate;
+}
+/** The published boot-gate decision, or undefined when none has been set. */
+export function getTeeBootGateState() {
+    return currentGate;
+}
+/** Reset the singleton. Tests only — production sets the gate exactly once. */
+export function clearTeeBootGateState() {
+    currentGate = undefined;
+}
+/**
+ * True ONLY when a gate is set, the policy requires trusted TEE evidence, and
+ * that evidence is not trusted (secrets disabled). When no gate is set, or the
+ * policy is not required, or secrets are enabled, this returns false — so the
+ * default (non-TEE) case is fully inert.
+ */
+export function teeBootGateBlocksSecrets() {
+    return (currentGate !== undefined &&
+        currentGate.required === true &&
+        currentGate.secretsEnabled === false);
+}

package/services/tee-boot-gate.d.ts

@@ -0,0 +1,45 @@
+import type { TeeEvidenceProvider } from "./tee-evidence.ts";
+import { type TeeEvidencePolicy, type TeeEvidencePolicyDecision } from "./tee-policy.ts";
+import { type TeeProductionProfileOptions } from "./tee-production-profile.ts";
+import { type ResolveTeeRuntimePolicyOptions } from "./tee-runtime-config.ts";
+/**
+ * Boot-time TEE gate (plan §4.1). Consumes the resolved runtime policy, applies
+ * the production profile when configured, collects evidence via the provider,
+ * and evaluates trust ONCE at startup. The result tells the boot path which
+ * high-value capabilities may be enabled.
+ *
+ * Fail-closed contract: when the policy requires TEE and the decision is not
+ * trusted, NONE of model-key release, signing, agent-session secrets, or remote
+ * plugin sync may be enabled. The agent may still boot in a degraded,
+ * secret-less mode, but it must surface the failed decision via the structured
+ * logger ([TeeBootGate]) and never silently proceed with secrets.
+ */
+export type TeeBootGate = {
+    /** Resolved + production-merged policy actually evaluated (undefined ⇒ TEE not configured). */
+    policy: TeeEvidencePolicy | undefined;
+    /** True when no TEE policy is configured at all (local-only, no gating). */
+    teeConfigured: boolean;
+    /** True when the configured policy demands trusted evidence. */
+    required: boolean;
+    /** True when the production profile was merged in. */
+    productionProfile: boolean;
+    /** The single boot-time trust decision, when a policy was evaluated. */
+    decision?: TeeEvidencePolicyDecision;
+    /** Whether high-value secret/key/signing/sync capabilities may be enabled. */
+    secretsEnabled: boolean;
+};
+export type EvaluateTeeBootGateOptions = {
+    env?: Record<string, string | undefined>;
+    evidenceProvider?: TeeEvidenceProvider;
+    resolveOptions?: ResolveTeeRuntimePolicyOptions;
+    profileOptions?: TeeProductionProfileOptions;
+    nowMs?: number;
+};
+export declare function evaluateTeeBootGate(options?: EvaluateTeeBootGateOptions): Promise<TeeBootGate>;
+/**
+ * Guard a high-value capability behind the boot gate. Throws fail-closed when
+ * secrets are disabled, so a caller cannot accidentally release a key/secret or
+ * sync plugins after a failed attestation.
+ */
+export declare function assertTeeBootGateAllowsSecrets(gate: TeeBootGate, capability: string): void;
+//# sourceMappingURL=tee-boot-gate.d.ts.map

package/services/tee-boot-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-boot-gate.d.ts","sourceRoot":"","sources":["../../src/services/tee-boot-gate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC/B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,2BAA2B,EACjC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,8BAA8B,EAEpC,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,+FAA+F;IAC/F,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACtC,4EAA4E;IAC5E,aAAa,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,sDAAsD;IACtD,iBAAiB,EAAE,OAAO,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,8EAA8E;IAC9E,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC,cAAc,CAAC,EAAE,8BAA8B,CAAC;IAChD,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,WAAW,CAAC,CA+EtB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,GACjB,IAAI,CAQN"}

package/services/tee-boot-gate.js

@@ -0,0 +1,80 @@
+import { logger } from "@elizaos/core";
+import { evaluateTeeEvidencePolicy, } from "./tee-policy.js";
+import { mergeTeeProductionProfile, } from "./tee-production-profile.js";
+import { resolveTeeRuntimePolicy, } from "./tee-runtime-config.js";
+export async function evaluateTeeBootGate(options = {}) {
+    const env = options.env ?? process.env;
+    const resolved = await resolveTeeRuntimePolicy({
+        env,
+        ...(options.nowMs === undefined ? {} : { nowMs: options.nowMs }),
+        ...(options.resolveOptions ?? {}),
+    });
+    const useProductionProfile = env.ELIZA_TEE_PRODUCTION_PROFILE === "true";
+    if (resolved === undefined && !useProductionProfile) {
+        return {
+            policy: undefined,
+            teeConfigured: false,
+            required: false,
+            productionProfile: false,
+            secretsEnabled: true,
+        };
+    }
+    const policy = useProductionProfile
+        ? mergeTeeProductionProfile(resolved, options.profileOptions ?? {})
+        : resolved;
+    const required = policy?.required === true;
+    if (!required) {
+        return {
+            policy,
+            teeConfigured: policy !== undefined,
+            required: false,
+            productionProfile: useProductionProfile,
+            secretsEnabled: true,
+        };
+    }
+    if (!options.evidenceProvider) {
+        logger.error("[TeeBootGate] ELIZA_TEE_REQUIRED is set but no evidence provider is configured; refusing to enable secrets.");
+        return {
+            policy,
+            teeConfigured: true,
+            required: true,
+            productionProfile: useProductionProfile,
+            secretsEnabled: false,
+        };
+    }
+    const evidence = await options.evidenceProvider.collectEvidence();
+    const decision = evaluateTeeEvidencePolicy(evidence, policy);
+    if (!decision.trusted) {
+        logger.error({ reason: decision.reason, detail: decision.detail }, "[TeeBootGate] TEE evidence is not trusted; secrets, model-key release, signing, and remote plugin sync are disabled.");
+        return {
+            policy,
+            teeConfigured: true,
+            required: true,
+            productionProfile: useProductionProfile,
+            decision,
+            secretsEnabled: false,
+        };
+    }
+    logger.info({
+        reason: decision.reason,
+        productionProfile: useProductionProfile,
+    }, "[TeeBootGate] TEE evidence trusted; high-value capabilities enabled.");
+    return {
+        policy,
+        teeConfigured: true,
+        required: true,
+        productionProfile: useProductionProfile,
+        decision,
+        secretsEnabled: true,
+    };
+}
+/**
+ * Guard a high-value capability behind the boot gate. Throws fail-closed when
+ * secrets are disabled, so a caller cannot accidentally release a key/secret or
+ * sync plugins after a failed attestation.
+ */
+export function assertTeeBootGateAllowsSecrets(gate, capability) {
+    if (!gate.secretsEnabled) {
+        throw new Error(`[TeeBootGate] ${capability} blocked: TEE evidence is not trusted (${gate.decision?.detail ?? gate.decision?.reason ?? "no evidence provider"}).`);
+    }
+}

package/services/tee-confidential-inference.d.ts

@@ -0,0 +1,177 @@
+import type { TeeMeasurementName } from "./tee-evidence.ts";
+import type { TeeKeyReleaseClient, TeeKeyReleaseResult } from "./tee-key-release.ts";
+import type { TeeEvidencePolicy } from "./tee-policy.ts";
+/**
+ * Confidential-inference unseal path (plan §2.2 steps 4–7).
+ *
+ * Releases the `model-key` only after the TEE key-release client's evidence
+ * satisfies the policy, then decrypts the at-rest weights blob in process
+ * memory and hands the plaintext to the in-domain model runtime. The plaintext
+ * weights and the model key never touch disk, env, or the structured logger.
+ *
+ * HARDWARE BOUNDARY (fail-closed): real TDX/CoVE quote-signature verification
+ * is BLOCKED on hardware (plan Phase B2/C1). This path verifies a normalized
+ * evidence document + nonce binding + measurement match only. It must not be
+ * presented as hardware-verified trust until B2/C1 land. If the key-release
+ * client rejects the evidence, no key is returned, the ciphertext stays sealed,
+ * and unseal throws — the negative path is enforced by data unavailability,
+ * not by a software flag that could be patched out.
+ */
+export declare const MODEL_KEY_ID: "model-key";
+/**
+ * Deployment topology of the private-inference path (plan §2.5).
+ *
+ * - `local` (default): weights decrypt inside the on-device CVM/TVM and the
+ *   model runs against the chip NPU confidential-I/O lane. The policy MUST gate
+ *   `claims.npuProtected === true` and a `measurements.npuFirmware` golden
+ *   digest before any `model-key` release.
+ * - `cloud`: weights decrypt inside a remote dstack CVM behind a confidential
+ *   H100 GPU. The policy MUST gate `claims.gpuProtected === true` and a
+ *   `measurements.gpuFirmware` golden digest instead.
+ */
+export type InferenceTopology = "local" | "cloud";
+/**
+ * Fail-closed gate binding private inference to the confidential-I/O attestation
+ * lane (plan §2.4, Phase C item C2). For the local topology this enforces that
+ * the policy will only release the `model-key` against evidence that proves the
+ * NPU confidential-I/O lane is active:
+ *
+ *   - `requiredClaims.npuProtected === true`, and
+ *   - `requiredMeasurements.npuFirmware` is a non-empty golden digest.
+ *
+ * For the cloud topology it enforces the H100 confidential-GPU equivalent
+ * (`gpuProtected` + `gpuFirmware`). This is an explicit, reusable assertion so
+ * "no NPU/GPU confidential-I/O attestation ⇒ no private inference" is enforced
+ * at the unseal seam, not left as an implicit production-profile default a
+ * caller could forget. It checks that the *policy itself* will demand these
+ * gates; `evaluateTeeEvidencePolicy` then enforces them against the evidence at
+ * release time. It throws (fails closed) on any gap.
+ */
+export declare function assertNpuPrivateInferenceAllowed(policy: TeeEvidencePolicy, topology?: InferenceTopology): void;
+/**
+ * AES-256-GCM sealed weights envelope. A real device would store this per
+ * shard; the shape is identical so streaming decrypt can be added later.
+ */
+export type SealedWeightsBlob = {
+    algorithm: "aes-256-gcm";
+    ivBase64: string;
+    authTagBase64: string;
+    ciphertextBase64: string;
+    /**
+     * SHA-256 of the plaintext weights. Bound into the policy as the
+     * `modelWeights` measurement so `model-key` release is gated on the expected
+     * weights digest (defense in depth, plan §6.2 / §8).
+     */
+    weightsSha256: string;
+};
+/**
+ * One AES-256-GCM-sealed shard of the weights. Shards are ordered by `index`
+ * (0-based, contiguous) and concatenate — in order — to the full plaintext. Each
+ * shard carries its own IV + GCM auth tag, so a large model can stream-decrypt
+ * shard-by-shard without ever assembling the full plaintext in memory.
+ */
+export type SealedWeightsShard = {
+    index: number;
+    ivBase64: string;
+    authTagBase64: string;
+    ciphertextBase64: string;
+    /** SHA-256 of this shard's plaintext (defense in depth on top of the GCM tag). */
+    plaintextSha256: string;
+};
+/**
+ * Per-shard sealed weights envelope (plan §8 recommendation). The single-blob
+ * {@link SealedWeightsBlob} remains supported; this shape lets the streaming
+ * unseal decrypt and hand off one shard at a time.
+ */
+export type SealedWeightsManifest = {
+    algorithm: "aes-256-gcm";
+    /** SHA-256 of the FULL concatenated plaintext (matches the single-blob digest). */
+    weightsSha256: string;
+    shards: SealedWeightsShard[];
+};
+export type ModelKeyUnsealConfig = {
+    keyReleaseClient: TeeKeyReleaseClient;
+    policy: TeeEvidencePolicy;
+    sealedWeights: SealedWeightsBlob;
+    /**
+     * Measurements that MUST be present and matched by the policy before the
+     * model-key is released. For local private inference: agent, policy,
+     * container/compose, os, npuFirmware, and modelWeights.
+     */
+    requiredMeasurements: readonly TeeMeasurementName[];
+    /**
+     * Deployment topology (plan §2.5). Defaults to `local`, which gates the chip
+     * NPU confidential-I/O lane (`npuProtected` + `npuFirmware`). `cloud` gates
+     * the confidential-GPU lane (`gpuProtected` + `gpuFirmware`) instead.
+     */
+    topology?: InferenceTopology;
+    context?: string;
+};
+export type ModelKeyUnsealResult = {
+    /**
+     * Decrypted weights in process memory. The caller must hand this directly to
+     * the in-domain runtime and zeroize it after load. Never serialize it.
+     */
+    weights: Buffer;
+    decision: TeeKeyReleaseResult["decision"];
+    weightsSha256: string;
+};
+/**
+ * Request `model-key`, verify the policy gates the required measurements, then
+ * decrypt the sealed weights in memory. Fails closed on any gap.
+ */
+export declare function unsealModelWeights(config: ModelKeyUnsealConfig): Promise<ModelKeyUnsealResult>;
+export type StreamingUnsealConfig = {
+    keyReleaseClient: TeeKeyReleaseClient;
+    policy: TeeEvidencePolicy;
+    sealedWeights: SealedWeightsManifest;
+    /**
+     * Measurements that MUST be present and matched by the policy before the
+     * model-key is released (same gate as {@link unsealModelWeights}).
+     */
+    requiredMeasurements: readonly TeeMeasurementName[];
+    /**
+     * Deployment topology (plan §2.5). Defaults to `local` (NPU confidential-I/O).
+     * See {@link ModelKeyUnsealConfig.topology}.
+     */
+    topology?: InferenceTopology;
+    context?: string;
+};
+export type StreamingUnsealResult = {
+    decision: TeeKeyReleaseResult["decision"];
+    weightsSha256: string;
+    shardCount: number;
+};
+/**
+ * Sink for one decrypted shard. The buffer is valid only for the duration of
+ * this call: the streaming unseal zeroizes it immediately after `onShard`
+ * returns, before decrypting the next shard. The sink must consume (e.g. copy
+ * into the in-domain runtime) what it needs synchronously or via the awaited
+ * promise; it must not retain the buffer.
+ */
+export type ShardSink = (shard: {
+    index: number;
+    bytes: Buffer;
+}) => void | Promise<void>;
+/**
+ * Streaming per-shard unseal (plan §8 recommendation). Applies the same
+ * fail-closed gates as {@link unsealModelWeights}, then decrypts shards strictly
+ * in order, handing each plaintext shard to `onShard` and zeroizing it before
+ * decrypting the next — so the full plaintext is never assembled in memory. A
+ * running SHA-256 over the concatenated plaintext is verified against the
+ * manifest `weightsSha256` at the end (defense in depth). On any failure all
+ * transient buffers and the key material are zeroized and the call throws.
+ */
+export declare function unsealModelWeightsStreaming(config: StreamingUnsealConfig, onShard: ShardSink): Promise<StreamingUnsealResult>;
+/**
+ * Seal `weights` into a per-shard {@link SealedWeightsManifest} under `key`,
+ * splitting into `shardSizeBytes`-sized shards (the last may be smaller). Each
+ * shard gets a fresh 12-byte IV. Used by tests and any real packer; reuses the
+ * single-blob crypto patterns.
+ */
+export declare function sealModelWeightsShards(input: {
+    weights: Buffer;
+    key: Buffer;
+    shardSizeBytes: number;
+}): SealedWeightsManifest;
+//# sourceMappingURL=tee-confidential-inference.d.ts.map

package/services/tee-confidential-inference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee-confidential-inference.d.ts","sourceRoot":"","sources":["../../src/services/tee-confidential-inference.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,YAAY,EAAG,WAAoB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC;AAIlD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,iBAAiB,EACzB,QAAQ,GAAE,iBAA8C,GACvD,IAAI,CAmBN;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAE,aAAa,CAAC;IACzB,mFAAmF;IACnF,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,iBAAiB,CAAC;IACjC;;;;OAIG;IACH,oBAAoB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA8C/B;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,aAAa,EAAE,qBAAqB,CAAC;IACrC;;;OAGG;IACH,oBAAoB,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3B;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,SAAS,GACjB,OAAO,CAAC,qBAAqB,CAAC,CAoEhC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,qBAAqB,CAyCxB"}