@nanogpt/private-mode 0.2.8 → 0.2.11

package/README.md

@@ -5,7 +5,7 @@ OpenAI-compatible localhost proxy for NanoGPT Private Mode with supported TEE mo
 Requires Node.js 22 or later.
 
 ```bash
-NANOGPT_API_KEY=sk-your-key npx @nanogpt/private-mode
+NANOGPT_API_KEY=sk-your-key npx --yes @nanogpt/private-mode@latest
 ```
 
 Then point any OpenAI-compatible client at:
@@ -32,6 +32,14 @@ const response = await client.chat.completions.create({
 
 The local proxy verifies TEE attestation, encrypts request bodies with EHBP, sends ciphertext through NanoGPT, decrypts encrypted responses locally, and returns normal OpenAI JSON to the calling app.
 
+The model list is bundled with the installed proxy package. Before the proxy starts listening, it checks that list against NanoGPT's hosted Private Mode catalog and stops with an upgrade command if models were added or retired. This prevents an old package from advertising enclave targets that are no longer available. The running proxy reports its exact version at `GET http://127.0.0.1:8787/v1/private-mode/status`. To print the latest published package version, run:
+
+```bash
+npx --yes @nanogpt/private-mode@latest --version
+```
+
+If an older proxy is already running, stop it before starting the command above. API clients must use the localhost base URL shown below; sending `private/*` model IDs directly to NanoGPT's standard `/api/v1/chat/completions` endpoint does not enable Private Mode.
+
 After a long idle period (five minutes by default), the proxy re-verifies attestation and creates a fresh encrypted transport before the next request. This makes laptop sleep/resume safe without requiring a proxy restart. Set `NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS` to a positive millisecond value to adjust the idle threshold, or `0` to disable idle resets.
 
 NanoGPT can see account identity, selected private model, selected TEE target metadata, timing, sizes, status, and usage metadata. NanoGPT cannot read the prompt or completion body for supported private models.
@@ -44,6 +52,12 @@ In the hosted web app, decrypted Private Mode turns remain in local browser hist
 
 Private Mode also requires enough NanoGPT balance and API-key spend-limit headroom before dispatch. For streaming calls, NanoGPT may precharge a conservative reserve before dispatch and refund unused balance after verified usage metadata is available.
 
+Because the request body is encrypted before NanoGPT receives it, the service cannot inspect the request's `max_tokens` value during the balance precheck. The default streaming reserve therefore includes up to 32,768 output tokens, even when the encrypted request asks for fewer. This is a temporary reserve, not the final charge: unused balance is refunded when verified usage metadata arrives. The encrypted `max_tokens` value still controls generation inside the verified TEE.
+
+Private Mode streaming has a 29-minute soft deadline so billing can settle before the route's 30-minute hard runtime limit. If the decrypted upstream stream ends without both a non-null `finish_reason` and the OpenAI `[DONE]` marker, the local proxy emits an SSE error with code `private_stream_incomplete`. Any text received before that error may be partial.
+
+Private Mode currently supports Chat Completions only. The Responses API and Batch API are not available through the encrypted Private Mode endpoint. The standard Responses API outside Private Mode supports background requests within its configured 30-minute runtime limit; work that must reliably continue longer needs a durable job system.
+
 Useful local checks:
 
 ```text
@@ -54,17 +68,21 @@ GET http://127.0.0.1:8787/v1/private-mode/attestation
 
 Supported private model IDs include:
 
-- `private/deepseek-v4-flash`
+- `private/deepseek-v4-flash` - DeepSeek V4 Flash 0731
 - `private/kimi-k3`
-- `private/glm-5-1`
-- `private/glm-5-1-thinking`
+- `private/gpt-oss-120b`
+- `private/llama3-3-70b`
 - `private/glm-5-2`
 - `private/glm-5-2:thinking`
+- `private/gemma4-31b`
+- `private/gemma4-31b:thinking`
+
+Both GLM 5.2 variants are deployed with a 393,216-token total context limit, with prompt and output sharing that window. Kimi K3 Private has a 256,000-token context limit. DeepSeek V4 Flash 0731 Private has a 1,048,576-token total context limit. The model-list extension `context_length` is the combined prompt-and-output window, while `max_output_tokens` is the output ceiling within that same window. These values are not additive.
 
 Browser requests are locked down by default. The proxy only accepts same-machine clients and rejects browser `Origin` headers that are not explicitly allowed, so a random website or LAN client cannot spend the local `NANOGPT_API_KEY` while the proxy is running. If a local browser app needs to call the proxy directly, allow that exact origin:
 
 ```bash
-NANOGPT_API_KEY=sk-your-key npx @nanogpt/private-mode --allow-origin http://localhost:3000
+NANOGPT_API_KEY=sk-your-key npx --yes @nanogpt/private-mode@latest --allow-origin http://localhost:3000
 ```
 
 You can also set `NANOGPT_PRIVATE_ALLOWED_ORIGINS=http://localhost:3000`. Wildcard browser origins are not supported.
@@ -86,13 +104,13 @@ NanoGPT's hosted web app shows a Private Mode receipt on completed Private Mode
 To independently verify a copied receipt:
 
 ```bash
-npx @nanogpt/private-mode verify receipt.json
+npx --yes @nanogpt/private-mode@latest verify receipt.json
 ```
 
 You can also pipe JSON on stdin:
 
 ```bash
-cat receipt.json | npx @nanogpt/private-mode verify
+cat receipt.json | npx --yes @nanogpt/private-mode@latest verify
 ```
 
 The verifier re-fetches attestation material for the receipt's enclave, verifies it locally, and checks the resulting measurements, release digest, and HPKE key against the copied receipt. If an optional attestation bundle hash is present but the freshly fetched bundle serializes differently, the verifier prints a warning instead of failing the core verification.

package/bin/nanogpt-private-mode.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 import { parseArgs } from 'node:util';
+import { PRIVATE_MODE_PROXY_VERSION } from '../lib/packageInfo.js';
 import { startPrivateModeProxy } from '../lib/server.js';
 import { verifyPrivateModeReceiptCli } from '../lib/verifyReceipt.js';
 
@@ -14,10 +15,16 @@ const { values, positionals } = parseArgs({
     },
     'allow-origin': { type: 'string', multiple: true },
     help: { type: 'boolean', short: 'h', default: false },
+    version: { type: 'boolean', short: 'v', default: false },
   },
   allowPositionals: true,
 });
 
+if (values.version) {
+  process.stdout.write(`${PRIVATE_MODE_PROXY_VERSION}\n`);
+  process.exit(0);
+}
+
 if (values.help) {
   process.stdout.write(`NanoGPT Private Mode Proxy
 
@@ -32,6 +39,7 @@ Options:
   --api-base <url>    NanoGPT API base. Default: https://nano-gpt.com
   --allow-origin <origin>
                      Browser origin allowed to call the proxy, for example http://localhost:3000
+  --version, -v      Print the installed proxy version
 `);
   process.exit(0);
 }

package/lib/catalogCompatibility.js

@@ -0,0 +1,76 @@
+const DEFAULT_CATALOG_CHECK_TIMEOUT_MS = 10_000;
+
+function normalizeModelIds(models) {
+  if (!Array.isArray(models)) return null;
+
+  const ids = models.map((model) => (
+    typeof model?.id === 'string' ? model.id.trim().toLowerCase() : ''
+  ));
+  if (ids.some((id) => !id)) return null;
+
+  return new Set(ids);
+}
+
+export function comparePrivateModeCatalogs(localModels, hostedCatalog) {
+  const localIds = normalizeModelIds(localModels);
+  const hostedIds = normalizeModelIds(hostedCatalog?.data);
+  if (!localIds || !hostedIds) {
+    throw new Error('Private Mode model catalog response was malformed.');
+  }
+
+  return {
+    status: 'checked',
+    retiredLocalModels: [...localIds].filter((id) => !hostedIds.has(id)).sort(),
+    missingLocalModels: [...hostedIds].filter((id) => !localIds.has(id)).sort(),
+  };
+}
+
+export async function checkHostedPrivateModeCatalog({
+  apiBase,
+  localModels,
+  fetchImpl = fetch,
+  timeoutMs = DEFAULT_CATALOG_CHECK_TIMEOUT_MS,
+}) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+
+  try {
+    const response = await fetchImpl(`${apiBase}/api/v1/private/tinfoil/models`, {
+      headers: { accept: 'application/json' },
+      signal: controller.signal,
+    });
+    if (!response.ok) {
+      return { status: 'unavailable', reason: `HTTP ${response.status}` };
+    }
+
+    return comparePrivateModeCatalogs(localModels, await response.json());
+  } catch (error) {
+    return {
+      status: 'unavailable',
+      reason: error instanceof Error ? error.message : String(error),
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+export function hasPrivateModeCatalogMismatch(result) {
+  return result.status === 'checked'
+    && (result.retiredLocalModels.length > 0 || result.missingLocalModels.length > 0);
+}
+
+export function buildPrivateModeCatalogUnavailableMessage(result, apiBase) {
+  return `Could not verify the bundled Private Mode model catalog against ${apiBase}: ${result.reason}. The proxy did not start because catalog compatibility could not be confirmed. Check your network connection and NanoGPT service availability, then retry.`;
+}
+
+export function buildPrivateModeCatalogMismatchMessage(result, proxyVersion) {
+  const details = [];
+  if (result.retiredLocalModels.length > 0) {
+    details.push(`retired local models: ${result.retiredLocalModels.join(', ')}`);
+  }
+  if (result.missingLocalModels.length > 0) {
+    details.push(`hosted models missing locally: ${result.missingLocalModels.join(', ')}`);
+  }
+
+  return `The bundled Private Mode model catalog in @nanogpt/private-mode v${proxyVersion} is out of date (${details.join('; ')}). Stop this proxy and restart with: NANOGPT_API_KEY=... npx --yes @nanogpt/private-mode@latest`;
+}

package/lib/constants.js

@@ -0,0 +1,6 @@
+export const PRIVATE_MODE_STREAM_ROUTE_MAX_DURATION_MS = 30 * 60 * 1000;
+export const PRIVATE_MODE_STREAM_SOFT_DEADLINE_LEAD_MS = 60 * 1000;
+export const PRIVATE_MODE_STREAM_SETTLEMENT_SAFETY_MS = 30 * 1000;
+export const PRIVATE_MODE_STREAM_SOFT_DEADLINE_MS =
+  PRIVATE_MODE_STREAM_ROUTE_MAX_DURATION_MS - PRIVATE_MODE_STREAM_SOFT_DEADLINE_LEAD_MS;
+export const PRIVATE_MODE_DEFAULT_RESERVE_MAX_OUTPUT_TOKENS = 32_768;

package/lib/packageInfo.js

@@ -0,0 +1,8 @@
+import { readFileSync } from 'node:fs';
+
+const packageJson = JSON.parse(
+  readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
+);
+
+export const PRIVATE_MODE_PROXY_VERSION = String(packageJson.version);
+export const PRIVATE_MODE_PROXY_VERSION_HEADER = 'x-nanogpt-private-proxy-version';

package/lib/requestTransforms.js

@@ -14,8 +14,7 @@ const MAX_TOKEN_ALIAS_FIELDS = [
 ];
 const KIMI_K3_STANDARD_DEFAULT_MAX_COMPLETION_TOKENS = 16_384;
 const KIMI_K3_DEFAULT_MAX_COMPLETION_TOKENS = 65_536;
-const KIMI_K3_MAX_COMPLETION_TOKENS = 1_048_576;
-const KIMI_K3_CONTEXT_WINDOW_TOKENS = 1_048_576;
+const KIMI_K3_PRIVATE_CONTEXT_WINDOW_TOKENS = 256_000;
 const KIMI_K3_CONTEXT_SAFETY_MARGIN_TOKENS = 10;
 const KIMI_K3_ESTIMATED_TEXT_BYTES_PER_TOKEN = 3;
 const KIMI_K3_HIGH_ENTROPY_TEXT_MIN_LENGTH = 2_048;
@@ -549,8 +548,18 @@ function resolvePrivateModeKimiK3ReasoningEffort(body) {
   return excludesReasoning ? normalizedEffort ?? 'low' : normalizedEffort ?? 'max';
 }
 
-function applyPrivateModeKimiK3RequestParams(body) {
+function applyPrivateModeKimiK3RequestParams(body, model) {
   const reasoningEffort = resolvePrivateModeKimiK3ReasoningEffort(body);
+  const contextWindowTokens = typeof model.maxInputTokens === 'number'
+    && Number.isFinite(model.maxInputTokens)
+    && model.maxInputTokens > 0
+      ? Math.floor(model.maxInputTokens)
+      : KIMI_K3_PRIVATE_CONTEXT_WINDOW_TOKENS;
+  const maxCompletionTokens = typeof model.maxOutputTokens === 'number'
+    && Number.isFinite(model.maxOutputTokens)
+    && model.maxOutputTokens > 0
+      ? Math.floor(model.maxOutputTokens)
+      : contextWindowTokens;
   const requestedMaxTokens = typeof body.max_tokens === 'number' && Number.isFinite(body.max_tokens)
     ? body.max_tokens
     : undefined;
@@ -559,13 +568,13 @@ function applyPrivateModeKimiK3RequestParams(body) {
       ? KIMI_K3_DEFAULT_MAX_COMPLETION_TOKENS
       : KIMI_K3_STANDARD_DEFAULT_MAX_COMPLETION_TOKENS
     : requestedMaxTokens < 0
-      ? KIMI_K3_MAX_COMPLETION_TOKENS
+      ? maxCompletionTokens
       : requestedMaxTokens;
   normalizePrivateModeKimiK3NamedToolChoice(body);
   const promptTokenEstimate = estimatePrivateModeKimiK3PromptTokens(body);
   const remainingContext = Math.max(
     1,
-    KIMI_K3_CONTEXT_WINDOW_TOKENS -
+    contextWindowTokens -
       promptTokenEstimate -
       KIMI_K3_CONTEXT_SAFETY_MARGIN_TOKENS,
   );
@@ -670,13 +679,128 @@ export function createPrivateModeReasoningContentSuppressor() {
 }
 
 export function splitCompleteSseFrames(buffer) {
-  const parts = buffer.split(/\r?\n\r?\n/);
+  const parts = buffer.split(/(?:\r\n|\r|\n){2}/);
   return {
-    frames: parts.slice(0, -1).map((frame) => frame.replace(/\r\n/g, '\n')),
+    frames: parts.slice(0, -1).map((frame) => frame.replace(/\r\n|\r/g, '\n')),
     remainder: parts.at(-1) || '',
   };
 }
 
+export function createPrivateModeSseTerminalState(expectedChoiceCount = 1) {
+  return {
+    expectedChoiceCount: Number.isSafeInteger(expectedChoiceCount) && expectedChoiceCount > 0
+      ? expectedChoiceCount
+      : 1,
+    finishedChoiceIndexes: new Set(),
+    sawDone: false,
+  };
+}
+
+function readPrivateModeSseDataPayload(frame) {
+  if (typeof frame !== 'string') return '';
+  return frame
+    .split('\n')
+    .filter((line) => line.startsWith('data:'))
+    .map((line) => line.slice('data:'.length).trim())
+    .join('\n')
+    .trim();
+}
+
+export function observePrivateModeSseTerminalFrame(state, frame) {
+  if (!isPlainObject(state) || typeof frame !== 'string') return state;
+  const payload = readPrivateModeSseDataPayload(frame);
+  if (!payload) return state;
+  if (payload === '[DONE]') {
+    state.sawDone = true;
+    return state;
+  }
+
+  try {
+    const parsed = JSON.parse(payload);
+    if (isPlainObject(parsed) && Array.isArray(parsed.choices)) {
+      for (const choice of parsed.choices) {
+        if (
+          !isPlainObject(choice) ||
+          choice.finish_reason === undefined ||
+          choice.finish_reason === null
+        ) continue;
+        const choiceIndex = Number.isSafeInteger(choice.index)
+          ? choice.index
+          : state.expectedChoiceCount === 1
+            ? 0
+            : null;
+        if (choiceIndex !== null && choiceIndex >= 0 && choiceIndex < state.expectedChoiceCount) {
+          state.finishedChoiceIndexes.add(choiceIndex);
+        }
+      }
+    }
+  } catch {
+    // Other SSE payloads do not contribute to the OpenAI terminal sequence.
+  }
+  return state;
+}
+
+export function isPrivateModeSseTerminalStateComplete(state) {
+  return state?.sawDone === true &&
+    state?.finishedChoiceIndexes instanceof Set &&
+    state.finishedChoiceIndexes.size === state.expectedChoiceCount;
+}
+
+export function createPrivateModeSseTerminalGuard(expectedChoiceCount = 1) {
+  const state = createPrivateModeSseTerminalState(expectedChoiceCount);
+  let emittedDone = false;
+  return {
+    state,
+    observe(frame, forwardedFrame = frame) {
+      const doneAlreadyEmitted = emittedDone;
+      const containsDone = readPrivateModeSseDataPayload(frame) === '[DONE]';
+      observePrivateModeSseTerminalFrame(state, frame);
+      // The pump drains transport bytes after client-visible completion so the
+      // hosted request can finish settlement. Nothing from that drain belongs
+      // on the client side of the canonical terminal marker.
+      if (doneAlreadyEmitted) return '';
+      // Drop every raw DONE marker so duplicates collapse to one canonical
+      // marker. Reasoning suppression may prepend a synthetic visible-content
+      // delta, which must remain ahead of that marker.
+      const forwardedWithoutDone = containsDone
+        ? forwardedFrame
+          .split(/(?:\r\n|\r|\n){2}/)
+          .filter((forwarded) => readPrivateModeSseDataPayload(forwarded) !== '[DONE]')
+          .join('\n\n')
+        : forwardedFrame;
+
+      // A hosted stream can keep transport EOF open while billing settles.
+      // Release successful completion as soon as the full SSE terminal
+      // sequence is observed, then let the response pump drain the transport.
+      if (!emittedDone && isPrivateModeSseTerminalStateComplete(state)) {
+        emittedDone = true;
+        return [forwardedWithoutDone, 'data: [DONE]'].filter(Boolean).join('\n\n');
+      }
+      return forwardedWithoutDone;
+    },
+    hasEmittedDone() {
+      return emittedDone;
+    },
+    finish() {
+      if (isPrivateModeSseTerminalStateComplete(state)) {
+        if (emittedDone) return { complete: true, frame: '' };
+        emittedDone = true;
+        return { complete: true, frame: 'data: [DONE]' };
+      }
+      return {
+        complete: false,
+        frame: `data: ${JSON.stringify({
+          error: {
+            message: 'Private Mode stream ended before a complete terminal sequence. The response may be partial; retry the request.',
+            type: 'api_error',
+            code: 'private_stream_incomplete',
+          },
+        })}`,
+      };
+    },
+  };
+}
+
 const PRIVATE_MODE_SSE_CHUNK_METADATA_FIELDS = [
   'id',
   'object',
@@ -899,7 +1023,7 @@ export function applyPrivateModelRequestMutations(body, model) {
   normalizeStreamOptions(body);
   applyTinfoilCompatibilityMutations(body, model);
   if (isPrivateModeKimiK3Model(model)) {
-    applyPrivateModeKimiK3RequestParams(body);
+    applyPrivateModeKimiK3RequestParams(body, model);
   } else if (model.thinkingMode === 'deepseek-v4') {
     clampPrivateModeDeepSeekV4Output(body);
   }

package/lib/secureClientLifecycle.js

@@ -1,5 +1,40 @@
 const DEFAULT_SECURE_CLIENT_IDLE_RESET_MS = 5 * 60 * 1000;
+const DEFAULT_VERIFICATION_MAX_AGE_MS = 5 * 60 * 1000;
 const EHBP_RESPONSE_NONCE_HEADER = 'ehbp-response-nonce';
+const REQUIRED_VERIFICATION_STEPS = [
+  'fetchDigest',
+  'verifyCode',
+  'verifyEnclave',
+  'compareMeasurements',
+];
+
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+function hasCompleteVerificationEvidence(document) {
+  return document?.securityVerified === true
+    && isNonEmptyString(document.codeFingerprint)
+    && isNonEmptyString(document.enclaveFingerprint)
+    && isNonEmptyString(document.releaseDigest)
+    && isNonEmptyString(document.hpkePublicKey)
+    && REQUIRED_VERIFICATION_STEPS.every(
+      (step) => document.steps?.[step]?.status === 'success',
+    )
+    && !Object.values(document.steps || {}).some((step) => step?.status === 'failed');
+}
+
+function isMeasurementMismatchError(error) {
+  let current = error;
+  for (let depth = 0; depth < 5 && current; depth += 1) {
+    const message = String(current.message || current);
+    if (/\b(?:code\s+)?measurement mismatch\b|\bcannot compare measurements\b/i.test(message)) {
+      return true;
+    }
+    current = current.cause;
+  }
+  return false;
+}
 
 function readSecureClientIdleResetMs() {
   const configured = process.env.NANOGPT_PRIVATE_CLIENT_IDLE_RESET_MS?.trim();
@@ -14,9 +49,14 @@ export function createSecureState(apiBase, options = {}) {
     : readSecureClientIdleResetMs();
   const loadTinfoil = options.loadTinfoil || (() => import('tinfoil'));
   const now = options.now || Date.now;
+  const verificationMaxAgeMs = Number.isFinite(options.verificationMaxAgeMs)
+    && options.verificationMaxAgeMs >= 0
+    ? Math.floor(options.verificationMaxAgeMs)
+    : DEFAULT_VERIFICATION_MAX_AGE_MS;
   let clientState = null;
   let verificationDocument = null;
   let verificationError = null;
+  let verifiedAtMs = null;
 
   async function getClient(userCacheSecret = clientState?.userCacheSecret) {
     if (!userCacheSecret) {
@@ -24,12 +64,18 @@ export function createSecureState(apiBase, options = {}) {
     }
     const nowMs = now();
     const idleMs = clientState ? nowMs - clientState.lastUsedAtMs : 0;
+    const verificationAgeMs = verifiedAtMs === null ? 0 : nowMs - verifiedAtMs;
     if (
       clientState?.userCacheSecret === userCacheSecret
       && (
         idleResetMs === 0
         || (idleMs >= 0 && idleMs < idleResetMs)
       )
+      && (
+        verifiedAtMs === null
+        || verificationMaxAgeMs === 0
+        || (verificationAgeMs >= 0 && verificationAgeMs < verificationMaxAgeMs)
+      )
     ) {
       clientState.lastUsedAtMs = nowMs;
       return clientState.promise;
@@ -40,6 +86,7 @@ export function createSecureState(apiBase, options = {}) {
     // still be finishing an older in-flight request.
     verificationDocument = null;
     verificationError = null;
+    verifiedAtMs = null;
     const nextState = {
       client: null,
       lastUsedAtMs: nowMs,
@@ -54,10 +101,19 @@ export function createSecureState(apiBase, options = {}) {
         transport: 'ehbp',
         userCacheSecret,
       });
-      await client.ready();
       nextState.client = client;
+      try {
+        await client.ready();
+      } finally {
+        if (clientState === nextState) {
+          verificationDocument = client.getVerificationDocument();
+        }
+      }
+      if (!hasCompleteVerificationEvidence(verificationDocument)) {
+        throw new Error('Private Mode attestation evidence was incomplete.');
+      }
       if (clientState === nextState) {
-        verificationDocument = client.getVerificationDocument();
+        verifiedAtMs = now();
         verificationError = null;
       }
       return client;
@@ -80,7 +136,23 @@ export function createSecureState(apiBase, options = {}) {
     getClient,
     markClientUsed(client) {
       if (!clientState || clientState.client !== client) return false;
-      clientState.lastUsedAtMs = now();
+      const nowMs = now();
+      const currentDocument = client.getVerificationDocument();
+      if (currentDocument !== verificationDocument) {
+        verificationDocument = currentDocument;
+        if (hasCompleteVerificationEvidence(currentDocument)) {
+          verifiedAtMs = nowMs;
+          verificationError = null;
+        } else {
+          verifiedAtMs = null;
+          // Preserve the incomplete document for status visibility, but never
+          // reuse a transport after the SDK has invalidated its evidence.
+          clientState.lastUsedAtMs = nowMs;
+          clientState = null;
+          return true;
+        }
+      }
+      clientState.lastUsedAtMs = nowMs;
       return true;
     },
     invalidateClient(client) {
@@ -89,11 +161,49 @@ export function createSecureState(apiBase, options = {}) {
       clientState = null;
       verificationDocument = null;
       verificationError = null;
+      verifiedAtMs = null;
       return true;
     },
     getVerificationState() {
+      const nowMs = now();
+      // Tinfoil 1.1.12 resets its document to "pending" after an exhausted
+      // AttestationError retry, so retain the SDK's explicit mismatch signal.
+      const mismatch = verificationDocument?.steps?.compareMeasurements?.status === 'failed'
+        || isMeasurementMismatchError(verificationError);
+      const verified = hasCompleteVerificationEvidence(verificationDocument)
+        && !mismatch
+        && verifiedAtMs !== null;
+      const verificationAgeMs = verifiedAtMs === null ? null : nowMs - verifiedAtMs;
+      const clockRolledBack = verificationAgeMs !== null && verificationAgeMs < 0;
+      const expiresAtMs = verifiedAtMs === null || verificationMaxAgeMs === 0
+        ? null
+        : verifiedAtMs + verificationMaxAgeMs;
+      const isStale = verified && (
+        clockRolledBack
+        || (expiresAtMs !== null && nowMs >= expiresAtMs)
+      );
+      const freshnessSeconds = expiresAtMs === null
+        ? null
+        : clockRolledBack
+          ? 0
+          : Math.max(0, Math.floor((expiresAtMs - nowMs) / 1000));
+      const verificationStatus = mismatch
+        ? 'measurement_mismatch'
+        : verified && verifiedAtMs !== null
+          ? isStale
+            ? 'stale'
+            : 'verified'
+          : verificationError || verificationDocument
+            ? 'verification_failed'
+            : 'not_checked';
       return {
-        verified: verificationDocument?.securityVerified === true,
+        verified,
+        verificationStatus,
+        verifiedAt: verifiedAtMs === null ? null : new Date(verifiedAtMs).toISOString(),
+        expiresAt: expiresAtMs === null
+          ? null
+          : new Date(expiresAtMs).toISOString(),
+        freshnessSeconds,
         verificationDocument,
         error: verificationError ? String(verificationError.message || verificationError) : null,
       };

package/lib/server.js

@@ -2,28 +2,45 @@ import { createServer } from 'node:http';
 import { readFileSync } from 'node:fs';
 
 import { buildPrivateModeCacheScopeProof } from './cacheScope.js';
+import {
+  buildPrivateModeCatalogMismatchMessage,
+  buildPrivateModeCatalogUnavailableMessage,
+  checkHostedPrivateModeCatalog,
+  hasPrivateModeCatalogMismatch,
+} from './catalogCompatibility.js';
+import {
+  PRIVATE_MODE_DEFAULT_RESERVE_MAX_OUTPUT_TOKENS,
+  PRIVATE_MODE_STREAM_SOFT_DEADLINE_MS,
+} from './constants.js';
 import {
   buildPrivateModeOriginPolicy,
   getCorsHeadersForRequest,
 } from './originPolicy.js';
 import {
   applyPrivateModelRequestMutations,
-  buildPrivateModeSseContentDelta,
-  createPrivateModeReasoningContentSuppressor,
   shouldSuppressPrivateModelReasoning,
-  splitCompleteSseFrames,
-  suppressPrivateModeReasoningFromSseFrame,
   suppressPrivateModeReasoningFromJsonText,
 } from './requestTransforms.js';
 import {
   normalizePrivateModeUpstreamErrorMessage,
   readErrorMessage,
 } from './serverErrorNormalization.js';
+import {
+  PRIVATE_MODE_PROXY_VERSION,
+  PRIVATE_MODE_PROXY_VERSION_HEADER,
+} from './packageInfo.js';
 import {
   createSecureState,
   fetchWithSecureClientRecovery,
 } from './secureClientLifecycle.js';
-import { buildPrivateModeStatusContract } from './statusContract.js';
+import {
+  buildPrivateModeStatusContract,
+  buildPublicAttestationSummary,
+} from './statusContract.js';
+import {
+  isPrivateModeSseResponse,
+  pipePrivateModeSseResponse,
+} from './sseResponsePump.js';
 
 const MODELS = JSON.parse(
   readFileSync(new URL('../models/private-tee.json', import.meta.url), 'utf8'),
@@ -76,15 +93,18 @@ function openAIModelList() {
       object: 'model',
       created: model.created,
       owned_by: model.ownedBy,
+      ...(model.maxInputTokens ? { context_length: model.maxInputTokens } : {}),
       ...(model.maxOutputTokens ? { max_output_tokens: model.maxOutputTokens } : {}),
     })),
   };
 }
 
-export function privateModeStatus(apiBase, secureState, localBase, originPolicy) {
+export function privateModeStatus(apiBase, secureState, localBase, originPolicy, catalogCompatibility) {
+  const verificationState = secureState.getVerificationState();
   return {
     ok: true,
     mode: 'private_tee',
+    proxy_version: PRIVATE_MODE_PROXY_VERSION,
     apiBase,
     local_base_url: localBase,
     models_path: '/v1/models',
@@ -97,12 +117,19 @@ export function privateModeStatus(apiBase, secureState, localBase, originPolicy)
     response_body_encrypted: true,
     streaming: true,
     streaming_billing: 'precharged_reserve_with_verified_usage_refund',
+    // This deadline is enforced by the hosted route, not this process. A
+    // local environment override cannot configure the remote service.
+    streaming_soft_deadline_ms: PRIVATE_MODE_STREAM_SOFT_DEADLINE_MS,
+    default_stream_reserve_max_output_tokens: PRIVATE_MODE_DEFAULT_RESERVE_MAX_OUTPUT_TOKENS,
+    responses_api_supported: false,
+    batch_api_supported: false,
     api_local_proxy_required: true,
     browser_frontend_local_proxy_required: false,
-    ...buildPrivateModeStatusContract(),
+    ...buildPrivateModeStatusContract(verificationState),
     browser_origins_allowed: originPolicy.allowedOrigins,
     models: openAIModelList().data,
-    attestation: secureState.getVerificationState(),
+    catalog_compatibility: catalogCompatibility,
+    attestation: buildPublicAttestationSummary(verificationState),
   };
 }
 
@@ -174,6 +201,7 @@ async function runPreflight({ apiBase, apiKey, model, req, requestBodyBytes }) {
     headers: {
       authorization: `Bearer ${apiKey}`,
       'content-type': 'application/json',
+      [PRIVATE_MODE_PROXY_VERSION_HEADER]: PRIVATE_MODE_PROXY_VERSION,
       ...copyLocalHeaders(req),
     },
     body: JSON.stringify(preflightBody),
@@ -265,7 +293,7 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
   if (!model) {
     jsonResponse(res, 400, {
       error: {
-        message: `Unsupported private model "${body.model || ''}".`,
+        message: `Unsupported private model "${body.model || ''}" in @nanogpt/private-mode v${PRIVATE_MODE_PROXY_VERSION}. Check this proxy's /v1/models endpoint or restart with: NANOGPT_API_KEY=... npx --yes @nanogpt/private-mode@latest`,
         type: 'invalid_request_error',
         code: 'model_not_supported',
       },
@@ -276,6 +304,7 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
   const suppressReasoning = shouldSuppressPrivateModelReasoning(body, model);
   applyPrivateModelRequestMutations(body, model);
   const privateStreamRequested = body.stream === true;
+  const expectedChoiceCount = Number.isSafeInteger(body.n) && body.n > 0 ? body.n : 1;
 
   const privateRequestBody = JSON.stringify(body);
   const preflight = await runPreflight({
@@ -312,6 +341,7 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
           'x-nanogpt-private-model': model.id,
           'x-nanogpt-private-stream': privateStreamRequested ? 'true' : 'false',
           'x-nanogpt-private-cache-scope': buildPrivateModeCacheScopeProof(preflight.cacheScope),
+          [PRIVATE_MODE_PROXY_VERSION_HEADER]: PRIVATE_MODE_PROXY_VERSION,
           'x-query-source': 'api',
           ...copyLocalHeaders(req),
         },
@@ -360,59 +390,30 @@ async function handleChatCompletion({ apiBase, apiKey, secureState, req, res, co
     return;
   }
 
-  if (privateStreamRequested && response.body) {
+  if (isPrivateModeSseResponse(privateStreamRequested, response)) {
     res.writeHead(response.status, headers);
-    const reader = response.body.getReader();
-    const decoder = suppressReasoning ? new TextDecoder() : null;
-    const contentSuppressor = suppressReasoning
-      ? createPrivateModeReasoningContentSuppressor()
-      : null;
-    const sseChunkMetadata = {};
-    let sseBuffer = '';
-    let streamFailed = false;
     try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        if (res.destroyed) {
-          await reader.cancel('client disconnected');
-          upstreamAbortController.abort();
-          return;
-        }
-        if (!value) continue;
-        if (!suppressReasoning || !decoder || !contentSuppressor) {
-          res.write(Buffer.from(value));
-          continue;
-        }
-        sseBuffer += decoder.decode(value, { stream: true });
-        const { frames, remainder } = splitCompleteSseFrames(sseBuffer);
-        sseBuffer = remainder;
-        for (const frame of frames) {
-          res.write(`${suppressPrivateModeReasoningFromSseFrame(frame, contentSuppressor, sseChunkMetadata)}\n\n`);
-        }
-      }
-      if (suppressReasoning && decoder && contentSuppressor) {
-        sseBuffer += decoder.decode();
-        if (sseBuffer) {
-          res.write(`${suppressPrivateModeReasoningFromSseFrame(sseBuffer, contentSuppressor, sseChunkMetadata)}\n\n`);
-        }
-        const flushedContent = contentSuppressor.flush();
-        if (flushedContent) {
-          const finalDelta = buildPrivateModeSseContentDelta(flushedContent, sseChunkMetadata);
-          res.write(`data: ${finalDelta}\n\n`);
-        }
+      const outcome = await pipePrivateModeSseResponse({
+        body: response.body,
+        res,
+        suppressReasoning,
+        upstreamAbortController,
+        expectedChoiceCount,
+      });
+      // Successful completion and downstream disconnect still count as
+      // activity. Truncated or transport-failed streams keep the prior failure
+      // behavior and do not refresh the secure-client lifecycle.
+      if (!outcome.transportFailed && !outcome.streamFailed) {
+        secureState.markClientUsed(responseClient);
       }
     } catch (error) {
-      streamFailed = true;
       upstreamAbortController.abort();
       if (!res.destroyed) {
-        res.destroy(error instanceof Error ? error : new Error(String(error)));
+        process.stderr.write(`Private Mode stream pump failed: ${error instanceof Error ? error.message : String(error)}\n`);
       }
-      return;
     } finally {
       responseComplete = true;
-      if (!streamFailed) secureState.markClientUsed(responseClient);
-      if (!streamFailed && !res.writableEnded && !res.destroyed) res.end();
+      if (!res.writableEnded && !res.destroyed) res.end();
     }
     return;
   }
@@ -468,6 +469,19 @@ function handleOptions(req, res, corsHeaders) {
 
 export async function startPrivateModeProxy(options) {
   const apiBase = normalizeApiBase(options.apiBase);
+  const catalogCompatibility = await checkHostedPrivateModeCatalog({
+    apiBase,
+    localModels: MODELS,
+  });
+  if (catalogCompatibility.status === 'unavailable') {
+    throw new Error(buildPrivateModeCatalogUnavailableMessage(catalogCompatibility, apiBase));
+  }
+  if (hasPrivateModeCatalogMismatch(catalogCompatibility)) {
+    throw new Error(buildPrivateModeCatalogMismatchMessage(
+      catalogCompatibility,
+      PRIVATE_MODE_PROXY_VERSION,
+    ));
+  }
   const secureState = createSecureState(apiBase);
   const localBase = `http://${options.host}:${options.port}/v1`;
   const originPolicy = buildPrivateModeOriginPolicy(options);
@@ -493,7 +507,7 @@ export async function startPrivateModeProxy(options) {
       }
 
       if (req.method === 'GET' && url.pathname === '/health') {
-        jsonResponse(res, 200, privateModeStatus(apiBase, secureState, localBase, originPolicy), corsHeaders);
+        jsonResponse(res, 200, privateModeStatus(apiBase, secureState, localBase, originPolicy, catalogCompatibility), corsHeaders);
         return;
       }
 
@@ -503,7 +517,7 @@ export async function startPrivateModeProxy(options) {
       }
 
       if (req.method === 'GET' && url.pathname === '/v1/private-mode/status') {
-        jsonResponse(res, 200, privateModeStatus(apiBase, secureState, localBase, originPolicy), corsHeaders);
+        jsonResponse(res, 200, privateModeStatus(apiBase, secureState, localBase, originPolicy, catalogCompatibility), corsHeaders);
         return;
       }
 
@@ -539,7 +553,7 @@ export async function startPrivateModeProxy(options) {
       }
 
       if (req.method === 'GET' && url.pathname === '/') {
-        textResponse(res, 200, `NanoGPT Private Mode Proxy\nOpenAI base URL: ${localBase}\nStatus: /v1/private-mode/status\n`, corsHeaders);
+        textResponse(res, 200, `NanoGPT Private Mode Proxy v${PRIVATE_MODE_PROXY_VERSION}\nOpenAI base URL: ${localBase}\nStatus: /v1/private-mode/status\n`, corsHeaders);
         return;
       }
 
@@ -567,6 +581,7 @@ export async function startPrivateModeProxy(options) {
 
   if (options.quiet !== true) {
     process.stdout.write(`NanoGPT Private Mode Proxy
+Version: ${PRIVATE_MODE_PROXY_VERSION}
 Local base URL: ${localBase}
 NanoGPT API: ${apiBase}
 Models: ${MODELS.map((model) => model.id).join(', ')}

package/lib/sseResponsePump.js

@@ -0,0 +1,163 @@
+import {
+  buildPrivateModeSseContentDelta,
+  createPrivateModeReasoningContentSuppressor,
+  createPrivateModeSseTerminalGuard,
+  splitCompleteSseFrames,
+  suppressPrivateModeReasoningFromSseFrame,
+} from './requestTransforms.js';
+
+const MAX_SSE_FRAME_BYTES = 2 * 1024 * 1024;
+const DEFAULT_DOWNSTREAM_DRAIN_TIMEOUT_MS = 60 * 1000;
+
+function assertSseFrameWithinLimit(frame) {
+  if (Buffer.byteLength(frame, 'utf8') > MAX_SSE_FRAME_BYTES) {
+    throw new Error('Private Mode upstream SSE frame exceeded the proxy buffer limit.');
+  }
+}
+
+export function isPrivateModeSseResponse(streamRequested, response) {
+  const contentType = response?.headers?.get?.('content-type') || '';
+  return streamRequested === true
+    && Boolean(response?.body)
+    && contentType.toLowerCase().includes('text/event-stream');
+}
+
+function writeWithBackpressure(res, chunk, timeoutMs) {
+  if (res.destroyed || res.writableEnded) return Promise.resolve(false);
+  try {
+    if (res.write(chunk)) return Promise.resolve(true);
+  } catch {
+    return Promise.resolve(false);
+  }
+
+  return new Promise((resolve) => {
+    let drainTimer;
+    const cleanup = () => {
+      if (drainTimer) clearTimeout(drainTimer);
+      res.off('drain', onDrain);
+      res.off('close', onClose);
+      res.off('error', onError);
+    };
+    const settle = (writable) => {
+      cleanup();
+      resolve(writable);
+    };
+    const onDrain = () => settle(!res.destroyed && !res.writableEnded);
+    const onClose = () => settle(false);
+    const onError = () => settle(false);
+    res.once('drain', onDrain);
+    res.once('close', onClose);
+    res.once('error', onError);
+    drainTimer = setTimeout(() => settle(false), timeoutMs);
+    drainTimer.unref?.();
+  });
+}
+
+export async function pipePrivateModeSseResponse({
+  body,
+  res,
+  suppressReasoning,
+  upstreamAbortController,
+  expectedChoiceCount = 1,
+  downstreamDrainTimeoutMs = DEFAULT_DOWNSTREAM_DRAIN_TIMEOUT_MS,
+}) {
+  let reader;
+  const decoder = new TextDecoder();
+  const contentSuppressor = suppressReasoning
+    ? createPrivateModeReasoningContentSuppressor()
+    : null;
+  const terminalGuard = createPrivateModeSseTerminalGuard(expectedChoiceCount);
+  const sseChunkMetadata = {};
+  let sseBuffer = '';
+  let transportFailed = false;
+
+  const writeFrame = async (frame) => {
+    if (!frame) return true;
+    return writeWithBackpressure(res, `${frame}\n\n`, downstreamDrainTimeoutMs);
+  };
+  const forwardFrame = async (frame) => {
+    const forwarded = suppressReasoning && contentSuppressor
+      ? suppressPrivateModeReasoningFromSseFrame(frame, contentSuppressor, sseChunkMetadata)
+      : frame;
+    return writeFrame(terminalGuard.observe(frame, forwarded));
+  };
+  const finishStream = async () => {
+    // A complete terminal sequence may be released before transport EOF.
+    // Never append a defensive suppressor flush after that marker.
+    if (contentSuppressor && !terminalGuard.hasEmittedDone()) {
+      const flushedContent = contentSuppressor.flush();
+      if (flushedContent) {
+        const delta = buildPrivateModeSseContentDelta(flushedContent, sseChunkMetadata);
+        if (!await writeFrame(`data: ${delta}`)) return null;
+      }
+    }
+    const terminal = terminalGuard.finish();
+    if (!await writeFrame(terminal.frame)) return null;
+    return terminal;
+  };
+
+  try {
+    reader = body.getReader();
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (res.destroyed || res.writableEnded) {
+        await reader.cancel('client disconnected').catch(() => {});
+        upstreamAbortController.abort();
+        return { streamFailed: false, clientDisconnected: true, transportFailed: false };
+      }
+      if (!value) continue;
+      sseBuffer += decoder.decode(value, { stream: true });
+      const { frames, remainder } = splitCompleteSseFrames(sseBuffer);
+      sseBuffer = remainder;
+      assertSseFrameWithinLimit(sseBuffer);
+      for (const frame of frames) {
+        assertSseFrameWithinLimit(frame);
+        if (!await forwardFrame(frame)) {
+          await reader.cancel('client disconnected').catch(() => {});
+          upstreamAbortController.abort();
+          return { streamFailed: false, clientDisconnected: true, transportFailed: false };
+        }
+      }
+    }
+    sseBuffer += decoder.decode();
+    if (sseBuffer && !await forwardFrame(sseBuffer)) {
+      await reader.cancel('client disconnected').catch(() => {});
+      upstreamAbortController.abort();
+      return { streamFailed: false, clientDisconnected: true, transportFailed: false };
+    }
+  } catch (error) {
+    transportFailed = true;
+    upstreamAbortController.abort();
+    process.stderr.write(`Private Mode upstream stream failed: ${error instanceof Error ? error.message : String(error)}\n`);
+  }
+
+  if (res.destroyed || res.writableEnded) {
+    upstreamAbortController.abort();
+    return { streamFailed: false, clientDisconnected: true, transportFailed };
+  }
+
+  let terminal;
+  try {
+    terminal = await finishStream();
+  } catch (error) {
+    transportFailed = true;
+    upstreamAbortController.abort();
+    process.stderr.write(`Private Mode stream finalization failed: ${error instanceof Error ? error.message : String(error)}\n`);
+    if (!terminalGuard.hasEmittedDone()) {
+      await writeFrame(`data: ${JSON.stringify({
+        error: {
+          message: 'Private Mode stream ended before a complete terminal sequence. The response may be partial; retry the request.',
+          type: 'api_error',
+          code: 'private_stream_incomplete',
+        },
+      })}`);
+    }
+    return { streamFailed: true, clientDisconnected: false, transportFailed };
+  }
+  if (!terminal) {
+    upstreamAbortController.abort();
+    return { streamFailed: false, clientDisconnected: true, transportFailed };
+  }
+  return { streamFailed: !terminal.complete, clientDisconnected: false, transportFailed };
+}

package/lib/statusContract.js

@@ -1,3 +1,5 @@
+import { createHash } from 'node:crypto';
+
 export const PRIVATE_MODE_FRONTEND_SUPPORTED_FEATURES = Object.freeze([
   'text_chat',
   'streaming',
@@ -43,12 +45,88 @@ export const PRIVATE_MODE_PLAINTEXT_VISIBLE_TO = Object.freeze([
   'verified_tee_target',
 ]);
 
-export function buildPrivateModeStatusContract() {
+export const PRIVATE_MODE_KNOWN_LIMITATIONS = Object.freeze([
+  'NanoGPT still observes account, routing, timing, size, status, and usage metadata.',
+  'Provider-reported usage metrics are trusted for billing and are not end-to-end signed.',
+  'A verification receipt does not prove usage correctness, prompt non-retention, or response content authenticity on its own.',
+  'Verification receipts are browser-generated and unsigned; the hashed request identifier is for opaque correlation, not proof of server issuance.',
+  'NanoGPT does not implement attestation-gated KMS release of upstream credentials; the inference enclave is provider-operated.',
+]);
+
+const PRIVATE_MODE_VERIFICATION_STATUSES = new Set([
+  'verified',
+  'unavailable',
+  'stale',
+  'measurement_mismatch',
+  'verification_failed',
+  'unsupported',
+  'not_checked',
+]);
+
+function stringIdentifier(value) {
+  return typeof value === 'string' && value.trim() ? value.trim().slice(0, 512) : undefined;
+}
+
+function publicKeyFingerprint(value) {
+  return typeof value === 'string' && value
+    ? createHash('sha256').update(value).digest('hex')
+    : undefined;
+}
+
+export function buildPublicAttestationSummary(verificationState = {}) {
+  return {
+    verified: verificationState.verified === true,
+    verificationStatus: verificationState.verificationStatus,
+    verifiedAt: verificationState.verifiedAt,
+    expiresAt: verificationState.expiresAt,
+    freshnessSeconds: verificationState.freshnessSeconds,
+    error: verificationState.error ? 'Private Mode attestation failed.' : null,
+  };
+}
+
+export function buildPrivateModeStatusContract(verificationState = {}) {
+  const verificationStatus = PRIVATE_MODE_VERIFICATION_STATUSES.has(verificationState.verificationStatus)
+    ? verificationState.verificationStatus
+    : 'not_checked';
+  const document = verificationState.verificationDocument || {};
+  const keyFingerprint = publicKeyFingerprint(document.hpkePublicKey);
   return {
     frontend_supported_features: [...PRIVATE_MODE_FRONTEND_SUPPORTED_FEATURES],
     frontend_disabled_features: [...PRIVATE_MODE_FRONTEND_DISABLED_FEATURES],
     nanogpt_visible: [...PRIVATE_MODE_NANOGPT_VISIBLE],
     encrypted_from_nanogpt: [...PRIVATE_MODE_ENCRYPTED_FROM_NANOGPT],
     plaintext_visible_to: [...PRIVATE_MODE_PLAINTEXT_VISIBLE_TO],
+    assurance: {
+      contract_version: 1,
+      assurance_level: 'private_mode',
+      transport: 'ehbp',
+      verification_status: verificationStatus,
+      eligible: verificationStatus === 'verified',
+      verified_by: verificationState.verifiedAt || verificationStatus !== 'not_checked'
+        ? ['local_proxy:tinfoil-js']
+        : [],
+      ...(verificationState.verifiedAt ? { verified_at: verificationState.verifiedAt } : {}),
+      ...(verificationState.expiresAt ? { expires_at: verificationState.expiresAt } : {}),
+      ...(Number.isFinite(verificationState.freshnessSeconds)
+        ? { freshness_seconds: Math.max(0, Math.floor(verificationState.freshnessSeconds)) }
+        : {}),
+      ...(stringIdentifier(document.codeFingerprint)
+        ? { expected_measurement: stringIdentifier(document.codeFingerprint) }
+        : {}),
+      ...(stringIdentifier(document.enclaveFingerprint)
+        ? { observed_measurement: stringIdentifier(document.enclaveFingerprint) }
+        : {}),
+      ...(stringIdentifier(document.releaseDigest)
+        ? { release_digest: stringIdentifier(document.releaseDigest) }
+        : {}),
+      ...(keyFingerprint ? { public_key_fingerprint: keyFingerprint } : {}),
+      receipt_available: true,
+      verifier: { name: 'tinfoil-js', version: '1.1.12' },
+      documentation_url: 'https://nano-gpt.com/private-mode-verification',
+      known_limitations: [...PRIVATE_MODE_KNOWN_LIMITATIONS],
+      ...(verificationStatus !== 'verified' && verificationStatus !== 'not_checked'
+        ? { error_code: verificationStatus }
+        : {}),
+    },
   };
 }

package/lib/verifyReceipt.js

@@ -2,6 +2,9 @@ import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { fetchAttestationBundle, Verifier } from 'tinfoil';
 
+const PRIVATE_MODE_ATTESTATION_MAX_AGE_MS = 5 * 60 * 1000;
+const PRIVATE_MODE_RECEIPT_CLOCK_SKEW_MS = 60 * 1000;
+
 function isRecord(value) {
   return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
@@ -84,7 +87,7 @@ function assertReceiptFlag(failures, label, value) {
 }
 
 export async function verifyPrivateModeReceipt(receipt) {
-  if (!isRecord(receipt) || receipt.schemaVersion !== 1) {
+  if (!isRecord(receipt) || (receipt.schemaVersion !== 1 && receipt.schemaVersion !== 2)) {
     throw new Error('Unsupported or invalid Private Mode receipt.');
   }
 
@@ -113,6 +116,29 @@ export async function verifyPrivateModeReceipt(receipt) {
   if (receipt.status !== 'verified') {
     failures.push(`Receipt status is ${receipt.status || 'missing'}; expected verified.`);
   }
+  if (receipt.schemaVersion === 2) {
+    if (receipt.assuranceLevel !== 'private_mode') {
+      failures.push('Receipt assurance level is not private_mode.');
+    }
+    const verifiedAt = Date.parse(receipt.verifiedAt);
+    const expiresAt = Date.parse(receipt.expiresAt);
+    const now = Date.now();
+    if (
+      !Number.isFinite(verifiedAt)
+      || !Number.isFinite(expiresAt)
+      || expiresAt <= verifiedAt
+      || expiresAt - verifiedAt > PRIVATE_MODE_ATTESTATION_MAX_AGE_MS
+      || verifiedAt > now + PRIVATE_MODE_RECEIPT_CLOCK_SKEW_MS
+    ) {
+      failures.push('Receipt freshness timestamps are invalid.');
+    } else if (expiresAt <= now) {
+      warnings.push('Receipt attestation freshness window has expired; fresh evidence was verified again now.');
+    }
+    const requestIdSha256 = receipt.response?.requestIdSha256;
+    if (requestIdSha256 !== undefined && !/^[a-f0-9]{64}$/i.test(requestIdSha256)) {
+      failures.push('Request identifier binding is not a SHA-256 digest.');
+    }
+  }
 
   const encryption = isRecord(receipt.encryption) ? receipt.encryption : {};
   if (encryption.transport !== 'EHBP') {
@@ -126,6 +152,16 @@ export async function verifyPrivateModeReceipt(receipt) {
   assertRequiredEqual(failures, 'Runtime measurement', doc?.enclaveFingerprint, receipt.verifier?.enclaveFingerprint);
   assertRequiredEqual(failures, 'Release digest', doc?.releaseDigest, receipt.verifier?.releaseDigest);
   assertRequiredEqual(failures, 'HPKE public key', doc?.hpkePublicKey, receipt.verifier?.hpkePublicKey);
+  if (receipt.schemaVersion === 2) {
+    assertRequiredEqual(
+      failures,
+      'HPKE public-key fingerprint',
+      isNonEmptyString(doc?.hpkePublicKey)
+        ? createHash('sha256').update(doc.hpkePublicKey).digest('hex')
+        : undefined,
+      receipt.verifier?.hpkePublicKeySha256,
+    );
+  }
   assertOptionalEqual(warnings, 'Attestation bundle SHA-256', attestationBundleSha256, receipt.verifier?.attestationBundleSha256);
 
   return {
@@ -137,6 +173,7 @@ export async function verifyPrivateModeReceipt(receipt) {
     enclaveFingerprint: doc?.enclaveFingerprint,
     attestationBundleSha256,
     verificationDocumentSha256,
+    schemaVersion: receipt.schemaVersion,
   };
 }
 
@@ -155,6 +192,7 @@ export async function verifyPrivateModeReceiptCli(positionals, io = process) {
   }
 
   io.stdout.write('Private Mode receipt verified.\n');
+  io.stdout.write(`Receipt schema: v${result.schemaVersion}\n`);
   io.stdout.write(`Enclave: ${result.enclaveURL}\n`);
   io.stdout.write(`Expected measurement: ${result.codeFingerprint}\n`);
   io.stdout.write(`Runtime measurement: ${result.enclaveFingerprint}\n`);

package/models/private-tee.json

@@ -1,11 +1,13 @@
 [
   {
     "id": "private/deepseek-v4-flash",
-    "name": "DeepSeek V4 Flash Private",
+    "name": "DeepSeek V4 Flash 0731 Private",
     "upstreamModel": "deepseek-v4-flash",
     "billingModel": "private/deepseek-v4-flash",
+    "providerPricingModel": "TEE/deepseek-v4-flash",
     "teeTargetModel": "deepseek-v4-flash",
     "thinkingMode": "deepseek-v4",
+    "maxInputTokens": 1048576,
     "maxOutputTokens": 1048576,
     "created": 1786406400,
     "ownedBy": "nanogpt-private-mode",
@@ -16,8 +18,10 @@
     "name": "Kimi K3 Private",
     "upstreamModel": "kimi-k3",
     "billingModel": "TEE/kimi-k3",
+    "providerPricingModel": "TEE/kimi-k3",
     "teeTargetModel": "kimi-k3",
-    "maxOutputTokens": 1048576,
+    "maxInputTokens": 256000,
+    "maxOutputTokens": 256000,
     "created": 1786147200,
     "ownedBy": "nanogpt-private-mode",
     "aliases": ["TEE/kimi-k3"]
@@ -27,6 +31,7 @@
     "name": "GPT OSS 120B Private",
     "upstreamModel": "gpt-oss-120b",
     "billingModel": "TEE/gpt-oss-120b",
+    "providerPricingModel": "openai/gpt-oss-120b",
     "teeTargetModel": "gpt-oss-120b",
     "created": 1764547200,
     "ownedBy": "nanogpt-private-mode",
@@ -37,6 +42,7 @@
     "name": "Llama 3.3 70B Private",
     "upstreamModel": "llama3-3-70b",
     "billingModel": "TEE/llama3-3-70b",
+    "providerPricingModel": "meta-llama/llama-3.3-70b-instruct",
     "teeTargetModel": "llama3-3-70b",
     "created": 1764547200,
     "ownedBy": "nanogpt-private-mode",
@@ -47,8 +53,11 @@
     "name": "GLM 5.2 Private",
     "upstreamModel": "glm-5-2",
     "billingModel": "TEE/glm-5-2",
+    "providerPricingModel": "TEE/glm-5.2",
     "teeTargetModel": "glm-5-2",
     "thinkingMode": "glm-5.2",
+    "maxInputTokens": 393216,
+    "maxOutputTokens": 131072,
     "created": 1781827200,
     "ownedBy": "nanogpt-private-mode",
     "aliases": ["private/glm-5.2", "TEE/glm-5-2", "TEE/glm-5.2"]
@@ -58,8 +67,11 @@
     "name": "GLM 5.2 Thinking Private",
     "upstreamModel": "glm-5-2",
     "billingModel": "TEE/glm-5-2:thinking",
+    "providerPricingModel": "TEE/glm-5.2:thinking",
     "teeTargetModel": "glm-5-2",
     "thinkingMode": "glm-5.2",
+    "maxInputTokens": 393216,
+    "maxOutputTokens": 131072,
     "created": 1781827200,
     "ownedBy": "nanogpt-private-mode",
     "aliases": ["private/glm-5.2:thinking", "TEE/glm-5-2:thinking", "TEE/glm-5.2:thinking"]
@@ -69,6 +81,7 @@
     "name": "Gemma 4 31B Private",
     "upstreamModel": "gemma4-31b",
     "billingModel": "TEE/gemma4-31b",
+    "providerPricingModel": "TEE/gemma4-31b",
     "teeTargetModel": "gemma4-31b",
     "thinkingMode": "gemma",
     "created": 1764547200,
@@ -80,6 +93,7 @@
     "name": "Gemma 4 31B Thinking Private",
     "upstreamModel": "gemma4-31b",
     "billingModel": "TEE/gemma4-31b:thinking",
+    "providerPricingModel": "TEE/gemma4-31b:thinking",
     "teeTargetModel": "gemma4-31b",
     "thinkingMode": "gemma",
     "created": 1764547200,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanogpt/private-mode",
-  "version": "0.2.8",
+  "version": "0.2.11",
   "description": "OpenAI-compatible localhost proxy for NanoGPT Private Mode.",
   "type": "module",
   "publishConfig": {
@@ -13,11 +13,15 @@
   "files": [
     "bin",
     "lib/cacheScope.js",
+    "lib/catalogCompatibility.js",
+    "lib/constants.js",
     "lib/originPolicy.js",
+    "lib/packageInfo.js",
     "lib/requestTransforms.js",
     "lib/secureClientLifecycle.js",
     "lib/server.js",
     "lib/serverErrorNormalization.js",
+    "lib/sseResponsePump.js",
     "lib/statusContract.js",
     "lib/verifyReceipt.js",
     "models",