@opendatalabs/personal-server-ts-core 0.0.1-canary.016adf9 → 0.0.1-canary.052d47e

package/dist/test-utils/e2ee-fixtures.d.ts

@@ -0,0 +1,94 @@
+/**
+ * A real `GET /v1/aci/attestation?nonce=...` report captured from
+ * https://inference.phala.com on 2026-08-28 (the TDX quote, event log,
+ * app compose and vm config are omitted: they are not part of the
+ * structural binding chain). The nonce below is the one the report was
+ * requested with, so `report_data` recomputes from the keyset digest.
+ */
+export declare const LIVE_ACI_ATTESTATION_NONCE = "434fe0866976bf566484a1f11dbb0a55d9d4554b84f25ccd1ddd9095375722b1";
+/** Unix seconds inside the fixture keyset's validity window. */
+export declare const LIVE_ACI_ATTESTATION_CLOCK_S = 1788220800;
+export declare const LIVE_ACI_X25519_PUBLIC_KEY_HEX = "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537";
+export declare const LIVE_ACI_ATTESTATION_REPORT: {
+    readonly api_version: "aci/1";
+    readonly workload_keyset_digest: "sha256:4f3dc45eeb18a5aefa49dfe5c0f2b6dbc77dd37276adc0cee87f1c1f70b73072";
+    readonly attestation: {
+        readonly tee_type: "tdx";
+        readonly workload_keyset: {
+            readonly subject: null;
+            readonly not_after: 1790498751;
+            readonly receipt_signing_keys: readonly [{
+                readonly key_id: "dstack-kms-receipt-ed25519-v1";
+                readonly algo: "ed25519";
+                readonly public_key: "110f3824daeeef29dbeba9677a5794ffed257b1082d9fd4599b3c0819953aa0a";
+            }];
+            readonly e2ee_public_keys: readonly [{
+                readonly key_id: "dstack-kms-e2ee-v1";
+                readonly algo: "secp256k1-aes-256-gcm-hkdf-sha256";
+                readonly public_key: "04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d";
+            }, {
+                readonly key_id: "dstack-kms-e2ee-x25519-v1";
+                readonly algo: "x25519-aes-256-gcm-hkdf-sha256";
+                readonly public_key: "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537";
+            }];
+            readonly tls_public_keys: readonly [{
+                readonly spki_sha256: "4586d125aaef3d1b33a3c34f12a5c235af3016dddd35e56a99b6b3ed3ba57dcb";
+                readonly domain: "tee.redpill.ai";
+            }, {
+                readonly spki_sha256: "8e89a8a01e12098065037be187dcd2f03071dc1e7c9bb8527160f4c56ebc728f";
+                readonly domain: "inference.phala.com";
+            }, {
+                readonly spki_sha256: "e52fdca52c039def33e51cd2b5eded43eae1949030e47866f5f09e90b6940a88";
+                readonly domain: "api.redpill.ai";
+            }];
+        };
+        readonly report_data: "9ba90c1e314b8feb6c48be5de2f6b41d7174103056845e27d6e835c4202e5954";
+        readonly source_provenance: {
+            readonly repo_url: "https://github.com/Dstack-TEE/private-ai-gateway.git";
+            readonly repo_commit: "d567f6b4c4d93e33037ea202db04db86a8ad881c";
+            readonly image_digest: null;
+            readonly image_provenance: null;
+        };
+        readonly evidence: {
+            readonly quote_report_data: "9ba90c1e314b8feb6c48be5de2f6b41d7174103056845e27d6e835c4202e59540000000000000000000000000000000000000000000000000000000000000000";
+            readonly key_custody: {
+                readonly provider: "dstack-kms";
+                readonly keys: readonly [{
+                    readonly role: "receipt";
+                    readonly path: "aci/receipt-ed25519/v1";
+                    readonly purpose: "aci.receipt.ed25519.v1";
+                    readonly algo: "ed25519";
+                    readonly public_key: "110f3824daeeef29dbeba9677a5794ffed257b1082d9fd4599b3c0819953aa0a";
+                    readonly kms_public_key: "02f7fb3ed8c352d316dfdc19458a9f29c06eb7e74130b3808d784e2fd401a2c12d";
+                    readonly signature_chain: readonly ["d1f59335effc2688acdf502ee34d8d3373b0e7e6be493075383714ce5673a29973f224690437c483ae3fdd37172df3abad82877c4023ed7c5a64d5acaf18477c00", "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501"];
+                }, {
+                    readonly role: "e2ee-secp256k1";
+                    readonly path: "aci/e2ee/v1";
+                    readonly purpose: "aci.e2ee.v1";
+                    readonly algo: "secp256k1-aes-256-gcm-hkdf-sha256";
+                    readonly public_key: "04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d";
+                    readonly kms_public_key: "03943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f";
+                    readonly signature_chain: readonly ["452d6f86a807fef0ce0d65e6c5cd25a0a249b1fd8608d26c3efe17fc10346f4c2d3dfb8969d10dc1feac1d595b3816f63faa40ac370a3a233ce1d712d418c89701", "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501"];
+                }, {
+                    readonly role: "e2ee-x25519";
+                    readonly path: "aci/e2ee-x25519/v1";
+                    readonly purpose: "aci.e2ee.x25519.v1";
+                    readonly algo: "x25519-aes-256-gcm-hkdf-sha256";
+                    readonly public_key: "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537";
+                    readonly kms_public_key: "03892f86b3f55f78cc0760cec933cf8e2a92862fb173c2d221cc25895847cbb5eb";
+                    readonly signature_chain: readonly ["358cd661ca4f5e986ed950ca083bf7bcfef6ab4b839ca11a953b156d64f82b1c51a213730d5777b4c845170827680d41e8220c2f950a38081025ff16eb3789ba00", "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501"];
+                }];
+            };
+            readonly downstream_tls_binding: {
+                readonly domain: "inference.phala.com";
+                readonly spki_sha256: "8e89a8a01e12098065037be187dcd2f03071dc1e7c9bb8527160f4c56ebc728f";
+            };
+            readonly quote: "<omitted in fixture>";
+        };
+    };
+    readonly service_capabilities: {
+        readonly supported_e2ee_versions: readonly ["2"];
+        readonly serving: "aggregator";
+    };
+};
+//# sourceMappingURL=e2ee-fixtures.d.ts.map

package/dist/test-utils/e2ee-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-fixtures.d.ts","sourceRoot":"","sources":["../../src/test-utils/e2ee-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,0BAA0B,qEAC6B,CAAC;AAErE,gEAAgE;AAChE,eAAO,MAAM,4BAA4B,aAAa,CAAC;AAEvD,eAAO,MAAM,8BAA8B,qEACyB,CAAC;AAErE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuH9B,CAAC"}

package/dist/test-utils/e2ee-fixtures.js

@@ -0,0 +1,116 @@
+/**
+ * A real `GET /v1/aci/attestation?nonce=...` report captured from
+ * https://inference.phala.com on 2026-08-28 (the TDX quote, event log,
+ * app compose and vm config are omitted: they are not part of the
+ * structural binding chain). The nonce below is the one the report was
+ * requested with, so `report_data` recomputes from the keyset digest.
+ */
+export const LIVE_ACI_ATTESTATION_NONCE = "434fe0866976bf566484a1f11dbb0a55d9d4554b84f25ccd1ddd9095375722b1";
+/** Unix seconds inside the fixture keyset's validity window. */
+export const LIVE_ACI_ATTESTATION_CLOCK_S = 1788220800;
+export const LIVE_ACI_X25519_PUBLIC_KEY_HEX = "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537";
+export const LIVE_ACI_ATTESTATION_REPORT = {
+    api_version: "aci/1",
+    workload_keyset_digest: "sha256:4f3dc45eeb18a5aefa49dfe5c0f2b6dbc77dd37276adc0cee87f1c1f70b73072",
+    attestation: {
+        tee_type: "tdx",
+        workload_keyset: {
+            subject: null,
+            not_after: 1790498751,
+            receipt_signing_keys: [
+                {
+                    key_id: "dstack-kms-receipt-ed25519-v1",
+                    algo: "ed25519",
+                    public_key: "110f3824daeeef29dbeba9677a5794ffed257b1082d9fd4599b3c0819953aa0a",
+                },
+            ],
+            e2ee_public_keys: [
+                {
+                    key_id: "dstack-kms-e2ee-v1",
+                    algo: "secp256k1-aes-256-gcm-hkdf-sha256",
+                    public_key: "04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d",
+                },
+                {
+                    key_id: "dstack-kms-e2ee-x25519-v1",
+                    algo: "x25519-aes-256-gcm-hkdf-sha256",
+                    public_key: "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537",
+                },
+            ],
+            tls_public_keys: [
+                {
+                    spki_sha256: "4586d125aaef3d1b33a3c34f12a5c235af3016dddd35e56a99b6b3ed3ba57dcb",
+                    domain: "tee.redpill.ai",
+                },
+                {
+                    spki_sha256: "8e89a8a01e12098065037be187dcd2f03071dc1e7c9bb8527160f4c56ebc728f",
+                    domain: "inference.phala.com",
+                },
+                {
+                    spki_sha256: "e52fdca52c039def33e51cd2b5eded43eae1949030e47866f5f09e90b6940a88",
+                    domain: "api.redpill.ai",
+                },
+            ],
+        },
+        report_data: "9ba90c1e314b8feb6c48be5de2f6b41d7174103056845e27d6e835c4202e5954",
+        source_provenance: {
+            repo_url: "https://github.com/Dstack-TEE/private-ai-gateway.git",
+            repo_commit: "d567f6b4c4d93e33037ea202db04db86a8ad881c",
+            image_digest: null,
+            image_provenance: null,
+        },
+        evidence: {
+            quote_report_data: "9ba90c1e314b8feb6c48be5de2f6b41d7174103056845e27d6e835c4202e59540000000000000000000000000000000000000000000000000000000000000000",
+            key_custody: {
+                provider: "dstack-kms",
+                keys: [
+                    {
+                        role: "receipt",
+                        path: "aci/receipt-ed25519/v1",
+                        purpose: "aci.receipt.ed25519.v1",
+                        algo: "ed25519",
+                        public_key: "110f3824daeeef29dbeba9677a5794ffed257b1082d9fd4599b3c0819953aa0a",
+                        kms_public_key: "02f7fb3ed8c352d316dfdc19458a9f29c06eb7e74130b3808d784e2fd401a2c12d",
+                        signature_chain: [
+                            "d1f59335effc2688acdf502ee34d8d3373b0e7e6be493075383714ce5673a29973f224690437c483ae3fdd37172df3abad82877c4023ed7c5a64d5acaf18477c00",
+                            "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501",
+                        ],
+                    },
+                    {
+                        role: "e2ee-secp256k1",
+                        path: "aci/e2ee/v1",
+                        purpose: "aci.e2ee.v1",
+                        algo: "secp256k1-aes-256-gcm-hkdf-sha256",
+                        public_key: "04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d",
+                        kms_public_key: "03943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f",
+                        signature_chain: [
+                            "452d6f86a807fef0ce0d65e6c5cd25a0a249b1fd8608d26c3efe17fc10346f4c2d3dfb8969d10dc1feac1d595b3816f63faa40ac370a3a233ce1d712d418c89701",
+                            "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501",
+                        ],
+                    },
+                    {
+                        role: "e2ee-x25519",
+                        path: "aci/e2ee-x25519/v1",
+                        purpose: "aci.e2ee.x25519.v1",
+                        algo: "x25519-aes-256-gcm-hkdf-sha256",
+                        public_key: "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537",
+                        kms_public_key: "03892f86b3f55f78cc0760cec933cf8e2a92862fb173c2d221cc25895847cbb5eb",
+                        signature_chain: [
+                            "358cd661ca4f5e986ed950ca083bf7bcfef6ab4b839ca11a953b156d64f82b1c51a213730d5777b4c845170827680d41e8220c2f950a38081025ff16eb3789ba00",
+                            "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501",
+                        ],
+                    },
+                ],
+            },
+            downstream_tls_binding: {
+                domain: "inference.phala.com",
+                spki_sha256: "8e89a8a01e12098065037be187dcd2f03071dc1e7c9bb8527160f4c56ebc728f",
+            },
+            quote: "<omitted in fixture>",
+        },
+    },
+    service_capabilities: {
+        supported_e2ee_versions: ["2"],
+        serving: "aggregator",
+    },
+};
+//# sourceMappingURL=e2ee-fixtures.js.map

package/dist/test-utils/e2ee-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-fixtures.js","sourceRoot":"","sources":["../../src/test-utils/e2ee-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,0BAA0B,GACrC,kEAAkE,CAAC;AAErE,gEAAgE;AAChE,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEvD,MAAM,CAAC,MAAM,8BAA8B,GACzC,kEAAkE,CAAC;AAErE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,WAAW,EAAE,OAAO;IACpB,sBAAsB,EACpB,yEAAyE;IAC3E,WAAW,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,eAAe,EAAE;YACf,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,UAAU;YACrB,oBAAoB,EAAE;gBACpB;oBACE,MAAM,EAAE,+BAA+B;oBACvC,IAAI,EAAE,SAAS;oBACf,UAAU,EACR,kEAAkE;iBACrE;aACF;YACD,gBAAgB,EAAE;gBAChB;oBACE,MAAM,EAAE,oBAAoB;oBAC5B,IAAI,EAAE,mCAAmC;oBACzC,UAAU,EACR,oIAAoI;iBACvI;gBACD;oBACE,MAAM,EAAE,2BAA2B;oBACnC,IAAI,EAAE,gCAAgC;oBACtC,UAAU,EACR,kEAAkE;iBACrE;aACF;YACD,eAAe,EAAE;gBACf;oBACE,WAAW,EACT,kEAAkE;oBACpE,MAAM,EAAE,gBAAgB;iBACzB;gBACD;oBACE,WAAW,EACT,kEAAkE;oBACpE,MAAM,EAAE,qBAAqB;iBAC9B;gBACD;oBACE,WAAW,EACT,kEAAkE;oBACpE,MAAM,EAAE,gBAAgB;iBACzB;aACF;SACF;QACD,WAAW,EACT,kEAAkE;QACpE,iBAAiB,EAAE;YACjB,QAAQ,EAAE,sDAAsD;YAChE,WAAW,EAAE,0CAA0C;YACvD,YAAY,EAAE,IAAI;YAClB,gBAAgB,EAAE,IAAI;SACvB;QACD,QAAQ,EAAE;YACR,iBAAiB,EACf,kIAAkI;YACpI,WAAW,EAAE;gBACX,QAAQ,EAAE,YAAY;gBACtB,IAAI,EAAE;oBACJ;wBACE,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,wBAAwB;wBACjC,IAAI,EAAE,SAAS;wBACf,UAAU,EACR,kEAAkE;wBACpE,cAAc,EACZ,oEAAoE;wBACtE,eAAe,EAAE;4BACf,oIAAoI;4BACpI,oIAAoI;yBACrI;qBACF;oBACD;wBACE,IAAI,EAAE,gBAAgB;wBACtB,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,aAAa;wBACtB,IAAI,EAAE,mCAAmC;wBACzC,UAAU,EACR,oIAAoI;wBACtI,cAAc,EACZ,oEAAoE;wBACtE,eAAe,EAAE;4BACf,oIAAoI;4BACpI,oIAAoI;yBACrI;qBACF;oBACD;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,oBAAoB;wBAC7B,IAAI,EAAE,gCAAgC;wBACtC,UAAU,EACR,kEAAkE;wBACpE,cAAc,EACZ,oEAAoE;wBACtE,eAAe,EAAE;4BACf,oIAAoI;4BACpI,oIAAoI;yBACrI;qBACF;iBACF;aACF;YACD,sBAAsB,EAAE;gBACtB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EACT,kEAAkE;aACrE;YACD,KAAK,EAAE,sBAAsB;SAC9B;KACF;IACD,oBAAoB,EAAE;QACpB,uBAAuB,EAAE,CAAC,GAAG,CAAC;QAC9B,OAAO,EAAE,YAAY;KACtB;CACO,CAAC"}

package/dist/test-utils/e2ee-gateway.d.ts

@@ -0,0 +1,61 @@
+/**
+ * A fake Phala-style ACI gateway behind a `fetch` function, for tests of the
+ * E2EE v2 client: serves the attestation report for its keyset and a chat
+ * completions endpoint that behaves like the enclave (validates the five
+ * headers, decrypts the request fields, encrypts the answer to the client
+ * key). It records what the "relay" saw on the wire and what the "enclave"
+ * decrypted, so a test can assert the two differ.
+ */
+import { type AciWorkloadKeyset } from "../derivatives/e2ee/attestation.js";
+import { type E2eeKeyPair } from "../derivatives/e2ee/suite.js";
+/** The spec test-vector service key: seed 32 x 0x03. */
+export declare const TEST_VECTOR_SERVICE_SEED: Uint8Array<ArrayBuffer>;
+export declare const TEST_VECTOR_SERVICE_PUBLIC_KEY_HEX = "5dfedd3b6bd47f6fa28ee15d969d5bb0ea53774d488bdaf9df1c6e0124b3ef22";
+export declare function testVectorServiceKeyPair(): Promise<E2eeKeyPair>;
+export interface FakeE2eeGatewayRequest {
+    url: string;
+    headers: Record<string, string>;
+    /** The JSON body exactly as the relay would see it. */
+    body: Record<string, unknown>;
+}
+export interface FakeE2eeGatewayOptions {
+    /** Chat completions base the gateway answers on (default relay.test/v1). */
+    baseUrl?: string;
+    /** Service key (default: the spec test-vector key). */
+    serviceKey?: E2eeKeyPair;
+    keyId?: string;
+    notAfter?: number;
+    /** Plaintext answer for a decrypted prompt (default: fixed JSON answer). */
+    respond?: (input: {
+        model: string;
+        messages: Array<{
+            role: string;
+            content: string;
+        }>;
+    }) => string | Promise<string>;
+    /** false = 404 on the attestation route (a relay without passthrough). */
+    attestationRoute?: boolean;
+    /** Advertised E2EE versions (default ["2"]). */
+    supportedE2eeVersions?: string[];
+    /** Response id put on completions (default chatcmpl-test). */
+    responseId?: string;
+}
+export interface FakeE2eeGateway {
+    fetch: typeof fetch;
+    keyset: AciWorkloadKeyset;
+    /** Every chat completion request, as seen on the wire. */
+    requests: FakeE2eeGatewayRequest[];
+    /** Attestation report requests (url only). */
+    attestationRequests: string[];
+    /** Decrypted message contents per request, as the enclave saw them. */
+    decryptedPrompts: string[][];
+    /** Replace the service key: a keyset rotation with a fresh digest. */
+    rotateKey(): Promise<void>;
+    /** Serve the next N chat requests as this OpenAI-style error. */
+    failNext(count: number, status: number, errorType: string): void;
+    /** Serve the next chat response with plaintext content (no E2EE). */
+    plaintextNext(): void;
+    keysetDigest(): Promise<string>;
+}
+export declare function createFakeE2eeGateway(options?: FakeE2eeGatewayOptions): Promise<FakeE2eeGateway>;
+//# sourceMappingURL=e2ee-gateway.d.ts.map

package/dist/test-utils/e2ee-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-gateway.d.ts","sourceRoot":"","sources":["../../src/test-utils/e2ee-gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAQL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,yBAA6B,CAAC;AACnE,eAAO,MAAM,kCAAkC,qEACqB,CAAC;AAErE,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,WAAW,CAAC,CAKrE;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACpD,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gDAAgD;IAChD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,8CAA8C;IAC9C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,EAAE,EAAE,CAAC;IAC7B,sEAAsE;IACtE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACjE,qEAAqE;IACrE,aAAa,IAAI,IAAI,CAAC;IACtB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAmBD,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CAsP1B"}

package/dist/test-utils/e2ee-gateway.js

@@ -0,0 +1,248 @@
+/**
+ * A fake Phala-style ACI gateway behind a `fetch` function, for tests of the
+ * E2EE v2 client: serves the attestation report for its keyset and a chat
+ * completions endpoint that behaves like the enclave (validates the five
+ * headers, decrypts the request fields, encrypts the answer to the client
+ * key). It records what the "relay" saw on the wire and what the "enclave"
+ * decrypted, so a test can assert the two differ.
+ */
+import { requestFieldAad, responseFieldAad } from "../derivatives/e2ee/aad.js";
+import { reportDataFor, workloadKeysetDigest, } from "../derivatives/e2ee/attestation.js";
+import { E2EE_ALGO_X25519, bytesToHex, decryptField, encryptField, generateX25519KeyPair, hexToBytes, importX25519PrivateKey, } from "../derivatives/e2ee/suite.js";
+/** The spec test-vector service key: seed 32 x 0x03. */
+export const TEST_VECTOR_SERVICE_SEED = new Uint8Array(32).fill(3);
+export const TEST_VECTOR_SERVICE_PUBLIC_KEY_HEX = "5dfedd3b6bd47f6fa28ee15d969d5bb0ea53774d488bdaf9df1c6e0124b3ef22";
+export async function testVectorServiceKeyPair() {
+    return importX25519PrivateKey(TEST_VECTOR_SERVICE_SEED, hexToBytes(TEST_VECTOR_SERVICE_PUBLIC_KEY_HEX));
+}
+function jsonResponse(status, body, headers = {}) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { "Content-Type": "application/json", ...headers },
+    });
+}
+function errorResponse(status, type) {
+    return jsonResponse(status, {
+        error: { type, message: `fake gateway: ${type}` },
+    });
+}
+export async function createFakeE2eeGateway(options = {}) {
+    const baseUrl = (options.baseUrl ?? "https://relay.test/v1").replace(/\/+$/, "");
+    let serviceKey = options.serviceKey ?? (await testVectorServiceKeyPair());
+    const keyId = options.keyId ?? "dstack-kms-e2ee-x25519-v1";
+    const notAfter = options.notAfter ?? Math.floor(Date.now() / 1000) + 30 * 24 * 3600;
+    const responseId = options.responseId ?? "chatcmpl-test";
+    const respond = options.respond ??
+        (() => JSON.stringify({ answer: "fake answer", evidence: "fake evidence" }));
+    const buildKeyset = () => ({
+        subject: null,
+        not_after: notAfter,
+        receipt_signing_keys: [
+            {
+                key_id: "dstack-kms-receipt-ed25519-v1",
+                algo: "ed25519",
+                public_key: "00".repeat(32),
+            },
+        ],
+        e2ee_public_keys: [
+            {
+                key_id: "dstack-kms-e2ee-v1",
+                algo: "secp256k1-aes-256-gcm-hkdf-sha256",
+                public_key: "04" + "11".repeat(64),
+            },
+            {
+                key_id: keyId,
+                algo: E2EE_ALGO_X25519,
+                public_key: bytesToHex(serviceKey.publicKey),
+            },
+        ],
+        tls_public_keys: [{ spki_sha256: "22".repeat(32), domain: "relay.test" }],
+    });
+    const gateway = {
+        fetch: undefined,
+        keyset: buildKeyset(),
+        requests: [],
+        attestationRequests: [],
+        decryptedPrompts: [],
+        async rotateKey() {
+            serviceKey = await generateX25519KeyPair();
+            gateway.keyset = buildKeyset();
+        },
+        failNext(count, status, errorType) {
+            pendingFailures = { count, status, errorType };
+        },
+        plaintextNext() {
+            plaintextOnce = true;
+        },
+        keysetDigest: () => workloadKeysetDigest(gateway.keyset),
+    };
+    let pendingFailures = null;
+    let plaintextOnce = false;
+    const serveAttestation = async (url) => {
+        gateway.attestationRequests.push(url.toString());
+        if (options.attestationRoute === false) {
+            return jsonResponse(404, { error: "not found" });
+        }
+        const nonce = url.searchParams.get("nonce");
+        if (!nonce || !/^[0-9a-f]{64}$/.test(nonce)) {
+            return errorResponse(400, "invalid_request_error");
+        }
+        const digest = await workloadKeysetDigest(gateway.keyset);
+        const reportData = await reportDataFor(digest, nonce);
+        const report = {
+            api_version: "aci/1",
+            workload_keyset_digest: digest,
+            attestation: {
+                tee_type: "tdx",
+                workload_keyset: gateway.keyset,
+                report_data: reportData,
+                source_provenance: {
+                    repo_url: "https://github.com/Dstack-TEE/private-ai-gateway.git",
+                    repo_commit: "d567f6b4c4d93e33037ea202db04db86a8ad881c",
+                    image_digest: null,
+                    image_provenance: null,
+                },
+                evidence: {
+                    quote: "0400",
+                    quote_report_data: reportData + "0".repeat(64),
+                },
+            },
+            service_capabilities: {
+                supported_e2ee_versions: options.supportedE2eeVersions ?? ["2"],
+                serving: "aggregator",
+            },
+        };
+        return jsonResponse(200, report);
+    };
+    const serveChat = async (url, init) => {
+        const headers = new Headers(init?.headers);
+        const headerRecord = {};
+        headers.forEach((value, key) => {
+            headerRecord[key] = value;
+        });
+        const body = JSON.parse(String(init?.body));
+        gateway.requests.push({ url: url.toString(), headers: headerRecord, body });
+        const digest = await workloadKeysetDigest(gateway.keyset);
+        const common = { "X-ACI-Keyset-Digest": digest, "X-Receipt-Id": "rcpt-1" };
+        if (pendingFailures && pendingFailures.count > 0) {
+            pendingFailures.count -= 1;
+            return errorResponse(pendingFailures.status, pendingFailures.errorType);
+        }
+        const required = [
+            "x-e2ee-version",
+            "x-client-pub-key",
+            "x-model-pub-key",
+            "x-e2ee-nonce",
+            "x-e2ee-timestamp",
+        ];
+        const present = required.filter((name) => headers.has(name));
+        if (present.length !== required.length) {
+            return errorResponse(400, "e2ee_header_missing");
+        }
+        if (headers.get("x-e2ee-version") !== "2") {
+            return errorResponse(400, "e2ee_invalid_version");
+        }
+        if (headers.get("x-model-pub-key") !== bytesToHex(serviceKey.publicKey)) {
+            return errorResponse(400, "e2ee_model_key_mismatch");
+        }
+        const nonce = headers.get("x-e2ee-nonce");
+        if (!/^[0-9a-fA-F]{64}$/.test(nonce)) {
+            return errorResponse(400, "e2ee_invalid_nonce");
+        }
+        const ts = Number(headers.get("x-e2ee-timestamp"));
+        if (!Number.isInteger(ts)) {
+            return errorResponse(400, "e2ee_invalid_timestamp");
+        }
+        if (typeof body.model !== "string") {
+            return errorResponse(400, "e2ee_invalid_payload_model");
+        }
+        let clientPublicKey;
+        try {
+            clientPublicKey = hexToBytes(headers.get("x-client-pub-key"));
+            if (clientPublicKey.length !== 32)
+                throw new Error("length");
+        }
+        catch {
+            return errorResponse(400, "e2ee_invalid_public_key");
+        }
+        const context = {
+            algo: E2EE_ALGO_X25519,
+            model: body.model,
+            nonce,
+            ts,
+        };
+        const messages = Array.isArray(body.messages) ? body.messages : [];
+        const decrypted = [];
+        for (let index = 0; index < messages.length; index += 1) {
+            const message = messages[index];
+            if (typeof message.content !== "string") {
+                return errorResponse(400, "e2ee_decryption_failed");
+            }
+            try {
+                decrypted.push({
+                    role: message.role,
+                    content: await decryptField({
+                        wire: message.content,
+                        privateKey: serviceKey.privateKey,
+                        aad: requestFieldAad(context, `messages.${index}.content`),
+                    }),
+                });
+            }
+            catch {
+                return errorResponse(400, "e2ee_decryption_failed");
+            }
+        }
+        if (decrypted.length === 0) {
+            return errorResponse(400, "e2ee_decryption_failed");
+        }
+        gateway.decryptedPrompts.push(decrypted.map((m) => m.content));
+        const answer = await respond({ model: body.model, messages: decrypted });
+        if (plaintextOnce) {
+            plaintextOnce = false;
+            return jsonResponse(200, {
+                id: responseId,
+                choices: [
+                    { index: 0, message: { role: "assistant", content: answer } },
+                ],
+            }, common);
+        }
+        const content = await encryptField({
+            plaintext: answer,
+            recipientPublicKey: clientPublicKey,
+            aad: responseFieldAad(context, "choices.0.message.content", responseId),
+        });
+        return jsonResponse(200, {
+            id: responseId,
+            object: "chat.completion",
+            model: body.model,
+            choices: [
+                {
+                    index: 0,
+                    finish_reason: "stop",
+                    message: { role: "assistant", content },
+                },
+            ],
+            usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 },
+        }, {
+            ...common,
+            "X-E2EE-Applied": "true",
+            "X-E2EE-Version": "2",
+            "X-E2EE-Algo": E2EE_ALGO_X25519,
+        });
+    };
+    gateway.fetch = (async (input, init) => {
+        const url = new URL(typeof input === "string"
+            ? input
+            : input instanceof URL
+                ? input.toString()
+                : input.url);
+        const path = url.origin + url.pathname;
+        if (path === `${baseUrl}/aci/attestation`)
+            return serveAttestation(url);
+        if (path === `${baseUrl}/chat/completions`)
+            return serveChat(url, init);
+        return jsonResponse(404, { error: "not found" });
+    });
+    return gateway;
+}
+//# sourceMappingURL=e2ee-gateway.js.map

package/dist/test-utils/e2ee-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-gateway.js","sourceRoot":"","sources":["../../src/test-utils/e2ee-gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EACL,aAAa,EACb,oBAAoB,GAGrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,UAAU,EACV,sBAAsB,GAEvB,MAAM,8BAA8B,CAAC;AAEtC,wDAAwD;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnE,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kEAAkE,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,OAAO,sBAAsB,CAC3B,wBAAwB,EACxB,UAAU,CAAC,kCAAkC,CAAC,CAC/C,CAAC;AACJ,CAAC;AA+CD,SAAS,YAAY,CACnB,MAAc,EACd,IAAa,EACb,UAAkC,EAAE;IAEpC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,IAAY;IACjD,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,IAAI,EAAE,EAAE;KAClD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkC,EAAE;IAEpC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAClE,MAAM,EACN,EAAE,CACH,CAAC;IACF,IAAI,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,2BAA2B,CAAC;IAC3D,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC;IACzD,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,GAAG,EAAE,CACJ,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IAE1E,MAAM,WAAW,GAAG,GAAsB,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,QAAQ;QACnB,oBAAoB,EAAE;YACpB;gBACE,MAAM,EAAE,+BAA+B;gBACvC,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;aAC5B;SACF;QACD,gBAAgB,EAAE;YAChB;gBACE,MAAM,EAAE,oBAAoB;gBAC5B,IAAI,EAAE,mCAAmC;gBACzC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;aACnC;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,gBAAgB;gBACtB,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;aAC7C;SACF;QACD,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;KAC1E,CAAC,CAAC;IAEH,MAAM,OAAO,GAAoB;QAC/B,KAAK,EAAE,SAAoC;QAC3C,MAAM,EAAE,WAAW,EAAE;QACrB,QAAQ,EAAE,EAAE;QACZ,mBAAmB,EAAE,EAAE;QACvB,gBAAgB,EAAE,EAAE;QACpB,KAAK,CAAC,SAAS;YACb,UAAU,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC3C,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QACjC,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS;YAC/B,eAAe,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjD,CAAC;QACD,aAAa;YACX,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC;KACzD,CAAC;IACF,IAAI,eAAe,GAIR,IAAI,CAAC;IAChB,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAQ,EAAqB,EAAE;QAC7D,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,aAAa,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,MAAM,GAAyB;YACnC,WAAW,EAAE,OAAO;YACpB,sBAAsB,EAAE,MAAM;YAC9B,WAAW,EAAE;gBACX,QAAQ,EAAE,KAAK;gBACf,eAAe,EAAE,OAAO,CAAC,MAAM;gBAC/B,WAAW,EAAE,UAAU;gBACvB,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,sDAAsD;oBAChE,WAAW,EAAE,0CAA0C;oBACvD,YAAY,EAAE,IAAI;oBAClB,gBAAgB,EAAE,IAAI;iBACvB;gBACD,QAAQ,EAAE;oBACR,KAAK,EAAE,MAAM;oBACb,iBAAiB,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC/C;aACF;YACD,oBAAoB,EAAE;gBACpB,uBAAuB,EAAE,OAAO,CAAC,qBAAqB,IAAI,CAAC,GAAG,CAAC;gBAC/D,OAAO,EAAE,YAAY;aACtB;SACF,CAAC;QACF,OAAO,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EACrB,GAAQ,EACR,IAA6B,EACV,EAAE;QACrB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAA4B,CAAC;QACvE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;QAE3E,IAAI,eAAe,IAAI,eAAe,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACjD,eAAe,CAAC,KAAK,IAAI,CAAC,CAAC;YAC3B,OAAO,aAAa,CAAC,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,QAAQ,GAAG;YACf,gBAAgB;YAChB,kBAAkB;YAClB,iBAAiB;YACjB,cAAc;YACd,kBAAkB;SACnB,CAAC;QACF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,aAAa,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,EAAE,CAAC;YAC1C,OAAO,aAAa,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,OAAO,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;QAC3C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,OAAO,aAAa,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,eAA2B,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAE,CAAC,CAAC;YAC/D,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK;YACL,EAAE;SACH,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,SAAS,GAA6C,EAAE,CAAC;QAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAuC,CAAC;YACtE,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACxC,OAAO,aAAa,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,MAAM,YAAY,CAAC;wBAC1B,IAAI,EAAE,OAAO,CAAC,OAAO;wBACrB,UAAU,EAAE,UAAU,CAAC,UAAU;wBACjC,GAAG,EAAE,eAAe,CAAC,OAAO,EAAE,YAAY,KAAK,UAAU,CAAC;qBAC3D,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,aAAa,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,aAAa,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,IAAI,aAAa,EAAE,CAAC;YAClB,aAAa,GAAG,KAAK,CAAC;YACtB,OAAO,YAAY,CACjB,GAAG,EACH;gBACE,EAAE,EAAE,UAAU;gBACd,OAAO,EAAE;oBACP,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;iBAC9D;aACF,EACD,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;YACjC,SAAS,EAAE,MAAM;YACjB,kBAAkB,EAAE,eAAe;YACnC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,EAAE,UAAU,CAAC;SACxE,CAAC,CAAC;QACH,OAAO,YAAY,CACjB,GAAG,EACH;YACE,EAAE,EAAE,UAAU;YACd,MAAM,EAAE,iBAAiB;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE,CAAC;oBACR,aAAa,EAAE,MAAM;oBACrB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE;iBACxC;aACF;YACD,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;SACnE,EACD;YACE,GAAG,MAAM;YACT,gBAAgB,EAAE,MAAM;YACxB,gBAAgB,EAAE,GAAG;YACrB,aAAa,EAAE,gBAAgB;SAChC,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,CAAC,KAAK,GAAG,CAAC,KAAK,EACpB,KAA6B,EAC7B,IAAkB,EAClB,EAAE;QACF,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,KAAK,KAAK,QAAQ;YACvB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,KAAK,YAAY,GAAG;gBACpB,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAClB,CAAC,CAAC,KAAK,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC;QACvC,IAAI,IAAI,KAAK,GAAG,OAAO,kBAAkB;YAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,IAAI,KAAK,GAAG,OAAO,mBAAmB;YAAE,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxE,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC,CAAiB,CAAC;IAEnB,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/test-utils/index.d.ts

@@ -1,2 +1,5 @@
 export { createTestWallet, buildWeb3SignedHeader, type TestWallet, } from "./wallet.js";
+export { createMemoryDataStorage, type MemoryDataStorage, } from "./memory-storage.js";
+export { TEST_VECTOR_SERVICE_PUBLIC_KEY_HEX, TEST_VECTOR_SERVICE_SEED, createFakeE2eeGateway, testVectorServiceKeyPair, type FakeE2eeGateway, type FakeE2eeGatewayOptions, type FakeE2eeGatewayRequest, } from "./e2ee-gateway.js";
+export { LIVE_ACI_ATTESTATION_CLOCK_S, LIVE_ACI_ATTESTATION_NONCE, LIVE_ACI_ATTESTATION_REPORT, LIVE_ACI_X25519_PUBLIC_KEY_HEX, } from "./e2ee-fixtures.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/test-utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/test-utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/test-utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,UAAU,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC"}

package/dist/test-utils/index.js

@@ -1,2 +1,5 @@
 export { createTestWallet, buildWeb3SignedHeader, } from "./wallet.js";
+export { createMemoryDataStorage, } from "./memory-storage.js";
+export { TEST_VECTOR_SERVICE_PUBLIC_KEY_HEX, TEST_VECTOR_SERVICE_SEED, createFakeE2eeGateway, testVectorServiceKeyPair, } from "./e2ee-gateway.js";
+export { LIVE_ACI_ATTESTATION_CLOCK_S, LIVE_ACI_ATTESTATION_NONCE, LIVE_ACI_ATTESTATION_REPORT, LIVE_ACI_X25519_PUBLIC_KEY_HEX, } from "./e2ee-fixtures.js";
 //# sourceMappingURL=index.js.map

package/dist/test-utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/test-utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/test-utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,GAIzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC"}

package/dist/test-utils/memory-storage.d.ts

@@ -0,0 +1,12 @@
+/**
+ * In-memory DataStoragePort for unit tests: envelopes in a Map, index rows
+ * in an array, versions assigned max+1 per scope like the real index.
+ */
+import type { DataStoragePort } from "../ports/index.js";
+import type { IndexEntry } from "../storage/index/types.js";
+export interface MemoryDataStorage extends DataStoragePort {
+    /** Every index row, oldest first (test inspection). */
+    readonly entries: IndexEntry[];
+}
+export declare function createMemoryDataStorage(): MemoryDataStorage;
+//# sourceMappingURL=memory-storage.d.ts.map

package/dist/test-utils/memory-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-storage.d.ts","sourceRoot":"","sources":["../../src/test-utils/memory-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;CAChC;AAED,wBAAgB,uBAAuB,IAAI,iBAAiB,CA8J3D"}