@opendatalabs/personal-server-ts-core 1.9.0 → 1.10.0

package/dist/derivatives/inference.js

@@ -7,13 +7,13 @@
  * optional API key header exists for local development against a provider
  * directly.
  *
- * E2EE SEAM (not implemented): the Phala confidential-inference E2EE v2
- * protocol encrypts each `messages[i].content` to the model's public key
- * and adds the headers X-E2EE-Version, X-Client-Pub-Key, X-Model-Pub-Key,
- * X-E2EE-Nonce and X-E2EE-Timestamp; the response content comes back
- * encrypted to the client key. `InferenceRequestEncryption` below is the
- * hook where that lands: it sees the outgoing messages + headers and the
- * incoming content + headers, and nothing else in this module has to change.
+ * E2EE SEAM: the Phala confidential-inference E2EE v2 protocol encrypts each
+ * `messages[i].content` to the gateway's attested public key and adds the
+ * headers X-E2EE-Version, X-Client-Pub-Key, X-Model-Pub-Key, X-E2EE-Nonce
+ * and X-E2EE-Timestamp; the response content comes back encrypted to the
+ * client key. `InferenceRequestEncryption` below is the hook, implemented
+ * by `createPhalaE2eeEncryption` in ./e2ee. This module only knows the
+ * shape: encrypt the outgoing messages, decrypt the one response field.
  */
 export const DEFAULT_INFERENCE_BASE_URL = "https://inference.phala.com/v1";
 export const DEFAULT_INFERENCE_MODEL = "z-ai/glm-5.2";
@@ -25,10 +25,19 @@ export const DEFAULT_INFERENCE_REQUEST_FIELDS = {
 /** Thrown for a non-2xx or malformed provider reply. Carries no prompt text. */
 export class InferenceRequestError extends Error {
     status;
-    constructor(message, status) {
+    /** OpenAI-style `error.type` of the rejection, when the body had one. */
+    errorType;
+    /**
+     * Explicit retry hint. When undefined the compute layer falls back to the
+     * status: no response, 429 or 5xx are retried.
+     */
+    retryable;
+    constructor(message, status, options = {}) {
         super(message);
         this.status = status;
         this.name = "InferenceRequestError";
+        this.errorType = options.errorType ?? null;
+        this.retryable = options.retryable;
     }
 }
 function isRecord(value) {
@@ -51,15 +60,31 @@ function readContent(body) {
     const first = body.choices[0];
     if (!isRecord(first) || !isRecord(first.message))
         return null;
+    const index = typeof first.index === "number" ? first.index : 0;
+    const field = `choices.${index}.message.content`;
+    const id = typeof body.id === "string" ? body.id : "";
     const content = first.message.content;
     if (typeof content === "string")
-        return content;
+        return { content, field, id };
     // Some providers return content parts.
     if (Array.isArray(content)) {
         const text = content
             .map((part) => isRecord(part) && typeof part.text === "string" ? part.text : "")
             .join("");
-        return text;
+        return { content: text, field, id };
+    }
+    return null;
+}
+/** OpenAI-style `{ error: { type } }` of a rejection; never its message. */
+async function readErrorType(response) {
+    try {
+        const body = await response.json();
+        if (isRecord(body) && isRecord(body.error)) {
+            return typeof body.error.type === "string" ? body.error.type : null;
+        }
+    }
+    catch {
+        // Not JSON: no type to report.
     }
     return null;
 }
@@ -69,70 +94,109 @@ export function createOpenAiCompatibleInferenceProvider(options = {}) {
     const timeoutMs = options.timeoutMs ?? DEFAULT_INFERENCE_TIMEOUT_MS;
     const doFetch = options.fetch ?? fetch;
     const requestFields = options.requestFields ?? DEFAULT_INFERENCE_REQUEST_FIELDS;
-    return {
-        defaultModel,
-        async chat(input) {
-            const headers = new Headers({ "Content-Type": "application/json" });
-            if (options.apiKey) {
-                headers.set("Authorization", `Bearer ${options.apiKey}`);
-            }
-            let messages = input.messages;
-            if (options.encryption) {
-                ({ messages } = await options.encryption.encryptRequest({
-                    messages,
-                    headers,
-                }));
-            }
-            const body = {
-                ...requestFields,
-                model: input.model || defaultModel,
+    const encryption = options.encryption;
+    /** One send; `rejected` reports a non-2xx so the caller may retry once. */
+    async function send(input) {
+        const headers = new Headers({ "Content-Type": "application/json" });
+        if (options.apiKey) {
+            headers.set("Authorization", `Bearer ${options.apiKey}`);
+        }
+        const model = input.model || defaultModel;
+        let messages = input.messages;
+        let encrypted = null;
+        if (encryption) {
+            encrypted = await encryption.encryptRequest({
+                model,
                 messages,
-                max_tokens: input.maxTokens ?? DEFAULT_INFERENCE_MAX_TOKENS,
-            };
-            let response;
-            try {
-                response = await doFetch(`${base}/chat/completions`, {
-                    method: "POST",
-                    headers,
-                    body: JSON.stringify(body),
-                    signal: AbortSignal.timeout(timeoutMs),
-                });
-            }
-            catch (err) {
-                // Transport failure: no status, no body. The message is the error
-                // class name only; it never carries request contents.
-                const name = err instanceof Error ? err.name : "Error";
-                throw new InferenceRequestError(`inference request failed before a response (${name})`, null);
-            }
-            if (!response.ok) {
-                throw new InferenceRequestError(`inference request failed with status ${response.status}`, response.status);
-            }
-            let parsed;
-            try {
-                parsed = await response.json();
-            }
-            catch {
-                throw new InferenceRequestError("inference response was not JSON", response.status);
-            }
-            let content = readContent(parsed);
-            if (content === null || content.trim() === "") {
-                // An empty reply must never become a "ready" derivative.
-                throw new InferenceRequestError("inference response carried no assistant content", response.status);
-            }
-            if (options.encryption) {
-                content = await options.encryption.decryptResponse({
-                    content,
-                    headers: response.headers,
-                });
-            }
-            const receiptId = response.headers.get("x-receipt-id") ?? undefined;
-            const aciIdentity = response.headers.get("x-aci-identity") ?? undefined;
+                headers,
+            });
+            messages = encrypted.messages;
+        }
+        const body = {
+            ...requestFields,
+            model,
+            messages,
+            max_tokens: input.maxTokens ?? DEFAULT_INFERENCE_MAX_TOKENS,
+        };
+        let response;
+        try {
+            response = await doFetch(`${base}/chat/completions`, {
+                method: "POST",
+                headers,
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch (err) {
+            // Transport failure: no status, no body. The message is the error
+            // class name only; it never carries request contents.
+            const name = err instanceof Error ? err.name : "Error";
+            throw new InferenceRequestError(`inference request failed before a response (${name})`, null);
+        }
+        if (!response.ok) {
+            const errorType = await readErrorType(response);
+            const retry = (await encryption?.onRejected?.({
+                status: response.status,
+                errorType,
+                headers: response.headers,
+            })) === true;
             return {
+                ok: false,
+                retry,
+                error: new InferenceRequestError(`inference request failed with status ${response.status}${errorType ? ` (${errorType})` : ""}`, response.status, { errorType }),
+            };
+        }
+        let parsed;
+        try {
+            parsed = await response.json();
+        }
+        catch {
+            throw new InferenceRequestError("inference response was not JSON", response.status);
+        }
+        const choice = readContent(parsed);
+        if (choice === null) {
+            throw new InferenceRequestError("inference response carried no assistant content", response.status);
+        }
+        let content = choice.content;
+        if (encrypted) {
+            // Fail closed: a reply that is not valid ciphertext for this request
+            // is an error, never used as plaintext.
+            content = await encrypted.decryptResponse({
+                content,
+                field: choice.field,
+                id: choice.id,
+                headers: response.headers,
+            });
+        }
+        if (content.trim() === "") {
+            // An empty reply must never become a "ready" derivative.
+            throw new InferenceRequestError("inference response carried no assistant content", response.status);
+        }
+        const receiptId = response.headers.get("x-receipt-id") ?? undefined;
+        const aciIdentity = response.headers.get("x-aci-identity") ?? undefined;
+        return {
+            ok: true,
+            result: {
                 content,
                 usage: readUsage(isRecord(parsed) ? parsed.usage : undefined),
                 ...(receiptId ? { receiptId } : {}),
                 ...(aciIdentity ? { aciIdentity } : {}),
-            };
+            },
+        };
+    }
+    return {
+        defaultModel,
+        async chat(input) {
+            const first = await send(input);
+            if (first.ok)
+                return first.result;
+            if (!first.retry)
+                throw first.error;
+            // The encryption asked for one re-send (fresh key, fresh nonce).
+            const second = await send(input);
+            if (second.ok)
+                return second.result;
+            throw second.error;
         },
     };
 }

package/dist/derivatives/inference.js.map

@@ -1 +1 @@
-{"version":3,"file":"inference.js","sourceRoot":"","sources":["../../src/derivatives/inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAsDH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAmBlD,MAAM,CAAC,MAAM,gCAAgC,GAA4B;IACvE,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE;CAC5C,CAAC;AAEF,gFAAgF;AAChF,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAG5B;IAFlB,YACE,OAAe,EACC,MAAqB;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAe;QAGrC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,KAAK,GAAmB;QAC5B,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;QACtC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,KAAK,GAAY,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;IACtC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,uCAAuC;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO;aACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACjE;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,UAA4C,EAAE;IAE9C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC,OAAO,CAClE,MAAM,EACN,EAAE,CACH,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,IAAI,uBAAuB,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,4BAA4B,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,gCAAgC,CAAC;IAE5D,OAAO;QACL,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC9B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;oBACtD,QAAQ;oBACR,OAAO;iBACR,CAAC,CAAC,CAAC;YACN,CAAC;YACD,MAAM,IAAI,GAAG;gBACX,GAAG,aAAa;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,YAAY;gBAClC,QAAQ;gBACR,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,4BAA4B;aAC5D,CAAC;YACF,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,mBAAmB,EAAE;oBACnD,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,sDAAsD;gBACtD,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBACvD,MAAM,IAAI,qBAAqB,CAC7B,+CAA+C,IAAI,GAAG,EACtD,IAAI,CACL,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,qBAAqB,CAC7B,wCAAwC,QAAQ,CAAC,MAAM,EAAE,EACzD,QAAQ,CAAC,MAAM,CAChB,CAAC;YACJ,CAAC;YACD,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,qBAAqB,CAC7B,iCAAiC,EACjC,QAAQ,CAAC,MAAM,CAChB,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC9C,yDAAyD;gBACzD,MAAM,IAAI,qBAAqB,CAC7B,iDAAiD,EACjD,QAAQ,CAAC,MAAM,CAChB,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;oBACjD,OAAO;oBACP,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;YACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC;YACxE,OAAO;gBACL,OAAO;gBACP,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CACzC,UAAwC,EAAE;IAE1C,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY;QAC3C,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,OAAO,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;oBACtB,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;gBACF,SAAS,EAAE,cAAc;aAC1B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"inference.js","sourceRoot":"","sources":["../../src/derivatives/inference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA+EH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAmBlD,MAAM,CAAC,MAAM,gCAAgC,GAA4B;IACvE,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE;CAC5C,CAAC;AAEF,gFAAgF;AAChF,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAW5B;IAVlB,yEAAyE;IACzD,SAAS,CAAgB;IACzC;;;OAGG;IACa,SAAS,CAAsB;IAE/C,YACE,OAAe,EACC,MAAqB,EACrC,UAA8D,EAAE;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAe;QAIrC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,KAAK,GAAmB;QAC5B,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;QACtC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;KACrC,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAaD,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,KAAK,GAAY,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,KAAK,kBAAkB,CAAC;IACjD,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;IACtC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC/D,uCAAuC;IACvC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO;aACjB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACZ,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACjE;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,aAAa,CAAC,QAAkB;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,UAA4C,EAAE;IAE9C,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC,OAAO,CAClE,MAAM,EACN,EAAE,CACH,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,IAAI,uBAAuB,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,4BAA4B,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,gCAAgC,CAAC;IAE5D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAEtC,2EAA2E;IAC3E,KAAK,UAAU,IAAI,CACjB,KAAyB;QAKzB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,YAAY,CAAC;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC9B,IAAI,SAAS,GAAqC,IAAI,CAAC;QACvD,IAAI,UAAU,EAAE,CAAC;YACf,SAAS,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC;gBAC1C,KAAK;gBACL,QAAQ;gBACR,OAAO;aACR,CAAC,CAAC;YACH,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,GAAG;YACX,GAAG,aAAa;YAChB,KAAK;YACL,QAAQ;YACR,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,4BAA4B;SAC5D,CAAC;QACF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,mBAAmB,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kEAAkE;YAClE,sDAAsD;YACtD,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACvD,MAAM,IAAI,qBAAqB,CAC7B,+CAA+C,IAAI,GAAG,EACtD,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,KAAK,GACT,CAAC,MAAM,UAAU,EAAE,UAAU,EAAE,CAAC;gBAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS;gBACT,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC,KAAK,IAAI,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK;gBACL,KAAK,EAAE,IAAI,qBAAqB,CAC9B,wCAAwC,QAAQ,CAAC,MAAM,GACrD,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,GAAG,CAAC,CAAC,CAAC,EAClC,EAAE,EACF,QAAQ,CAAC,MAAM,EACf,EAAE,SAAS,EAAE,CACd;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qBAAqB,CAC7B,iCAAiC,EACjC,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAC7B,iDAAiD,EACjD,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,IAAI,SAAS,EAAE,CAAC;YACd,qEAAqE;YACrE,wCAAwC;YACxC,OAAO,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC;gBACxC,OAAO;gBACP,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1B,yDAAyD;YACzD,MAAM,IAAI,qBAAqB,CAC7B,iDAAiD,EACjD,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;QACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC;QACxE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,OAAO;gBACP,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,MAAM,KAAK,CAAC,KAAK,CAAC;YACpC,iEAAiE;YACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;YACpC,MAAM,MAAM,CAAC,KAAK,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,+EAA+E;AAC/E,MAAM,UAAU,2BAA2B,CACzC,UAAwC,EAAE;IAE1C,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY;QAC3C,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,OAAO,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;oBACtB,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,eAAe;iBAC1B,CAAC;gBACF,SAAS,EAAE,cAAc;aAC1B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/schemas/server-config.d.ts

@@ -46,6 +46,7 @@ export declare const DEFAULTS: {
     inference: {
         baseUrl: string;
         model: string;
+        e2ee: boolean;
         maxSourceItems: number;
         recomputeDebounceMs: number;
     };
@@ -119,6 +120,7 @@ export declare const ServerConfigSchema: z.ZodObject<{
     inference: z.ZodDefault<z.ZodObject<{
         baseUrl: z.ZodDefault<z.ZodURL>;
         model: z.ZodDefault<z.ZodString>;
+        e2ee: z.ZodDefault<z.ZodBoolean>;
         maxSourceItems: z.ZodDefault<z.ZodNumber>;
         recomputeDebounceMs: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;

package/dist/schemas/server-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/schemas/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmEpB,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;EAMzB,CAAC;AAEH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6G7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,0BAA0B,EAAE,MAAM,CAAC;QACnC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,uBAAuB,EAAE,MAAM,CAAC;QAEhC,qBAAqB,EAAE,MAAM,CAAC;QAG9B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC"}
+{"version":3,"file":"server-config.d.ts","sourceRoot":"","sources":["../../src/schemas/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuEpB,CAAC;AAEF,eAAO,MAAM,cAAc;;;;;;EAMzB,CAAC;AAEH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8G7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAEpD,0DAA0D;AAC1D,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,0BAA0B,EAAE,MAAM,CAAC;QACnC,qBAAqB,EAAE,MAAM,CAAC;QAC9B,uBAAuB,EAAE,MAAM,CAAC;QAEhC,qBAAqB,EAAE,MAAM,CAAC;QAG9B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC"}

package/dist/schemas/server-config.js

@@ -61,6 +61,10 @@ export const DEFAULTS = {
         // provider key) or straight at a provider for local development.
         baseUrl: "https://inference.phala.com/v1",
         model: "z-ai/glm-5.2",
+        // End to end encryption of prompt and answer to the Phala gateway
+        // (E2EE v2): the relay only sees ciphertext. Set false only for local
+        // development against a provider without ACI attestation.
+        e2ee: true,
         // Newest-first items kept per source scope when a prompt is assembled.
         maxSourceItems: 50,
         // Quiet period after a source scope changes before a recompute starts.
@@ -172,6 +176,7 @@ export const ServerConfigSchema = z.object({
         .object({
         baseUrl: z.url().default(DEFAULTS.inference.baseUrl),
         model: z.string().min(1).default(DEFAULTS.inference.model),
+        e2ee: z.boolean().default(DEFAULTS.inference.e2ee),
         maxSourceItems: z
             .number()
             .int()

package/dist/schemas/server-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/schemas/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,MAAM,EAAE;QACN,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,uBAAuB;KAChC;IACD,OAAO,EAAE;QACP,KAAK,EAAE,MAAe;QACtB,MAAM,EAAE,KAAK;KACd;IACD,OAAO,EAAE;QACP,OAAO,EAAE,OAAgB;QACzB,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,MAAM,EAAE,0BAA0B;aACnC;SACF;KACF;IACD,OAAO,EAAE;QACP,GAAG,EAAE,sDAAsD;QAC3D,OAAO,EAAE,KAAK;QACd,SAAS,EAAE;YACT,6CAA6C;YAC7C,YAAY,EAAE,4CAA4C;YAC1D,uDAAuD;YACvD,0BAA0B,EAAE,4CAA4C;YACxE,+DAA+D;YAC/D,qBAAqB,EAAE,4CAA4C;YACnE,wCAAwC;YACxC,uBAAuB,EAAE,4CAA4C;YACrE,mEAAmE;YACnE,oDAAoD;YACpD,qBAAqB,EAAE,4CAA4C;YACnE,kEAAkE;YAClE,8DAA8D;YAC9D,qEAAqE;YACrE,WAAW,EAAE,4CAA4C;YACzD,oEAAoE;SACrE;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE,IAAI;KACd;IACD,OAAO,EAAE;QACP,iEAAiE;QACjE,wCAAwC;QACxC,OAAO,EAAE,KAAK;KACf;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,IAAI;KAC7B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,sBAAsB;QAClC,UAAU,EAAE,IAAI;KACjB;IACD,SAAS,EAAE;QACT,qEAAqE;QACrE,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,cAAc;QACrB,uEAAuE;QACvE,cAAc,EAAE,EAAE;QAClB,uEAAuE;QACvE,mBAAmB,EAAE,KAAK;KAC3B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;CAC7D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACtE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;KAChD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;aACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;QAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;KACrD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,IAAI,EAAE,uBAAuB,CAAC,QAAQ,EAAE;SACzC,CAAC;aACD,OAAO,CAAC,EAAE,CAAC;KACf,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACtE,SAAS,EAAE,CAAC;aACT,MAAM,CAAC;YACN,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;YACnD,0BAA0B,EAAE,CAAC;iBAC1B,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,0BAA0B,CAAC;YACjE,qBAAqB,EAAE,CAAC;iBACrB,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC;YAC5D,uBAAuB,EAAE,CAAC;iBACvB,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAAC;YAC9D,qBAAqB,EAAE,CAAC;iBACrB,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC;YAC5D,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;SACnD,CAAC;aACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;KACrD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC1B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACnD,sBAAsB,EAAE,CAAC;aACtB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC;KACjD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACzB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;QACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1D,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;KACvC,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC3B,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;QAC1D,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,MAAM,CAAC;aACX,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC;QAC7C,mBAAmB,EAAE,CAAC;aACnB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,SAAS,CAAC;aACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,CAAC;KACnD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;CAC/B,CAAC,CAAC"}
+{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/schemas/server-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,MAAM,EAAE;QACN,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,uBAAuB;KAChC;IACD,OAAO,EAAE;QACP,KAAK,EAAE,MAAe;QACtB,MAAM,EAAE,KAAK;KACd;IACD,OAAO,EAAE;QACP,OAAO,EAAE,OAAgB;QACzB,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,MAAM,EAAE,0BAA0B;aACnC;SACF;KACF;IACD,OAAO,EAAE;QACP,GAAG,EAAE,sDAAsD;QAC3D,OAAO,EAAE,KAAK;QACd,SAAS,EAAE;YACT,6CAA6C;YAC7C,YAAY,EAAE,4CAA4C;YAC1D,uDAAuD;YACvD,0BAA0B,EAAE,4CAA4C;YACxE,+DAA+D;YAC/D,qBAAqB,EAAE,4CAA4C;YACnE,wCAAwC;YACxC,uBAAuB,EAAE,4CAA4C;YACrE,mEAAmE;YACnE,oDAAoD;YACpD,qBAAqB,EAAE,4CAA4C;YACnE,kEAAkE;YAClE,8DAA8D;YAC9D,qEAAqE;YACrE,WAAW,EAAE,4CAA4C;YACzD,oEAAoE;SACrE;KACF;IACD,KAAK,EAAE;QACL,OAAO,EAAE,IAAI;KACd;IACD,OAAO,EAAE;QACP,iEAAiE;QACjE,wCAAwC;QACxC,OAAO,EAAE,KAAK;KACf;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,KAAK;QACd,sBAAsB,EAAE,IAAI;KAC7B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,sBAAsB;QAClC,UAAU,EAAE,IAAI;KACjB;IACD,SAAS,EAAE;QACT,qEAAqE;QACrE,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,EAAE,gCAAgC;QACzC,KAAK,EAAE,cAAc;QACrB,kEAAkE;QAClE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,EAAE,IAAI;QACV,uEAAuE;QACvE,cAAc,EAAE,EAAE;QAClB,uEAAuE;QACvE,mBAAmB,EAAE,KAAK;KAC3B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;CAC7D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QACtE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;KAChD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;aACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;QAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;KACrD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzD,MAAM,EAAE,CAAC;aACN,MAAM,CAAC;YACN,IAAI,EAAE,uBAAuB,CAAC,QAAQ,EAAE;SACzC,CAAC;aACD,OAAO,CAAC,EAAE,CAAC;KACf,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACtE,SAAS,EAAE,CAAC;aACT,MAAM,CAAC;YACN,YAAY,EAAE,CAAC;iBACZ,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;YACnD,0BAA0B,EAAE,CAAC;iBAC1B,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,0BAA0B,CAAC;YACjE,qBAAqB,EAAE,CAAC;iBACrB,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC;YAC5D,uBAAuB,EAAE,CAAC;iBACvB,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAAC;YAC9D,qBAAqB,EAAE,CAAC;iBACrB,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC;YAC5D,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,UAAU,CAAC,IAAI,CAAC;iBAChB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;SACnD,CAAC;aACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;KACrD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC1B,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC5B,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QACnD,sBAAsB,EAAE,CAAC;aACtB,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,EAAE;aACV,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,CAAC;KACjD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACzB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;QACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1D,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,KAAK,CAAC;aACV,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;KACvC,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC3B,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;QAC1D,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;QAClD,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,MAAM,CAAC;aACX,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC;QAC7C,mBAAmB,EAAE,CAAC;aACnB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,SAAS,CAAC;aACd,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB,CAAC;KACnD,CAAC;SACD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;CAC/B,CAAC,CAAC"}

package/dist/test-utils/e2ee-fixtures.d.ts

@@ -0,0 +1,94 @@
+/**
+ * A real `GET /v1/aci/attestation?nonce=...` report captured from
+ * https://inference.phala.com on 2026-08-28 (the TDX quote, event log,
+ * app compose and vm config are omitted: they are not part of the
+ * structural binding chain). The nonce below is the one the report was
+ * requested with, so `report_data` recomputes from the keyset digest.
+ */
+export declare const LIVE_ACI_ATTESTATION_NONCE = "434fe0866976bf566484a1f11dbb0a55d9d4554b84f25ccd1ddd9095375722b1";
+/** Unix seconds inside the fixture keyset's validity window. */
+export declare const LIVE_ACI_ATTESTATION_CLOCK_S = 1788220800;
+export declare const LIVE_ACI_X25519_PUBLIC_KEY_HEX = "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537";
+export declare const LIVE_ACI_ATTESTATION_REPORT: {
+    readonly api_version: "aci/1";
+    readonly workload_keyset_digest: "sha256:4f3dc45eeb18a5aefa49dfe5c0f2b6dbc77dd37276adc0cee87f1c1f70b73072";
+    readonly attestation: {
+        readonly tee_type: "tdx";
+        readonly workload_keyset: {
+            readonly subject: null;
+            readonly not_after: 1790498751;
+            readonly receipt_signing_keys: readonly [{
+                readonly key_id: "dstack-kms-receipt-ed25519-v1";
+                readonly algo: "ed25519";
+                readonly public_key: "110f3824daeeef29dbeba9677a5794ffed257b1082d9fd4599b3c0819953aa0a";
+            }];
+            readonly e2ee_public_keys: readonly [{
+                readonly key_id: "dstack-kms-e2ee-v1";
+                readonly algo: "secp256k1-aes-256-gcm-hkdf-sha256";
+                readonly public_key: "04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d";
+            }, {
+                readonly key_id: "dstack-kms-e2ee-x25519-v1";
+                readonly algo: "x25519-aes-256-gcm-hkdf-sha256";
+                readonly public_key: "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537";
+            }];
+            readonly tls_public_keys: readonly [{
+                readonly spki_sha256: "4586d125aaef3d1b33a3c34f12a5c235af3016dddd35e56a99b6b3ed3ba57dcb";
+                readonly domain: "tee.redpill.ai";
+            }, {
+                readonly spki_sha256: "8e89a8a01e12098065037be187dcd2f03071dc1e7c9bb8527160f4c56ebc728f";
+                readonly domain: "inference.phala.com";
+            }, {
+                readonly spki_sha256: "e52fdca52c039def33e51cd2b5eded43eae1949030e47866f5f09e90b6940a88";
+                readonly domain: "api.redpill.ai";
+            }];
+        };
+        readonly report_data: "9ba90c1e314b8feb6c48be5de2f6b41d7174103056845e27d6e835c4202e5954";
+        readonly source_provenance: {
+            readonly repo_url: "https://github.com/Dstack-TEE/private-ai-gateway.git";
+            readonly repo_commit: "d567f6b4c4d93e33037ea202db04db86a8ad881c";
+            readonly image_digest: null;
+            readonly image_provenance: null;
+        };
+        readonly evidence: {
+            readonly quote_report_data: "9ba90c1e314b8feb6c48be5de2f6b41d7174103056845e27d6e835c4202e59540000000000000000000000000000000000000000000000000000000000000000";
+            readonly key_custody: {
+                readonly provider: "dstack-kms";
+                readonly keys: readonly [{
+                    readonly role: "receipt";
+                    readonly path: "aci/receipt-ed25519/v1";
+                    readonly purpose: "aci.receipt.ed25519.v1";
+                    readonly algo: "ed25519";
+                    readonly public_key: "110f3824daeeef29dbeba9677a5794ffed257b1082d9fd4599b3c0819953aa0a";
+                    readonly kms_public_key: "02f7fb3ed8c352d316dfdc19458a9f29c06eb7e74130b3808d784e2fd401a2c12d";
+                    readonly signature_chain: readonly ["d1f59335effc2688acdf502ee34d8d3373b0e7e6be493075383714ce5673a29973f224690437c483ae3fdd37172df3abad82877c4023ed7c5a64d5acaf18477c00", "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501"];
+                }, {
+                    readonly role: "e2ee-secp256k1";
+                    readonly path: "aci/e2ee/v1";
+                    readonly purpose: "aci.e2ee.v1";
+                    readonly algo: "secp256k1-aes-256-gcm-hkdf-sha256";
+                    readonly public_key: "04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d";
+                    readonly kms_public_key: "03943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f";
+                    readonly signature_chain: readonly ["452d6f86a807fef0ce0d65e6c5cd25a0a249b1fd8608d26c3efe17fc10346f4c2d3dfb8969d10dc1feac1d595b3816f63faa40ac370a3a233ce1d712d418c89701", "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501"];
+                }, {
+                    readonly role: "e2ee-x25519";
+                    readonly path: "aci/e2ee-x25519/v1";
+                    readonly purpose: "aci.e2ee.x25519.v1";
+                    readonly algo: "x25519-aes-256-gcm-hkdf-sha256";
+                    readonly public_key: "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537";
+                    readonly kms_public_key: "03892f86b3f55f78cc0760cec933cf8e2a92862fb173c2d221cc25895847cbb5eb";
+                    readonly signature_chain: readonly ["358cd661ca4f5e986ed950ca083bf7bcfef6ab4b839ca11a953b156d64f82b1c51a213730d5777b4c845170827680d41e8220c2f950a38081025ff16eb3789ba00", "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501"];
+                }];
+            };
+            readonly downstream_tls_binding: {
+                readonly domain: "inference.phala.com";
+                readonly spki_sha256: "8e89a8a01e12098065037be187dcd2f03071dc1e7c9bb8527160f4c56ebc728f";
+            };
+            readonly quote: "<omitted in fixture>";
+        };
+    };
+    readonly service_capabilities: {
+        readonly supported_e2ee_versions: readonly ["2"];
+        readonly serving: "aggregator";
+    };
+};
+//# sourceMappingURL=e2ee-fixtures.d.ts.map

package/dist/test-utils/e2ee-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-fixtures.d.ts","sourceRoot":"","sources":["../../src/test-utils/e2ee-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,0BAA0B,qEAC6B,CAAC;AAErE,gEAAgE;AAChE,eAAO,MAAM,4BAA4B,aAAa,CAAC;AAEvD,eAAO,MAAM,8BAA8B,qEACyB,CAAC;AAErE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuH9B,CAAC"}

package/dist/test-utils/e2ee-fixtures.js

@@ -0,0 +1,116 @@
+/**
+ * A real `GET /v1/aci/attestation?nonce=...` report captured from
+ * https://inference.phala.com on 2026-08-28 (the TDX quote, event log,
+ * app compose and vm config are omitted: they are not part of the
+ * structural binding chain). The nonce below is the one the report was
+ * requested with, so `report_data` recomputes from the keyset digest.
+ */
+export const LIVE_ACI_ATTESTATION_NONCE = "434fe0866976bf566484a1f11dbb0a55d9d4554b84f25ccd1ddd9095375722b1";
+/** Unix seconds inside the fixture keyset's validity window. */
+export const LIVE_ACI_ATTESTATION_CLOCK_S = 1788220800;
+export const LIVE_ACI_X25519_PUBLIC_KEY_HEX = "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537";
+export const LIVE_ACI_ATTESTATION_REPORT = {
+    api_version: "aci/1",
+    workload_keyset_digest: "sha256:4f3dc45eeb18a5aefa49dfe5c0f2b6dbc77dd37276adc0cee87f1c1f70b73072",
+    attestation: {
+        tee_type: "tdx",
+        workload_keyset: {
+            subject: null,
+            not_after: 1790498751,
+            receipt_signing_keys: [
+                {
+                    key_id: "dstack-kms-receipt-ed25519-v1",
+                    algo: "ed25519",
+                    public_key: "110f3824daeeef29dbeba9677a5794ffed257b1082d9fd4599b3c0819953aa0a",
+                },
+            ],
+            e2ee_public_keys: [
+                {
+                    key_id: "dstack-kms-e2ee-v1",
+                    algo: "secp256k1-aes-256-gcm-hkdf-sha256",
+                    public_key: "04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d",
+                },
+                {
+                    key_id: "dstack-kms-e2ee-x25519-v1",
+                    algo: "x25519-aes-256-gcm-hkdf-sha256",
+                    public_key: "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537",
+                },
+            ],
+            tls_public_keys: [
+                {
+                    spki_sha256: "4586d125aaef3d1b33a3c34f12a5c235af3016dddd35e56a99b6b3ed3ba57dcb",
+                    domain: "tee.redpill.ai",
+                },
+                {
+                    spki_sha256: "8e89a8a01e12098065037be187dcd2f03071dc1e7c9bb8527160f4c56ebc728f",
+                    domain: "inference.phala.com",
+                },
+                {
+                    spki_sha256: "e52fdca52c039def33e51cd2b5eded43eae1949030e47866f5f09e90b6940a88",
+                    domain: "api.redpill.ai",
+                },
+            ],
+        },
+        report_data: "9ba90c1e314b8feb6c48be5de2f6b41d7174103056845e27d6e835c4202e5954",
+        source_provenance: {
+            repo_url: "https://github.com/Dstack-TEE/private-ai-gateway.git",
+            repo_commit: "d567f6b4c4d93e33037ea202db04db86a8ad881c",
+            image_digest: null,
+            image_provenance: null,
+        },
+        evidence: {
+            quote_report_data: "9ba90c1e314b8feb6c48be5de2f6b41d7174103056845e27d6e835c4202e59540000000000000000000000000000000000000000000000000000000000000000",
+            key_custody: {
+                provider: "dstack-kms",
+                keys: [
+                    {
+                        role: "receipt",
+                        path: "aci/receipt-ed25519/v1",
+                        purpose: "aci.receipt.ed25519.v1",
+                        algo: "ed25519",
+                        public_key: "110f3824daeeef29dbeba9677a5794ffed257b1082d9fd4599b3c0819953aa0a",
+                        kms_public_key: "02f7fb3ed8c352d316dfdc19458a9f29c06eb7e74130b3808d784e2fd401a2c12d",
+                        signature_chain: [
+                            "d1f59335effc2688acdf502ee34d8d3373b0e7e6be493075383714ce5673a29973f224690437c483ae3fdd37172df3abad82877c4023ed7c5a64d5acaf18477c00",
+                            "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501",
+                        ],
+                    },
+                    {
+                        role: "e2ee-secp256k1",
+                        path: "aci/e2ee/v1",
+                        purpose: "aci.e2ee.v1",
+                        algo: "secp256k1-aes-256-gcm-hkdf-sha256",
+                        public_key: "04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d",
+                        kms_public_key: "03943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f",
+                        signature_chain: [
+                            "452d6f86a807fef0ce0d65e6c5cd25a0a249b1fd8608d26c3efe17fc10346f4c2d3dfb8969d10dc1feac1d595b3816f63faa40ac370a3a233ce1d712d418c89701",
+                            "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501",
+                        ],
+                    },
+                    {
+                        role: "e2ee-x25519",
+                        path: "aci/e2ee-x25519/v1",
+                        purpose: "aci.e2ee.x25519.v1",
+                        algo: "x25519-aes-256-gcm-hkdf-sha256",
+                        public_key: "408e82d159832cfae15007781bcade0badee7d50e9f76d50eaa1777464006537",
+                        kms_public_key: "03892f86b3f55f78cc0760cec933cf8e2a92862fb173c2d221cc25895847cbb5eb",
+                        signature_chain: [
+                            "358cd661ca4f5e986ed950ca083bf7bcfef6ab4b839ca11a953b156d64f82b1c51a213730d5777b4c845170827680d41e8220c2f950a38081025ff16eb3789ba00",
+                            "5c2fe36bdb1e434c0a371579bcbce07c4e7b89eba45affa089191baec84f23ad77b24a594aa28427b6b7a5f348b0ecf5597abfd9a2add05ddb55c521ba38a38501",
+                        ],
+                    },
+                ],
+            },
+            downstream_tls_binding: {
+                domain: "inference.phala.com",
+                spki_sha256: "8e89a8a01e12098065037be187dcd2f03071dc1e7c9bb8527160f4c56ebc728f",
+            },
+            quote: "<omitted in fixture>",
+        },
+    },
+    service_capabilities: {
+        supported_e2ee_versions: ["2"],
+        serving: "aggregator",
+    },
+};
+//# sourceMappingURL=e2ee-fixtures.js.map

package/dist/test-utils/e2ee-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-fixtures.js","sourceRoot":"","sources":["../../src/test-utils/e2ee-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,0BAA0B,GACrC,kEAAkE,CAAC;AAErE,gEAAgE;AAChE,MAAM,CAAC,MAAM,4BAA4B,GAAG,UAAU,CAAC;AAEvD,MAAM,CAAC,MAAM,8BAA8B,GACzC,kEAAkE,CAAC;AAErE,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,WAAW,EAAE,OAAO;IACpB,sBAAsB,EACpB,yEAAyE;IAC3E,WAAW,EAAE;QACX,QAAQ,EAAE,KAAK;QACf,eAAe,EAAE;YACf,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,UAAU;YACrB,oBAAoB,EAAE;gBACpB;oBACE,MAAM,EAAE,+BAA+B;oBACvC,IAAI,EAAE,SAAS;oBACf,UAAU,EACR,kEAAkE;iBACrE;aACF;YACD,gBAAgB,EAAE;gBAChB;oBACE,MAAM,EAAE,oBAAoB;oBAC5B,IAAI,EAAE,mCAAmC;oBACzC,UAAU,EACR,oIAAoI;iBACvI;gBACD;oBACE,MAAM,EAAE,2BAA2B;oBACnC,IAAI,EAAE,gCAAgC;oBACtC,UAAU,EACR,kEAAkE;iBACrE;aACF;YACD,eAAe,EAAE;gBACf;oBACE,WAAW,EACT,kEAAkE;oBACpE,MAAM,EAAE,gBAAgB;iBACzB;gBACD;oBACE,WAAW,EACT,kEAAkE;oBACpE,MAAM,EAAE,qBAAqB;iBAC9B;gBACD;oBACE,WAAW,EACT,kEAAkE;oBACpE,MAAM,EAAE,gBAAgB;iBACzB;aACF;SACF;QACD,WAAW,EACT,kEAAkE;QACpE,iBAAiB,EAAE;YACjB,QAAQ,EAAE,sDAAsD;YAChE,WAAW,EAAE,0CAA0C;YACvD,YAAY,EAAE,IAAI;YAClB,gBAAgB,EAAE,IAAI;SACvB;QACD,QAAQ,EAAE;YACR,iBAAiB,EACf,kIAAkI;YACpI,WAAW,EAAE;gBACX,QAAQ,EAAE,YAAY;gBACtB,IAAI,EAAE;oBACJ;wBACE,IAAI,EAAE,SAAS;wBACf,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,wBAAwB;wBACjC,IAAI,EAAE,SAAS;wBACf,UAAU,EACR,kEAAkE;wBACpE,cAAc,EACZ,oEAAoE;wBACtE,eAAe,EAAE;4BACf,oIAAoI;4BACpI,oIAAoI;yBACrI;qBACF;oBACD;wBACE,IAAI,EAAE,gBAAgB;wBACtB,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,aAAa;wBACtB,IAAI,EAAE,mCAAmC;wBACzC,UAAU,EACR,oIAAoI;wBACtI,cAAc,EACZ,oEAAoE;wBACtE,eAAe,EAAE;4BACf,oIAAoI;4BACpI,oIAAoI;yBACrI;qBACF;oBACD;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,oBAAoB;wBAC7B,IAAI,EAAE,gCAAgC;wBACtC,UAAU,EACR,kEAAkE;wBACpE,cAAc,EACZ,oEAAoE;wBACtE,eAAe,EAAE;4BACf,oIAAoI;4BACpI,oIAAoI;yBACrI;qBACF;iBACF;aACF;YACD,sBAAsB,EAAE;gBACtB,MAAM,EAAE,qBAAqB;gBAC7B,WAAW,EACT,kEAAkE;aACrE;YACD,KAAK,EAAE,sBAAsB;SAC9B;KACF;IACD,oBAAoB,EAAE;QACpB,uBAAuB,EAAE,CAAC,GAAG,CAAC;QAC9B,OAAO,EAAE,YAAY;KACtB;CACO,CAAC"}

package/dist/test-utils/e2ee-gateway.d.ts

@@ -0,0 +1,61 @@
+/**
+ * A fake Phala-style ACI gateway behind a `fetch` function, for tests of the
+ * E2EE v2 client: serves the attestation report for its keyset and a chat
+ * completions endpoint that behaves like the enclave (validates the five
+ * headers, decrypts the request fields, encrypts the answer to the client
+ * key). It records what the "relay" saw on the wire and what the "enclave"
+ * decrypted, so a test can assert the two differ.
+ */
+import { type AciWorkloadKeyset } from "../derivatives/e2ee/attestation.js";
+import { type E2eeKeyPair } from "../derivatives/e2ee/suite.js";
+/** The spec test-vector service key: seed 32 x 0x03. */
+export declare const TEST_VECTOR_SERVICE_SEED: Uint8Array<ArrayBuffer>;
+export declare const TEST_VECTOR_SERVICE_PUBLIC_KEY_HEX = "5dfedd3b6bd47f6fa28ee15d969d5bb0ea53774d488bdaf9df1c6e0124b3ef22";
+export declare function testVectorServiceKeyPair(): Promise<E2eeKeyPair>;
+export interface FakeE2eeGatewayRequest {
+    url: string;
+    headers: Record<string, string>;
+    /** The JSON body exactly as the relay would see it. */
+    body: Record<string, unknown>;
+}
+export interface FakeE2eeGatewayOptions {
+    /** Chat completions base the gateway answers on (default relay.test/v1). */
+    baseUrl?: string;
+    /** Service key (default: the spec test-vector key). */
+    serviceKey?: E2eeKeyPair;
+    keyId?: string;
+    notAfter?: number;
+    /** Plaintext answer for a decrypted prompt (default: fixed JSON answer). */
+    respond?: (input: {
+        model: string;
+        messages: Array<{
+            role: string;
+            content: string;
+        }>;
+    }) => string | Promise<string>;
+    /** false = 404 on the attestation route (a relay without passthrough). */
+    attestationRoute?: boolean;
+    /** Advertised E2EE versions (default ["2"]). */
+    supportedE2eeVersions?: string[];
+    /** Response id put on completions (default chatcmpl-test). */
+    responseId?: string;
+}
+export interface FakeE2eeGateway {
+    fetch: typeof fetch;
+    keyset: AciWorkloadKeyset;
+    /** Every chat completion request, as seen on the wire. */
+    requests: FakeE2eeGatewayRequest[];
+    /** Attestation report requests (url only). */
+    attestationRequests: string[];
+    /** Decrypted message contents per request, as the enclave saw them. */
+    decryptedPrompts: string[][];
+    /** Replace the service key: a keyset rotation with a fresh digest. */
+    rotateKey(): Promise<void>;
+    /** Serve the next N chat requests as this OpenAI-style error. */
+    failNext(count: number, status: number, errorType: string): void;
+    /** Serve the next chat response with plaintext content (no E2EE). */
+    plaintextNext(): void;
+    keysetDigest(): Promise<string>;
+}
+export declare function createFakeE2eeGateway(options?: FakeE2eeGatewayOptions): Promise<FakeE2eeGateway>;
+//# sourceMappingURL=e2ee-gateway.d.ts.map

package/dist/test-utils/e2ee-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-gateway.d.ts","sourceRoot":"","sources":["../../src/test-utils/e2ee-gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAQL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,yBAA6B,CAAC;AACnE,eAAO,MAAM,kCAAkC,qEACqB,CAAC;AAErE,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,WAAW,CAAC,CAKrE;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACpD,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gDAAgD;IAChD,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,8CAA8C;IAC9C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,EAAE,EAAE,CAAC;IAC7B,sEAAsE;IACtE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACjE,qEAAqE;IACrE,aAAa,IAAI,IAAI,CAAC;IACtB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACjC;AAmBD,wBAAsB,qBAAqB,CACzC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CAsP1B"}