feat(wasm): add encrypted CDN state decryption support

Add AES-256-GCM decryption to the WASM guest layer so providers
can consume encrypted CDN state blobs.

- New proto message `SetEncryptedResolverStateRequest`
- New guest export `wasm_msg_guest_set_encrypted_resolver_state`
- `aes-gcm` crate (~42K WASM binary increase)
- Encrypted test fixture for e2e tests
- Go WASM binary synced

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: nicklasl

Cargo.lock

@@ -0,0 +1 @@
+342b666ceb14fb94ed1d7da0a85acb529ca2a244c3193c6b02251044a454f4a2

data/encryption_key_test.hex

@@ -17,6 +17,12 @@ message SetResolverStateRequest {
     confidence.flags.resolver.v1.Sdk sdk = 3;
 }
 
+message SetEncryptedResolverStateRequest {
+    bytes encrypted_state = 1;
+    bytes encryption_key = 2;
+    confidence.flags.resolver.v1.Sdk sdk = 3;
+}
+
 message Request {
     bytes data = 1;
 }

data/resolver_state_encrypted.pb

@@ -21,6 +21,12 @@ message SetResolverStateRequest {
     Sdk sdk = 3;
 }
 
+message SetEncryptedResolverStateRequest {
+    bytes encrypted_state = 1;
+    bytes encryption_key = 2;
+    Sdk sdk = 3;
+}
+
 message ResolveSimpleRequest {
     string client_secret = 1;
     google.protobuf.Struct evaluation_context = 2;

openfeature-provider/go/confidence/internal/local_resolver/assets/confidence_resolver.wasm

@@ -15,6 +15,7 @@ prost-types = { version = "0.12", default-features = false }
 # TODO re-export Bytes
 bytes = { version = "1.4.0", default-features = false }
 arc-swap = "1.7.1"
+aes-gcm = { version = "0.10", default-features = false, features = ["aes", "alloc"] }
 
 [build-dependencies]
 prost-build = "0.12"

openfeature-provider/proto/confidence/wasm/messages.proto

@@ -21,7 +21,7 @@ use wasm_msg::WasmResult;
 pub mod proto {
     include!(concat!(env!("OUT_DIR"), "/rust_guest.rs"));
 }
-use crate::proto::SetResolverStateRequest;
+use crate::proto::{SetEncryptedResolverStateRequest, SetResolverStateRequest};
 use confidence_resolver::{
     proto::{
         confidence::flags::admin::v1::ResolverState as ResolverStatePb,
@@ -140,6 +140,39 @@ wasm_msg_guest! {
         Ok(VOID)
     }
 
+    fn set_encrypted_resolver_state(request: SetEncryptedResolverStateRequest) -> WasmResult<Void> {
+        use aes_gcm::{Aes256Gcm, Nonce, KeyInit};
+        use aes_gcm::aead::Aead;
+
+        if request.encryption_key.len() != 32 {
+            return Err(format!(
+                "Encryption key must be 32 bytes (AES-256), got {}",
+                request.encryption_key.len()
+            ));
+        }
+
+        let cipher = Aes256Gcm::new_from_slice(&request.encryption_key)
+            .map_err(|e| format!("Invalid encryption key: {}", e))?;
+
+        if request.encrypted_state.len() < 12 {
+            return Err("Encrypted state too short (missing nonce)".to_string());
+        }
+
+        let nonce = Nonce::from_slice(&request.encrypted_state[..12]);
+        let plaintext = cipher
+            .decrypt(nonce, &request.encrypted_state[12..])
+            .map_err(|_| "Failed to decrypt resolver state: invalid key or corrupted data".to_string())?;
+
+        let inner = SetResolverStateRequest::decode(plaintext.as_slice())
+            .map_err(|e| format!("Failed to decode decrypted resolver state: {}", e))?;
+
+        let state_pb = ResolverStatePb::decode(inner.state.as_slice())
+            .map_err(|e| format!("Failed to decode resolver state: {}", e))?;
+        let new_state = ResolverState::from_proto(state_pb, inner.account_id.as_str(), request.sdk)?;
+        RESOLVER_STATE.store(Some(Arc::new(new_state)));
+        Ok(VOID)
+    }
+
     fn resolve_flags(request: ResolveProcessRequest) -> WasmResult<ResolveProcessResponse> {
         let resolver_state = get_resolver_state()?;