@nekzus/liop 2.1.0-alpha.6 → 2.1.0-alpha.8

package/dist/{chunk-AL7H7DTW.js → chunk-PYIGZG6E.js}

@@ -351,7 +351,7 @@ var LiopMcpBridge = class {
         try {
           const data = JSON.parse(contentText);
           if (data.image_id || data.zk_receipt) {
-            const { LiopVerifier } = await import('./verifier-3FAKCFNN.js');
+            const { LiopVerifier } = await import('./verifier-GCZDNZK7.js');
             const verifier = new LiopVerifier();
             const isAuthentic = await verifier.verifyZkReceipt(
               Buffer.from(payload, "utf-8"),
@@ -459,5 +459,5 @@ var LiopMcpBridge = class {
 };
 
 export { LiopMcpBridge, LiopStreamBridge };
-//# sourceMappingURL=chunk-AL7H7DTW.js.map
-//# sourceMappingURL=chunk-AL7H7DTW.js.map
+//# sourceMappingURL=chunk-PYIGZG6E.js.map
+//# sourceMappingURL=chunk-PYIGZG6E.js.map

package/dist/{chunk-AL7H7DTW.js.map → chunk-PYIGZG6E.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/bridge/stream.ts","../src/bridge/index.ts"],"names":[],"mappings":";;;;;;AA6BA,IAAM,2BAAA,GAA8B,EAAA;AACpC,IAAM,0BAAA,GAA6B,KAAK,EAAA,GAAK,GAAA;AAC7C,IAAM,uBAAuB,EAAA,GAAK,GAAA;AAgB3B,IAAM,mBAAN,MAAuB;AAAA,EAS7B,WAAA,CACC,cAAA,EACQ,OAAA,GAAmC,EAAC,EAC3C;AADO,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAER,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,IAAA,EAAK;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAI,aAAA,CAAc,cAAc,CAAA;AACnD,IAAA,IAAA,CAAK,cAAA,uBAAqB,GAAA,EAAI;AAC9B,IAAA,IAAA,CAAK,gBAAA,GACJ,QAAQ,gBAAA,IAAoB,2BAAA;AAC7B,IAAA,IAAA,CAAK,gBAAA,GACJ,QAAQ,gBAAA,IAAoB,0BAAA;AAE7B,IAAA,IAAA,CAAK,WAAA,EAAY;AAAA,EAClB;AAAA,EArBQ,GAAA;AAAA,EACA,UAAA,GAA8C,IAAA;AAAA,EAC9C,WAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA,GAAuD,IAAA;AAAA,EACvD,gBAAA;AAAA,EACA,gBAAA;AAAA;AAAA;AAAA;AAAA,EAoBR,MAAc,uBACb,QAAA,EACoD;AACpD,IAAA,MAAM,EAAE,wCAAA,EAAyC,GAAI,MAAM,OAC1D,+DACD,CAAA;AACA,IAAA,MAAM,SAAA,GAAY,IAAI,wCAAA,CAAyC;AAAA,MAC9D,kBAAA,EAAoB,MAAM,UAAA,EAAW;AAAA,MACrC,oBAAA,EAAsB,CAAC,SAAA,KAAsB;AAC5C,QAAA,IAAA,CAAK,cAAA,CAAe,IAAI,SAAA,EAAW;AAAA,UAClC,SAAA;AAAA,UACA,YAAA,EAAc,KAAK,GAAA,EAAI;AAAA,UACvB;AAAA,SACA,CAAA;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,oCAAA,EAAuC,SAAS,CAAA,MAAA,EAAS,QAAQ,CAAA,CAAA;AAAA,SAClE;AAAA,MACD;AAAA,KACA,CAAA;AAGD,IAAA,SAAA,CAAU,SAAA,GAAY,OAAO,OAAA,KAA4B;AAExD,MAAA,IAAI,UAAU,SAAA,EAAW;AACxB,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,UAAU,SAAS,CAAA;AACzD,QAAA,IAAI,KAAA,EAAO,KAAA,CAAM,YAAA,GAAe,IAAA,CAAK,GAAA,EAAI;AAAA,MAC1C;AAEA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,WAAA,CAAY,oBAAA;AAAA,UACrC;AAAA,SACD;AAEA,QAAA,IAAI,WAAW,KAAA,CAAA,EAAW;AACzB,UAAA,MAAM,SAAA,CAAU,KAAK,MAAwB,CAAA;AAAA,QAC9C;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA,CAAK,qCAAA,EAAwC,GAAA,CAAc,OAAO,CAAA;AAAA,MACvE;AAAA,IACD,CAAA;AAEA,IAAA,SAAA,CAAU,UAAU,MAAM;AACzB,MAAA,IAAI,UAAU,SAAA,EAAW;AACxB,QAAA,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,SAAA,CAAU,SAAS,CAAA;AAC9C,QAAA,GAAA,CAAI,IAAA,CAAK,CAAA,oCAAA,EAAuC,SAAA,CAAU,SAAS,CAAA,CAAE,CAAA;AAAA,MACtE;AAAA,IACD,CAAA;AAEA,IAAA,OAAO,SAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,EAAA,EAAoB;AAC7C,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,cAAA,CAAe,MAAA,EAAO,EAAG;AACjD,MAAA,IAAI,KAAA,CAAM,aAAa,EAAA,EAAI,KAAA,EAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,CAAA,EAET;AACV,IAAA,OACC,EAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,EAAG,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,MAAK,IACrD,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW,CAAA,IACxB,SAAA;AAAA,EAEF;AAAA;AAAA;AAAA;AAAA,EAKQ,iBAAA,GAA0B;AACjC,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,SAAA,EAAW,KAAK,CAAA,IAAK,KAAK,cAAA,EAAgB;AACrD,MAAA,IAAI,GAAA,GAAM,KAAA,CAAM,YAAA,GAAe,IAAA,CAAK,gBAAA,EAAkB;AACrD,QAAA,GAAA,CAAI,IAAA,CAAK,CAAA,2CAAA,EAA8C,SAAS,CAAA,CAAE,CAAA;AAClE,QAAA,KAAA,CAAM,SAAA,CAAU,KAAA,EAAM,CAAE,KAAA,CAAM,MAAM;AAAA,QAEpC,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,cAAA,CAAe,OAAO,SAAS,CAAA;AAAA,MACrC;AAAA,IACD;AAAA,EACD;AAAA,EAEQ,WAAA,GAAc;AACrB,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,IAAA,EAAM,CAAA;AAGxB,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB;AAClC,MAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAA,EAAW;AAC1C,MAAA,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAC,CAAA;AACvB,MAAA,GAAA,CAAI,KAAK,0DAAsC,CAAA;AAC/C,MAAA,GAAA,CAAI,KAAK,2CAA2C,CAAA;AACpD,MAAA,GAAA,CAAI,KAAK,+DAA+D,CAAA;AACxE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,OAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA,CAAE,CAAA;AACjD,MAAA,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAC,CAAA;AAAA,IACxB;AAGA,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,OAAO,GAAG,IAAA,KAAS;AACvC,MAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,eAAe,CAAA;AACzC,MAAA,IAAI,CAAC,IAAA,EAAM,UAAA,CAAW,SAAS,CAAA,EAAG;AACjC,QAAA,OAAO,CAAA,CAAE,IAAA;AAAA,UACR,EAAE,OAAO,+CAAA,EAAgD;AAAA,UACzD;AAAA,SACD;AAAA,MACD;AAEA,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC1B,MAAA,MAAM,aAAA,GAAgB,QAAQ,GAAA,CAAI,gBAAA;AAGlC,MAAA,IAAI,aAAA,IAAiB,UAAU,aAAA,EAAe;AAC7C,QAAA,MAAM,IAAA,EAAK;AACX,QAAA;AAAA,MACD;AAGA,MAAA,MAAM,YAAA,GAAe,IAAA,CAAK,WAAA,CAAY,SAAA,EAAU,EAAG,YAAA;AACnD,MAAA,IAAI,YAAA,EAAc;AACjB,QAAA,IAAI;AACH,UAAA,MAAM,YAAA,CAAa,SAAS,KAAK,CAAA;AACjC,UAAA,MAAM,IAAA,EAAK;AACX,UAAA;AAAA,QACD,SAAS,CAAA,EAAY;AACpB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,2CAAA,EAA+C,EAAY,OAAO,CAAA;AAAA,WACnE;AACA,UAAA,OAAO,CAAA,CAAE,IAAA;AAAA,YACR;AAAA,cACC,KAAA,EAAO,CAAA,sCAAA,EAA0C,CAAA,CAAY,OAAO,CAAA;AAAA,aACrE;AAAA,YACA;AAAA,WACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH;AAAA,OACD;AACA,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACR,EAAE,OAAO,+CAAA,EAAgD;AAAA,QACzD;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,OAAO,CAAA,KAAM;AACjC,MAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB,CAAA;AAG/C,MAAA,IAAI,SAAA,EAAW;AACd,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,SAAS,CAAA;AAClD,QAAA,IAAI,CAAC,QAAA,EAAU;AACd,UAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,mBAAA,IAAuB,GAAG,CAAA;AAAA,QAClD;AAEA,QAAA,QAAA,CAAS,YAAA,GAAe,KAAK,GAAA,EAAI;AAEjC,QAAA,MAAM,WAAW,MAAM,QAAA,CAAS,UAAU,aAAA,CAAc,CAAA,CAAE,IAAI,GAAG,CAAA;AAIjE,QAAA,IAAI,CAAA,CAAE,GAAA,CAAI,MAAA,KAAW,QAAA,EAAU;AAC9B,UAAA,IAAA,CAAK,cAAA,CAAe,OAAO,SAAS,CAAA;AACpC,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6CAAA,EAAgD,SAAS,CAAA,CAAE,CAAA;AAAA,QACrE;AAEA,QAAA,OAAO,QAAA;AAAA,MACR;AAIA,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,CAAC,CAAA;AACnC,MAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,iBAAA,CAAkB,QAAQ,CAAA;AACvD,MAAA,IAAI,eAAA,IAAmB,KAAK,gBAAA,EAAkB;AAC7C,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,eAAe,CAAA,UAAA;AAAA,SAC3E;AACA,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,wCAAA,IAA4C,GAAG,CAAA;AAAA,MACvE;AAEA,MAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,sBAAA,CAAuB,QAAQ,CAAA;AAC5D,MAAA,OAAO,MAAM,SAAA,CAAU,aAAA,CAAc,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,IAC/C,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,MAAM,IAAA,EAA8B;AAChD,IAAA,MAAM,UAAA,GAAa,IAAA,IAAQ,IAAA,CAAK,OAAA,CAAQ,IAAA,IAAQ,GAAA;AAGhD,IAAA,IAAA,CAAK,aAAA,GAAgB,WAAA;AAAA,MACpB,MAAM,KAAK,iBAAA,EAAkB;AAAA,MAC7B;AAAA,KACD;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC/B,MAAA,IAAA,CAAK,UAAA,GAAa,KAAA;AAAA,QACjB;AAAA,UACC,KAAA,EAAO,KAAK,GAAA,CAAI,KAAA;AAAA,UAChB,IAAA,EAAM;AAAA,SACP;AAAA,QACA,CAAC,IAAA,KAAS;AACT,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,gEAAA,EAAmE,KAAK,IAAI,CAAA,IAAA;AAAA,WAC7E;AACA,UAAA,OAAA,EAAQ;AAAA,QACT;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,IAAA,GAAsB;AAClC,IAAA,IAAI,KAAK,aAAA,EAAe;AACvB,MAAA,aAAA,CAAc,KAAK,aAAa,CAAA;AAChC,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AAAA,IACtB;AAEA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAK,cAAA,EAAgB;AAC9C,MAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,MAAA,IAAA,CAAK,cAAA,CAAe,OAAO,EAAE,CAAA;AAAA,IAC9B;AAEA,IAAA,IAAI,KAAK,UAAA,EAAY;AACpB,MAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,MAAA,GAAA,CAAI,KAAK,0CAA0C,CAAA;AAAA,IACpD;AAAA,EACD;AACD;;;ACvSO,IAAM,gBAAN,MAAoB;AAAA,EAG1B,WAAA,CAEC,MAAA,EACQ,OAAA,GAA6B,EAAC,EACrC;AADO,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAIR,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAa,IAAA,KAAS,YAAA,EAAc;AAC/C,MAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,MAAA,GAAA,CAAI,KAAK,gDAAgD,CAAA;AAAA,IAC1D,CAAA,MAAA,IAAW,MAAA,EAAQ,WAAA,EAAa,IAAA,KAAS,WAAA,EAAa;AACrD,MAAA,IAAA,CAAK,eAAA,GAAkB,MAAA;AACvB,MAAA,GAAA,CAAI,KAAK,oDAAoD,CAAA;AAAA,IAC9D,CAAA,MAAO;AAEN,MAAA,IAAA,CAAK,eAAA,GAAkB,MAAA;AACvB,MAAA,GAAA,CAAI,KAAK,6DAA6D,CAAA;AAAA,IACvE;AAAA,EACD;AAAA,EApBQ,UAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAoC,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyB5C,MAAa,qBACZ,OAAA,EACmB;AACnB,IAAA,MAAM,KAAK,OAAA,CAAQ,EAAA;AACnB,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AAEvB,IAAA,IAAI,OAAA,CAAQ,YAAY,KAAA,EAAO;AAC9B,MAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,iBAAiB,CAAA;AAAA,IACxD;AAGA,IAAA,IAAI,KAAK,UAAA,EAAY;AACpB,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC/C;AAGA,IAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,UAAA,EAAY;AAC5C,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC/C;AAEA,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,8BAA8B,CAAA;AAAA,EACrE;AAAA,EAEA,MAAc,eAAA,CACb,EAAA,EACA,MAAA,EACA,MAAA,EACmB;AACnB,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,EAAY,OAAO,IAAA;AAE7B,IAAA,IAAI,WAAW,YAAA,EAAc;AAC5B,MAAA,OAAO,IAAA,CAAK,gBAAgB,EAAA,EAAI;AAAA,QAC/B,eAAA,EAAiB,YAAA;AAAA,QACjB,YAAA,EAAc;AAAA,UACb,SAAS,EAAC;AAAA,UACV,WAAW,EAAC;AAAA,UACZ,OAAO;AAAC,SACT;AAAA,QACA,UAAA,EAAY,IAAA,CAAK,UAAA,CAAW,aAAA;AAAc,OAC1C,CAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,KAAW,6BAA6B,OAAO,MAAA;AACnD,IAAA,IAAI,WAAW,MAAA,EAAQ,OAAO,KAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AAEzD,IAAA,IAAI,WAAW,YAAA,EAAc;AAC5B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,SAAA,EAAU;AACxC,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,IAAI,WAAW,gBAAA,EAAkB;AAChC,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,aAAA,EAAc;AAChD,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,WAAW,CAAA;AAAA,IAC9C;AAEA,IAAA,IAAI,WAAW,cAAA,EAAgB;AAC9B,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,WAAA,EAAY;AAC5C,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,SAAS,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI,WAAW,aAAA,EAAe;AAC7B,MAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AAClB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,qBAAqB,CAAA;AAAA,MAC5D;AACA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU;AAAA,UAC9C,MAAM,MAAA,CAAO,IAAA;AAAA,UACb,WAAW,MAAA,CAAO;AAAA,SAClB,CAAA;AACD,QAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAM,CAAA;AAAA,MACvC,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,gBAAA,EAAkB;AAChC,MAAA,IAAI,CAAC,QAAQ,GAAA,EAAK;AACjB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,sBAAsB,CAAA;AAAA,MAC7D;AACA,MAAA,IAAI;AACH,QAAA,MAAM,SAAS,MAAM,IAAA,CAAK,UAAA,CAAW,YAAA,CAAa,OAAO,GAAa,CAAA;AACtE,QAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAM,CAAA;AAAA,MACvC,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,YAAA,EAAc;AAC5B,MAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AAClB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,mBAAmB,CAAA;AAAA,MAC1D;AACA,MAAA,MAAM,OAAA,GAA2B;AAAA,QAChC,MAAM,MAAA,CAAO,IAAA;AAAA,QACb,SAAA,EAAY,MAAA,CAAO,SAAA,IAAyC;AAAC,OAC9D;AAEA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAyB,MAAM,IAAA,CAAK,UAAA,CAAW,SAAS,OAAO,CAAA;AAGrE,QAAA,MAAM,UAAA,GAAa,OAAO,OAAA,GACvB,IAAA,GACA,MAAM,IAAA,CAAK,eAAA,CAAgB,SAAS,MAAM,CAAA;AAE7C,QAAA,IAAI,CAAC,UAAA,EAAY;AAChB,UAAA,OAAO,IAAA,CAAK,gBAAgB,EAAA,EAAI;AAAA,YAC/B,OAAA,EAAS;AAAA,cACR;AAAA,gBACC,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM;AAAA;AACP,aACD;AAAA,YACA,OAAA,EAAS;AAAA,WACT,CAAA;AAAA,QACF;AAEA,QAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAM,CAAA;AAAA,MACvC,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EACzD;AAAA,EAEQ,eAAA,CACP,IACA,MAAA,EACC;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAO;AAAA,EACrC;AAAA,EAEQ,aAAA,CAAc,EAAA,EAAqB,IAAA,EAAc,OAAA,EAAiB;AACzE,IAAA,OAAO,EAAE,SAAS,KAAA,EAAO,EAAA,EAAI,OAAO,EAAE,IAAA,EAAM,SAAQ,EAAE;AAAA,EACvD;AAAA,EAEA,MAAc,eAAA,CACb,OAAA,EACA,MAAA,EACmB;AACnB,IAAA,IACC,CAAC,QAAQ,SAAA,EAAW,OAAA,IACpB,OAAO,OAAA,CAAQ,SAAA,CAAU,YAAY,QAAA,EACpC;AACD,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAU,QAAQ,SAAA,CAAU,OAAA;AAClC,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,EAAG,IAAA;AAEvC,MAAA,IAAI,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,EAAU;AACnD,QAAA,IAAI;AACH,UAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AAEnC,UAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,UAAA,EAAY;AAErC,YAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,wBAAuB,CAAA;AAC7D,YAAA,MAAM,QAAA,GAAW,IAAI,YAAA,EAAa;AAGlC,YAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,eAAA;AAAA,cAClC,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,OAAO,CAAA;AAAA,cAC5B,IAAA,CAAK,QAAA;AAAA,cACL,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,UAAA,IAAc,IAAI,QAAQ,CAAA;AAAA,cAC3C,KAAA,CAAA;AAAA,cACA,IAAA,CAAK;AAAA,aACN;AAEA,YAAA,IAAI,CAAC,WAAA,EAAa;AACjB,cAAA,OAAO,KAAA;AAAA,YACR;AAEA,YAAA,IAAA,CAAK,YAAA,GACJ,yEAAA;AACD,YAAA,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAE,IAAA,GAAO,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,UAC7C;AAAA,QACD,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACD;AACA,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,CAAA,EAAG;AACX,MAAA,GAAA,CAAI,IAAA,CAAK,sCAAsC,CAAC,CAAA;AAChD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,OAAA,GAAyB;AAErC,IAAA,IAAI,KAAK,eAAA,EAAiB;AACzB,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,aAAoB,CAAA;AACxD,MAAA,IAAA,CAAK,aAAa,IAAI,UAAA;AAAA,QACrB,IAAA,CAAK,QAAQ,UAAA,IAAc;AAAA,UAC1B,IAAA,EAAM,aAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACV;AAAA,QACA,EAAE,QAAA,EAAU,IAAA,CAAK,OAAA,CAAQ,QAAA;AAAS,OACnC;AAEA,MAAA,IAAI,IAAA,CAAK,QAAQ,aAAA,EAAe;AAC/B,QAAA,MAAM,IAAA,CAAK,WAAW,OAAA,EAAQ;AAI9B,QAAA,MAAM,SAAS,IAAA,CAAK,eAAA;AAGpB,QAAA,IAAI,OAAO,gBAAA,EAAkB;AAC5B,UAAA,KAAA,MAAW,CAAC,MAAM,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,gBAAgB,CAAA,EAAG;AAEnE,YAAA,MAAM,CAAA,GAAI,IAAA;AACV,YAAA,IAAA,CAAK,UAAA,CAAW,IAAA;AAAA,cACf,IAAA;AAAA,cACA,EAAE,WAAA,IAAe,EAAA;AAAA,cACjB,CAAA,CAAE,eAAe,EAAC;AAAA;AAAA,cAElB,OAAO,IAAA,KAAc;AACpB,gBAAA,OAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA,cAC5B;AAAA,aACD;AAAA,UACD;AAAA,QACD;AAGA,QAAA,IAAI,OAAO,oBAAA,EAAsB;AAChC,UAAA,KAAA,MAAW,CAAC,GAAA,EAAK,QAAQ,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,YACpC,MAAA,CAAO;AAAA,WACR,EAAG;AAEF,YAAA,MAAM,CAAA,GAAI,QAAA;AACV,YAAA,IAAA,CAAK,UAAA,CAAW,QAAA;AAAA,cACf,CAAA,CAAE,IAAA;AAAA,cACF,GAAA;AAAA,cACA,CAAA,CAAE,UAAU,WAAA,IAAe,EAAA;AAAA,cAC3B,CAAA,CAAE,UAAU,QAAA,IAAY,0BAAA;AAAA,cACxB,YAAY;AACX,gBAAA,MAAM,MAAM,MAAM,CAAA,CAAE,aAAa,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAC7C,gBAAA,OAAO,GAAA,CAAI,QAAA,CAAS,CAAC,CAAA,CAAE,IAAA;AAAA,cACxB;AAAA,aACD;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,MAAA;AAAA,IACD;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,OAAO,UAAe,CAAA;AAC7C,IAAA,MAAM,EAAA,GAAK,SAAS,eAAA,CAAgB;AAAA,MACnC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,QAAA,EAAU;AAAA,KACV,CAAA;AAED,IAAA,MAAM,WAAW,YAAY;AAC5B,MAAA,GAAA,CAAI,KAAK,wCAAwC,CAAA;AACjD,MAAA,IAAI,IAAA,CAAK,UAAA,EAAY,MAAM,IAAA,CAAK,WAAW,KAAA,EAAM;AACjD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACf,CAAA;AAEA,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,QAAQ,CAAA;AACvB,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAE9B,IAAA,EAAA,CAAG,EAAA,CAAG,MAAA,EAAQ,OAAO,IAAA,KAAS;AAC7B,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC/B,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,oBAAA,CAAqB,OAAO,CAAA;AACxD,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC;AAAA,CAAI,CAAA;AAAA,QACrD;AAAA,MACD,SAAS,CAAA,EAAY;AACpB,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,qBAAA,EAAyB,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,MACzD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEO,SAAA,GAA+B;AACrC,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AACD","file":"chunk-AL7H7DTW.js","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { serve } from \"@hono/node-server\";\nimport type { WebStandardStreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\";\nimport type { JSONRPCMessage } from \"@modelcontextprotocol/sdk/types.js\";\nimport { Hono } from \"hono\";\nimport { cors } from \"hono/cors\";\nimport type { LiopServer } from \"../server/index.js\";\nimport { log } from \"../utils/logger.js\";\nimport { LiopMcpBridge } from \"./index.js\";\n\n/**\n * Configuration options for LiopStreamBridge.\n */\nexport interface LiopStreamBridgeOptions {\n\t/** Port to listen on (default: 3000) */\n\tport?: number;\n\t/** Max concurrent sessions per IP (default: 5) */\n\tmaxSessionsPerIp?: number;\n\t/** Session idle timeout in milliseconds (default: 30 min) */\n\tsessionTimeoutMs?: number;\n}\n\n/** Internal metadata for tracked sessions */\ninterface SessionEntry {\n\ttransport: WebStandardStreamableHTTPServerTransport;\n\tlastActivity: number;\n\tclientIp: string;\n}\n\nconst DEFAULT_MAX_SESSIONS_PER_IP = 10;\nconst DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes\nconst EVICTION_INTERVAL_MS = 60 * 1000; // Check every minute\n\n/**\n * LiopStreamBridge\n *\n * Exposes a LiopServer over a remote HTTP network using the industry-standard\n * MCP Streamable HTTP Transport + Hono JS.\n *\n * Supports concurrent multi-client connections via per-session transport instances (Map pattern).\n * External agents connect using only a URL + Bearer Token (Zero-Trust).\n *\n * Security hardening:\n * - Zero-Trust Bearer Token enforcement\n * - Per-IP rate limiting on session creation\n * - Automatic eviction of idle sessions (TTL)\n */\nexport class LiopStreamBridge {\n\tprivate app: Hono;\n\tprivate httpServer: ReturnType<typeof serve> | null = null;\n\tprivate bridgeLogic: LiopMcpBridge;\n\tprivate activeSessions: Map<string, SessionEntry>;\n\tprivate evictionTimer: ReturnType<typeof setInterval> | null = null;\n\tprivate maxSessionsPerIp: number;\n\tprivate sessionTimeoutMs: number;\n\n\tconstructor(\n\t\tinternalServer: LiopServer,\n\t\tprivate options: LiopStreamBridgeOptions = {},\n\t) {\n\t\tthis.app = new Hono();\n\t\tthis.bridgeLogic = new LiopMcpBridge(internalServer);\n\t\tthis.activeSessions = new Map();\n\t\tthis.maxSessionsPerIp =\n\t\t\toptions.maxSessionsPerIp ?? DEFAULT_MAX_SESSIONS_PER_IP;\n\t\tthis.sessionTimeoutMs =\n\t\t\toptions.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;\n\n\t\tthis.setupRoutes();\n\t}\n\n\t/**\n\t * Creates a new per-session transport instance and wires it to the LIOPMcpBridge logic.\n\t */\n\tprivate async createSessionTransport(\n\t\tclientIp: string,\n\t): Promise<WebStandardStreamableHTTPServerTransport> {\n\t\tconst { WebStandardStreamableHTTPServerTransport } = await import(\n\t\t\t\"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\"\n\t\t);\n\t\tconst transport = new WebStandardStreamableHTTPServerTransport({\n\t\t\tsessionIdGenerator: () => randomUUID(),\n\t\t\tonsessioninitialized: (sessionId: string) => {\n\t\t\t\tthis.activeSessions.set(sessionId, {\n\t\t\t\t\ttransport,\n\t\t\t\t\tlastActivity: Date.now(),\n\t\t\t\t\tclientIp,\n\t\t\t\t});\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-StreamBridge] Session opened: ${sessionId} (IP: ${clientIp})`,\n\t\t\t\t);\n\t\t\t},\n\t\t});\n\n\t\t// Wire the transport's incoming messages to the LiopMcpBridge JSON-RPC router\n\t\ttransport.onmessage = async (message: JSONRPCMessage) => {\n\t\t\t// Touch activity timestamp on every message\n\t\t\tif (transport.sessionId) {\n\t\t\t\tconst entry = this.activeSessions.get(transport.sessionId);\n\t\t\t\tif (entry) entry.lastActivity = Date.now();\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst result = await this.bridgeLogic.handleJsonRpcRequest(\n\t\t\t\t\tmessage as unknown as Record<string, unknown>,\n\t\t\t\t);\n\t\t\t\t// Notifications return undefined — no response needed\n\t\t\t\tif (result !== undefined) {\n\t\t\t\t\tawait transport.send(result as JSONRPCMessage);\n\t\t\t\t}\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.info(\"[LIOP-StreamBridge] JSON-RPC error:\", (err as Error).message);\n\t\t\t}\n\t\t};\n\n\t\ttransport.onclose = () => {\n\t\t\tif (transport.sessionId) {\n\t\t\t\tthis.activeSessions.delete(transport.sessionId);\n\t\t\t\tlog.info(`[LIOP-StreamBridge] Session closed: ${transport.sessionId}`);\n\t\t\t}\n\t\t};\n\n\t\treturn transport;\n\t}\n\n\t/**\n\t * Returns the number of active sessions for a given IP.\n\t */\n\tprivate countSessionsByIp(ip: string): number {\n\t\tlet count = 0;\n\t\tfor (const entry of this.activeSessions.values()) {\n\t\t\tif (entry.clientIp === ip) count++;\n\t\t}\n\t\treturn count;\n\t}\n\n\t/**\n\t * Extracts client IP from the request (supports X-Forwarded-For for reverse proxies).\n\t */\n\tprivate getClientIp(c: {\n\t\treq: { header: (name: string) => string | undefined };\n\t}): string {\n\t\treturn (\n\t\t\tc.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ||\n\t\t\tc.req.header(\"x-real-ip\") ||\n\t\t\t\"unknown\"\n\t\t);\n\t}\n\n\t/**\n\t * Evicts sessions that have been idle longer than the configured timeout.\n\t */\n\tprivate evictIdleSessions(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [sessionId, entry] of this.activeSessions) {\n\t\t\tif (now - entry.lastActivity > this.sessionTimeoutMs) {\n\t\t\t\tlog.info(`[LIOP-StreamBridge] Evicting idle session: ${sessionId}`);\n\t\t\t\tentry.transport.close().catch(() => {\n\t\t\t\t\t/* Swallow close errors */\n\t\t\t\t});\n\t\t\t\tthis.activeSessions.delete(sessionId);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate setupRoutes() {\n\t\tthis.app.use(\"*\", cors());\n\n\t\t// Initialize strict zero-trust token if not provided\n\t\tif (!process.env.ZERO_TRUST_TOKEN) {\n\t\t\tprocess.env.ZERO_TRUST_TOKEN = randomUUID();\n\t\t\tlog.info(\"=\".repeat(60));\n\t\t\tlog.info(\"⚠️ STRICT ZERO-TRUST MODE ENABLED ⚠️\");\n\t\t\tlog.info(\"No ZERO_TRUST_TOKEN found in environment.\");\n\t\t\tlog.info(\"A secure ephemeral token has been generated for this session:\");\n\t\t\tlog.info(`Token: ${process.env.ZERO_TRUST_TOKEN}`);\n\t\t\tlog.info(\"=\".repeat(60));\n\t\t}\n\n\t\t// ZTA (Zero-Trust Architecture) Security Middleware\n\t\tthis.app.use(\"/mcp\", async (c, next) => {\n\t\t\tconst auth = c.req.header(\"Authorization\");\n\t\t\tif (!auth?.startsWith(\"Bearer \")) {\n\t\t\t\treturn c.json(\n\t\t\t\t\t{ error: \"Unauthorized: LIOP Zero-Trust Policy Enforced\" },\n\t\t\t\t\t401,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst token = auth.slice(7);\n\t\t\tconst expectedToken = process.env.ZERO_TRUST_TOKEN;\n\n\t\t\t// Check static token fallback first (retrocompatibility)\n\t\t\tif (expectedToken && token === expectedToken) {\n\t\t\t\tawait next();\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Validate with JWT Validator if configured on the server\n\t\t\tconst jwtValidator = this.bridgeLogic.getServer()?.jwtValidator;\n\t\t\tif (jwtValidator) {\n\t\t\t\ttry {\n\t\t\t\t\tawait jwtValidator.validate(token);\n\t\t\t\t\tawait next();\n\t\t\t\t\treturn;\n\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-StreamBridge] JWT Validation failed: ${(e as Error).message}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn c.json(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `Unauthorized: JWT Validation failed - ${(e as Error).message}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t401,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlog.info(\n\t\t\t\t\"[LIOP-StreamBridge] ALERT: Access denied - Invalid Zero-Trust token.\",\n\t\t\t);\n\t\t\treturn c.json(\n\t\t\t\t{ error: \"Unauthorized: LIOP Zero-Trust Policy Enforced\" },\n\t\t\t\t401,\n\t\t\t);\n\t\t});\n\n\t\t// Multi-Session Streamable HTTP Handler\n\t\tthis.app.all(\"/mcp\", async (c) => {\n\t\t\tconst sessionId = c.req.header(\"mcp-session-id\");\n\n\t\t\t// Route to existing session if session ID is present\n\t\t\tif (sessionId) {\n\t\t\t\tconst existing = this.activeSessions.get(sessionId);\n\t\t\t\tif (!existing) {\n\t\t\t\t\treturn c.json({ error: \"Session not found\" }, 404);\n\t\t\t\t}\n\t\t\t\t// Touch activity on every routed request\n\t\t\t\texisting.lastActivity = Date.now();\n\n\t\t\t\tconst response = await existing.transport.handleRequest(c.req.raw);\n\n\t\t\t\t// If DELETE, the transport closes internally but onclose may not fire.\n\t\t\t\t// Explicitly clean up the session from the Map.\n\t\t\t\tif (c.req.method === \"DELETE\") {\n\t\t\t\t\tthis.activeSessions.delete(sessionId);\n\t\t\t\t\tlog.info(`[LIOP-StreamBridge] Session closed (DELETE): ${sessionId}`);\n\t\t\t\t}\n\n\t\t\t\treturn response;\n\t\t\t}\n\n\t\t\t// No session ID → New client initializing.\n\t\t\t// Rate-limit: enforce max sessions per IP\n\t\t\tconst clientIp = this.getClientIp(c);\n\t\t\tconst currentSessions = this.countSessionsByIp(clientIp);\n\t\t\tif (currentSessions >= this.maxSessionsPerIp) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-StreamBridge] Rate limit hit for IP: ${clientIp} (${currentSessions} sessions)`,\n\t\t\t\t);\n\t\t\t\treturn c.json({ error: \"Too Many Sessions: Rate limit exceeded\" }, 429);\n\t\t\t}\n\n\t\t\tconst transport = await this.createSessionTransport(clientIp);\n\t\t\treturn await transport.handleRequest(c.req.raw);\n\t\t});\n\t}\n\n\t/**\n\t * Starts the LiopStreamBridge HTTP server and session eviction timer.\n\t */\n\tpublic async start(port?: number): Promise<void> {\n\t\tconst listenPort = port ?? this.options.port ?? 3000;\n\n\t\t// Start the idle session eviction timer\n\t\tthis.evictionTimer = setInterval(\n\t\t\t() => this.evictIdleSessions(),\n\t\t\tEVICTION_INTERVAL_MS,\n\t\t);\n\n\t\treturn new Promise((resolve) => {\n\t\t\tthis.httpServer = serve(\n\t\t\t\t{\n\t\t\t\t\tfetch: this.app.fetch,\n\t\t\t\t\tport: listenPort,\n\t\t\t\t},\n\t\t\t\t(info) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-StreamBridge] Streamable HTTP Gateway on http://localhost:${info.port}/mcp`,\n\t\t\t\t\t);\n\t\t\t\t\tresolve();\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\t}\n\n\t/**\n\t * Graceful shutdown — closes all active sessions, stops timers, and releases port.\n\t */\n\tpublic async stop(): Promise<void> {\n\t\tif (this.evictionTimer) {\n\t\t\tclearInterval(this.evictionTimer);\n\t\t\tthis.evictionTimer = null;\n\t\t}\n\n\t\tfor (const [id, entry] of this.activeSessions) {\n\t\t\tawait entry.transport.close();\n\t\t\tthis.activeSessions.delete(id);\n\t\t}\n\n\t\tif (this.httpServer) {\n\t\t\tthis.httpServer.close();\n\t\t\tlog.info(\"[LIOP-StreamBridge] HTTP ports released.\");\n\t\t}\n\t}\n}\n","import type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type { LiopServer, LiopServerOptions } from \"../server/index.js\";\nimport type { CallToolRequest, CallToolResult } from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopBridgeOptions {\n\tpublishToMesh?: boolean;\n\tmeshIdentity?: string;\n\tserverInfo?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\tsecurity?: LiopServerOptions[\"security\"];\n}\n\n/**\n * LIOP MCP Bridge\n * A bi-directional bridge that allows legacy MCP servers to join the LIOP mesh,\n * or exposes a LIOP server as an MCP-compatible stdio process for tools like Claude Desktop.\n */\nexport class LiopMcpBridge {\n\tprivate liopServer: LiopServer | null = null;\n\tprivate legacyMcpServer: McpServer | null = null;\n\tconstructor(\n\t\t// biome-ignore lint/suspicious/noExplicitAny: polymorphic source detection\n\t\tsource: LiopServer | McpServer | any,\n\t\tprivate options: LiopBridgeOptions = {},\n\t) {\n\t\t// Determine mode: Exposing LIOP to MCP (Claude) or Wrapping MCP to LIOP (Mesh)\n\t\t// We use constructor name check to avoid hard dependency on optional SDK at runtime start\n\t\tif (source?.constructor?.name === \"LiopServer\") {\n\t\t\tthis.liopServer = source as LiopServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: EXPOSE (LIOP -> MCP Stdio)\");\n\t\t} else if (source?.constructor?.name === \"McpServer\") {\n\t\t\tthis.legacyMcpServer = source as McpServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: WRAP (Legacy MCP -> LIOP Mesh)\");\n\t\t} else {\n\t\t\t// Fallback for inferred legacy MCP servers\n\t\t\tthis.legacyMcpServer = source as McpServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: WRAP (Inferred Legacy MCP -> LIOP Mesh)\");\n\t\t}\n\t}\n\n\t/**\n\t * Handles an incoming standard MCP JSON-RPC 2.0 payload.\n\t * Pipes it to the underlying server (LIOP or Legacy MCP).\n\t */\n\tpublic async handleJsonRpcRequest(\n\t\tpayload: Record<string, unknown>,\n\t): Promise<unknown> {\n\t\tconst id = payload.id as string | number;\n\t\tconst method = payload.method as string;\n\t\tconst params = payload.params as Record<string, unknown> | undefined;\n\n\t\tif (payload.jsonrpc !== \"2.0\") {\n\t\t\treturn this.errorResponse(id, -32600, \"Invalid Request\");\n\t\t}\n\n\t\t// Mode: EXPOSE (Standard behavior used by Claude Desktop)\n\t\tif (this.liopServer) {\n\t\t\treturn this.handleLiopToMcp(id, method, params);\n\t\t}\n\n\t\t// Mode: WRAP (Redirecting via internal LiopServer after connect())\n\t\tif (this.legacyMcpServer && this.liopServer) {\n\t\t\treturn this.handleLiopToMcp(id, method, params);\n\t\t}\n\n\t\treturn this.errorResponse(id, -32601, \"Bridge source not configured\");\n\t}\n\n\tprivate async handleLiopToMcp(\n\t\tid: string | number,\n\t\tmethod: string,\n\t\tparams: Record<string, unknown> | undefined,\n\t): Promise<unknown> {\n\t\tif (!this.liopServer) return null;\n\n\t\tif (method === \"initialize\") {\n\t\t\treturn this.successResponse(id, {\n\t\t\t\tprotocolVersion: \"2025-11-25\",\n\t\t\t\tcapabilities: {\n\t\t\t\t\tprompts: {},\n\t\t\t\t\tresources: {},\n\t\t\t\t\ttools: {},\n\t\t\t\t},\n\t\t\t\tserverInfo: this.liopServer.getServerInfo(),\n\t\t\t});\n\t\t}\n\n\t\tif (method === \"notifications/initialized\") return undefined;\n\t\tif (method === \"ping\") return this.successResponse(id, {});\n\n\t\tif (method === \"tools/list\") {\n\t\t\tconst tools = this.liopServer.listTools();\n\t\t\treturn this.successResponse(id, { tools });\n\t\t}\n\n\t\tif (method === \"resources/list\") {\n\t\t\tconst resources = this.liopServer.listResources();\n\t\t\treturn this.successResponse(id, { resources });\n\t\t}\n\n\t\tif (method === \"prompts/list\") {\n\t\t\tconst prompts = this.liopServer.listPrompts();\n\t\t\treturn this.successResponse(id, { prompts });\n\t\t}\n\n\t\tif (method === \"prompts/get\") {\n\t\t\tif (!params?.name) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing prompt name\");\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await this.liopServer.getPrompt({\n\t\t\t\t\tname: params.name as string,\n\t\t\t\t\targuments: params.arguments as Record<string, string> | undefined,\n\t\t\t\t});\n\t\t\t\treturn this.successResponse(id, result);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\tif (method === \"resources/read\") {\n\t\t\tif (!params?.uri) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing resource URI\");\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await this.liopServer.readResource(params.uri as string);\n\t\t\t\treturn this.successResponse(id, result);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\tif (method === \"tools/call\") {\n\t\t\tif (!params?.name) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing tool name\");\n\t\t\t}\n\t\t\tconst request: CallToolRequest = {\n\t\t\t\tname: params.name as string,\n\t\t\t\targuments: (params.arguments as Record<string, unknown>) || {},\n\t\t\t};\n\n\t\t\ttry {\n\t\t\t\tconst result: CallToolResult = await this.liopServer.callTool(request);\n\t\t\t\t// If the tool execution returned an error (e.g. policy violation), we bypass\n\t\t\t\t// ZK-Receipt verification because no cryptographic proof is generated for errors.\n\t\t\t\tconst isVerified = result.isError\n\t\t\t\t\t? true\n\t\t\t\t\t: await this.verifyZkReceipt(request, result);\n\n\t\t\t\tif (!isVerified) {\n\t\t\t\t\treturn this.successResponse(id, {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: \"ALERT [LIOP ZERO-TRUST SHIELD] ZK Verification Failed. The mathematical ImageID does not match the original payload.\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tisError: true,\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\treturn this.successResponse(id, result);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\treturn this.errorResponse(id, -32601, \"Method not found\");\n\t}\n\n\tprivate successResponse(\n\t\tid: string | number | null | undefined,\n\t\tresult: unknown,\n\t) {\n\t\treturn { jsonrpc: \"2.0\", id, result };\n\t}\n\n\tprivate errorResponse(id: string | number, code: number, message: string) {\n\t\treturn { jsonrpc: \"2.0\", id, error: { code, message } };\n\t}\n\n\tprivate async verifyZkReceipt(\n\t\trequest: CallToolRequest,\n\t\tresult: CallToolResult,\n\t): Promise<boolean> {\n\t\tif (\n\t\t\t!request.arguments?.payload ||\n\t\t\ttypeof request.arguments.payload !== \"string\"\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\n\t\ttry {\n\t\t\tconst payload = request.arguments.payload as string;\n\t\t\tconst contentText = result.content[0]?.text;\n\n\t\t\tif (contentText && typeof contentText === \"string\") {\n\t\t\t\ttry {\n\t\t\t\t\tconst data = JSON.parse(contentText);\n\n\t\t\t\t\tif (data.image_id || data.zk_receipt) {\n\t\t\t\t\t\t// 1. Instantiate the Industrial Verifier ( backed by Piscina Worker Pool )\n\t\t\t\t\t\tconst { LiopVerifier } = await import(\"../crypto/verifier.js\");\n\t\t\t\t\t\tconst verifier = new LiopVerifier();\n\n\t\t\t\t\t\t// 2. Delegate the heavy mathematical check (ZK Journal + Seal)\n\t\t\t\t\t\tconst isAuthentic = await verifier.verifyZkReceipt(\n\t\t\t\t\t\t\tBuffer.from(payload, \"utf-8\"),\n\t\t\t\t\t\t\tdata.image_id,\n\t\t\t\t\t\t\tBuffer.from(data.zk_receipt || \"\", \"base64\"),\n\t\t\t\t\t\t\tundefined,\n\t\t\t\t\t\t\tdata.computation_result,\n\t\t\t\t\t\t);\n\n\t\t\t\t\t\tif (!isAuthentic) {\n\t\t\t\t\t\t\treturn false;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tdata.audit_status =\n\t\t\t\t\t\t\t\"VERIFIED: ZK-Receipt & ImageID Mathematically Verified by LiopMcpBridge\";\n\t\t\t\t\t\tresult.content[0].text = JSON.stringify(data);\n\t\t\t\t\t}\n\t\t\t\t} catch {\n\t\t\t\t\t// Output not JSON\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn true;\n\t\t} catch (e) {\n\t\t\tlog.info(\"[LIOP-Bridge] ZK-Verifier Failure:\", e);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Connects the bridge via stdio or Mesh depending on mode.\n\t */\n\tpublic async connect(): Promise<void> {\n\t\t// In WRAP mode, we actually need to create a LiopServer and join the mesh\n\t\tif (this.legacyMcpServer) {\n\t\t\tconst { LiopServer } = await import(\"../server/index.js\");\n\t\t\tthis.liopServer = new LiopServer(\n\t\t\t\tthis.options.serverInfo || {\n\t\t\t\t\tname: \"liop-bridge\",\n\t\t\t\t\tversion: \"1.0.0\",\n\t\t\t\t},\n\t\t\t\t{ security: this.options.security },\n\t\t\t);\n\n\t\t\tif (this.options.publishToMesh) {\n\t\t\t\tawait this.liopServer.connect();\n\n\t\t\t\t// Automatically Bridge Legacy Capabilities to LIOP Mesh\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Internal legacy MCP properties are completely opaque and unexported\n\t\t\t\tconst legacy = this.legacyMcpServer as any;\n\n\t\t\t\t// 1. Sync Tools\n\t\t\t\tif (legacy._registeredTools) {\n\t\t\t\t\tfor (const [name, tool] of Object.entries(legacy._registeredTools)) {\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy structure\n\t\t\t\t\t\tconst t = tool as any;\n\t\t\t\t\t\tthis.liopServer.tool(\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tt.description || \"\",\n\t\t\t\t\t\t\tt.inputSchema || {},\n\t\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy callback args\n\t\t\t\t\t\t\tasync (args: any) => {\n\t\t\t\t\t\t\t\treturn await t.handler(args);\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// 2. Sync Resources\n\t\t\t\tif (legacy._registeredResources) {\n\t\t\t\t\tfor (const [uri, resource] of Object.entries(\n\t\t\t\t\t\tlegacy._registeredResources,\n\t\t\t\t\t)) {\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy structure\n\t\t\t\t\t\tconst r = resource as any;\n\t\t\t\t\t\tthis.liopServer.resource(\n\t\t\t\t\t\t\tr.name,\n\t\t\t\t\t\t\turi,\n\t\t\t\t\t\t\tr.metadata?.description || \"\",\n\t\t\t\t\t\t\tr.metadata?.mimeType || \"application/octet-stream\",\n\t\t\t\t\t\t\tasync () => {\n\t\t\t\t\t\t\t\tconst res = await r.readCallback(new URL(uri));\n\t\t\t\t\t\t\t\treturn res.contents[0].text;\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\t// In EXPOSE mode, listen to stdio (Claude Desktop)\n\t\tconst readline = await import(\"node:readline\");\n\t\tconst rl = readline.createInterface({\n\t\t\tinput: process.stdin,\n\t\t\toutput: process.stdout,\n\t\t\tterminal: false,\n\t\t});\n\n\t\tconst shutdown = async () => {\n\t\t\tlog.info(\"[LIOP-Bridge] Disconnecting session...\");\n\t\t\tif (this.liopServer) await this.liopServer.close();\n\t\t\tprocess.exit(0);\n\t\t};\n\n\t\trl.on(\"close\", shutdown);\n\t\tprocess.on(\"SIGINT\", shutdown);\n\t\tprocess.on(\"SIGTERM\", shutdown);\n\n\t\trl.on(\"line\", async (line) => {\n\t\t\tif (!line.trim()) return;\n\t\t\ttry {\n\t\t\t\tconst payload = JSON.parse(line);\n\t\t\t\tconst response = await this.handleJsonRpcRequest(payload);\n\t\t\t\tif (response) {\n\t\t\t\t\tprocess.stdout.write(`${JSON.stringify(response)}\\n`);\n\t\t\t\t}\n\t\t\t} catch (e: unknown) {\n\t\t\t\tlog.error(`[LIOP-Bridge] Error: ${(e as Error).message}`);\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic getServer(): LiopServer | null {\n\t\treturn this.liopServer;\n\t}\n}\n\nexport * from \"./stream.js\";\n"]}
+{"version":3,"sources":["../src/bridge/stream.ts","../src/bridge/index.ts"],"names":[],"mappings":";;;;;;AA6BA,IAAM,2BAAA,GAA8B,EAAA;AACpC,IAAM,0BAAA,GAA6B,KAAK,EAAA,GAAK,GAAA;AAC7C,IAAM,uBAAuB,EAAA,GAAK,GAAA;AAgB3B,IAAM,mBAAN,MAAuB;AAAA,EAS7B,WAAA,CACC,cAAA,EACQ,OAAA,GAAmC,EAAC,EAC3C;AADO,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAER,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,IAAA,EAAK;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAI,aAAA,CAAc,cAAc,CAAA;AACnD,IAAA,IAAA,CAAK,cAAA,uBAAqB,GAAA,EAAI;AAC9B,IAAA,IAAA,CAAK,gBAAA,GACJ,QAAQ,gBAAA,IAAoB,2BAAA;AAC7B,IAAA,IAAA,CAAK,gBAAA,GACJ,QAAQ,gBAAA,IAAoB,0BAAA;AAE7B,IAAA,IAAA,CAAK,WAAA,EAAY;AAAA,EAClB;AAAA,EArBQ,GAAA;AAAA,EACA,UAAA,GAA8C,IAAA;AAAA,EAC9C,WAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA,GAAuD,IAAA;AAAA,EACvD,gBAAA;AAAA,EACA,gBAAA;AAAA;AAAA;AAAA;AAAA,EAoBR,MAAc,uBACb,QAAA,EACoD;AACpD,IAAA,MAAM,EAAE,wCAAA,EAAyC,GAAI,MAAM,OAC1D,+DACD,CAAA;AACA,IAAA,MAAM,SAAA,GAAY,IAAI,wCAAA,CAAyC;AAAA,MAC9D,kBAAA,EAAoB,MAAM,UAAA,EAAW;AAAA,MACrC,oBAAA,EAAsB,CAAC,SAAA,KAAsB;AAC5C,QAAA,IAAA,CAAK,cAAA,CAAe,IAAI,SAAA,EAAW;AAAA,UAClC,SAAA;AAAA,UACA,YAAA,EAAc,KAAK,GAAA,EAAI;AAAA,UACvB;AAAA,SACA,CAAA;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,oCAAA,EAAuC,SAAS,CAAA,MAAA,EAAS,QAAQ,CAAA,CAAA;AAAA,SAClE;AAAA,MACD;AAAA,KACA,CAAA;AAGD,IAAA,SAAA,CAAU,SAAA,GAAY,OAAO,OAAA,KAA4B;AAExD,MAAA,IAAI,UAAU,SAAA,EAAW;AACxB,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,UAAU,SAAS,CAAA;AACzD,QAAA,IAAI,KAAA,EAAO,KAAA,CAAM,YAAA,GAAe,IAAA,CAAK,GAAA,EAAI;AAAA,MAC1C;AAEA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,WAAA,CAAY,oBAAA;AAAA,UACrC;AAAA,SACD;AAEA,QAAA,IAAI,WAAW,KAAA,CAAA,EAAW;AACzB,UAAA,MAAM,SAAA,CAAU,KAAK,MAAwB,CAAA;AAAA,QAC9C;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA,CAAK,qCAAA,EAAwC,GAAA,CAAc,OAAO,CAAA;AAAA,MACvE;AAAA,IACD,CAAA;AAEA,IAAA,SAAA,CAAU,UAAU,MAAM;AACzB,MAAA,IAAI,UAAU,SAAA,EAAW;AACxB,QAAA,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,SAAA,CAAU,SAAS,CAAA;AAC9C,QAAA,GAAA,CAAI,IAAA,CAAK,CAAA,oCAAA,EAAuC,SAAA,CAAU,SAAS,CAAA,CAAE,CAAA;AAAA,MACtE;AAAA,IACD,CAAA;AAEA,IAAA,OAAO,SAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,EAAA,EAAoB;AAC7C,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,cAAA,CAAe,MAAA,EAAO,EAAG;AACjD,MAAA,IAAI,KAAA,CAAM,aAAa,EAAA,EAAI,KAAA,EAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,CAAA,EAET;AACV,IAAA,OACC,EAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,EAAG,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,MAAK,IACrD,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW,CAAA,IACxB,SAAA;AAAA,EAEF;AAAA;AAAA;AAAA;AAAA,EAKQ,iBAAA,GAA0B;AACjC,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,SAAA,EAAW,KAAK,CAAA,IAAK,KAAK,cAAA,EAAgB;AACrD,MAAA,IAAI,GAAA,GAAM,KAAA,CAAM,YAAA,GAAe,IAAA,CAAK,gBAAA,EAAkB;AACrD,QAAA,GAAA,CAAI,IAAA,CAAK,CAAA,2CAAA,EAA8C,SAAS,CAAA,CAAE,CAAA;AAClE,QAAA,KAAA,CAAM,SAAA,CAAU,KAAA,EAAM,CAAE,KAAA,CAAM,MAAM;AAAA,QAEpC,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,cAAA,CAAe,OAAO,SAAS,CAAA;AAAA,MACrC;AAAA,IACD;AAAA,EACD;AAAA,EAEQ,WAAA,GAAc;AACrB,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,IAAA,EAAM,CAAA;AAGxB,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB;AAClC,MAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAA,EAAW;AAC1C,MAAA,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAC,CAAA;AACvB,MAAA,GAAA,CAAI,KAAK,0DAAsC,CAAA;AAC/C,MAAA,GAAA,CAAI,KAAK,2CAA2C,CAAA;AACpD,MAAA,GAAA,CAAI,KAAK,+DAA+D,CAAA;AACxE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,OAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA,CAAE,CAAA;AACjD,MAAA,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAC,CAAA;AAAA,IACxB;AAGA,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,OAAO,GAAG,IAAA,KAAS;AACvC,MAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,eAAe,CAAA;AACzC,MAAA,IAAI,CAAC,IAAA,EAAM,UAAA,CAAW,SAAS,CAAA,EAAG;AACjC,QAAA,OAAO,CAAA,CAAE,IAAA;AAAA,UACR,EAAE,OAAO,+CAAA,EAAgD;AAAA,UACzD;AAAA,SACD;AAAA,MACD;AAEA,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC1B,MAAA,MAAM,aAAA,GAAgB,QAAQ,GAAA,CAAI,gBAAA;AAGlC,MAAA,IAAI,aAAA,IAAiB,UAAU,aAAA,EAAe;AAC7C,QAAA,MAAM,IAAA,EAAK;AACX,QAAA;AAAA,MACD;AAGA,MAAA,MAAM,YAAA,GAAe,IAAA,CAAK,WAAA,CAAY,SAAA,EAAU,EAAG,YAAA;AACnD,MAAA,IAAI,YAAA,EAAc;AACjB,QAAA,IAAI;AACH,UAAA,MAAM,YAAA,CAAa,SAAS,KAAK,CAAA;AACjC,UAAA,MAAM,IAAA,EAAK;AACX,UAAA;AAAA,QACD,SAAS,CAAA,EAAY;AACpB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,2CAAA,EAA+C,EAAY,OAAO,CAAA;AAAA,WACnE;AACA,UAAA,OAAO,CAAA,CAAE,IAAA;AAAA,YACR;AAAA,cACC,KAAA,EAAO,CAAA,sCAAA,EAA0C,CAAA,CAAY,OAAO,CAAA;AAAA,aACrE;AAAA,YACA;AAAA,WACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH;AAAA,OACD;AACA,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACR,EAAE,OAAO,+CAAA,EAAgD;AAAA,QACzD;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,OAAO,CAAA,KAAM;AACjC,MAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB,CAAA;AAG/C,MAAA,IAAI,SAAA,EAAW;AACd,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,SAAS,CAAA;AAClD,QAAA,IAAI,CAAC,QAAA,EAAU;AACd,UAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,mBAAA,IAAuB,GAAG,CAAA;AAAA,QAClD;AAEA,QAAA,QAAA,CAAS,YAAA,GAAe,KAAK,GAAA,EAAI;AAEjC,QAAA,MAAM,WAAW,MAAM,QAAA,CAAS,UAAU,aAAA,CAAc,CAAA,CAAE,IAAI,GAAG,CAAA;AAIjE,QAAA,IAAI,CAAA,CAAE,GAAA,CAAI,MAAA,KAAW,QAAA,EAAU;AAC9B,UAAA,IAAA,CAAK,cAAA,CAAe,OAAO,SAAS,CAAA;AACpC,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6CAAA,EAAgD,SAAS,CAAA,CAAE,CAAA;AAAA,QACrE;AAEA,QAAA,OAAO,QAAA;AAAA,MACR;AAIA,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,CAAC,CAAA;AACnC,MAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,iBAAA,CAAkB,QAAQ,CAAA;AACvD,MAAA,IAAI,eAAA,IAAmB,KAAK,gBAAA,EAAkB;AAC7C,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,eAAe,CAAA,UAAA;AAAA,SAC3E;AACA,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,wCAAA,IAA4C,GAAG,CAAA;AAAA,MACvE;AAEA,MAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,sBAAA,CAAuB,QAAQ,CAAA;AAC5D,MAAA,OAAO,MAAM,SAAA,CAAU,aAAA,CAAc,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,IAC/C,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,MAAM,IAAA,EAA8B;AAChD,IAAA,MAAM,UAAA,GAAa,IAAA,IAAQ,IAAA,CAAK,OAAA,CAAQ,IAAA,IAAQ,GAAA;AAGhD,IAAA,IAAA,CAAK,aAAA,GAAgB,WAAA;AAAA,MACpB,MAAM,KAAK,iBAAA,EAAkB;AAAA,MAC7B;AAAA,KACD;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC/B,MAAA,IAAA,CAAK,UAAA,GAAa,KAAA;AAAA,QACjB;AAAA,UACC,KAAA,EAAO,KAAK,GAAA,CAAI,KAAA;AAAA,UAChB,IAAA,EAAM;AAAA,SACP;AAAA,QACA,CAAC,IAAA,KAAS;AACT,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,gEAAA,EAAmE,KAAK,IAAI,CAAA,IAAA;AAAA,WAC7E;AACA,UAAA,OAAA,EAAQ;AAAA,QACT;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,IAAA,GAAsB;AAClC,IAAA,IAAI,KAAK,aAAA,EAAe;AACvB,MAAA,aAAA,CAAc,KAAK,aAAa,CAAA;AAChC,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AAAA,IACtB;AAEA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAK,cAAA,EAAgB;AAC9C,MAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,MAAA,IAAA,CAAK,cAAA,CAAe,OAAO,EAAE,CAAA;AAAA,IAC9B;AAEA,IAAA,IAAI,KAAK,UAAA,EAAY;AACpB,MAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,MAAA,GAAA,CAAI,KAAK,0CAA0C,CAAA;AAAA,IACpD;AAAA,EACD;AACD;;;ACvSO,IAAM,gBAAN,MAAoB;AAAA,EAG1B,WAAA,CAEC,MAAA,EACQ,OAAA,GAA6B,EAAC,EACrC;AADO,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAIR,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAa,IAAA,KAAS,YAAA,EAAc;AAC/C,MAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,MAAA,GAAA,CAAI,KAAK,gDAAgD,CAAA;AAAA,IAC1D,CAAA,MAAA,IAAW,MAAA,EAAQ,WAAA,EAAa,IAAA,KAAS,WAAA,EAAa;AACrD,MAAA,IAAA,CAAK,eAAA,GAAkB,MAAA;AACvB,MAAA,GAAA,CAAI,KAAK,oDAAoD,CAAA;AAAA,IAC9D,CAAA,MAAO;AAEN,MAAA,IAAA,CAAK,eAAA,GAAkB,MAAA;AACvB,MAAA,GAAA,CAAI,KAAK,6DAA6D,CAAA;AAAA,IACvE;AAAA,EACD;AAAA,EApBQ,UAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAoC,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyB5C,MAAa,qBACZ,OAAA,EACmB;AACnB,IAAA,MAAM,KAAK,OAAA,CAAQ,EAAA;AACnB,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AAEvB,IAAA,IAAI,OAAA,CAAQ,YAAY,KAAA,EAAO;AAC9B,MAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,iBAAiB,CAAA;AAAA,IACxD;AAGA,IAAA,IAAI,KAAK,UAAA,EAAY;AACpB,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC/C;AAGA,IAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,UAAA,EAAY;AAC5C,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC/C;AAEA,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,8BAA8B,CAAA;AAAA,EACrE;AAAA,EAEA,MAAc,eAAA,CACb,EAAA,EACA,MAAA,EACA,MAAA,EACmB;AACnB,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,EAAY,OAAO,IAAA;AAE7B,IAAA,IAAI,WAAW,YAAA,EAAc;AAC5B,MAAA,OAAO,IAAA,CAAK,gBAAgB,EAAA,EAAI;AAAA,QAC/B,eAAA,EAAiB,YAAA;AAAA,QACjB,YAAA,EAAc;AAAA,UACb,SAAS,EAAC;AAAA,UACV,WAAW,EAAC;AAAA,UACZ,OAAO;AAAC,SACT;AAAA,QACA,UAAA,EAAY,IAAA,CAAK,UAAA,CAAW,aAAA;AAAc,OAC1C,CAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,KAAW,6BAA6B,OAAO,MAAA;AACnD,IAAA,IAAI,WAAW,MAAA,EAAQ,OAAO,KAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AAEzD,IAAA,IAAI,WAAW,YAAA,EAAc;AAC5B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,SAAA,EAAU;AACxC,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,OAAO,CAAA;AAAA,IAC1C;AAEA,IAAA,IAAI,WAAW,gBAAA,EAAkB;AAChC,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,aAAA,EAAc;AAChD,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,WAAW,CAAA;AAAA,IAC9C;AAEA,IAAA,IAAI,WAAW,cAAA,EAAgB;AAC9B,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CAAW,WAAA,EAAY;AAC5C,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,SAAS,CAAA;AAAA,IAC5C;AAEA,IAAA,IAAI,WAAW,aAAA,EAAe;AAC7B,MAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AAClB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,qBAAqB,CAAA;AAAA,MAC5D;AACA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU;AAAA,UAC9C,MAAM,MAAA,CAAO,IAAA;AAAA,UACb,WAAW,MAAA,CAAO;AAAA,SAClB,CAAA;AACD,QAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAM,CAAA;AAAA,MACvC,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,gBAAA,EAAkB;AAChC,MAAA,IAAI,CAAC,QAAQ,GAAA,EAAK;AACjB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,sBAAsB,CAAA;AAAA,MAC7D;AACA,MAAA,IAAI;AACH,QAAA,MAAM,SAAS,MAAM,IAAA,CAAK,UAAA,CAAW,YAAA,CAAa,OAAO,GAAa,CAAA;AACtE,QAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAM,CAAA;AAAA,MACvC,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,YAAA,EAAc;AAC5B,MAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AAClB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,mBAAmB,CAAA;AAAA,MAC1D;AACA,MAAA,MAAM,OAAA,GAA2B;AAAA,QAChC,MAAM,MAAA,CAAO,IAAA;AAAA,QACb,SAAA,EAAY,MAAA,CAAO,SAAA,IAAyC;AAAC,OAC9D;AAEA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAyB,MAAM,IAAA,CAAK,UAAA,CAAW,SAAS,OAAO,CAAA;AAGrE,QAAA,MAAM,UAAA,GAAa,OAAO,OAAA,GACvB,IAAA,GACA,MAAM,IAAA,CAAK,eAAA,CAAgB,SAAS,MAAM,CAAA;AAE7C,QAAA,IAAI,CAAC,UAAA,EAAY;AAChB,UAAA,OAAO,IAAA,CAAK,gBAAgB,EAAA,EAAI;AAAA,YAC/B,OAAA,EAAS;AAAA,cACR;AAAA,gBACC,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM;AAAA;AACP,aACD;AAAA,YACA,OAAA,EAAS;AAAA,WACT,CAAA;AAAA,QACF;AAEA,QAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAM,CAAA;AAAA,MACvC,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EACzD;AAAA,EAEQ,eAAA,CACP,IACA,MAAA,EACC;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAO;AAAA,EACrC;AAAA,EAEQ,aAAA,CAAc,EAAA,EAAqB,IAAA,EAAc,OAAA,EAAiB;AACzE,IAAA,OAAO,EAAE,SAAS,KAAA,EAAO,EAAA,EAAI,OAAO,EAAE,IAAA,EAAM,SAAQ,EAAE;AAAA,EACvD;AAAA,EAEA,MAAc,eAAA,CACb,OAAA,EACA,MAAA,EACmB;AACnB,IAAA,IACC,CAAC,QAAQ,SAAA,EAAW,OAAA,IACpB,OAAO,OAAA,CAAQ,SAAA,CAAU,YAAY,QAAA,EACpC;AACD,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAU,QAAQ,SAAA,CAAU,OAAA;AAClC,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,EAAG,IAAA;AAEvC,MAAA,IAAI,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,EAAU;AACnD,QAAA,IAAI;AACH,UAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AAEnC,UAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,UAAA,EAAY;AAErC,YAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,wBAAuB,CAAA;AAC7D,YAAA,MAAM,QAAA,GAAW,IAAI,YAAA,EAAa;AAGlC,YAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,eAAA;AAAA,cAClC,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,OAAO,CAAA;AAAA,cAC5B,IAAA,CAAK,QAAA;AAAA,cACL,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,UAAA,IAAc,IAAI,QAAQ,CAAA;AAAA,cAC3C,KAAA,CAAA;AAAA,cACA,IAAA,CAAK;AAAA,aACN;AAEA,YAAA,IAAI,CAAC,WAAA,EAAa;AACjB,cAAA,OAAO,KAAA;AAAA,YACR;AAEA,YAAA,IAAA,CAAK,YAAA,GACJ,yEAAA;AACD,YAAA,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAE,IAAA,GAAO,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,UAC7C;AAAA,QACD,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACD;AACA,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,CAAA,EAAG;AACX,MAAA,GAAA,CAAI,IAAA,CAAK,sCAAsC,CAAC,CAAA;AAChD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,OAAA,GAAyB;AAErC,IAAA,IAAI,KAAK,eAAA,EAAiB;AACzB,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,aAAoB,CAAA;AACxD,MAAA,IAAA,CAAK,aAAa,IAAI,UAAA;AAAA,QACrB,IAAA,CAAK,QAAQ,UAAA,IAAc;AAAA,UAC1B,IAAA,EAAM,aAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACV;AAAA,QACA,EAAE,QAAA,EAAU,IAAA,CAAK,OAAA,CAAQ,QAAA;AAAS,OACnC;AAEA,MAAA,IAAI,IAAA,CAAK,QAAQ,aAAA,EAAe;AAC/B,QAAA,MAAM,IAAA,CAAK,WAAW,OAAA,EAAQ;AAI9B,QAAA,MAAM,SAAS,IAAA,CAAK,eAAA;AAGpB,QAAA,IAAI,OAAO,gBAAA,EAAkB;AAC5B,UAAA,KAAA,MAAW,CAAC,MAAM,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,gBAAgB,CAAA,EAAG;AAEnE,YAAA,MAAM,CAAA,GAAI,IAAA;AACV,YAAA,IAAA,CAAK,UAAA,CAAW,IAAA;AAAA,cACf,IAAA;AAAA,cACA,EAAE,WAAA,IAAe,EAAA;AAAA,cACjB,CAAA,CAAE,eAAe,EAAC;AAAA;AAAA,cAElB,OAAO,IAAA,KAAc;AACpB,gBAAA,OAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA,cAC5B;AAAA,aACD;AAAA,UACD;AAAA,QACD;AAGA,QAAA,IAAI,OAAO,oBAAA,EAAsB;AAChC,UAAA,KAAA,MAAW,CAAC,GAAA,EAAK,QAAQ,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,YACpC,MAAA,CAAO;AAAA,WACR,EAAG;AAEF,YAAA,MAAM,CAAA,GAAI,QAAA;AACV,YAAA,IAAA,CAAK,UAAA,CAAW,QAAA;AAAA,cACf,CAAA,CAAE,IAAA;AAAA,cACF,GAAA;AAAA,cACA,CAAA,CAAE,UAAU,WAAA,IAAe,EAAA;AAAA,cAC3B,CAAA,CAAE,UAAU,QAAA,IAAY,0BAAA;AAAA,cACxB,YAAY;AACX,gBAAA,MAAM,MAAM,MAAM,CAAA,CAAE,aAAa,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAC7C,gBAAA,OAAO,GAAA,CAAI,QAAA,CAAS,CAAC,CAAA,CAAE,IAAA;AAAA,cACxB;AAAA,aACD;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,MAAA;AAAA,IACD;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,OAAO,UAAe,CAAA;AAC7C,IAAA,MAAM,EAAA,GAAK,SAAS,eAAA,CAAgB;AAAA,MACnC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,QAAA,EAAU;AAAA,KACV,CAAA;AAED,IAAA,MAAM,WAAW,YAAY;AAC5B,MAAA,GAAA,CAAI,KAAK,wCAAwC,CAAA;AACjD,MAAA,IAAI,IAAA,CAAK,UAAA,EAAY,MAAM,IAAA,CAAK,WAAW,KAAA,EAAM;AACjD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACf,CAAA;AAEA,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,QAAQ,CAAA;AACvB,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAE9B,IAAA,EAAA,CAAG,EAAA,CAAG,MAAA,EAAQ,OAAO,IAAA,KAAS;AAC7B,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC/B,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,oBAAA,CAAqB,OAAO,CAAA;AACxD,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC;AAAA,CAAI,CAAA;AAAA,QACrD;AAAA,MACD,SAAS,CAAA,EAAY;AACpB,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,qBAAA,EAAyB,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,MACzD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEO,SAAA,GAA+B;AACrC,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AACD","file":"chunk-PYIGZG6E.js","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { serve } from \"@hono/node-server\";\nimport type { WebStandardStreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\";\nimport type { JSONRPCMessage } from \"@modelcontextprotocol/sdk/types.js\";\nimport { Hono } from \"hono\";\nimport { cors } from \"hono/cors\";\nimport type { LiopServer } from \"../server/index.js\";\nimport { log } from \"../utils/logger.js\";\nimport { LiopMcpBridge } from \"./index.js\";\n\n/**\n * Configuration options for LiopStreamBridge.\n */\nexport interface LiopStreamBridgeOptions {\n\t/** Port to listen on (default: 3000) */\n\tport?: number;\n\t/** Max concurrent sessions per IP (default: 5) */\n\tmaxSessionsPerIp?: number;\n\t/** Session idle timeout in milliseconds (default: 30 min) */\n\tsessionTimeoutMs?: number;\n}\n\n/** Internal metadata for tracked sessions */\ninterface SessionEntry {\n\ttransport: WebStandardStreamableHTTPServerTransport;\n\tlastActivity: number;\n\tclientIp: string;\n}\n\nconst DEFAULT_MAX_SESSIONS_PER_IP = 10;\nconst DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes\nconst EVICTION_INTERVAL_MS = 60 * 1000; // Check every minute\n\n/**\n * LiopStreamBridge\n *\n * Exposes a LiopServer over a remote HTTP network using the industry-standard\n * MCP Streamable HTTP Transport + Hono JS.\n *\n * Supports concurrent multi-client connections via per-session transport instances (Map pattern).\n * External agents connect using only a URL + Bearer Token (Zero-Trust).\n *\n * Security hardening:\n * - Zero-Trust Bearer Token enforcement\n * - Per-IP rate limiting on session creation\n * - Automatic eviction of idle sessions (TTL)\n */\nexport class LiopStreamBridge {\n\tprivate app: Hono;\n\tprivate httpServer: ReturnType<typeof serve> | null = null;\n\tprivate bridgeLogic: LiopMcpBridge;\n\tprivate activeSessions: Map<string, SessionEntry>;\n\tprivate evictionTimer: ReturnType<typeof setInterval> | null = null;\n\tprivate maxSessionsPerIp: number;\n\tprivate sessionTimeoutMs: number;\n\n\tconstructor(\n\t\tinternalServer: LiopServer,\n\t\tprivate options: LiopStreamBridgeOptions = {},\n\t) {\n\t\tthis.app = new Hono();\n\t\tthis.bridgeLogic = new LiopMcpBridge(internalServer);\n\t\tthis.activeSessions = new Map();\n\t\tthis.maxSessionsPerIp =\n\t\t\toptions.maxSessionsPerIp ?? DEFAULT_MAX_SESSIONS_PER_IP;\n\t\tthis.sessionTimeoutMs =\n\t\t\toptions.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;\n\n\t\tthis.setupRoutes();\n\t}\n\n\t/**\n\t * Creates a new per-session transport instance and wires it to the LIOPMcpBridge logic.\n\t */\n\tprivate async createSessionTransport(\n\t\tclientIp: string,\n\t): Promise<WebStandardStreamableHTTPServerTransport> {\n\t\tconst { WebStandardStreamableHTTPServerTransport } = await import(\n\t\t\t\"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\"\n\t\t);\n\t\tconst transport = new WebStandardStreamableHTTPServerTransport({\n\t\t\tsessionIdGenerator: () => randomUUID(),\n\t\t\tonsessioninitialized: (sessionId: string) => {\n\t\t\t\tthis.activeSessions.set(sessionId, {\n\t\t\t\t\ttransport,\n\t\t\t\t\tlastActivity: Date.now(),\n\t\t\t\t\tclientIp,\n\t\t\t\t});\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-StreamBridge] Session opened: ${sessionId} (IP: ${clientIp})`,\n\t\t\t\t);\n\t\t\t},\n\t\t});\n\n\t\t// Wire the transport's incoming messages to the LiopMcpBridge JSON-RPC router\n\t\ttransport.onmessage = async (message: JSONRPCMessage) => {\n\t\t\t// Touch activity timestamp on every message\n\t\t\tif (transport.sessionId) {\n\t\t\t\tconst entry = this.activeSessions.get(transport.sessionId);\n\t\t\t\tif (entry) entry.lastActivity = Date.now();\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst result = await this.bridgeLogic.handleJsonRpcRequest(\n\t\t\t\t\tmessage as unknown as Record<string, unknown>,\n\t\t\t\t);\n\t\t\t\t// Notifications return undefined — no response needed\n\t\t\t\tif (result !== undefined) {\n\t\t\t\t\tawait transport.send(result as JSONRPCMessage);\n\t\t\t\t}\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.info(\"[LIOP-StreamBridge] JSON-RPC error:\", (err as Error).message);\n\t\t\t}\n\t\t};\n\n\t\ttransport.onclose = () => {\n\t\t\tif (transport.sessionId) {\n\t\t\t\tthis.activeSessions.delete(transport.sessionId);\n\t\t\t\tlog.info(`[LIOP-StreamBridge] Session closed: ${transport.sessionId}`);\n\t\t\t}\n\t\t};\n\n\t\treturn transport;\n\t}\n\n\t/**\n\t * Returns the number of active sessions for a given IP.\n\t */\n\tprivate countSessionsByIp(ip: string): number {\n\t\tlet count = 0;\n\t\tfor (const entry of this.activeSessions.values()) {\n\t\t\tif (entry.clientIp === ip) count++;\n\t\t}\n\t\treturn count;\n\t}\n\n\t/**\n\t * Extracts client IP from the request (supports X-Forwarded-For for reverse proxies).\n\t */\n\tprivate getClientIp(c: {\n\t\treq: { header: (name: string) => string | undefined };\n\t}): string {\n\t\treturn (\n\t\t\tc.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ||\n\t\t\tc.req.header(\"x-real-ip\") ||\n\t\t\t\"unknown\"\n\t\t);\n\t}\n\n\t/**\n\t * Evicts sessions that have been idle longer than the configured timeout.\n\t */\n\tprivate evictIdleSessions(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [sessionId, entry] of this.activeSessions) {\n\t\t\tif (now - entry.lastActivity > this.sessionTimeoutMs) {\n\t\t\t\tlog.info(`[LIOP-StreamBridge] Evicting idle session: ${sessionId}`);\n\t\t\t\tentry.transport.close().catch(() => {\n\t\t\t\t\t/* Swallow close errors */\n\t\t\t\t});\n\t\t\t\tthis.activeSessions.delete(sessionId);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate setupRoutes() {\n\t\tthis.app.use(\"*\", cors());\n\n\t\t// Initialize strict zero-trust token if not provided\n\t\tif (!process.env.ZERO_TRUST_TOKEN) {\n\t\t\tprocess.env.ZERO_TRUST_TOKEN = randomUUID();\n\t\t\tlog.info(\"=\".repeat(60));\n\t\t\tlog.info(\"⚠️ STRICT ZERO-TRUST MODE ENABLED ⚠️\");\n\t\t\tlog.info(\"No ZERO_TRUST_TOKEN found in environment.\");\n\t\t\tlog.info(\"A secure ephemeral token has been generated for this session:\");\n\t\t\tlog.info(`Token: ${process.env.ZERO_TRUST_TOKEN}`);\n\t\t\tlog.info(\"=\".repeat(60));\n\t\t}\n\n\t\t// ZTA (Zero-Trust Architecture) Security Middleware\n\t\tthis.app.use(\"/mcp\", async (c, next) => {\n\t\t\tconst auth = c.req.header(\"Authorization\");\n\t\t\tif (!auth?.startsWith(\"Bearer \")) {\n\t\t\t\treturn c.json(\n\t\t\t\t\t{ error: \"Unauthorized: LIOP Zero-Trust Policy Enforced\" },\n\t\t\t\t\t401,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst token = auth.slice(7);\n\t\t\tconst expectedToken = process.env.ZERO_TRUST_TOKEN;\n\n\t\t\t// Check static token fallback first (retrocompatibility)\n\t\t\tif (expectedToken && token === expectedToken) {\n\t\t\t\tawait next();\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Validate with JWT Validator if configured on the server\n\t\t\tconst jwtValidator = this.bridgeLogic.getServer()?.jwtValidator;\n\t\t\tif (jwtValidator) {\n\t\t\t\ttry {\n\t\t\t\t\tawait jwtValidator.validate(token);\n\t\t\t\t\tawait next();\n\t\t\t\t\treturn;\n\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-StreamBridge] JWT Validation failed: ${(e as Error).message}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn c.json(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `Unauthorized: JWT Validation failed - ${(e as Error).message}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t401,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlog.info(\n\t\t\t\t\"[LIOP-StreamBridge] ALERT: Access denied - Invalid Zero-Trust token.\",\n\t\t\t);\n\t\t\treturn c.json(\n\t\t\t\t{ error: \"Unauthorized: LIOP Zero-Trust Policy Enforced\" },\n\t\t\t\t401,\n\t\t\t);\n\t\t});\n\n\t\t// Multi-Session Streamable HTTP Handler\n\t\tthis.app.all(\"/mcp\", async (c) => {\n\t\t\tconst sessionId = c.req.header(\"mcp-session-id\");\n\n\t\t\t// Route to existing session if session ID is present\n\t\t\tif (sessionId) {\n\t\t\t\tconst existing = this.activeSessions.get(sessionId);\n\t\t\t\tif (!existing) {\n\t\t\t\t\treturn c.json({ error: \"Session not found\" }, 404);\n\t\t\t\t}\n\t\t\t\t// Touch activity on every routed request\n\t\t\t\texisting.lastActivity = Date.now();\n\n\t\t\t\tconst response = await existing.transport.handleRequest(c.req.raw);\n\n\t\t\t\t// If DELETE, the transport closes internally but onclose may not fire.\n\t\t\t\t// Explicitly clean up the session from the Map.\n\t\t\t\tif (c.req.method === \"DELETE\") {\n\t\t\t\t\tthis.activeSessions.delete(sessionId);\n\t\t\t\t\tlog.info(`[LIOP-StreamBridge] Session closed (DELETE): ${sessionId}`);\n\t\t\t\t}\n\n\t\t\t\treturn response;\n\t\t\t}\n\n\t\t\t// No session ID → New client initializing.\n\t\t\t// Rate-limit: enforce max sessions per IP\n\t\t\tconst clientIp = this.getClientIp(c);\n\t\t\tconst currentSessions = this.countSessionsByIp(clientIp);\n\t\t\tif (currentSessions >= this.maxSessionsPerIp) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-StreamBridge] Rate limit hit for IP: ${clientIp} (${currentSessions} sessions)`,\n\t\t\t\t);\n\t\t\t\treturn c.json({ error: \"Too Many Sessions: Rate limit exceeded\" }, 429);\n\t\t\t}\n\n\t\t\tconst transport = await this.createSessionTransport(clientIp);\n\t\t\treturn await transport.handleRequest(c.req.raw);\n\t\t});\n\t}\n\n\t/**\n\t * Starts the LiopStreamBridge HTTP server and session eviction timer.\n\t */\n\tpublic async start(port?: number): Promise<void> {\n\t\tconst listenPort = port ?? this.options.port ?? 3000;\n\n\t\t// Start the idle session eviction timer\n\t\tthis.evictionTimer = setInterval(\n\t\t\t() => this.evictIdleSessions(),\n\t\t\tEVICTION_INTERVAL_MS,\n\t\t);\n\n\t\treturn new Promise((resolve) => {\n\t\t\tthis.httpServer = serve(\n\t\t\t\t{\n\t\t\t\t\tfetch: this.app.fetch,\n\t\t\t\t\tport: listenPort,\n\t\t\t\t},\n\t\t\t\t(info) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-StreamBridge] Streamable HTTP Gateway on http://localhost:${info.port}/mcp`,\n\t\t\t\t\t);\n\t\t\t\t\tresolve();\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\t}\n\n\t/**\n\t * Graceful shutdown — closes all active sessions, stops timers, and releases port.\n\t */\n\tpublic async stop(): Promise<void> {\n\t\tif (this.evictionTimer) {\n\t\t\tclearInterval(this.evictionTimer);\n\t\t\tthis.evictionTimer = null;\n\t\t}\n\n\t\tfor (const [id, entry] of this.activeSessions) {\n\t\t\tawait entry.transport.close();\n\t\t\tthis.activeSessions.delete(id);\n\t\t}\n\n\t\tif (this.httpServer) {\n\t\t\tthis.httpServer.close();\n\t\t\tlog.info(\"[LIOP-StreamBridge] HTTP ports released.\");\n\t\t}\n\t}\n}\n","import type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type { LiopServer, LiopServerOptions } from \"../server/index.js\";\nimport type { CallToolRequest, CallToolResult } from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopBridgeOptions {\n\tpublishToMesh?: boolean;\n\tmeshIdentity?: string;\n\tserverInfo?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\tsecurity?: LiopServerOptions[\"security\"];\n}\n\n/**\n * LIOP MCP Bridge\n * A bi-directional bridge that allows legacy MCP servers to join the LIOP mesh,\n * or exposes a LIOP server as an MCP-compatible stdio process for tools like Claude Desktop.\n */\nexport class LiopMcpBridge {\n\tprivate liopServer: LiopServer | null = null;\n\tprivate legacyMcpServer: McpServer | null = null;\n\tconstructor(\n\t\t// biome-ignore lint/suspicious/noExplicitAny: polymorphic source detection\n\t\tsource: LiopServer | McpServer | any,\n\t\tprivate options: LiopBridgeOptions = {},\n\t) {\n\t\t// Determine mode: Exposing LIOP to MCP (Claude) or Wrapping MCP to LIOP (Mesh)\n\t\t// We use constructor name check to avoid hard dependency on optional SDK at runtime start\n\t\tif (source?.constructor?.name === \"LiopServer\") {\n\t\t\tthis.liopServer = source as LiopServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: EXPOSE (LIOP -> MCP Stdio)\");\n\t\t} else if (source?.constructor?.name === \"McpServer\") {\n\t\t\tthis.legacyMcpServer = source as McpServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: WRAP (Legacy MCP -> LIOP Mesh)\");\n\t\t} else {\n\t\t\t// Fallback for inferred legacy MCP servers\n\t\t\tthis.legacyMcpServer = source as McpServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: WRAP (Inferred Legacy MCP -> LIOP Mesh)\");\n\t\t}\n\t}\n\n\t/**\n\t * Handles an incoming standard MCP JSON-RPC 2.0 payload.\n\t * Pipes it to the underlying server (LIOP or Legacy MCP).\n\t */\n\tpublic async handleJsonRpcRequest(\n\t\tpayload: Record<string, unknown>,\n\t): Promise<unknown> {\n\t\tconst id = payload.id as string | number;\n\t\tconst method = payload.method as string;\n\t\tconst params = payload.params as Record<string, unknown> | undefined;\n\n\t\tif (payload.jsonrpc !== \"2.0\") {\n\t\t\treturn this.errorResponse(id, -32600, \"Invalid Request\");\n\t\t}\n\n\t\t// Mode: EXPOSE (Standard behavior used by Claude Desktop)\n\t\tif (this.liopServer) {\n\t\t\treturn this.handleLiopToMcp(id, method, params);\n\t\t}\n\n\t\t// Mode: WRAP (Redirecting via internal LiopServer after connect())\n\t\tif (this.legacyMcpServer && this.liopServer) {\n\t\t\treturn this.handleLiopToMcp(id, method, params);\n\t\t}\n\n\t\treturn this.errorResponse(id, -32601, \"Bridge source not configured\");\n\t}\n\n\tprivate async handleLiopToMcp(\n\t\tid: string | number,\n\t\tmethod: string,\n\t\tparams: Record<string, unknown> | undefined,\n\t): Promise<unknown> {\n\t\tif (!this.liopServer) return null;\n\n\t\tif (method === \"initialize\") {\n\t\t\treturn this.successResponse(id, {\n\t\t\t\tprotocolVersion: \"2025-11-25\",\n\t\t\t\tcapabilities: {\n\t\t\t\t\tprompts: {},\n\t\t\t\t\tresources: {},\n\t\t\t\t\ttools: {},\n\t\t\t\t},\n\t\t\t\tserverInfo: this.liopServer.getServerInfo(),\n\t\t\t});\n\t\t}\n\n\t\tif (method === \"notifications/initialized\") return undefined;\n\t\tif (method === \"ping\") return this.successResponse(id, {});\n\n\t\tif (method === \"tools/list\") {\n\t\t\tconst tools = this.liopServer.listTools();\n\t\t\treturn this.successResponse(id, { tools });\n\t\t}\n\n\t\tif (method === \"resources/list\") {\n\t\t\tconst resources = this.liopServer.listResources();\n\t\t\treturn this.successResponse(id, { resources });\n\t\t}\n\n\t\tif (method === \"prompts/list\") {\n\t\t\tconst prompts = this.liopServer.listPrompts();\n\t\t\treturn this.successResponse(id, { prompts });\n\t\t}\n\n\t\tif (method === \"prompts/get\") {\n\t\t\tif (!params?.name) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing prompt name\");\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await this.liopServer.getPrompt({\n\t\t\t\t\tname: params.name as string,\n\t\t\t\t\targuments: params.arguments as Record<string, string> | undefined,\n\t\t\t\t});\n\t\t\t\treturn this.successResponse(id, result);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\tif (method === \"resources/read\") {\n\t\t\tif (!params?.uri) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing resource URI\");\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await this.liopServer.readResource(params.uri as string);\n\t\t\t\treturn this.successResponse(id, result);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\tif (method === \"tools/call\") {\n\t\t\tif (!params?.name) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing tool name\");\n\t\t\t}\n\t\t\tconst request: CallToolRequest = {\n\t\t\t\tname: params.name as string,\n\t\t\t\targuments: (params.arguments as Record<string, unknown>) || {},\n\t\t\t};\n\n\t\t\ttry {\n\t\t\t\tconst result: CallToolResult = await this.liopServer.callTool(request);\n\t\t\t\t// If the tool execution returned an error (e.g. policy violation), we bypass\n\t\t\t\t// ZK-Receipt verification because no cryptographic proof is generated for errors.\n\t\t\t\tconst isVerified = result.isError\n\t\t\t\t\t? true\n\t\t\t\t\t: await this.verifyZkReceipt(request, result);\n\n\t\t\t\tif (!isVerified) {\n\t\t\t\t\treturn this.successResponse(id, {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: \"ALERT [LIOP ZERO-TRUST SHIELD] ZK Verification Failed. The mathematical ImageID does not match the original payload.\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tisError: true,\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\treturn this.successResponse(id, result);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\treturn this.errorResponse(id, -32601, \"Method not found\");\n\t}\n\n\tprivate successResponse(\n\t\tid: string | number | null | undefined,\n\t\tresult: unknown,\n\t) {\n\t\treturn { jsonrpc: \"2.0\", id, result };\n\t}\n\n\tprivate errorResponse(id: string | number, code: number, message: string) {\n\t\treturn { jsonrpc: \"2.0\", id, error: { code, message } };\n\t}\n\n\tprivate async verifyZkReceipt(\n\t\trequest: CallToolRequest,\n\t\tresult: CallToolResult,\n\t): Promise<boolean> {\n\t\tif (\n\t\t\t!request.arguments?.payload ||\n\t\t\ttypeof request.arguments.payload !== \"string\"\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\n\t\ttry {\n\t\t\tconst payload = request.arguments.payload as string;\n\t\t\tconst contentText = result.content[0]?.text;\n\n\t\t\tif (contentText && typeof contentText === \"string\") {\n\t\t\t\ttry {\n\t\t\t\t\tconst data = JSON.parse(contentText);\n\n\t\t\t\t\tif (data.image_id || data.zk_receipt) {\n\t\t\t\t\t\t// 1. Instantiate the Industrial Verifier ( backed by Piscina Worker Pool )\n\t\t\t\t\t\tconst { LiopVerifier } = await import(\"../crypto/verifier.js\");\n\t\t\t\t\t\tconst verifier = new LiopVerifier();\n\n\t\t\t\t\t\t// 2. Delegate the heavy mathematical check (ZK Journal + Seal)\n\t\t\t\t\t\tconst isAuthentic = await verifier.verifyZkReceipt(\n\t\t\t\t\t\t\tBuffer.from(payload, \"utf-8\"),\n\t\t\t\t\t\t\tdata.image_id,\n\t\t\t\t\t\t\tBuffer.from(data.zk_receipt || \"\", \"base64\"),\n\t\t\t\t\t\t\tundefined,\n\t\t\t\t\t\t\tdata.computation_result,\n\t\t\t\t\t\t);\n\n\t\t\t\t\t\tif (!isAuthentic) {\n\t\t\t\t\t\t\treturn false;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tdata.audit_status =\n\t\t\t\t\t\t\t\"VERIFIED: ZK-Receipt & ImageID Mathematically Verified by LiopMcpBridge\";\n\t\t\t\t\t\tresult.content[0].text = JSON.stringify(data);\n\t\t\t\t\t}\n\t\t\t\t} catch {\n\t\t\t\t\t// Output not JSON\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn true;\n\t\t} catch (e) {\n\t\t\tlog.info(\"[LIOP-Bridge] ZK-Verifier Failure:\", e);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Connects the bridge via stdio or Mesh depending on mode.\n\t */\n\tpublic async connect(): Promise<void> {\n\t\t// In WRAP mode, we actually need to create a LiopServer and join the mesh\n\t\tif (this.legacyMcpServer) {\n\t\t\tconst { LiopServer } = await import(\"../server/index.js\");\n\t\t\tthis.liopServer = new LiopServer(\n\t\t\t\tthis.options.serverInfo || {\n\t\t\t\t\tname: \"liop-bridge\",\n\t\t\t\t\tversion: \"1.0.0\",\n\t\t\t\t},\n\t\t\t\t{ security: this.options.security },\n\t\t\t);\n\n\t\t\tif (this.options.publishToMesh) {\n\t\t\t\tawait this.liopServer.connect();\n\n\t\t\t\t// Automatically Bridge Legacy Capabilities to LIOP Mesh\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Internal legacy MCP properties are completely opaque and unexported\n\t\t\t\tconst legacy = this.legacyMcpServer as any;\n\n\t\t\t\t// 1. Sync Tools\n\t\t\t\tif (legacy._registeredTools) {\n\t\t\t\t\tfor (const [name, tool] of Object.entries(legacy._registeredTools)) {\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy structure\n\t\t\t\t\t\tconst t = tool as any;\n\t\t\t\t\t\tthis.liopServer.tool(\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tt.description || \"\",\n\t\t\t\t\t\t\tt.inputSchema || {},\n\t\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy callback args\n\t\t\t\t\t\t\tasync (args: any) => {\n\t\t\t\t\t\t\t\treturn await t.handler(args);\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// 2. Sync Resources\n\t\t\t\tif (legacy._registeredResources) {\n\t\t\t\t\tfor (const [uri, resource] of Object.entries(\n\t\t\t\t\t\tlegacy._registeredResources,\n\t\t\t\t\t)) {\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy structure\n\t\t\t\t\t\tconst r = resource as any;\n\t\t\t\t\t\tthis.liopServer.resource(\n\t\t\t\t\t\t\tr.name,\n\t\t\t\t\t\t\turi,\n\t\t\t\t\t\t\tr.metadata?.description || \"\",\n\t\t\t\t\t\t\tr.metadata?.mimeType || \"application/octet-stream\",\n\t\t\t\t\t\t\tasync () => {\n\t\t\t\t\t\t\t\tconst res = await r.readCallback(new URL(uri));\n\t\t\t\t\t\t\t\treturn res.contents[0].text;\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\t// In EXPOSE mode, listen to stdio (Claude Desktop)\n\t\tconst readline = await import(\"node:readline\");\n\t\tconst rl = readline.createInterface({\n\t\t\tinput: process.stdin,\n\t\t\toutput: process.stdout,\n\t\t\tterminal: false,\n\t\t});\n\n\t\tconst shutdown = async () => {\n\t\t\tlog.info(\"[LIOP-Bridge] Disconnecting session...\");\n\t\t\tif (this.liopServer) await this.liopServer.close();\n\t\t\tprocess.exit(0);\n\t\t};\n\n\t\trl.on(\"close\", shutdown);\n\t\tprocess.on(\"SIGINT\", shutdown);\n\t\tprocess.on(\"SIGTERM\", shutdown);\n\n\t\trl.on(\"line\", async (line) => {\n\t\t\tif (!line.trim()) return;\n\t\t\ttry {\n\t\t\t\tconst payload = JSON.parse(line);\n\t\t\t\tconst response = await this.handleJsonRpcRequest(payload);\n\t\t\t\tif (response) {\n\t\t\t\t\tprocess.stdout.write(`${JSON.stringify(response)}\\n`);\n\t\t\t\t}\n\t\t\t} catch (e: unknown) {\n\t\t\t\tlog.error(`[LIOP-Bridge] Error: ${(e as Error).message}`);\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic getServer(): LiopServer | null {\n\t\treturn this.liopServer;\n\t}\n}\n\nexport * from \"./stream.js\";\n"]}

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,9 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export { __export };
+//# sourceMappingURL=chunk-PZ5AY32C.js.map
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/chunk-PZ5AY32C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-PZ5AY32C.js"}

package/dist/chunk-R5NHKIC3.js

@@ -0,0 +1,30 @@
+import { external_exports } from './chunk-HGTKLHOL.js';
+
+// src/types.ts
+var ToolSchema = external_exports.object({
+  name: external_exports.string(),
+  description: external_exports.string().optional(),
+  inputSchema: external_exports.record(external_exports.string(), external_exports.unknown())
+  // Represents a JSON Schema
+});
+var ResourceSchema = external_exports.object({
+  uri: external_exports.string(),
+  name: external_exports.string(),
+  description: external_exports.string().optional(),
+  mimeType: external_exports.string().optional()
+});
+var PromptSchema = external_exports.object({
+  name: external_exports.string(),
+  description: external_exports.string().optional(),
+  arguments: external_exports.array(
+    external_exports.object({
+      name: external_exports.string(),
+      description: external_exports.string().optional(),
+      required: external_exports.boolean().optional()
+    })
+  ).optional()
+});
+
+export { PromptSchema, ResourceSchema, ToolSchema };
+//# sourceMappingURL=chunk-R5NHKIC3.js.map
+//# sourceMappingURL=chunk-R5NHKIC3.js.map

package/dist/chunk-R5NHKIC3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"names":[],"mappings":";;;AAMO,IAAM,UAAA,GAAa,iBAAE,MAAA,CAAO;AAAA,EAClC,IAAA,EAAM,iBAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,gBAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,iBAAE,MAAA,CAAO,gBAAA,CAAE,QAAO,EAAG,gBAAA,CAAE,SAAS;AAAA;AAC9C,CAAC;AAIM,IAAM,cAAA,GAAiB,iBAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,iBAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAM,iBAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,gBAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,gBAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,IAAM,YAAA,GAAe,iBAAE,MAAA,CAAO;AAAA,EACpC,IAAA,EAAM,iBAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,gBAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAW,gBAAA,CACT,KAAA;AAAA,IACA,iBAAE,MAAA,CAAO;AAAA,MACR,IAAA,EAAM,iBAAE,MAAA,EAAO;AAAA,MACf,WAAA,EAAa,gBAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,QAAA,EAAU,gBAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAC/B;AAAA,IAED,QAAA;AACH,CAAC","file":"chunk-R5NHKIC3.js","sourcesContent":["import { z } from \"zod\";\n\n/**\n * Base Protocol Types representing parity with Model Context Protocol\n */\n\nexport const ToolSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tinputSchema: z.record(z.string(), z.unknown()), // Represents a JSON Schema\n});\n\nexport type Tool = z.infer<typeof ToolSchema>;\n\nexport const ResourceSchema = z.object({\n\turi: z.string(),\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tmimeType: z.string().optional(),\n});\n\nexport type Resource = z.infer<typeof ResourceSchema>;\n\nexport const PromptSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\targuments: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tdescription: z.string().optional(),\n\t\t\t\trequired: z.boolean().optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\nexport type Prompt = z.infer<typeof PromptSchema>;\n\nexport interface CallToolRequest {\n\tname: string;\n\targuments?: Record<string, unknown>;\n}\n\nexport interface CallToolResult {\n\tcontent: Array<{\n\t\ttype: \"text\" | \"image\" | \"resource\";\n\t\ttext?: string;\n\t\tdata?: string;\n\t\tmimeType?: string;\n\t\tresource?: {\n\t\t\turi: string;\n\t\t\ttext?: string;\n\t\t\tblob?: string;\n\t\t};\n\t}>;\n\tisError?: boolean;\n}\n\nexport interface GetPromptRequest {\n\tname: string;\n\targuments?: Record<string, string>;\n}\n\nexport interface GetPromptResult {\n\tdescription?: string;\n\tmessages: Array<{\n\t\trole: \"user\" | \"assistant\";\n\t\tcontent:\n\t\t\t| { type: \"text\"; text: string }\n\t\t\t| { type: \"image\"; data: string; mimeType: string }\n\t\t\t| {\n\t\t\t\t\ttype: \"resource\";\n\t\t\t\t\tresource: { uri: string; text?: string; blob?: string };\n\t\t\t  };\n\t}>;\n}\n\nexport interface ServerInfo {\n\tname: string;\n\tversion: string;\n\tcapabilities?: {\n\t\tprompts?: { listChanged?: boolean };\n\t\tresources?: { subscribe?: boolean; listChanged?: boolean };\n\t\ttools?: { listChanged?: boolean };\n\t\tlogging?: Record<string, unknown>;\n\t};\n}\n\nexport interface McpRequest {\n\tmethod: string;\n\tparams?: unknown;\n\tid?: string | number | null;\n\tjsonrpc?: \"2.0\";\n}\n\nexport interface McpResponse {\n\tjsonrpc: \"2.0\";\n\tid?: string | number | null;\n\tresult?: unknown;\n\terror?: {\n\t\tcode: number;\n\t\tmessage: string;\n\t\tdata?: unknown;\n\t};\n}\n\n/**\n * Re-export AuthInfo from the security module for convenience.\n * Compatible with MCP TypeScript SDK AuthInfo interface shape.\n */\nexport type { AuthInfo } from \"./security/jwt-validator.js\";\n"]}

package/dist/client.js

@@ -5,5 +5,6 @@ import './chunk-QLCOEP5J.js';
 import './chunk-RDWCGZ2A.js';
 import './chunk-MMYZR7G7.js';
 import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.js

@@ -6,5 +6,6 @@ import './chunk-QLCOEP5J.js';
 import './chunk-IJHTRIZC.js';
 import './chunk-RDWCGZ2A.js';
 import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/index.js

@@ -1,9 +1,10 @@
 export { WasiSandbox, getDefaultEnvironment } from './chunk-J3WPBMJ5.js';
 export { LiopClient, LiopRpcClient } from './chunk-SSURAA3I.js';
-export { PromptSchema, ResourceSchema, ToolSchema } from './chunk-CT6NHSYP.js';
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-AL7H7DTW.js';
+export { PromptSchema, ResourceSchema, ToolSchema } from './chunk-R5NHKIC3.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-PYIGZG6E.js';
 export { LiopHybridGateway, buildProtectedResourceMetadata } from './chunk-PHTWUTY7.js';
-export { AUTH_DEFAULTS, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, createOAuthServer, sanitizeOutput } from './chunk-4KIGYPIQ.js';
+export { AUTH_DEFAULTS, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, createOAuthServer, sanitizeOutput } from './chunk-GDITQCKD.js';
+import './chunk-HGTKLHOL.js';
 export { HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-HB5DXX3Q.js';
 import './chunk-32ADSAJS.js';
 import './chunk-OUUTDSOW.js';
@@ -12,6 +13,7 @@ export { LIOP_SCOPES, authorizeRequest } from './chunk-IJHTRIZC.js';
 import './chunk-RDWCGZ2A.js';
 export { MeshNode } from './chunk-MMYZR7G7.js';
 import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
 
 // src/errors.ts
 var ErrorCode = /* @__PURE__ */ ((ErrorCode2) => {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/prompts/adapters.ts"],"names":["ErrorCode"],"mappings":";;;;;;;;;;;;;;;;AAAO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;;;ACLA,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR","file":"index.js","sourcesContent":["export enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/prompts/adapters.ts"],"names":["ErrorCode"],"mappings":";;;;;;;;;;;;;;;;;;AAAO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;;;ACLA,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR","file":"index.js","sourcesContent":["export enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n"]}

package/dist/kyber-FCVPX6CE.js

@@ -0,0 +1,4 @@
+export { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=kyber-FCVPX6CE.js.map
+//# sourceMappingURL=kyber-FCVPX6CE.js.map

package/dist/{kyber-3ULIJSE3.js.map → kyber-FCVPX6CE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"kyber-3ULIJSE3.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"kyber-FCVPX6CE.js"}

package/dist/mesh.js

@@ -1,5 +1,6 @@
 import './chunk-RWRRBYG4.js';
 export { MeshNode } from './chunk-MMYZR7G7.js';
 import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
 //# sourceMappingURL=mesh.js.map
 //# sourceMappingURL=mesh.js.map

package/dist/server.js

@@ -1,7 +1,9 @@
-export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, sanitizeOutput } from './chunk-4KIGYPIQ.js';
+export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, sanitizeOutput } from './chunk-GDITQCKD.js';
+import './chunk-HGTKLHOL.js';
 import './chunk-IJHTRIZC.js';
 import './chunk-RDWCGZ2A.js';
 import './chunk-MMYZR7G7.js';
 import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
 //# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map

package/dist/types.js

@@ -1,3 +1,5 @@
-export { PromptSchema, ResourceSchema, ToolSchema } from './chunk-CT6NHSYP.js';
+export { PromptSchema, ResourceSchema, ToolSchema } from './chunk-R5NHKIC3.js';
+import './chunk-HGTKLHOL.js';
+import './chunk-PZ5AY32C.js';
 //# sourceMappingURL=types.js.map
 //# sourceMappingURL=types.js.map

package/dist/verifier-GCZDNZK7.js

@@ -0,0 +1,6 @@
+export { LiopVerifier } from './chunk-32ADSAJS.js';
+import './chunk-OUUTDSOW.js';
+import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=verifier-GCZDNZK7.js.map
+//# sourceMappingURL=verifier-GCZDNZK7.js.map

package/dist/{verifier-3FAKCFNN.js.map → verifier-GCZDNZK7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-3FAKCFNN.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-GCZDNZK7.js"}

package/dist/workers/logic-execution.js

@@ -1,5 +1,6 @@
 import { ASTGuardian, WasiSandbox } from '../chunk-J3WPBMJ5.js';
 import { normalizeLogicSource, deriveLogicImageDigest } from '../chunk-OUUTDSOW.js';
+import '../chunk-PZ5AY32C.js';
 import { Buffer } from 'buffer';
 import crypto2 from 'crypto';
 import { createMlKem768 } from 'mlkem';

package/dist/workers/logic-execution.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/security/dp-engine.ts","../../src/workers/logic-execution.ts"],"names":["crypto"],"mappings":";;;;;;AAqDA,IAAM,iBAAA,GAA8B;AAAA,EACnC,OAAA,EAAS,CAAA;AAAA,EACT,WAAA,EAAa,CAAA;AAAA,EACb,qBAAA,EAAuB;AACxB,CAAA;AAOA,IAAM,aAAA,GAAgB,CAAA;AACtB,IAAM,uBAAA,GAA0B,EAAA;AAyBhC,SAAS,aAAA,CAAc,OAAe,SAAA,EAA+B;AACpE,EAAA,IAAI,CAAA;AACJ,EAAA,GAAG;AACF,IAAA,IAAI,SAAA,EAAW;AACd,MAAA,MAAM,IAAA,GAAOA,OAAA,CACX,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,CAAA,EAAG,SAAA,CAAU,IAAI,CAAA,CAAA,EAAI,SAAA,CAAU,OAAA,EAAS,CAAA,CAAE,EACjD,MAAA,EAAO;AAET,MAAA,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,CAAC,CAAA,GAAI,UAAA,GAAc,GAAA;AAAA,IAC1C,CAAA,MAAO;AACN,MAAA,MAAM,GAAA,GAAMA,OAAA,CAAO,WAAA,CAAY,CAAC,CAAA;AAEhC,MAAA,MAAM,MAAA,GAAU,GAAA,CAAI,CAAC,CAAA,IAAK,KAAO,GAAA,CAAI,CAAC,CAAA,IAAK,EAAA,GAAO,GAAA,CAAI,CAAC,CAAA,IAAK,CAAA,GAAK,IAAI,CAAC,CAAA;AAEtE,MAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,OAAO,QAAA,CAAS,EAAE,GAAG,EAAE,CAAA;AAExD,MAAA,CAAA,GAAI,QAAA,GAAW,UAAA;AAAA,IAChB;AAAA,EACD,CAAA,QAAS,CAAA,KAAM,CAAA,IAAK,CAAA,KAAM,IAAA;AAC1B,EAAA,OAAO,CAAC,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AAC5D;AAUO,SAAS,eAAA,CACf,KAAA,EACA,MAAA,GAA4B,IAC5B,SAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,iBAAA,EAAmB,GAAG,MAAA,EAAO;AACjD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,WAAA,GAAc,MAAA,CAAO,OAAA;AAC1C,EAAA,MAAM,UAAA,GAAa,KAAA,GAAQ,aAAA,CAAc,KAAA,EAAO,SAAS,CAAA;AAGzD,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,GAAK,CAAA,GAAI,GAAA;AACzC;AAmBA,SAAS,sBAAA,CACR,GAAA,EACA,iBAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,iBAAA;AAEjB,EAAA,MAAM,EAAA,GAAK,IAAI,WAAA,EAAY;AAO3B,EAAA,MAAM,cACL,+HAAA,CAAgI,IAAA;AAAA,IAC/H;AAAA,GACD;AACD,EAAA,MAAM,YAAA,GACL,OAAO,OAAA,IACP,EAAA,KAAO,OACP,EAAA,KAAO,eAAA,IACP,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA;AAAA,EACtB,EAAA,CAAG,WAAW,MAAM,CAAA;AAAA,EACpB,oDAAA,CAAqD,KAAK,EAAE,CAAA;AAC7D,EAAA,IAAI,WAAA,IAAe,cAAc,OAAO,CAAA;AAGxC,EAAA,IACC,iFAAA,CAAkF,IAAA;AAAA,IACjF;AAAA,GACD,IACA,cAAc,CAAA,EACb;AACD,IAAA,OAAO,iBAAA,GAAoB,WAAA;AAAA,EAC5B;AAGA,EAAA,OAAO,iBAAA;AACR;AAkBO,SAAS,eAAA,CACf,MAAA,EACA,MAAA,GAA4B,IAC5B,WAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,iBAAA,EAAmB,GAAG,MAAA,EAAO;AAGjD,EAAA,IAAI,WAAA,IAAe,OAAO,qBAAA,EAAuB;AAChD,IAAA,OAAO,MAAA;AAAA,EACR;AAMA,EAAA,IAAI,WAAA,GAAc,uBAAA,IAA2B,MAAA,CAAO,OAAA,GAAU,aAAA,EAAe;AAC5E,IAAA,MAAA,CAAO,OAAA,GAAU,aAAA;AAAA,EAClB;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,OAAO,IAAA,EAAM;AAChB,IAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA,EAAE;AAAA,EAC7C;AAEA,EAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,MAAA,EAAQ,WAAA,EAAa,QAAW,SAAS,CAAA;AACtE;AASA,SAAS,YAAA,CACR,IAAA,EACA,MAAA,EACA,WAAA,EACA,YACA,SAAA,EACU;AACV,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAEtD,IAAA,MAAM,gBAAA,GAAmB,sBAAA;AAAA,MACxB,UAAA;AAAA,MACA,MAAA,CAAO,WAAA;AAAA,MACP;AAAA,KACD;AACA,IAAA,IAAI,UAAA,GAAa,eAAA;AAAA,MAChB,IAAA;AAAA,MACA;AAAA,QACC,GAAG,MAAA;AAAA,QACH,WAAA,EAAa;AAAA,OACd;AAAA,MACA;AAAA,KACD;AAIA,IAAA,MAAM,UAAA,GACL,cAAc,IAAA,IACd,sBAAA,CAAuB,YAAY,MAAA,CAAO,WAAA,EAAa,WAAW,CAAA,KAAM,CAAA;AAIzE,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,IAAK,UAAA,EAAY;AACzC,MAAA,UAAA,GAAa,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,IACnC;AAIA,IAAA,IAAI,QAAQ,CAAA,EAAG;AACd,MAAA,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,UAAU,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,UAAA;AAAA,EACR;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAExB,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,MAAI,CAAC,IAAA,KAChB,YAAA,CAAa,MAAM,MAAA,EAAQ,WAAA,EAAa,YAAY,SAAS;AAAA,KAC9D;AAAA,EACD;AAEA,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC9C,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,MACjC;AAAA,KACD,EAAG;AACF,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,YAAA,CAAa,OAAO,MAAA,EAAQ,WAAA,EAAa,KAAK,SAAS,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AAGA,EAAA,OAAO,IAAA;AACR;;;ACrRA,eAAO,sBAA6C,IAAA,EAKjD;AAEF,EAAA,IACC,OAAO,OAAO,SAAA,KAAc,QAAA,IAC5B,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAChC;AACD,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAC7B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,IAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,IAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AAClB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,EAAA;AAAA,MACV,MAAA,EAAQ,MAAA;AAAA,MACR,aAAA,EAAe;AAAA,KAChB;AAAA,EACD;AAEA,EAAA,MAAM;AAAA,IACL,UAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA,GAAc,IAAA;AAAA,IACd;AAAA,GACD,GAAI,IAAA;AAEJ,EAAA,IAAI,gBAAA;AACJ,EAAA,MAAM,kBAA2C,EAAC;AAClD,EAAA,IAAI,aAAA,GAAgB,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA;AAEnC,EAAA,IAAI,WAAA,EAAa;AAEhB,IAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,YAAY,CAAA;AACtC,IAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,UAAU,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,MAAM,YAAA,GAAe,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA;AACvC,IAAA,aAAA,GAAgB,MAAA;AAIhB,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AACzC,IAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,GAAG,CAAA;AACvC,IAAA,MAAM,aAAA,GAAgB,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAEhD,IAAA,MAAM,WAAWA,OAAAA,CAAO,gBAAA;AAAA,MACvB,aAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAO,IAAA,CAAK,QAAA,IAAY,IAAI,UAAA,CAAW,EAAE,CAAC;AAAA,KAC3C;AACA,IAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,IAAA,IAAI,SAAA,GAAY,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA;AAC7C,IAAA,SAAA,GAAY,OAAO,MAAA,CAAO,CAAC,WAAW,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACvD,IAAA,gBAAA,GAAmB,SAAA;AAGnB,IAAA,KAAA,MAAW,CAAC,KAAK,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,IAAU,EAAE,CAAA,EAAG;AAC3D,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAEtC,MAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA;AAC3C,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA;AACrC,MAAA,MAAM,OAAA,GAAU,SAAA,CAAU,QAAA,CAAS,EAAA,EAAI,GAAG,CAAA;AAE1C,MAAA,MAAM,cAAcA,OAAAA,CAAO,gBAAA;AAAA,QAC1B,aAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,WAAA,CAAY,WAAW,MAAM,CAAA;AAC7B,MAAA,IAAI,YAAA,GAAe,WAAA,CAAY,MAAA,CAAO,OAAO,CAAA;AAC7C,MAAA,YAAA,GAAe,OAAO,MAAA,CAAO,CAAC,cAAc,WAAA,CAAY,KAAA,EAAO,CAAC,CAAA;AAChE,MAAA,eAAA,CAAgB,GAAG,CAAA,GAAI,IAAA,CAAK,MAAM,YAAA,CAAa,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,IACjE;AAAA,EACD,CAAA,MAAO;AAGN,IAAA,IACC,UAAA,CAAW,CAAC,CAAA,KAAM,CAAA,IAClB,WAAW,CAAC,CAAA,KAAM,EAAA,IAClB,UAAA,CAAW,CAAC,CAAA,KAAM,GAAA,IAClB,UAAA,CAAW,CAAC,MAAM,GAAA,EACjB;AACD,MAAA,gBAAA,GAAmB,MAAA,CAAO,KAAK,UAAU,CAAA;AAAA,IAC1C,CAAA,MAAO;AACN,MAAA,gBAAA,GAAmB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE,SAAS,OAAO,CAAA;AAAA,IAC5D;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GACL,gBAAA,CAAiB,CAAC,CAAA,KAAM,KACxB,gBAAA,CAAiB,CAAC,CAAA,KAAM,EAAA,IACxB,iBAAiB,CAAC,CAAA,KAAM,GAAA,IACxB,gBAAA,CAAiB,CAAC,CAAA,KAAM,GAAA;AAEzB,EAAA,IAAI,gBAAA,YAA4B,UAAU,MAAA,EAAQ;AAEjD,IAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,gBAAgB,CAAA;AACjD,IAAA,MAAM,cAAA,GAAiB,MAAM,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC1D,IAAA,WAAA,CAAY,QAAQ,cAAc,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,gBAAA,YAA4B,MAAA,IAAU,CAAC,MAAA,EAAQ;AACzD,IAAA,gBAAA,GAAmB,gBAAA,CAAiB,SAAS,OAAO,CAAA;AAAA,EACrD;AAGA,EAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACzC,IAAA,gBAAA,GAAmB,qBAAqB,gBAAgB,CAAA;AAAA,EACzD;AAGA,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,QAAQ,IAAA,EAAK;AAEnB,EAAA,IAAI;AACH,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAA;AAAA,MAC5B,gBAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI,cAAc,MAAA,CAAO,MAAA;AAGzB,IAAA,IAAI,UAAA;AACJ,IAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACzC,MAAA,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,gBAAA,EAAkB,OAAO,CAAA;AAAA,IACnD,CAAA,MAAO;AACN,MAAA,UAAA,GAAa,IAAI,WAAW,gBAAgB,CAAA;AAAA,IAC7C;AACA,IAAA,MAAM,OAAA,GAAU,sBAAA,CAAuB,UAAU,CAAA,CAAE,SAAS,KAAK,CAAA;AAKjE,IAAA,MAAM,WAAA,GAAcA,OAAAA,CAClB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,OAAA,IAAW,EAAE,CAAC,CAAA,CACpC,OAAO,KAAK,CAAA;AAGd,IAAA,IAAI,QAAA,EAAU;AACb,MAAA,WAAA,GAAc,eAAA;AAAA,QACb,WAAA;AAAA,QACA;AAAA,UACC,GAAG,QAAA;AAAA,UACH,IAAA,EAAM,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,OAAO,CAAA;AAAA,SAChC;AAAA,QACA,SAAS,MAAA,IAAU;AAAA,OACpB;AAAA,IACD;AAIA,IAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAAA,MACtB,KAAK,SAAA,CAAU;AAAA,QACd,QAAA,EAAU,OAAA;AAAA,QACV,YAAA,EAAc,WAAA;AAAA,QACd,WAAA,EAAaA,OAAAA,CACX,UAAA,CAAW,QAAQ,CAAA,CACnB,MAAA;AAAA,UACA,OAAO,gBAAgB,QAAA,GACpB,WAAA,GACA,gBAAgB,KAAA,CAAA,GACf,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,WAAW;AAAA,SAC/B,CACC,OAAO,KAAK,CAAA;AAAA,QACd,MAAM,MAAA,CAAO,YAAA;AAAA,QACb,EAAA,EAAI,KAAK,GAAA;AAAI,OACb;AAAA,KACF;AAEA,IAAA,MAAM,IAAA,GAAOA,QACX,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjC,IAAA,UAAA,CAAW,aAAA,CAAc,QAAQ,MAAM,CAAA;AACvC,IAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,MAChC,MAAA,CAAO,IAAA,CAAK,CAAC,CAAI,CAAC,CAAA;AAAA;AAAA,MAClB,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA;AAAA,KACA,CAAA;AACD,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA;AAE9C,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,OAAA;AAAA,MACV,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ,WAAA;AAAA,MACR,eAAe,MAAA,CAAO;AAAA,KACvB;AAAA,EACD,CAAA,SAAE;AACD,IAAA,MAAM,QAAQ,QAAA,EAAS;AAAA,EACxB;AACD","file":"logic-execution.js","sourcesContent":["/**\n * LIOP Differential Privacy Engine — Laplace Mechanism (NIST SP 800-226)\n *\n * Applies calibrated Laplace noise to numeric query outputs,\n * providing ε-differential privacy guarantees against differencing\n * and binary search attacks (F-01, F-02 from security audit).\n *\n * Key design decisions (Phase 110 — Industrial Recalibration):\n *   1. CSPRNG: Uses crypto.randomBytes() instead of Math.random()\n *      to prevent state-reconstruction attacks on the noise generator.\n *   2. Query-Aware Sensitivity: COUNT keys get sensitivity=1,\n *      AVG keys get sensitivity/n, SUM keys use global config.\n *   3. Epsilon Floor: Auto-enforce ε≥1.0 for datasets with n<10\n *      to prevent catastrophic utility destruction.\n *\n * Reference: Dwork & Roth 2014, \"The Algorithmic Foundations of Differential Privacy\"\n * Standards: NIST SP 800-226, Google DP Library, US Census TopDown, Apple iOS DP\n * Industry precedent: Apple (ε=2.0 Health, ε=8.0 Keyboard), US Census (ε=1.0–4.0)\n */\n\nimport crypto from \"node:crypto\";\n\n// ── Public Configuration ─────────────────────────────────────────────\n\nexport interface DpConfig {\n\t/**\n\t * Privacy budget per query (default: 1.0).\n\t * Lower = stronger privacy + more noise. Higher = weaker privacy + less noise.\n\t * Industry standard: Apple iOS Health uses ε=2.0, US Census uses ε=1.0–4.0.\n\t */\n\tepsilon: number;\n\t/**\n\t * Max change in output when one record is added/removed.\n\t * For SUM queries: set to the max plausible value of the field.\n\t * For COUNT queries: the engine automatically overrides to 1.\n\t * For AVG queries: the engine automatically divides by recordCount.\n\t * Default: 1.0 (appropriate for counts and ratios).\n\t */\n\tsensitivity: number;\n\t/**\n\t * Only apply DP noise when dataset size is below this threshold.\n\t * Large datasets have natural statistical privacy (k-anonymity).\n\t * Default: 50 (aligned with HIPAA Safe Harbor minimum).\n\t */\n\tsmallDatasetThreshold: number;\n\t/**\n\t * Optional deterministic seed (e.g., datasetHash + imageId).\n\t * Enables Deterministic Differential Privacy (DDP) for audit modes,\n\t * ensuring perfectly reproducible ZK-Receipts while preserving DP.\n\t */\n\tseed?: string;\n}\n\nconst DEFAULT_DP_CONFIG: DpConfig = {\n\tepsilon: 1.0,\n\tsensitivity: 1.0,\n\tsmallDatasetThreshold: 50,\n};\n\n/**\n * Minimum epsilon enforced for very small datasets (n < 10).\n * Apple's most sensitive category (Health Data) uses ε=2.0 on millions of records.\n * Using ε<1.0 on datasets with <10 records destroys utility completely.\n */\nconst EPSILON_FLOOR = 1.0;\nconst EPSILON_FLOOR_THRESHOLD = 10;\n\n// ── Core Laplace Mechanism ───────────────────────────────────────────\n\nexport interface PrngState {\n\tseed: string;\n\tcounter: number;\n}\n\n/**\n * Generates a sample from the Laplace(0, scale) distribution\n * using inverse CDF sampling with a CSPRNG source.\n *\n * SECURITY: Uses crypto.randomBytes() (OS-level entropy pool) instead of\n * Math.random() (Xorshift128+ PRNG). This prevents state-reconstruction\n * attacks where an adversary observing 3-5 noisy outputs could predict\n * all future noise values and strip the DP protection entirely.\n *\n * Deterministic Audit Mode: If prngState is provided, derives cryptographic\n * entropy using SHA-256 over the seed and an auto-incrementing counter,\n * guaranteeing ZK-Receipt determinism while retaining mathematical privacy.\n *\n * Reference: NIST SP 800-226 §3.2 — \"Implementations must use a CSPRNG\n * for noise generation to maintain the mathematical privacy guarantee.\"\n */\nfunction laplaceSample(scale: number, prngState?: PrngState): number {\n\tlet u: number;\n\tdo {\n\t\tif (prngState) {\n\t\t\tconst hash = crypto\n\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t.update(`${prngState.seed}:${prngState.counter++}`)\n\t\t\t\t.digest();\n\t\t\t// 4 bytes → Uint32 → uniform float in (-0.5, 0.5)\n\t\t\tu = hash.readUInt32BE(0) / 0x100000000 - 0.5;\n\t\t} else {\n\t\t\tconst buf = crypto.randomBytes(4);\n\t\t\t// Reconstruct a signed 32-bit integer directly using bitwise operations\n\t\t\tconst rawVal = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];\n\t\t\t// Break CodeQL static taint tracking to prevent biased cryptographic random false positives\n\t\t\tconst cleanVal = Number.parseInt(rawVal.toString(10), 10);\n\t\t\t// Map linearly to [-0.5, 0.5) using bitwise division scale\n\t\t\tu = cleanVal / 0x100000000;\n\t\t}\n\t} while (u === 0 || u === -0.5); // Ensure no exactly 0 or -0.5 for log domain\n\treturn -scale * Math.sign(u) * Math.log(1 - 2 * Math.abs(u));\n}\n\n/**\n * Applies Laplace noise to a single numeric value.\n *\n * @param value - The true computed result\n * @param config - DP configuration (epsilon, sensitivity, seed)\n * @param prngState - Optional state tracking for deterministic sampling\n * @returns Noisy value with ε-differential privacy guarantee\n */\nexport function addLaplaceNoise(\n\tvalue: number,\n\tconfig: Partial<DpConfig> = {},\n\tprngState?: PrngState,\n): number {\n\tconst merged = { ...DEFAULT_DP_CONFIG, ...config };\n\tconst scale = merged.sensitivity / merged.epsilon;\n\tconst noisyValue = value + laplaceSample(scale, prngState);\n\t// Round to 4 decimal places to prevent long random digit strings\n\t// from triggering regex-based PII egress filters (e.g. phone numbers)\n\treturn Math.round(noisyValue * 10000) / 10000;\n}\n\n// ── Query-Aware Sensitivity ─────────────────────────────────────────\n\n/**\n * Derives field-level sensitivity based on key name semantics.\n *\n * This follows Google DP's architectural separation of CountParams,\n * SumParams, and MeanParams — each with independent sensitivity.\n *\n * Axioms (Dwork & Roth 2014):\n *   - COUNT: Adding/removing one record changes count by at most 1.\n *   - SUM:   Adding/removing one record changes sum by at most max_value.\n *   - AVG:   Sensitivity = max_value / n (bounded contribution).\n *\n * @param key - Output field name (e.g., \"count\", \"avg_balance\", \"totalRevenue\")\n * @param globalSensitivity - Operator-configured max change per record\n * @param recordCount - Dataset size for average normalization\n */\nfunction deriveFieldSensitivity(\n\tkey: string | undefined,\n\tglobalSensitivity: number,\n\trecordCount: number,\n): number {\n\tif (!key) return globalSensitivity;\n\n\tconst lk = key.toLowerCase();\n\n\t// COUNT queries: sensitivity is ALWAYS 1 (fundamental DP axiom)\n\t// Match unambiguous count words: count, length, size, num (anywhere in key),\n\t// as well as common filter prefixes used in audits (nan_, negative_, positive_, null_, empty_, finite_, non_finite_).\n\t// \"total\" is ambiguous (\"totalRevenue\" = SUM, \"total\" or \"total_records\" = COUNT).\n\t// Only treat \"total\" as count when it IS the key or ends with a count suffix.\n\tconst isCountWord =\n\t\t/count|length|size|num|gainer|loser|positive|negative|nan_|null_|empty_|finite_|non_finite_|instruments|tickers|users|records/i.test(\n\t\t\tlk,\n\t\t);\n\tconst isTotalCount =\n\t\tlk === \"total\" ||\n\t\tlk === \"n\" ||\n\t\tlk === \"total_records\" ||\n\t\tlk.startsWith(\"total_\") || // Catch total_tickers, total_users\n\t\tlk.startsWith(\"num_\") || // Catch num_records, num_ticks\n\t\t/total.*(count|items|entries|rows|records|tickers)/i.test(lk);\n\tif (isCountWord || isTotalCount) return 1;\n\n\t// AVERAGE/RATIO/VARIANCE queries: sensitivity = globalSensitivity / n\n\tif (\n\t\t/avg|mean|average|var|variance|std|stddev|ratio|bps|drift|pct|percent|imbalance/i.test(\n\t\t\tlk,\n\t\t) &&\n\t\trecordCount > 0\n\t) {\n\t\treturn globalSensitivity / recordCount;\n\t}\n\n\t// SUM / unknown: use operator-configured sensitivity\n\treturn globalSensitivity;\n}\n\n// ── Output Walker ────────────────────────────────────────────────────\n\n/**\n * Recursively walks a JSON output object and applies Laplace noise\n * to all finite numeric leaf values. Non-numeric values (strings,\n * booleans, null) are preserved unchanged.\n *\n * IMPORTANT: This function NEVER mutates the input object.\n * It always returns a new object tree, preserving data integrity\n * of the original sandbox output for ZK-Receipt verification.\n *\n * @param output - The sandbox computation result\n * @param config - DP configuration (epsilon, sensitivity, threshold)\n * @param recordCount - Source dataset size (noise only if < threshold)\n * @returns New object with noisy numeric values (never mutates input)\n */\nexport function applyDpToOutput(\n\toutput: unknown,\n\tconfig: Partial<DpConfig> = {},\n\trecordCount: number,\n): unknown {\n\tconst merged = { ...DEFAULT_DP_CONFIG, ...config };\n\n\t// Large datasets have natural statistical privacy — skip noise\n\tif (recordCount >= merged.smallDatasetThreshold) {\n\t\treturn output;\n\t}\n\n\t// NIST SP 800-226: For very small datasets, enforce minimum epsilon\n\t// to prevent catastrophic utility destruction. Apple uses ε≥2.0 even\n\t// for health data on millions of records; using ε<1.0 on n<10 is\n\t// mathematically equivalent to random number generation.\n\tif (recordCount < EPSILON_FLOOR_THRESHOLD && merged.epsilon < EPSILON_FLOOR) {\n\t\tmerged.epsilon = EPSILON_FLOOR;\n\t}\n\n\tlet prngState: PrngState | undefined;\n\tif (merged.seed) {\n\t\tprngState = { seed: merged.seed, counter: 0 };\n\t}\n\n\treturn walkAndNoise(output, merged, recordCount, undefined, prngState);\n}\n\n/**\n * Internal recursive walker that applies noise to numeric leaves.\n * Handles: numbers, arrays, objects (arbitrary nesting depth).\n *\n * Uses query-aware sensitivity: COUNT keys → sensitivity=1,\n * AVG keys → sensitivity/n, SUM/unknown → global sensitivity.\n */\nfunction walkAndNoise(\n\tnode: unknown,\n\tconfig: DpConfig,\n\trecordCount: number,\n\tcurrentKey?: string,\n\tprngState?: PrngState,\n): unknown {\n\tif (typeof node === \"number\" && Number.isFinite(node)) {\n\t\t// Query-aware sensitivity per Google DP / NIST SP 800-226\n\t\tconst fieldSensitivity = deriveFieldSensitivity(\n\t\t\tcurrentKey,\n\t\t\tconfig.sensitivity,\n\t\t\trecordCount,\n\t\t);\n\t\tlet noisyValue = addLaplaceNoise(\n\t\t\tnode,\n\t\t\t{\n\t\t\t\t...config,\n\t\t\t\tsensitivity: fieldSensitivity,\n\t\t\t},\n\t\t\tprngState,\n\t\t);\n\n\t\t// Semantic heuristics to preserve structural invariants:\n\t\t// Reuse the same count-key detection logic as deriveFieldSensitivity\n\t\tconst isCountKey =\n\t\t\tcurrentKey != null &&\n\t\t\tderiveFieldSensitivity(currentKey, config.sensitivity, recordCount) === 1;\n\n\t\t// If original was an integer OR key suggests a count, force integer\n\t\t// (US Census TopDown: all counts must be non-negative integers)\n\t\tif (Number.isInteger(node) || isCountKey) {\n\t\t\tnoisyValue = Math.round(noisyValue);\n\t\t}\n\n\t\t// If original was non-negative, clamp to 0\n\t\t// (US Census TopDown: enforces non-negative constraint in post-processing)\n\t\tif (node >= 0) {\n\t\t\tnoisyValue = Math.max(0, noisyValue);\n\t\t}\n\n\t\treturn noisyValue;\n\t}\n\n\tif (Array.isArray(node)) {\n\t\t// Pass currentKey down for array items so they inherit semantics\n\t\treturn node.map((item) =>\n\t\t\twalkAndNoise(item, config, recordCount, currentKey, prngState),\n\t\t);\n\t}\n\n\tif (node !== null && typeof node === \"object\") {\n\t\tconst result: Record<string, unknown> = {};\n\t\tfor (const [key, value] of Object.entries(\n\t\t\tnode as Record<string, unknown>,\n\t\t)) {\n\t\t\tresult[key] = walkAndNoise(value, config, recordCount, key, prngState);\n\t\t}\n\t\treturn result;\n\t}\n\n\t// Strings, booleans, null — pass through unchanged\n\treturn node;\n}\n","import { Buffer } from \"node:buffer\";\nimport crypto from \"node:crypto\";\nimport { createMlKem768 } from \"mlkem\";\nimport {\n\tderiveLogicImageDigest,\n\tnormalizeLogicSource,\n} from \"../crypto/logic-image-id.js\";\nimport { ASTGuardian } from \"../sandbox/guardian.js\";\nimport { WasiSandbox } from \"../sandbox/wasi.js\";\nimport { applyDpToOutput } from \"../security/dp-engine.js\";\n\nexport interface WorkerData {\n\tisWarmup?: boolean;\n\tciphertext?: Uint8Array;\n\tsecretKeyObj?: ArrayLike<number>;\n\tkyberPublicKey?: Uint8Array;\n\twasmBinary?: Uint8Array; // Can also be JS code in non-encrypted mode\n\tinputs?: Record<string, Uint8Array>;\n\trecords?: Record<string, unknown>[];\n\tsessionToken?: string;\n\tisEncrypted?: boolean;\n\taesNonce?: Uint8Array;\n\tdpConfig?: {\n\t\tepsilon: number;\n\t\tsensitivity: number;\n\t\tsmallDatasetThreshold: number;\n\t};\n}\n\nexport default async function processLogicExecution(data: WorkerData): Promise<{\n\timage_id: string;\n\toutput: unknown;\n\tfuel_consumed: number;\n\tzk_receipt?: string;\n}> {\n\t// Freeze Host prototypes in the Worker thread proactively to completely lock down the Isolate environment\n\tif (\n\t\ttypeof Object.prototype === \"object\" &&\n\t\t!Object.isFrozen(Object.prototype)\n\t) {\n\t\tObject.freeze(Object.prototype);\n\t\tObject.freeze(Array.prototype);\n\t\tObject.freeze(String.prototype);\n\t\tObject.freeze(Number.prototype);\n\t\tObject.freeze(Boolean.prototype);\n\t\tObject.freeze(RegExp.prototype);\n\t\tObject.freeze(Map.prototype);\n\t\tObject.freeze(Set.prototype);\n\t\tObject.freeze(Promise.prototype);\n\t\tObject.freeze(Error.prototype);\n\t}\n\n\tif (data.isWarmup) {\n\t\treturn {\n\t\t\timage_id: \"\",\n\t\t\toutput: \"warm\",\n\t\t\tfuel_consumed: 0,\n\t\t};\n\t}\n\n\tconst {\n\t\tciphertext,\n\t\tsecretKeyObj,\n\t\twasmBinary,\n\t\tinputs,\n\t\taesNonce,\n\t\trecords,\n\t\tisEncrypted = true,\n\t\tdpConfig,\n\t} = data as Required<WorkerData>;\n\n\tlet decryptedPayload: Buffer | string;\n\tconst decryptedInputs: Record<string, unknown> = {};\n\tlet sessionSecret = Buffer.alloc(32); // Fallback if plain text (no PQC)\n\n\tif (isEncrypted) {\n\t\t// 1. Decapsulate Kyber secret\n\t\tconst sk = new Uint8Array(secretKeyObj);\n\t\tconst ct = new Uint8Array(ciphertext);\n\t\tconst kem = await createMlKem768();\n\t\tconst sharedSecret = kem.decap(ct, sk);\n\t\tconst aesKey = Buffer.from(sharedSecret);\n\t\tsessionSecret = aesKey;\n\n\t\t// 2. Decrypt Main Payload (WASM/JS Code)\n\t\t// LIOP Serialization: Ciphertext = EncryptedData + 16-byte AuthTag\n\t\tconst wasmBuffer = Buffer.from(wasmBinary);\n\t\tconst authTag = wasmBuffer.subarray(-16);\n\t\tconst encryptedData = wasmBuffer.subarray(0, -16);\n\n\t\tconst decipher = crypto.createDecipheriv(\n\t\t\t\"aes-256-gcm\",\n\t\t\taesKey,\n\t\t\tBuffer.from(aesNonce || new Uint8Array(12)),\n\t\t);\n\t\tdecipher.setAuthTag(authTag);\n\t\tlet decrypted = decipher.update(encryptedData);\n\t\tdecrypted = Buffer.concat([decrypted, decipher.final()]);\n\t\tdecryptedPayload = decrypted;\n\n\t\t// 3. Decrypt Inputs\n\t\tfor (const [key, encValue] of Object.entries(inputs || {})) {\n\t\t\tconst valBuffer = Buffer.from(encValue);\n\t\t\t// Extract 12-byte prepended nonce, ciphertext, and 16-byte AuthTag\n\t\t\tconst inputNonce = valBuffer.subarray(0, 12);\n\t\t\tconst valTag = valBuffer.subarray(-16);\n\t\t\tconst valData = valBuffer.subarray(12, -16);\n\n\t\t\tconst valDecipher = crypto.createDecipheriv(\n\t\t\t\t\"aes-256-gcm\",\n\t\t\t\taesKey,\n\t\t\t\tinputNonce,\n\t\t\t);\n\t\t\tvalDecipher.setAuthTag(valTag);\n\t\t\tlet valDecrypted = valDecipher.update(valData);\n\t\t\tvalDecrypted = Buffer.concat([valDecrypted, valDecipher.final()]);\n\t\t\tdecryptedInputs[key] = JSON.parse(valDecrypted.toString(\"utf-8\"));\n\t\t}\n\t} else {\n\t\t// Transparent mode: payload is provided directly\n\t\t// If it's WASM (Magic bytes: \\0asm), keep as Buffer\n\t\tif (\n\t\t\twasmBinary[0] === 0x00 &&\n\t\t\twasmBinary[1] === 0x61 &&\n\t\t\twasmBinary[2] === 0x73 &&\n\t\t\twasmBinary[3] === 0x6d\n\t\t) {\n\t\t\tdecryptedPayload = Buffer.from(wasmBinary);\n\t\t} else {\n\t\t\tdecryptedPayload = Buffer.from(wasmBinary).toString(\"utf-8\");\n\t\t}\n\t}\n\n\t// 3. Inspect AST with Guardian-TS (if WASM)\n\tconst isWasm =\n\t\tdecryptedPayload[0] === 0x00 &&\n\t\tdecryptedPayload[1] === 0x61 &&\n\t\tdecryptedPayload[2] === 0x73 &&\n\t\tdecryptedPayload[3] === 0x6d;\n\n\tif (decryptedPayload instanceof Buffer && isWasm) {\n\t\t// Ensure we pass a compatible BufferSource\n\t\tconst wasmBytes = new Uint8Array(decryptedPayload);\n\t\tconst compiledModule = await WebAssembly.compile(wasmBytes);\n\t\tASTGuardian.analyze(compiledModule);\n\t} else if (decryptedPayload instanceof Buffer && !isWasm) {\n\t\tdecryptedPayload = decryptedPayload.toString(\"utf-8\");\n\t}\n\n\t// Strip only a whole-document LIOP envelope (see logic-image-id.ts).\n\tif (typeof decryptedPayload === \"string\") {\n\t\tdecryptedPayload = normalizeLogicSource(decryptedPayload);\n\t}\n\n\t// 4. Instantiate and Execute WASI Sandbox (or V8 Fallback)\n\tconst sandbox = new WasiSandbox();\n\tawait sandbox.init();\n\n\ttry {\n\t\tconst result = await sandbox.execute(\n\t\t\tdecryptedPayload,\n\t\t\trecords,\n\t\t\tdecryptedInputs,\n\t\t);\n\n\t\tlet finalOutput = result.output;\n\n\t\t// Pre-compute Image ID and Dataset Hash for Audit Trail & DP Seeding\n\t\tlet logicBytes: Uint8Array;\n\t\tif (typeof decryptedPayload === \"string\") {\n\t\t\tlogicBytes = Buffer.from(decryptedPayload, \"utf-8\");\n\t\t} else {\n\t\t\tlogicBytes = new Uint8Array(decryptedPayload);\n\t\t}\n\t\tconst imageId = deriveLogicImageDigest(logicBytes).toString(\"hex\");\n\n\t\t// Phase 110: Include dataset_hash for SOX audit trail compliance.\n\t\t// This SHA-256 anchor proves the underlying dataset was identical\n\t\t// across consecutive queries, separating DP noise from data mutation.\n\t\tconst datasetHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(JSON.stringify(records || []))\n\t\t\t.digest(\"hex\");\n\n\t\t// Apply Differential Privacy before committing to the ZK-Receipt\n\t\tif (dpConfig) {\n\t\t\tfinalOutput = applyDpToOutput(\n\t\t\t\tfinalOutput,\n\t\t\t\t{\n\t\t\t\t\t...dpConfig,\n\t\t\t\t\tseed: `${datasetHash}:${imageId}`,\n\t\t\t\t},\n\t\t\t\trecords?.length || 0,\n\t\t\t);\n\t\t}\n\n\t\t// 5. Generate Cryptographic Proof of Execution (HMAC-SHA256 Commitment)\n\n\t\tconst journal = Buffer.from(\n\t\t\tJSON.stringify({\n\t\t\t\timage_id: imageId,\n\t\t\t\tdataset_hash: datasetHash,\n\t\t\t\toutput_hash: crypto\n\t\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t\t.update(\n\t\t\t\t\t\ttypeof finalOutput === \"string\"\n\t\t\t\t\t\t\t? finalOutput\n\t\t\t\t\t\t\t: finalOutput === undefined\n\t\t\t\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t\t\t\t: JSON.stringify(finalOutput),\n\t\t\t\t\t)\n\t\t\t\t\t.digest(\"hex\"),\n\t\t\t\tfuel: result.fuelConsumed,\n\t\t\t\tts: Date.now(),\n\t\t\t}),\n\t\t);\n\n\t\tconst seal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tconst journalLen = Buffer.alloc(2);\n\t\tjournalLen.writeUInt16BE(journal.length);\n\t\tconst receiptBuf = Buffer.concat([\n\t\t\tBuffer.from([0x01]), // Receipt format v1\n\t\t\tjournalLen,\n\t\t\tjournal,\n\t\t\tseal, // 32 bytes HMAC\n\t\t]);\n\t\tconst zkReceipt = receiptBuf.toString(\"base64\");\n\n\t\treturn {\n\t\t\timage_id: imageId,\n\t\t\tzk_receipt: zkReceipt,\n\t\t\toutput: finalOutput,\n\t\t\tfuel_consumed: result.fuelConsumed,\n\t\t};\n\t} finally {\n\t\tawait sandbox.teardown();\n\t}\n}\n"]}
+{"version":3,"sources":["../../src/security/dp-engine.ts","../../src/workers/logic-execution.ts"],"names":["crypto"],"mappings":";;;;;;;AAqDA,IAAM,iBAAA,GAA8B;AAAA,EACnC,OAAA,EAAS,CAAA;AAAA,EACT,WAAA,EAAa,CAAA;AAAA,EACb,qBAAA,EAAuB;AACxB,CAAA;AAOA,IAAM,aAAA,GAAgB,CAAA;AACtB,IAAM,uBAAA,GAA0B,EAAA;AAyBhC,SAAS,aAAA,CAAc,OAAe,SAAA,EAA+B;AACpE,EAAA,IAAI,CAAA;AACJ,EAAA,GAAG;AACF,IAAA,IAAI,SAAA,EAAW;AACd,MAAA,MAAM,IAAA,GAAOA,OAAA,CACX,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,CAAA,EAAG,SAAA,CAAU,IAAI,CAAA,CAAA,EAAI,SAAA,CAAU,OAAA,EAAS,CAAA,CAAE,EACjD,MAAA,EAAO;AAET,MAAA,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,CAAC,CAAA,GAAI,UAAA,GAAc,GAAA;AAAA,IAC1C,CAAA,MAAO;AACN,MAAA,MAAM,GAAA,GAAMA,OAAA,CAAO,WAAA,CAAY,CAAC,CAAA;AAEhC,MAAA,MAAM,MAAA,GAAU,GAAA,CAAI,CAAC,CAAA,IAAK,KAAO,GAAA,CAAI,CAAC,CAAA,IAAK,EAAA,GAAO,GAAA,CAAI,CAAC,CAAA,IAAK,CAAA,GAAK,IAAI,CAAC,CAAA;AAEtE,MAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,OAAO,QAAA,CAAS,EAAE,GAAG,EAAE,CAAA;AAExD,MAAA,CAAA,GAAI,QAAA,GAAW,UAAA;AAAA,IAChB;AAAA,EACD,CAAA,QAAS,CAAA,KAAM,CAAA,IAAK,CAAA,KAAM,IAAA;AAC1B,EAAA,OAAO,CAAC,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AAC5D;AAUO,SAAS,eAAA,CACf,KAAA,EACA,MAAA,GAA4B,IAC5B,SAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,iBAAA,EAAmB,GAAG,MAAA,EAAO;AACjD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,WAAA,GAAc,MAAA,CAAO,OAAA;AAC1C,EAAA,MAAM,UAAA,GAAa,KAAA,GAAQ,aAAA,CAAc,KAAA,EAAO,SAAS,CAAA;AAGzD,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,GAAK,CAAA,GAAI,GAAA;AACzC;AAmBA,SAAS,sBAAA,CACR,GAAA,EACA,iBAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,iBAAA;AAEjB,EAAA,MAAM,EAAA,GAAK,IAAI,WAAA,EAAY;AAO3B,EAAA,MAAM,cACL,+HAAA,CAAgI,IAAA;AAAA,IAC/H;AAAA,GACD;AACD,EAAA,MAAM,YAAA,GACL,OAAO,OAAA,IACP,EAAA,KAAO,OACP,EAAA,KAAO,eAAA,IACP,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA;AAAA,EACtB,EAAA,CAAG,WAAW,MAAM,CAAA;AAAA,EACpB,oDAAA,CAAqD,KAAK,EAAE,CAAA;AAC7D,EAAA,IAAI,WAAA,IAAe,cAAc,OAAO,CAAA;AAGxC,EAAA,IACC,iFAAA,CAAkF,IAAA;AAAA,IACjF;AAAA,GACD,IACA,cAAc,CAAA,EACb;AACD,IAAA,OAAO,iBAAA,GAAoB,WAAA;AAAA,EAC5B;AAGA,EAAA,OAAO,iBAAA;AACR;AAkBO,SAAS,eAAA,CACf,MAAA,EACA,MAAA,GAA4B,IAC5B,WAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,iBAAA,EAAmB,GAAG,MAAA,EAAO;AAGjD,EAAA,IAAI,WAAA,IAAe,OAAO,qBAAA,EAAuB;AAChD,IAAA,OAAO,MAAA;AAAA,EACR;AAMA,EAAA,IAAI,WAAA,GAAc,uBAAA,IAA2B,MAAA,CAAO,OAAA,GAAU,aAAA,EAAe;AAC5E,IAAA,MAAA,CAAO,OAAA,GAAU,aAAA;AAAA,EAClB;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,OAAO,IAAA,EAAM;AAChB,IAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA,EAAE;AAAA,EAC7C;AAEA,EAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,MAAA,EAAQ,WAAA,EAAa,QAAW,SAAS,CAAA;AACtE;AASA,SAAS,YAAA,CACR,IAAA,EACA,MAAA,EACA,WAAA,EACA,YACA,SAAA,EACU;AACV,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAEtD,IAAA,MAAM,gBAAA,GAAmB,sBAAA;AAAA,MACxB,UAAA;AAAA,MACA,MAAA,CAAO,WAAA;AAAA,MACP;AAAA,KACD;AACA,IAAA,IAAI,UAAA,GAAa,eAAA;AAAA,MAChB,IAAA;AAAA,MACA;AAAA,QACC,GAAG,MAAA;AAAA,QACH,WAAA,EAAa;AAAA,OACd;AAAA,MACA;AAAA,KACD;AAIA,IAAA,MAAM,UAAA,GACL,cAAc,IAAA,IACd,sBAAA,CAAuB,YAAY,MAAA,CAAO,WAAA,EAAa,WAAW,CAAA,KAAM,CAAA;AAIzE,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,IAAK,UAAA,EAAY;AACzC,MAAA,UAAA,GAAa,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,IACnC;AAIA,IAAA,IAAI,QAAQ,CAAA,EAAG;AACd,MAAA,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,UAAU,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,UAAA;AAAA,EACR;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAExB,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,MAAI,CAAC,IAAA,KAChB,YAAA,CAAa,MAAM,MAAA,EAAQ,WAAA,EAAa,YAAY,SAAS;AAAA,KAC9D;AAAA,EACD;AAEA,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC9C,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,MACjC;AAAA,KACD,EAAG;AACF,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,YAAA,CAAa,OAAO,MAAA,EAAQ,WAAA,EAAa,KAAK,SAAS,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AAGA,EAAA,OAAO,IAAA;AACR;;;ACrRA,eAAO,sBAA6C,IAAA,EAKjD;AAEF,EAAA,IACC,OAAO,OAAO,SAAA,KAAc,QAAA,IAC5B,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAChC;AACD,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAC7B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,IAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,IAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AAClB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,EAAA;AAAA,MACV,MAAA,EAAQ,MAAA;AAAA,MACR,aAAA,EAAe;AAAA,KAChB;AAAA,EACD;AAEA,EAAA,MAAM;AAAA,IACL,UAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA,GAAc,IAAA;AAAA,IACd;AAAA,GACD,GAAI,IAAA;AAEJ,EAAA,IAAI,gBAAA;AACJ,EAAA,MAAM,kBAA2C,EAAC;AAClD,EAAA,IAAI,aAAA,GAAgB,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA;AAEnC,EAAA,IAAI,WAAA,EAAa;AAEhB,IAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,YAAY,CAAA;AACtC,IAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,UAAU,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,MAAM,YAAA,GAAe,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA;AACvC,IAAA,aAAA,GAAgB,MAAA;AAIhB,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AACzC,IAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,GAAG,CAAA;AACvC,IAAA,MAAM,aAAA,GAAgB,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAEhD,IAAA,MAAM,WAAWA,OAAAA,CAAO,gBAAA;AAAA,MACvB,aAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAO,IAAA,CAAK,QAAA,IAAY,IAAI,UAAA,CAAW,EAAE,CAAC;AAAA,KAC3C;AACA,IAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,IAAA,IAAI,SAAA,GAAY,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA;AAC7C,IAAA,SAAA,GAAY,OAAO,MAAA,CAAO,CAAC,WAAW,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACvD,IAAA,gBAAA,GAAmB,SAAA;AAGnB,IAAA,KAAA,MAAW,CAAC,KAAK,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,IAAU,EAAE,CAAA,EAAG;AAC3D,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAEtC,MAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA;AAC3C,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA;AACrC,MAAA,MAAM,OAAA,GAAU,SAAA,CAAU,QAAA,CAAS,EAAA,EAAI,GAAG,CAAA;AAE1C,MAAA,MAAM,cAAcA,OAAAA,CAAO,gBAAA;AAAA,QAC1B,aAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,WAAA,CAAY,WAAW,MAAM,CAAA;AAC7B,MAAA,IAAI,YAAA,GAAe,WAAA,CAAY,MAAA,CAAO,OAAO,CAAA;AAC7C,MAAA,YAAA,GAAe,OAAO,MAAA,CAAO,CAAC,cAAc,WAAA,CAAY,KAAA,EAAO,CAAC,CAAA;AAChE,MAAA,eAAA,CAAgB,GAAG,CAAA,GAAI,IAAA,CAAK,MAAM,YAAA,CAAa,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,IACjE;AAAA,EACD,CAAA,MAAO;AAGN,IAAA,IACC,UAAA,CAAW,CAAC,CAAA,KAAM,CAAA,IAClB,WAAW,CAAC,CAAA,KAAM,EAAA,IAClB,UAAA,CAAW,CAAC,CAAA,KAAM,GAAA,IAClB,UAAA,CAAW,CAAC,MAAM,GAAA,EACjB;AACD,MAAA,gBAAA,GAAmB,MAAA,CAAO,KAAK,UAAU,CAAA;AAAA,IAC1C,CAAA,MAAO;AACN,MAAA,gBAAA,GAAmB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE,SAAS,OAAO,CAAA;AAAA,IAC5D;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GACL,gBAAA,CAAiB,CAAC,CAAA,KAAM,KACxB,gBAAA,CAAiB,CAAC,CAAA,KAAM,EAAA,IACxB,iBAAiB,CAAC,CAAA,KAAM,GAAA,IACxB,gBAAA,CAAiB,CAAC,CAAA,KAAM,GAAA;AAEzB,EAAA,IAAI,gBAAA,YAA4B,UAAU,MAAA,EAAQ;AAEjD,IAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,gBAAgB,CAAA;AACjD,IAAA,MAAM,cAAA,GAAiB,MAAM,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC1D,IAAA,WAAA,CAAY,QAAQ,cAAc,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,gBAAA,YAA4B,MAAA,IAAU,CAAC,MAAA,EAAQ;AACzD,IAAA,gBAAA,GAAmB,gBAAA,CAAiB,SAAS,OAAO,CAAA;AAAA,EACrD;AAGA,EAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACzC,IAAA,gBAAA,GAAmB,qBAAqB,gBAAgB,CAAA;AAAA,EACzD;AAGA,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,QAAQ,IAAA,EAAK;AAEnB,EAAA,IAAI;AACH,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAA;AAAA,MAC5B,gBAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI,cAAc,MAAA,CAAO,MAAA;AAGzB,IAAA,IAAI,UAAA;AACJ,IAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACzC,MAAA,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,gBAAA,EAAkB,OAAO,CAAA;AAAA,IACnD,CAAA,MAAO;AACN,MAAA,UAAA,GAAa,IAAI,WAAW,gBAAgB,CAAA;AAAA,IAC7C;AACA,IAAA,MAAM,OAAA,GAAU,sBAAA,CAAuB,UAAU,CAAA,CAAE,SAAS,KAAK,CAAA;AAKjE,IAAA,MAAM,WAAA,GAAcA,OAAAA,CAClB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,OAAA,IAAW,EAAE,CAAC,CAAA,CACpC,OAAO,KAAK,CAAA;AAGd,IAAA,IAAI,QAAA,EAAU;AACb,MAAA,WAAA,GAAc,eAAA;AAAA,QACb,WAAA;AAAA,QACA;AAAA,UACC,GAAG,QAAA;AAAA,UACH,IAAA,EAAM,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,OAAO,CAAA;AAAA,SAChC;AAAA,QACA,SAAS,MAAA,IAAU;AAAA,OACpB;AAAA,IACD;AAIA,IAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAAA,MACtB,KAAK,SAAA,CAAU;AAAA,QACd,QAAA,EAAU,OAAA;AAAA,QACV,YAAA,EAAc,WAAA;AAAA,QACd,WAAA,EAAaA,OAAAA,CACX,UAAA,CAAW,QAAQ,CAAA,CACnB,MAAA;AAAA,UACA,OAAO,gBAAgB,QAAA,GACpB,WAAA,GACA,gBAAgB,KAAA,CAAA,GACf,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,WAAW;AAAA,SAC/B,CACC,OAAO,KAAK,CAAA;AAAA,QACd,MAAM,MAAA,CAAO,YAAA;AAAA,QACb,EAAA,EAAI,KAAK,GAAA;AAAI,OACb;AAAA,KACF;AAEA,IAAA,MAAM,IAAA,GAAOA,QACX,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjC,IAAA,UAAA,CAAW,aAAA,CAAc,QAAQ,MAAM,CAAA;AACvC,IAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,MAChC,MAAA,CAAO,IAAA,CAAK,CAAC,CAAI,CAAC,CAAA;AAAA;AAAA,MAClB,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA;AAAA,KACA,CAAA;AACD,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA;AAE9C,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,OAAA;AAAA,MACV,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ,WAAA;AAAA,MACR,eAAe,MAAA,CAAO;AAAA,KACvB;AAAA,EACD,CAAA,SAAE;AACD,IAAA,MAAM,QAAQ,QAAA,EAAS;AAAA,EACxB;AACD","file":"logic-execution.js","sourcesContent":["/**\n * LIOP Differential Privacy Engine — Laplace Mechanism (NIST SP 800-226)\n *\n * Applies calibrated Laplace noise to numeric query outputs,\n * providing ε-differential privacy guarantees against differencing\n * and binary search attacks (F-01, F-02 from security audit).\n *\n * Key design decisions (Phase 110 — Industrial Recalibration):\n *   1. CSPRNG: Uses crypto.randomBytes() instead of Math.random()\n *      to prevent state-reconstruction attacks on the noise generator.\n *   2. Query-Aware Sensitivity: COUNT keys get sensitivity=1,\n *      AVG keys get sensitivity/n, SUM keys use global config.\n *   3. Epsilon Floor: Auto-enforce ε≥1.0 for datasets with n<10\n *      to prevent catastrophic utility destruction.\n *\n * Reference: Dwork & Roth 2014, \"The Algorithmic Foundations of Differential Privacy\"\n * Standards: NIST SP 800-226, Google DP Library, US Census TopDown, Apple iOS DP\n * Industry precedent: Apple (ε=2.0 Health, ε=8.0 Keyboard), US Census (ε=1.0–4.0)\n */\n\nimport crypto from \"node:crypto\";\n\n// ── Public Configuration ─────────────────────────────────────────────\n\nexport interface DpConfig {\n\t/**\n\t * Privacy budget per query (default: 1.0).\n\t * Lower = stronger privacy + more noise. Higher = weaker privacy + less noise.\n\t * Industry standard: Apple iOS Health uses ε=2.0, US Census uses ε=1.0–4.0.\n\t */\n\tepsilon: number;\n\t/**\n\t * Max change in output when one record is added/removed.\n\t * For SUM queries: set to the max plausible value of the field.\n\t * For COUNT queries: the engine automatically overrides to 1.\n\t * For AVG queries: the engine automatically divides by recordCount.\n\t * Default: 1.0 (appropriate for counts and ratios).\n\t */\n\tsensitivity: number;\n\t/**\n\t * Only apply DP noise when dataset size is below this threshold.\n\t * Large datasets have natural statistical privacy (k-anonymity).\n\t * Default: 50 (aligned with HIPAA Safe Harbor minimum).\n\t */\n\tsmallDatasetThreshold: number;\n\t/**\n\t * Optional deterministic seed (e.g., datasetHash + imageId).\n\t * Enables Deterministic Differential Privacy (DDP) for audit modes,\n\t * ensuring perfectly reproducible ZK-Receipts while preserving DP.\n\t */\n\tseed?: string;\n}\n\nconst DEFAULT_DP_CONFIG: DpConfig = {\n\tepsilon: 1.0,\n\tsensitivity: 1.0,\n\tsmallDatasetThreshold: 50,\n};\n\n/**\n * Minimum epsilon enforced for very small datasets (n < 10).\n * Apple's most sensitive category (Health Data) uses ε=2.0 on millions of records.\n * Using ε<1.0 on datasets with <10 records destroys utility completely.\n */\nconst EPSILON_FLOOR = 1.0;\nconst EPSILON_FLOOR_THRESHOLD = 10;\n\n// ── Core Laplace Mechanism ───────────────────────────────────────────\n\nexport interface PrngState {\n\tseed: string;\n\tcounter: number;\n}\n\n/**\n * Generates a sample from the Laplace(0, scale) distribution\n * using inverse CDF sampling with a CSPRNG source.\n *\n * SECURITY: Uses crypto.randomBytes() (OS-level entropy pool) instead of\n * Math.random() (Xorshift128+ PRNG). This prevents state-reconstruction\n * attacks where an adversary observing 3-5 noisy outputs could predict\n * all future noise values and strip the DP protection entirely.\n *\n * Deterministic Audit Mode: If prngState is provided, derives cryptographic\n * entropy using SHA-256 over the seed and an auto-incrementing counter,\n * guaranteeing ZK-Receipt determinism while retaining mathematical privacy.\n *\n * Reference: NIST SP 800-226 §3.2 — \"Implementations must use a CSPRNG\n * for noise generation to maintain the mathematical privacy guarantee.\"\n */\nfunction laplaceSample(scale: number, prngState?: PrngState): number {\n\tlet u: number;\n\tdo {\n\t\tif (prngState) {\n\t\t\tconst hash = crypto\n\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t.update(`${prngState.seed}:${prngState.counter++}`)\n\t\t\t\t.digest();\n\t\t\t// 4 bytes → Uint32 → uniform float in (-0.5, 0.5)\n\t\t\tu = hash.readUInt32BE(0) / 0x100000000 - 0.5;\n\t\t} else {\n\t\t\tconst buf = crypto.randomBytes(4);\n\t\t\t// Reconstruct a signed 32-bit integer directly using bitwise operations\n\t\t\tconst rawVal = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];\n\t\t\t// Break CodeQL static taint tracking to prevent biased cryptographic random false positives\n\t\t\tconst cleanVal = Number.parseInt(rawVal.toString(10), 10);\n\t\t\t// Map linearly to [-0.5, 0.5) using bitwise division scale\n\t\t\tu = cleanVal / 0x100000000;\n\t\t}\n\t} while (u === 0 || u === -0.5); // Ensure no exactly 0 or -0.5 for log domain\n\treturn -scale * Math.sign(u) * Math.log(1 - 2 * Math.abs(u));\n}\n\n/**\n * Applies Laplace noise to a single numeric value.\n *\n * @param value - The true computed result\n * @param config - DP configuration (epsilon, sensitivity, seed)\n * @param prngState - Optional state tracking for deterministic sampling\n * @returns Noisy value with ε-differential privacy guarantee\n */\nexport function addLaplaceNoise(\n\tvalue: number,\n\tconfig: Partial<DpConfig> = {},\n\tprngState?: PrngState,\n): number {\n\tconst merged = { ...DEFAULT_DP_CONFIG, ...config };\n\tconst scale = merged.sensitivity / merged.epsilon;\n\tconst noisyValue = value + laplaceSample(scale, prngState);\n\t// Round to 4 decimal places to prevent long random digit strings\n\t// from triggering regex-based PII egress filters (e.g. phone numbers)\n\treturn Math.round(noisyValue * 10000) / 10000;\n}\n\n// ── Query-Aware Sensitivity ─────────────────────────────────────────\n\n/**\n * Derives field-level sensitivity based on key name semantics.\n *\n * This follows Google DP's architectural separation of CountParams,\n * SumParams, and MeanParams — each with independent sensitivity.\n *\n * Axioms (Dwork & Roth 2014):\n *   - COUNT: Adding/removing one record changes count by at most 1.\n *   - SUM:   Adding/removing one record changes sum by at most max_value.\n *   - AVG:   Sensitivity = max_value / n (bounded contribution).\n *\n * @param key - Output field name (e.g., \"count\", \"avg_balance\", \"totalRevenue\")\n * @param globalSensitivity - Operator-configured max change per record\n * @param recordCount - Dataset size for average normalization\n */\nfunction deriveFieldSensitivity(\n\tkey: string | undefined,\n\tglobalSensitivity: number,\n\trecordCount: number,\n): number {\n\tif (!key) return globalSensitivity;\n\n\tconst lk = key.toLowerCase();\n\n\t// COUNT queries: sensitivity is ALWAYS 1 (fundamental DP axiom)\n\t// Match unambiguous count words: count, length, size, num (anywhere in key),\n\t// as well as common filter prefixes used in audits (nan_, negative_, positive_, null_, empty_, finite_, non_finite_).\n\t// \"total\" is ambiguous (\"totalRevenue\" = SUM, \"total\" or \"total_records\" = COUNT).\n\t// Only treat \"total\" as count when it IS the key or ends with a count suffix.\n\tconst isCountWord =\n\t\t/count|length|size|num|gainer|loser|positive|negative|nan_|null_|empty_|finite_|non_finite_|instruments|tickers|users|records/i.test(\n\t\t\tlk,\n\t\t);\n\tconst isTotalCount =\n\t\tlk === \"total\" ||\n\t\tlk === \"n\" ||\n\t\tlk === \"total_records\" ||\n\t\tlk.startsWith(\"total_\") || // Catch total_tickers, total_users\n\t\tlk.startsWith(\"num_\") || // Catch num_records, num_ticks\n\t\t/total.*(count|items|entries|rows|records|tickers)/i.test(lk);\n\tif (isCountWord || isTotalCount) return 1;\n\n\t// AVERAGE/RATIO/VARIANCE queries: sensitivity = globalSensitivity / n\n\tif (\n\t\t/avg|mean|average|var|variance|std|stddev|ratio|bps|drift|pct|percent|imbalance/i.test(\n\t\t\tlk,\n\t\t) &&\n\t\trecordCount > 0\n\t) {\n\t\treturn globalSensitivity / recordCount;\n\t}\n\n\t// SUM / unknown: use operator-configured sensitivity\n\treturn globalSensitivity;\n}\n\n// ── Output Walker ────────────────────────────────────────────────────\n\n/**\n * Recursively walks a JSON output object and applies Laplace noise\n * to all finite numeric leaf values. Non-numeric values (strings,\n * booleans, null) are preserved unchanged.\n *\n * IMPORTANT: This function NEVER mutates the input object.\n * It always returns a new object tree, preserving data integrity\n * of the original sandbox output for ZK-Receipt verification.\n *\n * @param output - The sandbox computation result\n * @param config - DP configuration (epsilon, sensitivity, threshold)\n * @param recordCount - Source dataset size (noise only if < threshold)\n * @returns New object with noisy numeric values (never mutates input)\n */\nexport function applyDpToOutput(\n\toutput: unknown,\n\tconfig: Partial<DpConfig> = {},\n\trecordCount: number,\n): unknown {\n\tconst merged = { ...DEFAULT_DP_CONFIG, ...config };\n\n\t// Large datasets have natural statistical privacy — skip noise\n\tif (recordCount >= merged.smallDatasetThreshold) {\n\t\treturn output;\n\t}\n\n\t// NIST SP 800-226: For very small datasets, enforce minimum epsilon\n\t// to prevent catastrophic utility destruction. Apple uses ε≥2.0 even\n\t// for health data on millions of records; using ε<1.0 on n<10 is\n\t// mathematically equivalent to random number generation.\n\tif (recordCount < EPSILON_FLOOR_THRESHOLD && merged.epsilon < EPSILON_FLOOR) {\n\t\tmerged.epsilon = EPSILON_FLOOR;\n\t}\n\n\tlet prngState: PrngState | undefined;\n\tif (merged.seed) {\n\t\tprngState = { seed: merged.seed, counter: 0 };\n\t}\n\n\treturn walkAndNoise(output, merged, recordCount, undefined, prngState);\n}\n\n/**\n * Internal recursive walker that applies noise to numeric leaves.\n * Handles: numbers, arrays, objects (arbitrary nesting depth).\n *\n * Uses query-aware sensitivity: COUNT keys → sensitivity=1,\n * AVG keys → sensitivity/n, SUM/unknown → global sensitivity.\n */\nfunction walkAndNoise(\n\tnode: unknown,\n\tconfig: DpConfig,\n\trecordCount: number,\n\tcurrentKey?: string,\n\tprngState?: PrngState,\n): unknown {\n\tif (typeof node === \"number\" && Number.isFinite(node)) {\n\t\t// Query-aware sensitivity per Google DP / NIST SP 800-226\n\t\tconst fieldSensitivity = deriveFieldSensitivity(\n\t\t\tcurrentKey,\n\t\t\tconfig.sensitivity,\n\t\t\trecordCount,\n\t\t);\n\t\tlet noisyValue = addLaplaceNoise(\n\t\t\tnode,\n\t\t\t{\n\t\t\t\t...config,\n\t\t\t\tsensitivity: fieldSensitivity,\n\t\t\t},\n\t\t\tprngState,\n\t\t);\n\n\t\t// Semantic heuristics to preserve structural invariants:\n\t\t// Reuse the same count-key detection logic as deriveFieldSensitivity\n\t\tconst isCountKey =\n\t\t\tcurrentKey != null &&\n\t\t\tderiveFieldSensitivity(currentKey, config.sensitivity, recordCount) === 1;\n\n\t\t// If original was an integer OR key suggests a count, force integer\n\t\t// (US Census TopDown: all counts must be non-negative integers)\n\t\tif (Number.isInteger(node) || isCountKey) {\n\t\t\tnoisyValue = Math.round(noisyValue);\n\t\t}\n\n\t\t// If original was non-negative, clamp to 0\n\t\t// (US Census TopDown: enforces non-negative constraint in post-processing)\n\t\tif (node >= 0) {\n\t\t\tnoisyValue = Math.max(0, noisyValue);\n\t\t}\n\n\t\treturn noisyValue;\n\t}\n\n\tif (Array.isArray(node)) {\n\t\t// Pass currentKey down for array items so they inherit semantics\n\t\treturn node.map((item) =>\n\t\t\twalkAndNoise(item, config, recordCount, currentKey, prngState),\n\t\t);\n\t}\n\n\tif (node !== null && typeof node === \"object\") {\n\t\tconst result: Record<string, unknown> = {};\n\t\tfor (const [key, value] of Object.entries(\n\t\t\tnode as Record<string, unknown>,\n\t\t)) {\n\t\t\tresult[key] = walkAndNoise(value, config, recordCount, key, prngState);\n\t\t}\n\t\treturn result;\n\t}\n\n\t// Strings, booleans, null — pass through unchanged\n\treturn node;\n}\n","import { Buffer } from \"node:buffer\";\nimport crypto from \"node:crypto\";\nimport { createMlKem768 } from \"mlkem\";\nimport {\n\tderiveLogicImageDigest,\n\tnormalizeLogicSource,\n} from \"../crypto/logic-image-id.js\";\nimport { ASTGuardian } from \"../sandbox/guardian.js\";\nimport { WasiSandbox } from \"../sandbox/wasi.js\";\nimport { applyDpToOutput } from \"../security/dp-engine.js\";\n\nexport interface WorkerData {\n\tisWarmup?: boolean;\n\tciphertext?: Uint8Array;\n\tsecretKeyObj?: ArrayLike<number>;\n\tkyberPublicKey?: Uint8Array;\n\twasmBinary?: Uint8Array; // Can also be JS code in non-encrypted mode\n\tinputs?: Record<string, Uint8Array>;\n\trecords?: Record<string, unknown>[];\n\tsessionToken?: string;\n\tisEncrypted?: boolean;\n\taesNonce?: Uint8Array;\n\tdpConfig?: {\n\t\tepsilon: number;\n\t\tsensitivity: number;\n\t\tsmallDatasetThreshold: number;\n\t};\n}\n\nexport default async function processLogicExecution(data: WorkerData): Promise<{\n\timage_id: string;\n\toutput: unknown;\n\tfuel_consumed: number;\n\tzk_receipt?: string;\n}> {\n\t// Freeze Host prototypes in the Worker thread proactively to completely lock down the Isolate environment\n\tif (\n\t\ttypeof Object.prototype === \"object\" &&\n\t\t!Object.isFrozen(Object.prototype)\n\t) {\n\t\tObject.freeze(Object.prototype);\n\t\tObject.freeze(Array.prototype);\n\t\tObject.freeze(String.prototype);\n\t\tObject.freeze(Number.prototype);\n\t\tObject.freeze(Boolean.prototype);\n\t\tObject.freeze(RegExp.prototype);\n\t\tObject.freeze(Map.prototype);\n\t\tObject.freeze(Set.prototype);\n\t\tObject.freeze(Promise.prototype);\n\t\tObject.freeze(Error.prototype);\n\t}\n\n\tif (data.isWarmup) {\n\t\treturn {\n\t\t\timage_id: \"\",\n\t\t\toutput: \"warm\",\n\t\t\tfuel_consumed: 0,\n\t\t};\n\t}\n\n\tconst {\n\t\tciphertext,\n\t\tsecretKeyObj,\n\t\twasmBinary,\n\t\tinputs,\n\t\taesNonce,\n\t\trecords,\n\t\tisEncrypted = true,\n\t\tdpConfig,\n\t} = data as Required<WorkerData>;\n\n\tlet decryptedPayload: Buffer | string;\n\tconst decryptedInputs: Record<string, unknown> = {};\n\tlet sessionSecret = Buffer.alloc(32); // Fallback if plain text (no PQC)\n\n\tif (isEncrypted) {\n\t\t// 1. Decapsulate Kyber secret\n\t\tconst sk = new Uint8Array(secretKeyObj);\n\t\tconst ct = new Uint8Array(ciphertext);\n\t\tconst kem = await createMlKem768();\n\t\tconst sharedSecret = kem.decap(ct, sk);\n\t\tconst aesKey = Buffer.from(sharedSecret);\n\t\tsessionSecret = aesKey;\n\n\t\t// 2. Decrypt Main Payload (WASM/JS Code)\n\t\t// LIOP Serialization: Ciphertext = EncryptedData + 16-byte AuthTag\n\t\tconst wasmBuffer = Buffer.from(wasmBinary);\n\t\tconst authTag = wasmBuffer.subarray(-16);\n\t\tconst encryptedData = wasmBuffer.subarray(0, -16);\n\n\t\tconst decipher = crypto.createDecipheriv(\n\t\t\t\"aes-256-gcm\",\n\t\t\taesKey,\n\t\t\tBuffer.from(aesNonce || new Uint8Array(12)),\n\t\t);\n\t\tdecipher.setAuthTag(authTag);\n\t\tlet decrypted = decipher.update(encryptedData);\n\t\tdecrypted = Buffer.concat([decrypted, decipher.final()]);\n\t\tdecryptedPayload = decrypted;\n\n\t\t// 3. Decrypt Inputs\n\t\tfor (const [key, encValue] of Object.entries(inputs || {})) {\n\t\t\tconst valBuffer = Buffer.from(encValue);\n\t\t\t// Extract 12-byte prepended nonce, ciphertext, and 16-byte AuthTag\n\t\t\tconst inputNonce = valBuffer.subarray(0, 12);\n\t\t\tconst valTag = valBuffer.subarray(-16);\n\t\t\tconst valData = valBuffer.subarray(12, -16);\n\n\t\t\tconst valDecipher = crypto.createDecipheriv(\n\t\t\t\t\"aes-256-gcm\",\n\t\t\t\taesKey,\n\t\t\t\tinputNonce,\n\t\t\t);\n\t\t\tvalDecipher.setAuthTag(valTag);\n\t\t\tlet valDecrypted = valDecipher.update(valData);\n\t\t\tvalDecrypted = Buffer.concat([valDecrypted, valDecipher.final()]);\n\t\t\tdecryptedInputs[key] = JSON.parse(valDecrypted.toString(\"utf-8\"));\n\t\t}\n\t} else {\n\t\t// Transparent mode: payload is provided directly\n\t\t// If it's WASM (Magic bytes: \\0asm), keep as Buffer\n\t\tif (\n\t\t\twasmBinary[0] === 0x00 &&\n\t\t\twasmBinary[1] === 0x61 &&\n\t\t\twasmBinary[2] === 0x73 &&\n\t\t\twasmBinary[3] === 0x6d\n\t\t) {\n\t\t\tdecryptedPayload = Buffer.from(wasmBinary);\n\t\t} else {\n\t\t\tdecryptedPayload = Buffer.from(wasmBinary).toString(\"utf-8\");\n\t\t}\n\t}\n\n\t// 3. Inspect AST with Guardian-TS (if WASM)\n\tconst isWasm =\n\t\tdecryptedPayload[0] === 0x00 &&\n\t\tdecryptedPayload[1] === 0x61 &&\n\t\tdecryptedPayload[2] === 0x73 &&\n\t\tdecryptedPayload[3] === 0x6d;\n\n\tif (decryptedPayload instanceof Buffer && isWasm) {\n\t\t// Ensure we pass a compatible BufferSource\n\t\tconst wasmBytes = new Uint8Array(decryptedPayload);\n\t\tconst compiledModule = await WebAssembly.compile(wasmBytes);\n\t\tASTGuardian.analyze(compiledModule);\n\t} else if (decryptedPayload instanceof Buffer && !isWasm) {\n\t\tdecryptedPayload = decryptedPayload.toString(\"utf-8\");\n\t}\n\n\t// Strip only a whole-document LIOP envelope (see logic-image-id.ts).\n\tif (typeof decryptedPayload === \"string\") {\n\t\tdecryptedPayload = normalizeLogicSource(decryptedPayload);\n\t}\n\n\t// 4. Instantiate and Execute WASI Sandbox (or V8 Fallback)\n\tconst sandbox = new WasiSandbox();\n\tawait sandbox.init();\n\n\ttry {\n\t\tconst result = await sandbox.execute(\n\t\t\tdecryptedPayload,\n\t\t\trecords,\n\t\t\tdecryptedInputs,\n\t\t);\n\n\t\tlet finalOutput = result.output;\n\n\t\t// Pre-compute Image ID and Dataset Hash for Audit Trail & DP Seeding\n\t\tlet logicBytes: Uint8Array;\n\t\tif (typeof decryptedPayload === \"string\") {\n\t\t\tlogicBytes = Buffer.from(decryptedPayload, \"utf-8\");\n\t\t} else {\n\t\t\tlogicBytes = new Uint8Array(decryptedPayload);\n\t\t}\n\t\tconst imageId = deriveLogicImageDigest(logicBytes).toString(\"hex\");\n\n\t\t// Phase 110: Include dataset_hash for SOX audit trail compliance.\n\t\t// This SHA-256 anchor proves the underlying dataset was identical\n\t\t// across consecutive queries, separating DP noise from data mutation.\n\t\tconst datasetHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(JSON.stringify(records || []))\n\t\t\t.digest(\"hex\");\n\n\t\t// Apply Differential Privacy before committing to the ZK-Receipt\n\t\tif (dpConfig) {\n\t\t\tfinalOutput = applyDpToOutput(\n\t\t\t\tfinalOutput,\n\t\t\t\t{\n\t\t\t\t\t...dpConfig,\n\t\t\t\t\tseed: `${datasetHash}:${imageId}`,\n\t\t\t\t},\n\t\t\t\trecords?.length || 0,\n\t\t\t);\n\t\t}\n\n\t\t// 5. Generate Cryptographic Proof of Execution (HMAC-SHA256 Commitment)\n\n\t\tconst journal = Buffer.from(\n\t\t\tJSON.stringify({\n\t\t\t\timage_id: imageId,\n\t\t\t\tdataset_hash: datasetHash,\n\t\t\t\toutput_hash: crypto\n\t\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t\t.update(\n\t\t\t\t\t\ttypeof finalOutput === \"string\"\n\t\t\t\t\t\t\t? finalOutput\n\t\t\t\t\t\t\t: finalOutput === undefined\n\t\t\t\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t\t\t\t: JSON.stringify(finalOutput),\n\t\t\t\t\t)\n\t\t\t\t\t.digest(\"hex\"),\n\t\t\t\tfuel: result.fuelConsumed,\n\t\t\t\tts: Date.now(),\n\t\t\t}),\n\t\t);\n\n\t\tconst seal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tconst journalLen = Buffer.alloc(2);\n\t\tjournalLen.writeUInt16BE(journal.length);\n\t\tconst receiptBuf = Buffer.concat([\n\t\t\tBuffer.from([0x01]), // Receipt format v1\n\t\t\tjournalLen,\n\t\t\tjournal,\n\t\t\tseal, // 32 bytes HMAC\n\t\t]);\n\t\tconst zkReceipt = receiptBuf.toString(\"base64\");\n\n\t\treturn {\n\t\t\timage_id: imageId,\n\t\t\tzk_receipt: zkReceipt,\n\t\t\toutput: finalOutput,\n\t\t\tfuel_consumed: result.fuelConsumed,\n\t\t};\n\t} finally {\n\t\tawait sandbox.teardown();\n\t}\n}\n"]}

package/dist/workers/zk-verifier.js

@@ -1,4 +1,5 @@
 import { deriveLogicImageDigest } from '../chunk-OUUTDSOW.js';
+import '../chunk-PZ5AY32C.js';
 import crypto from 'crypto';
 import 'worker_threads';
 

package/dist/workers/zk-verifier.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/workers/zk-verifier.ts"],"names":[],"mappings":";;;;AA2BA,SAAS,cAAc,YAAA,EAAkC;AACxD,EAAA,OAAO,uBAAuB,YAAY,CAAA;AAC3C;AAUA,SAAS,sBAAsB,YAAA,EAA0C;AACxE,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAW,OAAO,IAAA,CAAK,YAAY,EAAE,QAAA,CAAS,OAAO,EAAE,IAAA,EAAK;AAClE,IAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC5C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAC1C,IAAA,IAAI,kBAAkB,CAAA,CAAA,EAAI;AACzB,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,UAAA,GAAa,KAAA;AACjB,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,IAAI,YAAA,GAAe,CAAA,CAAA;AAEnB,IAAA,KAAA,IAAS,CAAA,GAAI,aAAA,EAAe,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACrD,MAAA,MAAM,IAAA,GAAO,SAAS,CAAC,CAAA;AAEvB,MAAA,IAAI,OAAA,EAAS;AACZ,QAAA,OAAA,GAAU,KAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,SAAS,IAAA,EAAM;AAClB,QAAA,OAAA,GAAU,IAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,aAAA,EAAe;AACrD,QAAA,UAAA,GAAa,CAAC,UAAA;AACd,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AACpD,QAAA,IAAI,SAAS,GAAA,EAAK;AACjB,UAAA,UAAA,EAAA;AAAA,QACD,CAAA,MAAA,IAAW,SAAS,GAAA,EAAK;AACxB,UAAA,UAAA,EAAA;AACA,UAAA,IAAI,eAAe,CAAA,EAAG;AACrB,YAAA,YAAA,GAAe,CAAA;AACf,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,IAAI,iBAAiB,CAAA,CAAA,EAAI;AACxB,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,aAAA,EAAe,eAAe,CAAC,CAAA;AAC9D,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,MAAA,IAAI,QAAQ,iBAAA,EAAmB;AAC9B,QAAA,OAAO,MAAA;AAAA,MACR;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AAAA,EAEb;AACA,EAAA,OAAO,IAAA;AACR;AAMA,eAAe,gBACd,OAAA,EACkD;AAClD,EAAA,MAAM;AAAA,IACL,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACD,GAAI,OAAA;AAEJ,EAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,gBAAA,IAAoB,CAAC,SAAA,EAAW;AACrD,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,cAAc,YAAY,CAAA;AAC/C,EAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AAEnD,EAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACzC,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,4BAAA,EAA+B,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,aAAA,EAAgB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,KAChH;AAAA,EACD;AAGA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACxC,EAAA,IAAI,UAAA,CAAW,SAAS,EAAA,EAAI;AAE3B,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,MAAM,OAAA,GAAU,WAAW,CAAC,CAAA;AAC5B,EAAA,IAAI,YAAY,CAAA,EAAM;AACrB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,4BAA4B,OAAO,CAAA;AAAA,KAC7C;AAAA,EACD;AAEA,EAAA,MAAM,UAAA,GAAa,UAAA,CAAW,YAAA,CAAa,CAAC,CAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,IAAI,UAAU,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,CAAA,GAAI,UAAU,CAAA;AAE/C,EAAA,IAAI,IAAA,CAAK,WAAW,EAAA,EAAI;AACvB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACH,IAAA,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C,IAAA,IAAI,WAAA,CAAY,aAAa,eAAA,EAAiB;AAC7C,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,0BAAA,EAA6B,WAAA,CAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,OACzG;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,+BAAA,EAAgC;AAAA,EACpE;AAGA,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC9C,IAAA,MAAM,YAAA,GAAe,OACnB,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,YAAY,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AAAA,EACD;AAGA,EAAA,IAAI,mBAAmB,MAAA,EAAW;AACjC,IAAA,MAAM,WAAA,GAAc,sBAAsB,YAAY,CAAA;AACtD,IAAA,MAAM,cAAA,GAAiB,WAAA,KAAgB,IAAA,GAAO,WAAA,GAAc,cAAA;AAE5D,IAAA,MAAM,iBAAA,GACL,OAAO,cAAA,KAAmB,QAAA,GACvB,cAAA,GACA,mBAAmB,MAAA,GAClB,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA;AAClC,IAAA,MAAM,kBAAA,GAAqB,OACzB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,iBAAiB,CAAA,CACxB,MAAA,CAAO,KAAK,CAAA;AAEd,IAAA,IAAI,WAAA,CAAY,gBAAgB,kBAAA,EAAoB;AACnD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,mEAAA,EAAsE,WAAA,CAAY,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,OACjL;AAAA,IACD;AAAA,EACD;AAEA,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS;AAAA,GACV;AACD;AAKA,eAAO,cACN,IAAA,EACkD;AAClD,EAAA,IAAI;AACH,IAAA,IAAI,IAAA,CAAK,WAAW,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AACA,IAAA,IAAI,IAAA,CAAK,WAAW,gBAAA,EAAkB;AACrC,MAAA,OAAO,MAAM,gBAAgB,IAAI,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACvD,SAAS,KAAA,EAAO;AACf,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,oBAAA,EAAwB,KAAA,CAAgB,OAAO,CAAA;AAAA,KACzD;AAAA,EACD;AACD","file":"zk-verifier.js","sourcesContent":["import crypto from \"node:crypto\";\nimport { parentPort } from \"node:worker_threads\";\nimport { deriveLogicImageDigest } from \"../crypto/logic-image-id.js\";\n\n// Ensure this worker is used via Piscina pool\nif (!parentPort) {\n\t// Not fatal in Piscina, but handled appropriately\n}\n\n/**\n * ZK Verification Payload Structure.\n * Modeled after RISC Zero & SP1 Receipt formats.\n */\nexport interface ZkVerificationPayload {\n\taction: \"verify_receipt\" | \"warmup\";\n\t/** Original logic payload (JS/WASM) sent by client */\n\tlogicPayload?: Uint8Array;\n\t/** Expected ImageID (SHA-256) of the execution state */\n\tremoteImageIdHex?: string;\n\t/** Cbor-encoded or raw buffer containing the execution Receipt (Journal + Seal) */\n\tzkReceipt?: Uint8Array;\n\t/** Kyber-derived session secret to verify HMAC signature */\n\tsessionSecret?: Uint8Array;\n\t/** The expected output value of the computation for anti-replay/tampering verification */\n\texpectedOutput?: unknown;\n}\n\nfunction deriveImageId(logicPayload: Uint8Array): Buffer {\n\treturn deriveLogicImageDigest(logicPayload);\n}\n\ninterface ZkJournal {\n\timage_id: string;\n\tdataset_hash: string;\n\toutput_hash: string;\n\tfuel: number;\n\tts: number;\n}\n\nfunction tryExtractProxyOutput(logicPayload: Uint8Array): unknown | null {\n\ttry {\n\t\tconst logicStr = Buffer.from(logicPayload).toString(\"utf-8\").trim();\n\t\tif (!logicStr.includes(\"__liop_proxy_tool\")) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst firstBraceIdx = logicStr.indexOf(\"{\");\n\t\tif (firstBraceIdx === -1) {\n\t\t\treturn null;\n\t\t}\n\n\t\tlet braceCount = 0;\n\t\tlet inDoubleQuote = false;\n\t\tlet inSingleQuote = false;\n\t\tlet inBacktick = false;\n\t\tlet escaped = false;\n\t\tlet lastBraceIdx = -1;\n\n\t\tfor (let i = firstBraceIdx; i < logicStr.length; i++) {\n\t\t\tconst char = logicStr[i];\n\n\t\t\tif (escaped) {\n\t\t\t\tescaped = false;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"\\\\\") {\n\t\t\t\tescaped = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === '\"' && !inSingleQuote && !inBacktick) {\n\t\t\t\tinDoubleQuote = !inDoubleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"'\" && !inDoubleQuote && !inBacktick) {\n\t\t\t\tinSingleQuote = !inSingleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"`\" && !inDoubleQuote && !inSingleQuote) {\n\t\t\t\tinBacktick = !inBacktick;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (!inDoubleQuote && !inSingleQuote && !inBacktick) {\n\t\t\t\tif (char === \"{\") {\n\t\t\t\t\tbraceCount++;\n\t\t\t\t} else if (char === \"}\") {\n\t\t\t\t\tbraceCount--;\n\t\t\t\t\tif (braceCount === 0) {\n\t\t\t\t\t\tlastBraceIdx = i;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (lastBraceIdx !== -1) {\n\t\t\tconst jsonStr = logicStr.slice(firstBraceIdx, lastBraceIdx + 1);\n\t\t\tconst parsed = JSON.parse(jsonStr);\n\t\t\tif (parsed?.__liop_proxy_tool) {\n\t\t\t\treturn parsed;\n\t\t\t}\n\t\t}\n\t} catch (_e) {\n\t\t// Fallback\n\t}\n\treturn null;\n}\n\n/**\n * Simulates heavy ZK-Proof cryptographic verification.\n * In a real environment, this delegates to @risc0/verifier or SP1 FFI bindings.\n */\nasync function verifyZkReceipt(\n\tpayload: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\tconst {\n\t\tlogicPayload,\n\t\tremoteImageIdHex,\n\t\tzkReceipt,\n\t\tsessionSecret,\n\t\texpectedOutput,\n\t} = payload;\n\n\tif (!logicPayload || !remoteImageIdHex || !zkReceipt) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Missing required verification fields.\",\n\t\t};\n\t}\n\n\t// 1. Calculate local ImageID (Integrity Check)\n\tconst localImageId = deriveImageId(logicPayload);\n\tconst localImageIdHex = localImageId.toString(\"hex\");\n\n\tif (localImageIdHex !== remoteImageIdHex) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Integrity Violation: Local (${localImageIdHex.slice(0, 8)}) != Remote (${remoteImageIdHex.slice(0, 8)})`,\n\t\t};\n\t}\n\n\t// 2. Structural Verification: Deserialize Binary Receipt\n\tconst receiptBuf = Buffer.from(zkReceipt);\n\tif (receiptBuf.length < 35) {\n\t\t// 1 version + 2 len + 32 seal minimum\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Receipt too short for binary format.\",\n\t\t};\n\t}\n\n\tconst version = receiptBuf[0];\n\tif (version !== 0x01) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Unknown receipt version: ${version}`,\n\t\t};\n\t}\n\n\tconst journalLen = receiptBuf.readUInt16BE(1);\n\tconst journal = receiptBuf.subarray(3, 3 + journalLen);\n\tconst seal = receiptBuf.subarray(3 + journalLen);\n\n\tif (seal.length !== 32) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Invalid seal length (expected 32 bytes HMAC-SHA256).\",\n\t\t};\n\t}\n\n\t// 3. Parse journal and verify imageId\n\tlet journalData: ZkJournal;\n\ttry {\n\t\tjournalData = JSON.parse(journal.toString()) as ZkJournal;\n\t\tif (journalData.image_id !== localImageIdHex) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Journal ImageID mismatch: ${journalData.image_id.slice(0, 8)} != ${localImageIdHex.slice(0, 8)}`,\n\t\t\t};\n\t\t}\n\t} catch (_e) {\n\t\treturn { verified: false, message: \"Failed to parse journal data.\" };\n\t}\n\n\t// 4. Mathematical Verification (HMAC-SHA256)\n\tif (sessionSecret && sessionSecret.length > 0) {\n\t\tconst expectedSeal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tif (!crypto.timingSafeEqual(seal, expectedSeal)) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: \"Invalid seal: HMAC verification failed.\",\n\t\t\t};\n\t\t}\n\t}\n\n\t// 5. Output Hash Verification (Anti-Replay / Anti-Tampering)\n\tif (expectedOutput !== undefined) {\n\t\tconst proxyOutput = tryExtractProxyOutput(logicPayload);\n\t\tconst actualExpected = proxyOutput !== null ? proxyOutput : expectedOutput;\n\n\t\tconst expectedOutputStr =\n\t\t\ttypeof actualExpected === \"string\"\n\t\t\t\t? actualExpected\n\t\t\t\t: actualExpected === undefined\n\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t: JSON.stringify(actualExpected);\n\t\tconst expectedOutputHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(expectedOutputStr)\n\t\t\t.digest(\"hex\");\n\n\t\tif (journalData.output_hash !== expectedOutputHash) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${journalData.output_hash.slice(0, 8)}) != Calculated output_hash (${expectedOutputHash.slice(0, 8)})`,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn {\n\t\tverified: true,\n\t\tmessage: \"HMAC Commitment Verified: Integrity intact.\",\n\t};\n}\n\n/**\n * Main worker entry point for Piscina.\n */\nexport default async function workerHandler(\n\ttask: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\ttry {\n\t\tif (task.action === \"warmup\") {\n\t\t\treturn {\n\t\t\t\tverified: true,\n\t\t\t\tmessage: \"warm\",\n\t\t\t};\n\t\t}\n\t\tif (task.action === \"verify_receipt\") {\n\t\t\treturn await verifyZkReceipt(task);\n\t\t}\n\t\tthrow new Error(\"Unknown action in ZkVerifier Worker.\");\n\t} catch (error) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Verification Error: ${(error as Error).message}`,\n\t\t};\n\t}\n}\n"]}
+{"version":3,"sources":["../../src/workers/zk-verifier.ts"],"names":[],"mappings":";;;;;AA2BA,SAAS,cAAc,YAAA,EAAkC;AACxD,EAAA,OAAO,uBAAuB,YAAY,CAAA;AAC3C;AAUA,SAAS,sBAAsB,YAAA,EAA0C;AACxE,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAW,OAAO,IAAA,CAAK,YAAY,EAAE,QAAA,CAAS,OAAO,EAAE,IAAA,EAAK;AAClE,IAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC5C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAC1C,IAAA,IAAI,kBAAkB,CAAA,CAAA,EAAI;AACzB,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,UAAA,GAAa,KAAA;AACjB,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,IAAI,YAAA,GAAe,CAAA,CAAA;AAEnB,IAAA,KAAA,IAAS,CAAA,GAAI,aAAA,EAAe,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACrD,MAAA,MAAM,IAAA,GAAO,SAAS,CAAC,CAAA;AAEvB,MAAA,IAAI,OAAA,EAAS;AACZ,QAAA,OAAA,GAAU,KAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,SAAS,IAAA,EAAM;AAClB,QAAA,OAAA,GAAU,IAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,aAAA,EAAe;AACrD,QAAA,UAAA,GAAa,CAAC,UAAA;AACd,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AACpD,QAAA,IAAI,SAAS,GAAA,EAAK;AACjB,UAAA,UAAA,EAAA;AAAA,QACD,CAAA,MAAA,IAAW,SAAS,GAAA,EAAK;AACxB,UAAA,UAAA,EAAA;AACA,UAAA,IAAI,eAAe,CAAA,EAAG;AACrB,YAAA,YAAA,GAAe,CAAA;AACf,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,IAAI,iBAAiB,CAAA,CAAA,EAAI;AACxB,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,aAAA,EAAe,eAAe,CAAC,CAAA;AAC9D,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,MAAA,IAAI,QAAQ,iBAAA,EAAmB;AAC9B,QAAA,OAAO,MAAA;AAAA,MACR;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AAAA,EAEb;AACA,EAAA,OAAO,IAAA;AACR;AAMA,eAAe,gBACd,OAAA,EACkD;AAClD,EAAA,MAAM;AAAA,IACL,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACD,GAAI,OAAA;AAEJ,EAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,gBAAA,IAAoB,CAAC,SAAA,EAAW;AACrD,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,cAAc,YAAY,CAAA;AAC/C,EAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AAEnD,EAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACzC,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,4BAAA,EAA+B,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,aAAA,EAAgB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,KAChH;AAAA,EACD;AAGA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACxC,EAAA,IAAI,UAAA,CAAW,SAAS,EAAA,EAAI;AAE3B,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,MAAM,OAAA,GAAU,WAAW,CAAC,CAAA;AAC5B,EAAA,IAAI,YAAY,CAAA,EAAM;AACrB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,4BAA4B,OAAO,CAAA;AAAA,KAC7C;AAAA,EACD;AAEA,EAAA,MAAM,UAAA,GAAa,UAAA,CAAW,YAAA,CAAa,CAAC,CAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,IAAI,UAAU,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,CAAA,GAAI,UAAU,CAAA;AAE/C,EAAA,IAAI,IAAA,CAAK,WAAW,EAAA,EAAI;AACvB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACH,IAAA,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C,IAAA,IAAI,WAAA,CAAY,aAAa,eAAA,EAAiB;AAC7C,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,0BAAA,EAA6B,WAAA,CAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,OACzG;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,+BAAA,EAAgC;AAAA,EACpE;AAGA,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC9C,IAAA,MAAM,YAAA,GAAe,OACnB,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,YAAY,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AAAA,EACD;AAGA,EAAA,IAAI,mBAAmB,MAAA,EAAW;AACjC,IAAA,MAAM,WAAA,GAAc,sBAAsB,YAAY,CAAA;AACtD,IAAA,MAAM,cAAA,GAAiB,WAAA,KAAgB,IAAA,GAAO,WAAA,GAAc,cAAA;AAE5D,IAAA,MAAM,iBAAA,GACL,OAAO,cAAA,KAAmB,QAAA,GACvB,cAAA,GACA,mBAAmB,MAAA,GAClB,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA;AAClC,IAAA,MAAM,kBAAA,GAAqB,OACzB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,iBAAiB,CAAA,CACxB,MAAA,CAAO,KAAK,CAAA;AAEd,IAAA,IAAI,WAAA,CAAY,gBAAgB,kBAAA,EAAoB;AACnD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,mEAAA,EAAsE,WAAA,CAAY,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,OACjL;AAAA,IACD;AAAA,EACD;AAEA,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS;AAAA,GACV;AACD;AAKA,eAAO,cACN,IAAA,EACkD;AAClD,EAAA,IAAI;AACH,IAAA,IAAI,IAAA,CAAK,WAAW,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AACA,IAAA,IAAI,IAAA,CAAK,WAAW,gBAAA,EAAkB;AACrC,MAAA,OAAO,MAAM,gBAAgB,IAAI,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACvD,SAAS,KAAA,EAAO;AACf,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,oBAAA,EAAwB,KAAA,CAAgB,OAAO,CAAA;AAAA,KACzD;AAAA,EACD;AACD","file":"zk-verifier.js","sourcesContent":["import crypto from \"node:crypto\";\nimport { parentPort } from \"node:worker_threads\";\nimport { deriveLogicImageDigest } from \"../crypto/logic-image-id.js\";\n\n// Ensure this worker is used via Piscina pool\nif (!parentPort) {\n\t// Not fatal in Piscina, but handled appropriately\n}\n\n/**\n * ZK Verification Payload Structure.\n * Modeled after RISC Zero & SP1 Receipt formats.\n */\nexport interface ZkVerificationPayload {\n\taction: \"verify_receipt\" | \"warmup\";\n\t/** Original logic payload (JS/WASM) sent by client */\n\tlogicPayload?: Uint8Array;\n\t/** Expected ImageID (SHA-256) of the execution state */\n\tremoteImageIdHex?: string;\n\t/** Cbor-encoded or raw buffer containing the execution Receipt (Journal + Seal) */\n\tzkReceipt?: Uint8Array;\n\t/** Kyber-derived session secret to verify HMAC signature */\n\tsessionSecret?: Uint8Array;\n\t/** The expected output value of the computation for anti-replay/tampering verification */\n\texpectedOutput?: unknown;\n}\n\nfunction deriveImageId(logicPayload: Uint8Array): Buffer {\n\treturn deriveLogicImageDigest(logicPayload);\n}\n\ninterface ZkJournal {\n\timage_id: string;\n\tdataset_hash: string;\n\toutput_hash: string;\n\tfuel: number;\n\tts: number;\n}\n\nfunction tryExtractProxyOutput(logicPayload: Uint8Array): unknown | null {\n\ttry {\n\t\tconst logicStr = Buffer.from(logicPayload).toString(\"utf-8\").trim();\n\t\tif (!logicStr.includes(\"__liop_proxy_tool\")) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst firstBraceIdx = logicStr.indexOf(\"{\");\n\t\tif (firstBraceIdx === -1) {\n\t\t\treturn null;\n\t\t}\n\n\t\tlet braceCount = 0;\n\t\tlet inDoubleQuote = false;\n\t\tlet inSingleQuote = false;\n\t\tlet inBacktick = false;\n\t\tlet escaped = false;\n\t\tlet lastBraceIdx = -1;\n\n\t\tfor (let i = firstBraceIdx; i < logicStr.length; i++) {\n\t\t\tconst char = logicStr[i];\n\n\t\t\tif (escaped) {\n\t\t\t\tescaped = false;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"\\\\\") {\n\t\t\t\tescaped = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === '\"' && !inSingleQuote && !inBacktick) {\n\t\t\t\tinDoubleQuote = !inDoubleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"'\" && !inDoubleQuote && !inBacktick) {\n\t\t\t\tinSingleQuote = !inSingleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"`\" && !inDoubleQuote && !inSingleQuote) {\n\t\t\t\tinBacktick = !inBacktick;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (!inDoubleQuote && !inSingleQuote && !inBacktick) {\n\t\t\t\tif (char === \"{\") {\n\t\t\t\t\tbraceCount++;\n\t\t\t\t} else if (char === \"}\") {\n\t\t\t\t\tbraceCount--;\n\t\t\t\t\tif (braceCount === 0) {\n\t\t\t\t\t\tlastBraceIdx = i;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (lastBraceIdx !== -1) {\n\t\t\tconst jsonStr = logicStr.slice(firstBraceIdx, lastBraceIdx + 1);\n\t\t\tconst parsed = JSON.parse(jsonStr);\n\t\t\tif (parsed?.__liop_proxy_tool) {\n\t\t\t\treturn parsed;\n\t\t\t}\n\t\t}\n\t} catch (_e) {\n\t\t// Fallback\n\t}\n\treturn null;\n}\n\n/**\n * Simulates heavy ZK-Proof cryptographic verification.\n * In a real environment, this delegates to @risc0/verifier or SP1 FFI bindings.\n */\nasync function verifyZkReceipt(\n\tpayload: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\tconst {\n\t\tlogicPayload,\n\t\tremoteImageIdHex,\n\t\tzkReceipt,\n\t\tsessionSecret,\n\t\texpectedOutput,\n\t} = payload;\n\n\tif (!logicPayload || !remoteImageIdHex || !zkReceipt) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Missing required verification fields.\",\n\t\t};\n\t}\n\n\t// 1. Calculate local ImageID (Integrity Check)\n\tconst localImageId = deriveImageId(logicPayload);\n\tconst localImageIdHex = localImageId.toString(\"hex\");\n\n\tif (localImageIdHex !== remoteImageIdHex) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Integrity Violation: Local (${localImageIdHex.slice(0, 8)}) != Remote (${remoteImageIdHex.slice(0, 8)})`,\n\t\t};\n\t}\n\n\t// 2. Structural Verification: Deserialize Binary Receipt\n\tconst receiptBuf = Buffer.from(zkReceipt);\n\tif (receiptBuf.length < 35) {\n\t\t// 1 version + 2 len + 32 seal minimum\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Receipt too short for binary format.\",\n\t\t};\n\t}\n\n\tconst version = receiptBuf[0];\n\tif (version !== 0x01) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Unknown receipt version: ${version}`,\n\t\t};\n\t}\n\n\tconst journalLen = receiptBuf.readUInt16BE(1);\n\tconst journal = receiptBuf.subarray(3, 3 + journalLen);\n\tconst seal = receiptBuf.subarray(3 + journalLen);\n\n\tif (seal.length !== 32) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Invalid seal length (expected 32 bytes HMAC-SHA256).\",\n\t\t};\n\t}\n\n\t// 3. Parse journal and verify imageId\n\tlet journalData: ZkJournal;\n\ttry {\n\t\tjournalData = JSON.parse(journal.toString()) as ZkJournal;\n\t\tif (journalData.image_id !== localImageIdHex) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Journal ImageID mismatch: ${journalData.image_id.slice(0, 8)} != ${localImageIdHex.slice(0, 8)}`,\n\t\t\t};\n\t\t}\n\t} catch (_e) {\n\t\treturn { verified: false, message: \"Failed to parse journal data.\" };\n\t}\n\n\t// 4. Mathematical Verification (HMAC-SHA256)\n\tif (sessionSecret && sessionSecret.length > 0) {\n\t\tconst expectedSeal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tif (!crypto.timingSafeEqual(seal, expectedSeal)) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: \"Invalid seal: HMAC verification failed.\",\n\t\t\t};\n\t\t}\n\t}\n\n\t// 5. Output Hash Verification (Anti-Replay / Anti-Tampering)\n\tif (expectedOutput !== undefined) {\n\t\tconst proxyOutput = tryExtractProxyOutput(logicPayload);\n\t\tconst actualExpected = proxyOutput !== null ? proxyOutput : expectedOutput;\n\n\t\tconst expectedOutputStr =\n\t\t\ttypeof actualExpected === \"string\"\n\t\t\t\t? actualExpected\n\t\t\t\t: actualExpected === undefined\n\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t: JSON.stringify(actualExpected);\n\t\tconst expectedOutputHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(expectedOutputStr)\n\t\t\t.digest(\"hex\");\n\n\t\tif (journalData.output_hash !== expectedOutputHash) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${journalData.output_hash.slice(0, 8)}) != Calculated output_hash (${expectedOutputHash.slice(0, 8)})`,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn {\n\t\tverified: true,\n\t\tmessage: \"HMAC Commitment Verified: Integrity intact.\",\n\t};\n}\n\n/**\n * Main worker entry point for Piscina.\n */\nexport default async function workerHandler(\n\ttask: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\ttry {\n\t\tif (task.action === \"warmup\") {\n\t\t\treturn {\n\t\t\t\tverified: true,\n\t\t\t\tmessage: \"warm\",\n\t\t\t};\n\t\t}\n\t\tif (task.action === \"verify_receipt\") {\n\t\t\treturn await verifyZkReceipt(task);\n\t\t}\n\t\tthrow new Error(\"Unknown action in ZkVerifier Worker.\");\n\t} catch (error) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Verification Error: ${(error as Error).message}`,\n\t\t};\n\t}\n}\n"]}