@nekzus/liop 2.4.0-alpha.21 → 2.4.0-alpha.23

package/dist/{chunk-5SWHE62F.js → chunk-T2QDHVUD.js}

@@ -1,8 +1,8 @@
 import { sanitizeOutput } from './chunk-Y62GORQF.js';
 import { LIOP_SCOPES, Dilithium65Wrapper, authorizeRequest } from './chunk-WPTOJYN5.js';
-import { GRPC_CHANNEL_OPTIONS, liopV1, createServerCredentials, TokenTelemetryEngine } from './chunk-UJFWPRDM.js';
-import { egressBlocksTotal, toolCallsTotal, fuelConsumed, wireEgressBytesTotal, wireSavedBytesTotal, toolCallErrorsTotal } from './chunk-PAICJCKJ.js';
-import { MeshNode } from './chunk-XRDN232O.js';
+import { GRPC_CHANNEL_OPTIONS, liopV1, createServerCredentials, TokenTelemetryEngine } from './chunk-GFGSHQN5.js';
+import { egressBlocksTotal, toolCallsTotal, fuelConsumed, wireEgressBytesTotal, wireSavedBytesTotal, toolCallErrorsTotal } from './chunk-Q3FKHJ3B.js';
+import { MeshNode } from './chunk-KB3HUVMD.js';
 import { log } from './chunk-K3DGJLUY.js';
 import { Buffer } from 'buffer';
 import * as crypto3 from 'crypto';
@@ -2810,11 +2810,18 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
     await this.meshNode.start();
     const meshNodeRef = this.meshNode;
     this.meshNode.registerManifestHandler(() => {
-      const tools = this.listTools().map((t) => ({
-        name: t.name,
-        description: t.description,
-        inputSchema: t.inputSchema
-      }));
+      const tools = this.listTools().map((t) => {
+        const entry = this.tools.get(t.name);
+        return {
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema,
+          zkMode: entry?.policy?.zkMode,
+          guestImageId: entry?.policy?.guestImageId ?? this.config?.guestImageId,
+          circuitName: entry?.policy?.circuitName,
+          vkey: entry?.policy?.vkey
+        };
+      });
       const resources = Array.from(this.resources.values()).map((r) => ({
         name: r.name,
         uri: r.uri,
@@ -2830,6 +2837,8 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
         serverInfo: this.serverInfo,
         authRequired: this.jwtValidator !== void 0,
         tokenSlug: this.config?.tokenSlug,
+        guestImageId: this.config?.guestImageId,
+        vkeys: this.config?.zkVkeys,
         taxonomy: this.config?.taxonomy ? {
           domain: this.config.taxonomy.domain || "Unknown Domain",
           clearanceTier: this.config.taxonomy.clearanceTier ?? 0,
@@ -3058,6 +3067,16 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               sensitivity: toolPolicy.dpSensitivity ?? 1,
               smallDatasetThreshold: toolPolicy.dpSmallDatasetThreshold ?? 50
             } : void 0;
+            let requestedProofMode = request.requested_proof_mode;
+            if (requestedProofMode === void 0 || requestedProofMode === 0 /* PROOF_MODE_LEGACY_HMAC */) {
+              if (toolPolicy?.zkMode === "required") {
+                requestedProofMode = 2 /* PROOF_MODE_ZK_BLOCKING */;
+              } else if (toolPolicy?.zkMode === "optimistic") {
+                requestedProofMode = 1 /* PROOF_MODE_ZK_OPTIMISTIC */;
+              } else {
+                requestedProofMode = 0 /* PROOF_MODE_LEGACY_HMAC */;
+              }
+            }
             const workerResponse = await this.workerPool.run({
               ciphertext: request.pqc_ciphertext,
               secretKeyObj: Array.from(session.kyber_sk),
@@ -3068,9 +3087,27 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               sessionToken: request.session_token,
               sessionTimestamp: session.createdAt,
               isEncrypted: true,
+              proofMode: requestedProofMode,
+              guestImageId: toolPolicy?.guestImageId ?? this.config?.guestImageId,
               dpConfig
               // Apply DP noise inside worker before ZK-Receipt commitment
             });
+            if (requestedProofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */) {
+              log.error(
+                `[LIOP-RPC] Enclave policy violation: Valid Groth16 zero-knowledge proof required but unavailable for ${toolName || "tool"}`
+              );
+              const errorResponse = {
+                semantic_evidence: "[LIOP-ZK] Clearance Tier 1 enclave policy violation: Valid Groth16 zero-knowledge proof required but unavailable.",
+                cryptographic_proof: Buffer.from(""),
+                zk_receipt: Buffer.from(""),
+                is_error: true,
+                proof_type: 0 /* PROOF_TYPE_HMAC_LEGACY */
+              };
+              call.write(errorResponse, () => {
+                call.end();
+              });
+              return;
+            }
             const sanitizedWorkerOutput = sanitizeOutput(workerResponse.output);
             let finalOutput;
             let validationOutput = sanitizedWorkerOutput;
@@ -3140,7 +3177,9 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
                 "hex"
               ),
               zk_receipt: workerResponse.zk_receipt ? Buffer.from(workerResponse.zk_receipt, "base64") : Buffer.from(""),
-              is_error: false
+              is_error: false,
+              proof_type: workerResponse.proof_type === 2 /* GROTH16 */ ? 2 /* PROOF_TYPE_GROTH16 */ : 0 /* PROOF_TYPE_HMAC_LEGACY */,
+              guest_image_id: workerResponse.guest_image_id || toolPolicy?.guestImageId || this.config?.guestImageId || ""
             };
             const violation = await this.piiScanner.scan(validationOutput);
             const aggregationViolation = this.violatesAggregationFirstPolicy(
@@ -3338,6 +3377,12 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
         sensitivity: dpPolicy.dpSensitivity ?? 1,
         smallDatasetThreshold: dpPolicy.dpSmallDatasetThreshold ?? 50
       } : void 0;
+      let proofMode = 0 /* PROOF_MODE_LEGACY_HMAC */;
+      if (dpPolicy?.zkMode === "required") {
+        proofMode = 2 /* PROOF_MODE_ZK_BLOCKING */;
+      } else if (dpPolicy?.zkMode === "optimistic") {
+        proofMode = 1 /* PROOF_MODE_ZK_OPTIMISTIC */;
+      }
       const workerResponse = await this.workerPool.run({
         ciphertext: new Uint8Array(0),
         secretKeyObj: Array.from(new Uint8Array(0)),
@@ -3348,15 +3393,30 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
         sessionToken: "local-dev-token",
         isEncrypted: false,
         // Use plaintext for local Logic-on-Origin injection
+        proofMode,
+        guestImageId: dpPolicy?.guestImageId ?? this.config?.guestImageId,
         dpConfig
         // Pass DP Config to apply inside worker before ZK-Receipt commitment
       });
+      if (proofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "[LIOP-ZK] Clearance Tier 1 enclave policy violation: Valid Groth16 zero-knowledge proof required but unavailable."
+            }
+          ],
+          isError: true
+        };
+      }
       const dpOutput = workerResponse.output;
       const sanitizedOutput = sanitizeOutput(dpOutput);
       const textOutput = JSON.stringify({
         computation_result: sanitizedOutput,
         image_id: workerResponse.image_id,
         zk_receipt: workerResponse.zk_receipt,
+        proof_type: workerResponse.proof_type === 2 /* GROTH16 */ ? "GROTH16" : "HMAC_LEGACY",
+        guest_image_id: workerResponse.guest_image_id,
         status: "Worker Pool Execution Success"
       });
       const content = [
@@ -3679,5 +3739,5 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
 };
 
 export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger };
-//# sourceMappingURL=chunk-5SWHE62F.js.map
-//# sourceMappingURL=chunk-5SWHE62F.js.map
+//# sourceMappingURL=chunk-T2QDHVUD.js.map
+//# sourceMappingURL=chunk-T2QDHVUD.js.map