@nekzus/liop 2.4.0-alpha.21 → 2.4.0-alpha.23

package/dist/{chunk-2KSO3W4A.js → chunk-YLFNJQI2.js}

@@ -73,5 +73,5 @@ var PromptSchema = z.object({
 });
 
 export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema, adaptResponseForLegacyClient, buildLegacyInitializeResponse, isLegacyRequest };
-//# sourceMappingURL=chunk-2KSO3W4A.js.map
-//# sourceMappingURL=chunk-2KSO3W4A.js.map
+//# sourceMappingURL=chunk-YLFNJQI2.js.map
+//# sourceMappingURL=chunk-YLFNJQI2.js.map

package/dist/{chunk-2KSO3W4A.js.map → chunk-YLFNJQI2.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/gateway/mcp-compat.ts","../src/types.ts"],"names":[],"mappings":";;;;;AAiBO,IAAM,0BAAA,GAA6B;AAKnC,IAAM,2BAAA,GAA8B;AAKpC,SAAS,6BAAA,CACf,YACA,EAAA,EACc;AACd,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,IAAI,EAAA,IAAM,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,MACP,eAAA,EAAiB,2BAAA;AAAA,MACjB,YAAA,EAAc;AAAA,QACb,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC3B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC/B,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA;AAAK,OAC9B;AAAA,MACA;AAAA;AACD,GACD;AACD;AAOO,SAAS,gBAAgB,OAAA,EAA8B;AAC7D,EAAA,IACC,OAAA,CAAQ,MAAA,KAAW,YAAA,IACnB,OAAA,CAAQ,WAAW,2BAAA,EAClB;AACD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,EAAA,MAAM,OAAO,MAAA,EAAQ,KAAA;AACrB,EAAA,MAAM,OAAA,GAAU,OAAO,yCAAyC,CAAA;AAEhE,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,2BAAA,EAA6B;AACxD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAA;AACR;AAMO,SAAS,6BACf,QAAA,EACc;AACd,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,IAAU,OAAO,QAAA,CAAS,WAAW,QAAA,EAAU;AAC5D,IAAA,OAAO,QAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAA,GAAY,EAAE,GAAI,QAAA,CAAS,MAAA,EAAmC;AAGpE,EAAA,OAAO,SAAA,CAAU,UAAA;AACjB,EAAA,OAAO,SAAA,CAAU,KAAA;AACjB,EAAA,OAAO,SAAA,CAAU,UAAA;AAEjB,EAAA,OAAO;AAAA,IACN,GAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT;AACD;;;ACpFO,IAAM,oBAAA,GAAuB;AAyD7B,IAAM,UAAA,GAAa,EAAE,MAAA,CAAO;AAAA,EAClC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,CAAA,CAAE,SAAS;AAAA;AAC9C,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,EAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EACpC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAW,CAAA,CACT,KAAA;AAAA,IACA,EAAE,MAAA,CAAO;AAAA,MACR,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,MACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAC/B;AAAA,IAED,QAAA;AACH,CAAC","file":"chunk-2KSO3W4A.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { McpRequest, McpResponse, ServerInfo } from \"../types.js\";\n\n/**\n * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.\n * Remove this file when MCP v1 (2025-11-25) reaches EOL.\n *\n * SUNSET INSTRUCTION: Delete this file, then grep for \"@mcp-legacy\" in the\n * codebase to find and remove all remaining legacy seams.\n */\n\n/**\n * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.\n * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.\n */\nexport const MCP_LEGACY_SUPPORT_ENABLED = true;\n\n/**\n * @mcp-legacy Legacy protocol version constant.\n */\nexport const MCP_PROTOCOL_VERSION_LEGACY = \"2025-11-25\" as const;\n\n/**\n * @mcp-legacy Build the legacy initialize handshake response.\n */\nexport function buildLegacyInitializeResponse(\n\tserverInfo: ServerInfo,\n\tid?: string | number | null,\n): McpResponse {\n\treturn {\n\t\tjsonrpc: \"2.0\",\n\t\tid: id ?? null,\n\t\tresult: {\n\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\tcapabilities: {\n\t\t\t\ttools: { listChanged: true },\n\t\t\t\tresources: { listChanged: true },\n\t\t\t\tprompts: { listChanged: true },\n\t\t\t},\n\t\t\tserverInfo,\n\t\t},\n\t};\n}\n\n/**\n * @mcp-legacy Detect if a request is strictly from a 2025-era legacy client.\n * Legacy requests either invoke 'initialize', 'notifications/initialized',\n * or lack modern '_meta' protocol envelopes.\n */\nexport function isLegacyRequest(request: McpRequest): boolean {\n\tif (\n\t\trequest.method === \"initialize\" ||\n\t\trequest.method === \"notifications/initialized\"\n\t) {\n\t\treturn true;\n\t}\n\n\tconst params = request.params as Record<string, unknown> | undefined;\n\tconst meta = params?._meta as Record<string, unknown> | undefined;\n\tconst version = meta?.[\"io.modelcontextprotocol/protocolVersion\"];\n\n\tif (!version || version === MCP_PROTOCOL_VERSION_LEGACY) {\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * @mcp-legacy Wrap and strip modern-era fields (resultType, ttlMs, cacheScope, etc.)\n * from a response to ensure 100% wire-compatibility with strict 2025 MCP clients.\n */\nexport function adaptResponseForLegacyClient(\n\tresponse: McpResponse,\n): McpResponse {\n\tif (!response.result || typeof response.result !== \"object\") {\n\t\treturn response;\n\t}\n\n\tconst rawResult = { ...(response.result as Record<string, unknown>) };\n\n\t// Strip modern-only envelope tags\n\tdelete rawResult.resultType;\n\tdelete rawResult.ttlMs;\n\tdelete rawResult.cacheScope;\n\n\treturn {\n\t\t...response,\n\t\tresult: rawResult,\n\t};\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from \"zod\";\n\n/**\n * Protocol Version Identifiers\n */\nexport const MCP_PROTOCOL_VERSION = \"2026-07-28\" as const;\n\nexport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"./gateway/mcp-compat.js\";\n\n/**\n * Protocol Era Classification\n */\nexport type McpEra = \"legacy\" | \"modern\";\n\n/**\n * Caching Hints for MCP 2026-07-28 Spec\n */\nexport interface CacheableResult {\n\tttlMs?: number;\n\tcacheScope?: \"public\" | \"private\";\n}\n\n/**\n * Multi-Round-Trip Requests (MRTR) Specification Types\n */\nexport interface InputRequest {\n\tid: string;\n\tmessage: string;\n\tschema?: Record<string, unknown>;\n}\n\nexport interface InputResponse {\n\tid: string;\n\tvalue: unknown;\n}\n\nexport interface InputRequiredResult {\n\tresultType: \"input_required\";\n\tinputRequests: InputRequest[];\n\trequestState?: string;\n}\n\n/**\n * Modern Envelope Metadata (_meta)\n */\nexport interface McpRequestMeta {\n\t\"io.modelcontextprotocol/protocolVersion\"?: string;\n\t\"io.modelcontextprotocol/clientInfo\"?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\t\"io.modelcontextprotocol/clientCapabilities\"?: Record<string, unknown>;\n\t[key: string]: unknown;\n}\n\n/**\n * Base Protocol Types representing parity with Model Context Protocol\n */\n\nexport const ToolSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tinputSchema: z.record(z.string(), z.unknown()), // Represents a JSON Schema\n});\n\nexport type Tool = z.infer<typeof ToolSchema>;\n\nexport const ResourceSchema = z.object({\n\turi: z.string(),\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tmimeType: z.string().optional(),\n});\n\nexport type Resource = z.infer<typeof ResourceSchema>;\n\nexport const PromptSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\targuments: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tdescription: z.string().optional(),\n\t\t\t\trequired: z.boolean().optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\nexport type Prompt = z.infer<typeof PromptSchema>;\n\nexport interface CallToolRequest {\n\tname: string;\n\targuments?: Record<string, unknown>;\n}\n\nexport interface CallToolResult {\n\tcontent: Array<{\n\t\ttype: \"text\" | \"image\" | \"resource\";\n\t\ttext?: string;\n\t\tdata?: string;\n\t\tmimeType?: string;\n\t\tresource?: {\n\t\t\turi: string;\n\t\t\ttext?: string;\n\t\t\tblob?: string;\n\t\t};\n\t}>;\n\tisError?: boolean;\n}\n\nexport interface GetPromptRequest {\n\tname: string;\n\targuments?: Record<string, string>;\n}\n\nexport interface GetPromptResult {\n\tdescription?: string;\n\tmessages: Array<{\n\t\trole: \"user\" | \"assistant\";\n\t\tcontent:\n\t\t\t| { type: \"text\"; text: string }\n\t\t\t| { type: \"image\"; data: string; mimeType: string }\n\t\t\t| {\n\t\t\t\t\ttype: \"resource\";\n\t\t\t\t\tresource: { uri: string; text?: string; blob?: string };\n\t\t\t  };\n\t}>;\n}\n\nexport interface ServerInfo {\n\tname: string;\n\tversion: string;\n\tcapabilities?: {\n\t\tprompts?: { listChanged?: boolean };\n\t\tresources?: { subscribe?: boolean; listChanged?: boolean };\n\t\ttools?: { listChanged?: boolean };\n\t\t/** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */\n\t\tlogging?: Record<string, unknown>;\n\t};\n}\n\nexport interface DiscoverResult {\n\tresultType: \"complete\";\n\tsupportedVersions: string[];\n\tcapabilities: ServerInfo[\"capabilities\"];\n\tserverInfo: ServerInfo;\n\tinstructions?: string;\n}\n\nexport interface McpRequest {\n\tmethod: string;\n\tparams?: unknown;\n\tid?: string | number | null;\n\tjsonrpc?: \"2.0\";\n}\n\nexport interface McpResponse {\n\tjsonrpc: \"2.0\";\n\tid?: string | number | null;\n\tresult?: unknown;\n\terror?: {\n\t\tcode: number;\n\t\tmessage: string;\n\t\tdata?: unknown;\n\t};\n}\n\n/**\n * Re-export Gateway Interceptor types for consumer convenience.\n */\nexport type {\n\tGatewayAdmissionResult,\n\tGatewayInterceptor,\n\tGatewayInterceptorContext,\n\tGatewayInterceptorOptions,\n} from \"./gateway/interceptor.js\";\nexport type { AuditInterceptor } from \"./interceptors/audit-interceptor.js\";\n/**\n * Re-export Log & Audit Interceptor types for consumer convenience.\n */\nexport type {\n\tLogEvent,\n\tLogInterceptor,\n} from \"./interceptors/log-interceptor.js\";\n/**\n * Re-export AuthInfo from the security module for convenience.\n * Compatible with MCP TypeScript SDK AuthInfo interface shape.\n */\nexport type { AuthInfo } from \"./security/jwt-validator.js\";\n"]}
+{"version":3,"sources":["../src/gateway/mcp-compat.ts","../src/types.ts"],"names":[],"mappings":";;;;;AAiBO,IAAM,0BAAA,GAA6B;AAKnC,IAAM,2BAAA,GAA8B;AAKpC,SAAS,6BAAA,CACf,YACA,EAAA,EACc;AACd,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,IAAI,EAAA,IAAM,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,MACP,eAAA,EAAiB,2BAAA;AAAA,MACjB,YAAA,EAAc;AAAA,QACb,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC3B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC/B,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA;AAAK,OAC9B;AAAA,MACA;AAAA;AACD,GACD;AACD;AAOO,SAAS,gBAAgB,OAAA,EAA8B;AAC7D,EAAA,IACC,OAAA,CAAQ,MAAA,KAAW,YAAA,IACnB,OAAA,CAAQ,WAAW,2BAAA,EAClB;AACD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,EAAA,MAAM,OAAO,MAAA,EAAQ,KAAA;AACrB,EAAA,MAAM,OAAA,GAAU,OAAO,yCAAyC,CAAA;AAEhE,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,2BAAA,EAA6B;AACxD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAA;AACR;AAMO,SAAS,6BACf,QAAA,EACc;AACd,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,IAAU,OAAO,QAAA,CAAS,WAAW,QAAA,EAAU;AAC5D,IAAA,OAAO,QAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAA,GAAY,EAAE,GAAI,QAAA,CAAS,MAAA,EAAmC;AAGpE,EAAA,OAAO,SAAA,CAAU,UAAA;AACjB,EAAA,OAAO,SAAA,CAAU,KAAA;AACjB,EAAA,OAAO,SAAA,CAAU,UAAA;AAEjB,EAAA,OAAO;AAAA,IACN,GAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT;AACD;;;ACpFO,IAAM,oBAAA,GAAuB;AAyD7B,IAAM,UAAA,GAAa,EAAE,MAAA,CAAO;AAAA,EAClC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,CAAA,CAAE,SAAS;AAAA;AAC9C,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,EAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EACpC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAW,CAAA,CACT,KAAA;AAAA,IACA,EAAE,MAAA,CAAO;AAAA,MACR,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,MACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAC/B;AAAA,IAED,QAAA;AACH,CAAC","file":"chunk-YLFNJQI2.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { McpRequest, McpResponse, ServerInfo } from \"../types.js\";\n\n/**\n * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.\n * Remove this file when MCP v1 (2025-11-25) reaches EOL.\n *\n * SUNSET INSTRUCTION: Delete this file, then grep for \"@mcp-legacy\" in the\n * codebase to find and remove all remaining legacy seams.\n */\n\n/**\n * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.\n * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.\n */\nexport const MCP_LEGACY_SUPPORT_ENABLED = true;\n\n/**\n * @mcp-legacy Legacy protocol version constant.\n */\nexport const MCP_PROTOCOL_VERSION_LEGACY = \"2025-11-25\" as const;\n\n/**\n * @mcp-legacy Build the legacy initialize handshake response.\n */\nexport function buildLegacyInitializeResponse(\n\tserverInfo: ServerInfo,\n\tid?: string | number | null,\n): McpResponse {\n\treturn {\n\t\tjsonrpc: \"2.0\",\n\t\tid: id ?? null,\n\t\tresult: {\n\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\tcapabilities: {\n\t\t\t\ttools: { listChanged: true },\n\t\t\t\tresources: { listChanged: true },\n\t\t\t\tprompts: { listChanged: true },\n\t\t\t},\n\t\t\tserverInfo,\n\t\t},\n\t};\n}\n\n/**\n * @mcp-legacy Detect if a request is strictly from a 2025-era legacy client.\n * Legacy requests either invoke 'initialize', 'notifications/initialized',\n * or lack modern '_meta' protocol envelopes.\n */\nexport function isLegacyRequest(request: McpRequest): boolean {\n\tif (\n\t\trequest.method === \"initialize\" ||\n\t\trequest.method === \"notifications/initialized\"\n\t) {\n\t\treturn true;\n\t}\n\n\tconst params = request.params as Record<string, unknown> | undefined;\n\tconst meta = params?._meta as Record<string, unknown> | undefined;\n\tconst version = meta?.[\"io.modelcontextprotocol/protocolVersion\"];\n\n\tif (!version || version === MCP_PROTOCOL_VERSION_LEGACY) {\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * @mcp-legacy Wrap and strip modern-era fields (resultType, ttlMs, cacheScope, etc.)\n * from a response to ensure 100% wire-compatibility with strict 2025 MCP clients.\n */\nexport function adaptResponseForLegacyClient(\n\tresponse: McpResponse,\n): McpResponse {\n\tif (!response.result || typeof response.result !== \"object\") {\n\t\treturn response;\n\t}\n\n\tconst rawResult = { ...(response.result as Record<string, unknown>) };\n\n\t// Strip modern-only envelope tags\n\tdelete rawResult.resultType;\n\tdelete rawResult.ttlMs;\n\tdelete rawResult.cacheScope;\n\n\treturn {\n\t\t...response,\n\t\tresult: rawResult,\n\t};\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from \"zod\";\n\n/**\n * Protocol Version Identifiers\n */\nexport const MCP_PROTOCOL_VERSION = \"2026-07-28\" as const;\n\nexport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"./gateway/mcp-compat.js\";\n\n/**\n * Protocol Era Classification\n */\nexport type McpEra = \"legacy\" | \"modern\";\n\n/**\n * Caching Hints for MCP 2026-07-28 Spec\n */\nexport interface CacheableResult {\n\tttlMs?: number;\n\tcacheScope?: \"public\" | \"private\";\n}\n\n/**\n * Multi-Round-Trip Requests (MRTR) Specification Types\n */\nexport interface InputRequest {\n\tid: string;\n\tmessage: string;\n\tschema?: Record<string, unknown>;\n}\n\nexport interface InputResponse {\n\tid: string;\n\tvalue: unknown;\n}\n\nexport interface InputRequiredResult {\n\tresultType: \"input_required\";\n\tinputRequests: InputRequest[];\n\trequestState?: string;\n}\n\n/**\n * Modern Envelope Metadata (_meta)\n */\nexport interface McpRequestMeta {\n\t\"io.modelcontextprotocol/protocolVersion\"?: string;\n\t\"io.modelcontextprotocol/clientInfo\"?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\t\"io.modelcontextprotocol/clientCapabilities\"?: Record<string, unknown>;\n\t[key: string]: unknown;\n}\n\n/**\n * Base Protocol Types representing parity with Model Context Protocol\n */\n\nexport const ToolSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tinputSchema: z.record(z.string(), z.unknown()), // Represents a JSON Schema\n});\n\nexport type Tool = z.infer<typeof ToolSchema>;\n\nexport const ResourceSchema = z.object({\n\turi: z.string(),\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tmimeType: z.string().optional(),\n});\n\nexport type Resource = z.infer<typeof ResourceSchema>;\n\nexport const PromptSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\targuments: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tdescription: z.string().optional(),\n\t\t\t\trequired: z.boolean().optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\nexport type Prompt = z.infer<typeof PromptSchema>;\n\nexport interface CallToolRequest {\n\tname: string;\n\targuments?: Record<string, unknown>;\n}\n\nexport interface CallToolResult {\n\tcontent: Array<{\n\t\ttype: \"text\" | \"image\" | \"resource\";\n\t\ttext?: string;\n\t\tdata?: string;\n\t\tmimeType?: string;\n\t\tresource?: {\n\t\t\turi: string;\n\t\t\ttext?: string;\n\t\t\tblob?: string;\n\t\t};\n\t}>;\n\tisError?: boolean;\n\tzkVerified?: boolean;\n\tzkProofType?: import(\"./security/zk.js\").ProofType;\n}\n\nexport interface GetPromptRequest {\n\tname: string;\n\targuments?: Record<string, string>;\n}\n\nexport interface GetPromptResult {\n\tdescription?: string;\n\tmessages: Array<{\n\t\trole: \"user\" | \"assistant\";\n\t\tcontent:\n\t\t\t| { type: \"text\"; text: string }\n\t\t\t| { type: \"image\"; data: string; mimeType: string }\n\t\t\t| {\n\t\t\t\t\ttype: \"resource\";\n\t\t\t\t\tresource: { uri: string; text?: string; blob?: string };\n\t\t\t  };\n\t}>;\n}\n\nexport interface ServerInfo {\n\tname: string;\n\tversion: string;\n\tcapabilities?: {\n\t\tprompts?: { listChanged?: boolean };\n\t\tresources?: { subscribe?: boolean; listChanged?: boolean };\n\t\ttools?: { listChanged?: boolean };\n\t\t/** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */\n\t\tlogging?: Record<string, unknown>;\n\t};\n}\n\nexport interface DiscoverResult {\n\tresultType: \"complete\";\n\tsupportedVersions: string[];\n\tcapabilities: ServerInfo[\"capabilities\"];\n\tserverInfo: ServerInfo;\n\tinstructions?: string;\n}\n\nexport interface McpRequest {\n\tmethod: string;\n\tparams?: unknown;\n\tid?: string | number | null;\n\tjsonrpc?: \"2.0\";\n}\n\nexport interface McpResponse {\n\tjsonrpc: \"2.0\";\n\tid?: string | number | null;\n\tresult?: unknown;\n\terror?: {\n\t\tcode: number;\n\t\tmessage: string;\n\t\tdata?: unknown;\n\t};\n}\n\n/**\n * Re-export Gateway Interceptor types for consumer convenience.\n */\nexport type {\n\tGatewayAdmissionResult,\n\tGatewayInterceptor,\n\tGatewayInterceptorContext,\n\tGatewayInterceptorOptions,\n} from \"./gateway/interceptor.js\";\nexport type { AuditInterceptor } from \"./interceptors/audit-interceptor.js\";\n/**\n * Re-export Log & Audit Interceptor types for consumer convenience.\n */\nexport type {\n\tLogEvent,\n\tLogInterceptor,\n} from \"./interceptors/log-interceptor.js\";\n/**\n * Re-export AuthInfo from the security module for convenience.\n * Compatible with MCP TypeScript SDK AuthInfo interface shape.\n */\nexport type { AuthInfo } from \"./security/jwt-validator.js\";\nexport type {\n\tZkJournalV2,\n\tZkPolicy,\n\tZkReceipt,\n} from \"./security/zk.js\";\n/**\n * Re-export Zero-Knowledge Proof & Verification types for consumer convenience.\n */\nexport {\n\tProofType,\n\tRECEIPT_VERSION_V1,\n\tRECEIPT_VERSION_V2,\n\tZK_JOURNAL_V2_SIZE,\n} from \"./security/zk.js\";\n"]}

package/dist/{chunk-2STZHJ24.js → chunk-ZRWNMP5L.js}

@@ -1,5 +1,5 @@
 import { deriveLogicImageDigest } from './chunk-IK7CGWAZ.js';
-import { zkVerificationDurationMs } from './chunk-PAICJCKJ.js';
+import { zkVkeyCacheSize, zkVerificationDurationMs, zkProofsByTypeTotal } from './chunk-Q3FKHJ3B.js';
 import { log } from './chunk-K3DGJLUY.js';
 import * as fs from 'fs';
 import { createRequire } from 'module';
@@ -12,6 +12,24 @@ var __dirname$1 = path.dirname(__filename$1);
 var LiopVerifier = class _LiopVerifier {
   // Singleton Worker Pool for heavy ZK verification
   static zkWorkerPool = null;
+  // Static registry of embedded verification keys for canonical circuits
+  static vkeyRegistry = /* @__PURE__ */ new Map();
+  /**
+   * Registers a verification key for a canonical analytical circuit.
+   */
+  static registerVKey(circuitName, vkeyRaw) {
+    _LiopVerifier.vkeyRegistry.set(circuitName, vkeyRaw);
+    try {
+      zkVkeyCacheSize.set(_LiopVerifier.vkeyRegistry.size);
+    } catch {
+    }
+  }
+  /**
+   * Retrieves a registered verification key by circuit name.
+   */
+  static getRegisteredVKey(circuitName) {
+    return _LiopVerifier.vkeyRegistry.get(circuitName);
+  }
   getZkPool() {
     if (!_LiopVerifier.zkWorkerPool) {
       const isTS = import.meta.url.endsWith(".ts");
@@ -54,29 +72,62 @@ var LiopVerifier = class _LiopVerifier {
   }
   /**
    * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.
+   * Supports both legacy positional arguments and structured options.
    *
    * @param logicPayload The raw WASM or JS logic that was sent to the provider.
    * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).
-   * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM.
+   * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM or Groth16.
+   * @param sessionSecretOrOptions Shared secret (Buffer) or structured VerifyZkOptions.
+   * @param expectedOutput Optional expected output value for anti-replay verification.
    */
-  async verifyZkReceipt(logicPayload, remoteImageIdHex, zkReceipt, sessionSecret, expectedOutput) {
+  async verifyZkReceipt(logicPayload, remoteImageIdHex, zkReceipt, sessionSecretOrOptions, expectedOutput) {
     const pool = this.getZkPool();
     if (!pool) throw new Error("Worker pool initialization failed");
+    let sessionSecret;
+    let actualExpectedOutput = expectedOutput;
+    let guestImageIdHex;
+    let vkeyRaw;
+    let zkPolicy;
+    if (Buffer.isBuffer(sessionSecretOrOptions)) {
+      sessionSecret = sessionSecretOrOptions;
+    } else if (sessionSecretOrOptions && typeof sessionSecretOrOptions === "object") {
+      sessionSecret = sessionSecretOrOptions.sessionSecret;
+      if (sessionSecretOrOptions.expectedOutput !== void 0) {
+        actualExpectedOutput = sessionSecretOrOptions.expectedOutput;
+      }
+      guestImageIdHex = sessionSecretOrOptions.guestImageIdHex;
+      vkeyRaw = sessionSecretOrOptions.vkeyRaw;
+      zkPolicy = sessionSecretOrOptions.zkPolicy;
+      if (!vkeyRaw && sessionSecretOrOptions.circuitName) {
+        vkeyRaw = _LiopVerifier.getRegisteredVKey(
+          sessionSecretOrOptions.circuitName
+        );
+      }
+    }
     const startTime = performance.now();
     const result = await pool.run({
       action: "verify_receipt",
       logicPayload: new Uint8Array(logicPayload),
       remoteImageIdHex,
+      guestImageIdHex,
       zkReceipt: new Uint8Array(zkReceipt),
       sessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : void 0,
-      expectedOutput
+      vkeyRaw: vkeyRaw ? new Uint8Array(vkeyRaw) : void 0,
+      expectedOutput: actualExpectedOutput,
+      zkPolicy
     });
     const durationMs = performance.now() - startTime;
     try {
       zkVerificationDurationMs.observe(
-        { status: result.verified ? "verified" : "failed" },
+        {
+          status: result.verified ? "verified" : "failed",
+          proof_type: result.proofType || "unknown"
+        },
         durationMs
       );
+      if (result.verified && result.proofType) {
+        zkProofsByTypeTotal.inc({ proof_type: result.proofType });
+      }
     } catch {
     }
     if (result.verified) {
@@ -110,5 +161,5 @@ var LiopVerifier = class _LiopVerifier {
 };
 
 export { LiopVerifier };
-//# sourceMappingURL=chunk-2STZHJ24.js.map
-//# sourceMappingURL=chunk-2STZHJ24.js.map
+//# sourceMappingURL=chunk-ZRWNMP5L.js.map
+//# sourceMappingURL=chunk-ZRWNMP5L.js.map

package/dist/chunk-ZRWNMP5L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crypto/verifier.ts"],"names":["__filename","__dirname"],"mappings":";;;;;;;;;AAgBA,IAAMA,YAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,WAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,YAAU,CAAA;AAkBlC,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA;AAAA,EAEzB,OAAe,YAAA,GAA+B,IAAA;AAAA;AAAA,EAE9C,OAAe,YAAA,mBAAe,IAAI,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA,EAKtD,OAAc,YAAA,CAAa,WAAA,EAAqB,OAAA,EAAuB;AACtE,IAAA,aAAA,CAAa,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,OAAO,CAAA;AAClD,IAAA,IAAI;AACH,MAAA,eAAA,CAAgB,GAAA,CAAI,aAAA,CAAa,YAAA,CAAa,IAAI,CAAA;AAAA,IACnD,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAKA,OAAc,kBAAkB,WAAA,EAAyC;AACxE,IAAA,OAAO,aAAA,CAAa,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA;AAAA,EACjD;AAAA,EAEQ,SAAA,GAAY;AACnB,IAAA,IAAI,CAAC,cAAa,YAAA,EAAc;AAC/B,MAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA,CAAY,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAC3C,MAAA,MAAM,SAAA,GAAY,OAAO,KAAA,GAAQ,KAAA;AAEjC,MAAA,IAAI,WAAqB,EAAC;AAC1B,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACzC,UAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,kBAAkB,CAAA;AAC7C,UAAA,MAAM,WAAA,GAAc,aAAA;AAAA,YACnB,KAAK,IAAA,CAAK,IAAA,CAAK,QAAQ,MAAM,CAAA,EAAG,QAAQ,YAAY;AAAA,WACrD,CAAE,IAAA;AACF,UAAA,QAAA,GAAW,CAAC,YAAY,WAAW,CAAA;AAAA,QACpC,SAAS,EAAA,EAAI;AACZ,UAAA,QAAA,GAAW,CAAC,YAAY,KAAK,CAAA;AAAA,QAC9B;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QACnB,IAAA,CAAK,OAAA,CAAQC,WAAA,EAAW,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAE,CAAA;AAAA;AAAA,QAC3D,IAAA,CAAK,OAAA,CAAQA,WAAA,EAAW,CAAA,sBAAA,EAAyB,SAAS,CAAA,CAAE;AAAA;AAAA,OAC7D;AAEA,MAAA,MAAM,cAAA,GACL,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAS,cAAW,CAAC,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA;AAE3D,MAAA,aAAA,CAAa,YAAA,GAAe,IAAI,OAAA,CAAQ;AAAA,QACvC,QAAA,EAAU,cAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY,CAAA;AAAA;AAAA,QACZ,WAAA,EAAa,GAAA;AAAA,QACb;AAAA,OACA,CAAA;AAGD,MAAA,aAAA,CAAa,YAAA,CAAa,IAAI,EAAE,MAAA,EAAQ,UAAU,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAClE,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,CAAA,sDAAA,EAAyD,IAAI,OAAO,CAAA;AAAA,SACrE;AAAA,MACD,CAAC,CAAA;AAAA,IACF;AACA,IAAA,OAAO,aAAA,CAAa,YAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,eAAA,CACZ,YAAA,EACA,gBAAA,EACA,SAAA,EACA,wBACA,cAAA,EACmB;AACnB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAE9D,IAAA,IAAI,aAAA;AACJ,IAAA,IAAI,oBAAA,GAAgC,cAAA;AACpC,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,QAAA;AAEJ,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,sBAAsB,CAAA,EAAG;AAC5C,MAAA,aAAA,GAAgB,sBAAA;AAAA,IACjB,CAAA,MAAA,IACC,sBAAA,IACA,OAAO,sBAAA,KAA2B,QAAA,EACjC;AACD,MAAA,aAAA,GAAgB,sBAAA,CAAuB,aAAA;AACvC,MAAA,IAAI,sBAAA,CAAuB,mBAAmB,MAAA,EAAW;AACxD,QAAA,oBAAA,GAAuB,sBAAA,CAAuB,cAAA;AAAA,MAC/C;AACA,MAAA,eAAA,GAAkB,sBAAA,CAAuB,eAAA;AACzC,MAAA,OAAA,GAAU,sBAAA,CAAuB,OAAA;AACjC,MAAA,QAAA,GAAW,sBAAA,CAAuB,QAAA;AAElC,MAAA,IAAI,CAAC,OAAA,IAAW,sBAAA,CAAuB,WAAA,EAAa;AACnD,QAAA,OAAA,GAAU,aAAA,CAAa,iBAAA;AAAA,UACtB,sBAAA,CAAuB;AAAA,SACxB;AAAA,MACD;AAAA,IACD;AAEA,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI;AAAA,MAC7B,MAAA,EAAQ,gBAAA;AAAA,MACR,YAAA,EAAc,IAAI,UAAA,CAAW,YAAY,CAAA;AAAA,MACzC,gBAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA,EAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AAAA,MACnC,aAAA,EAAe,aAAA,GAAgB,IAAI,UAAA,CAAW,aAAa,CAAA,GAAI,MAAA;AAAA,MAC/D,OAAA,EAAS,OAAA,GAAU,IAAI,UAAA,CAAW,OAAO,CAAA,GAAI,MAAA;AAAA,MAC7C,cAAA,EAAgB,oBAAA;AAAA,MAChB;AAAA,KACA,CAAA;AACD,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAEvC,IAAA,IAAI;AACH,MAAA,wBAAA,CAAyB,OAAA;AAAA,QACxB;AAAA,UACC,MAAA,EAAQ,MAAA,CAAO,QAAA,GAAW,UAAA,GAAa,QAAA;AAAA,UACvC,UAAA,EAAY,OAAO,SAAA,IAAa;AAAA,SACjC;AAAA,QACA;AAAA,OACD;AACA,MAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,SAAA,EAAW;AACxC,QAAA,mBAAA,CAAoB,GAAA,CAAI,EAAE,UAAA,EAAY,MAAA,CAAO,WAAW,CAAA;AAAA,MACzD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,OAAO,QAAA,EAAU;AACpB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,qBACZ,iBAAA,EACmB;AACnB,IAAA,IAAI,iBAAA,CAAkB,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE3C,IAAA,IAAI;AAKH,MAAA,GAAA,CAAI,KAAK,yDAAyD,CAAA;AAClE,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,GAAA,EAAK;AACb,MAAA,GAAA,CAAI,KAAA,CAAM,2CAA2C,GAAG,CAAA;AACxD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,YAAA,EAA8B;AAClD,IAAA,OAAO,uBAAuB,YAAY,CAAA;AAAA,EAC3C;AACD","file":"chunk-ZRWNMP5L.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Piscina } from \"piscina\";\nimport {\n\tzkProofsByTypeTotal,\n\tzkVerificationDurationMs,\n\tzkVkeyCacheSize,\n} from \"../observability/metrics.js\";\nimport { log } from \"../utils/logger.js\";\nimport { deriveLogicImageDigest } from \"./logic-image-id.js\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nexport interface VerifyZkOptions {\n\tsessionSecret?: Buffer;\n\texpectedOutput?: unknown;\n\tguestImageIdHex?: string;\n\tvkeyRaw?: Buffer;\n\tzkPolicy?: import(\"../security/zk.js\").ZkPolicy;\n\tcircuitName?: string;\n}\n\n/**\n * LIOP Tier-0 Industrial Verifier\n *\n * This engine is responsible for the trustless verification of remote logic execution.\n * It validates both the integrity of the code (ZkImageID) and the mathematical proof\n * of its execution (ZkSeal/Groth16), as well as hardware-level attestation (TEE).\n */\nexport class LiopVerifier {\n\t// Singleton Worker Pool for heavy ZK verification\n\tprivate static zkWorkerPool: Piscina | null = null;\n\t// Static registry of embedded verification keys for canonical circuits\n\tprivate static vkeyRegistry = new Map<string, Buffer>();\n\n\t/**\n\t * Registers a verification key for a canonical analytical circuit.\n\t */\n\tpublic static registerVKey(circuitName: string, vkeyRaw: Buffer): void {\n\t\tLiopVerifier.vkeyRegistry.set(circuitName, vkeyRaw);\n\t\ttry {\n\t\t\tzkVkeyCacheSize.set(LiopVerifier.vkeyRegistry.size);\n\t\t} catch {}\n\t}\n\n\t/**\n\t * Retrieves a registered verification key by circuit name.\n\t */\n\tpublic static getRegisteredVKey(circuitName: string): Buffer | undefined {\n\t\treturn LiopVerifier.vkeyRegistry.get(circuitName);\n\t}\n\n\tprivate getZkPool() {\n\t\tif (!LiopVerifier.zkWorkerPool) {\n\t\t\tconst isTS = import.meta.url.endsWith(\".ts\");\n\t\t\tconst workerExt = isTS ? \".ts\" : \".js\";\n\n\t\t\tlet execArgv: string[] = [];\n\t\t\tif (isTS) {\n\t\t\t\ttry {\n\t\t\t\t\tconst req = createRequire(import.meta.url);\n\t\t\t\t\tconst tsxPkg = req.resolve(\"tsx/package.json\");\n\t\t\t\t\tconst absoluteTsx = pathToFileURL(\n\t\t\t\t\t\tpath.join(path.dirname(tsxPkg), \"dist\", \"loader.mjs\"),\n\t\t\t\t\t).href;\n\t\t\t\t\texecArgv = [\"--import\", absoluteTsx];\n\t\t\t\t} catch (_e) {\n\t\t\t\t\texecArgv = [\"--import\", \"tsx\"];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Support both flat dist/ and original src/ structure\n\t\t\tconst workerPaths = [\n\t\t\t\tpath.resolve(__dirname, `./workers/zk-verifier${workerExt}`), // Flat dist/ (tsup)\n\t\t\t\tpath.resolve(__dirname, `../workers/zk-verifier${workerExt}`), // Original src/\n\t\t\t];\n\n\t\t\tconst workerFilename =\n\t\t\t\tworkerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];\n\n\t\t\tLiopVerifier.zkWorkerPool = new Piscina({\n\t\t\t\tfilename: workerFilename,\n\t\t\t\tminThreads: 1,\n\t\t\t\tmaxThreads: 2, // Minimal footprint since verification is fast compared to generation\n\t\t\t\tidleTimeout: 30000,\n\t\t\t\texecArgv,\n\t\t\t});\n\n\t\t\t// Pre-warm the verification worker\n\t\t\tLiopVerifier.zkWorkerPool.run({ action: \"warmup\" }).catch((err) => {\n\t\t\t\tlog.debug(\n\t\t\t\t\t`[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`,\n\t\t\t\t);\n\t\t\t});\n\t\t}\n\t\treturn LiopVerifier.zkWorkerPool;\n\t}\n\n\t/**\n\t * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.\n\t * Supports both legacy positional arguments and structured options.\n\t *\n\t * @param logicPayload The raw WASM or JS logic that was sent to the provider.\n\t * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).\n\t * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM or Groth16.\n\t * @param sessionSecretOrOptions Shared secret (Buffer) or structured VerifyZkOptions.\n\t * @param expectedOutput Optional expected output value for anti-replay verification.\n\t */\n\tpublic async verifyZkReceipt(\n\t\tlogicPayload: Buffer,\n\t\tremoteImageIdHex: string,\n\t\tzkReceipt: Buffer,\n\t\tsessionSecretOrOptions?: Buffer | VerifyZkOptions,\n\t\texpectedOutput?: unknown,\n\t): Promise<boolean> {\n\t\tconst pool = this.getZkPool();\n\t\tif (!pool) throw new Error(\"Worker pool initialization failed\");\n\n\t\tlet sessionSecret: Buffer | undefined;\n\t\tlet actualExpectedOutput: unknown = expectedOutput;\n\t\tlet guestImageIdHex: string | undefined;\n\t\tlet vkeyRaw: Buffer | undefined;\n\t\tlet zkPolicy: import(\"../security/zk.js\").ZkPolicy | undefined;\n\n\t\tif (Buffer.isBuffer(sessionSecretOrOptions)) {\n\t\t\tsessionSecret = sessionSecretOrOptions;\n\t\t} else if (\n\t\t\tsessionSecretOrOptions &&\n\t\t\ttypeof sessionSecretOrOptions === \"object\"\n\t\t) {\n\t\t\tsessionSecret = sessionSecretOrOptions.sessionSecret;\n\t\t\tif (sessionSecretOrOptions.expectedOutput !== undefined) {\n\t\t\t\tactualExpectedOutput = sessionSecretOrOptions.expectedOutput;\n\t\t\t}\n\t\t\tguestImageIdHex = sessionSecretOrOptions.guestImageIdHex;\n\t\t\tvkeyRaw = sessionSecretOrOptions.vkeyRaw;\n\t\t\tzkPolicy = sessionSecretOrOptions.zkPolicy;\n\n\t\t\tif (!vkeyRaw && sessionSecretOrOptions.circuitName) {\n\t\t\t\tvkeyRaw = LiopVerifier.getRegisteredVKey(\n\t\t\t\t\tsessionSecretOrOptions.circuitName,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tconst startTime = performance.now();\n\t\tconst result = await pool.run({\n\t\t\taction: \"verify_receipt\",\n\t\t\tlogicPayload: new Uint8Array(logicPayload),\n\t\t\tremoteImageIdHex,\n\t\t\tguestImageIdHex,\n\t\t\tzkReceipt: new Uint8Array(zkReceipt),\n\t\t\tsessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : undefined,\n\t\t\tvkeyRaw: vkeyRaw ? new Uint8Array(vkeyRaw) : undefined,\n\t\t\texpectedOutput: actualExpectedOutput,\n\t\t\tzkPolicy,\n\t\t});\n\t\tconst durationMs = performance.now() - startTime;\n\n\t\ttry {\n\t\t\tzkVerificationDurationMs.observe(\n\t\t\t\t{\n\t\t\t\t\tstatus: result.verified ? \"verified\" : \"failed\",\n\t\t\t\t\tproof_type: result.proofType || \"unknown\",\n\t\t\t\t},\n\t\t\t\tdurationMs,\n\t\t\t);\n\t\t\tif (result.verified && result.proofType) {\n\t\t\t\tzkProofsByTypeTotal.inc({ proof_type: result.proofType });\n\t\t\t}\n\t\t} catch {\n\t\t\t// Metrics observation failure must never disrupt cryptographic verification\n\t\t}\n\n\t\tif (result.verified) {\n\t\t\tlog.info(`[LiopVerifier] ${result.message}`);\n\t\t\treturn true;\n\t\t}\n\n\t\tlog.error(`[LiopVerifier] FAILED: ${result.message}`);\n\t\treturn false;\n\t}\n\n\t/**\n\t * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).\n\t *\n\t * @param attestationReport The COSE-signed attestation document from the hardware.\n\t */\n\tpublic async verifyTeeAttestation(\n\t\tattestationReport: Buffer,\n\t): Promise<boolean> {\n\t\tif (attestationReport.length === 0) return true; // Optional in Mesh Alpha\n\n\t\ttry {\n\t\t\t// Architecture for AWS Nitro Enclaves:\n\t\t\t// 1. Decode CBOR/COSE\n\t\t\t// 2. Verify Signature against AWS Nitro Root CA\n\t\t\t// 3. Compare PCRs\n\t\t\tlog.info(\"[LiopVerifier] TEE Attestation: Not configured (no-op).\");\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tlog.error(\"[LiopVerifier] TEE Verification Failed:\", err);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Derives the ImageID of a logic payload following the LIOP v1 Standard.\n\t */\n\tpublic deriveImageId(logicPayload: Buffer): Buffer {\n\t\treturn deriveLogicImageDigest(logicPayload);\n\t}\n}\n"]}

package/dist/client.d.ts

@@ -1,7 +1,8 @@
-import './verifier-COnid_dg.js';
-import './node-B0b2vUFS.js';
-export { c as LiopClient } from './index-BuEQtBHD.js';
-import './types-CzRSOlOo.js';
+import './verifier-DTn1LXDU.js';
+import './node-Djzm6UYd.js';
+export { c as LiopClient } from './index-DDwiS7tf.js';
+import './zk-CYImPsa6.js';
+import './types-rxL19f0l.js';
 import '@grpc/grpc-js';
 import 'node:events';
 import 'zod';

package/dist/client.js

@@ -1,12 +1,13 @@
-export { LiopClient } from './chunk-FCFTYOAS.js';
+export { LiopClient } from './chunk-3WKFZQ34.js';
 import './chunk-3QH44NKZ.js';
-import './chunk-2STZHJ24.js';
+import './chunk-ZRWNMP5L.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
-import './chunk-UJFWPRDM.js';
-import './chunk-PAICJCKJ.js';
-import './chunk-2KSO3W4A.js';
-import './chunk-XRDN232O.js';
+import './chunk-GFGSHQN5.js';
+import './chunk-Q3FKHJ3B.js';
+import './chunk-YLFNJQI2.js';
+import './chunk-P34HDRN5.js';
+import './chunk-KB3HUVMD.js';
 import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,7 +1,8 @@
-import './node-B0b2vUFS.js';
-import './index-CdW8j8Bn.js';
-import './types-CzRSOlOo.js';
-export { L as LiopHybridGateway } from './hybrid-DWe1bMoV.js';
+import './node-Djzm6UYd.js';
+import './index-D2P6Z_hP.js';
+import './types-rxL19f0l.js';
+export { L as LiopHybridGateway } from './hybrid-B7EjCj3q.js';
 import 'zod';
+import './zk-CYImPsa6.js';
 import 'jose';
-import './verifier-COnid_dg.js';
+import './verifier-DTn1LXDU.js';

package/dist/gateway.js

@@ -1,12 +1,13 @@
-export { LiopHybridGateway } from './chunk-EJ426URA.js';
-import './chunk-VRB5HUYU.js';
-import './chunk-2STZHJ24.js';
+export { LiopHybridGateway } from './chunk-E7RSX476.js';
+import './chunk-AMSFSS2I.js';
+import './chunk-ZRWNMP5L.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
 import './chunk-WPTOJYN5.js';
-import './chunk-UJFWPRDM.js';
-import './chunk-PAICJCKJ.js';
-import './chunk-2KSO3W4A.js';
+import './chunk-GFGSHQN5.js';
+import './chunk-Q3FKHJ3B.js';
+import './chunk-YLFNJQI2.js';
+import './chunk-P34HDRN5.js';
 import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/{hybrid-DWe1bMoV.d.ts → hybrid-B7EjCj3q.d.ts}

@@ -1,7 +1,7 @@
-import { a as MeshNode } from './node-B0b2vUFS.js';
-import { L as LiopServer } from './index-CdW8j8Bn.js';
-import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-CzRSOlOo.js';
-import { L as LiopVerifier } from './verifier-COnid_dg.js';
+import { a as MeshNode } from './node-Djzm6UYd.js';
+import { L as LiopServer } from './index-D2P6Z_hP.js';
+import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-rxL19f0l.js';
+import { L as LiopVerifier } from './verifier-DTn1LXDU.js';
 
 /**
  * LIOP Sliding-Window Rate Limiter

package/dist/{index-CdW8j8Bn.d.ts → index-D2P6Z_hP.d.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { M as MeshNodeConfig, a as MeshNode } from './node-B0b2vUFS.js';
-import { d as AuditLogger, J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, e as GetPromptRequest, f as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-CzRSOlOo.js';
+import { M as MeshNodeConfig, a as MeshNode } from './node-Djzm6UYd.js';
+import { d as AuditLogger, J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, e as GetPromptRequest, f as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-rxL19f0l.js';
 
 /**
  * LIOP OAuth 2.1 Hybrid Auth — Configuration Types
@@ -281,6 +281,10 @@ interface LiopServerOptions {
      * Path to a shared JSON file for persistent Query Budget tracking across multiple server instances.
      */
     budgetStorePath?: string;
+    /** Expected guest image identifier hash for sovereign enclaves (Hex) */
+    guestImageId?: string;
+    /** Static verification key mappings for fast-path analytical circuits */
+    zkVkeys?: Record<string, unknown>;
 }
 interface AggregationPolicy {
     /** Maximum number of object-type array elements allowed (default: 10) */
@@ -331,6 +335,25 @@ interface LogicExecutionPolicy {
      * Path to a shared JSON file for persistent Query Budget tracking across multiple server instances.
      */
     budgetStorePath?: string;
+    /**
+     * Zero-Knowledge proof mode required for this tool capability.
+     * - "none": standard HMAC-SHA256 session commitment
+     * - "optimistic": Groth16 v2 receipt generated if prover available, otherwise fallback
+     * - "required": strictly enforces Groth16 v2 proof generation; rejects if unavailable
+     */
+    zkMode?: "none" | "optimistic" | "required";
+    /**
+     * Optional custom guest image identifier hash for this capability.
+     */
+    guestImageId?: string;
+    /**
+     * Name of the designated R1CS circuit (e.g. "sum", "count", "average", "filter").
+     */
+    circuitName?: string;
+    /**
+     * Static verification key JSON structure for this capability.
+     */
+    vkey?: Record<string, unknown>;
 }
 declare class LiopServer {
     private serverInfo;

package/dist/{index-BuEQtBHD.d.ts → index-DDwiS7tf.d.ts}

@@ -1,8 +1,9 @@
-import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { M as MeshNodeConfig } from './node-B0b2vUFS.js';
+import { L as LiopVerifier } from './verifier-DTn1LXDU.js';
+import { M as MeshNodeConfig } from './node-Djzm6UYd.js';
 import * as grpc from '@grpc/grpc-js';
 import { EventEmitter } from 'node:events';
-import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-CzRSOlOo.js';
+import { Z as ZkPolicy } from './zk-CYImPsa6.js';
+import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-rxL19f0l.js';
 
 interface CertManagerOptions {
     /** Path to the root CA certificate (PEM format) */
@@ -166,7 +167,10 @@ declare class LiopClient {
     /**
      * Invokes a tool.
      */
-    callTool(request: CallToolRequest, _wasmPayload?: Buffer): Promise<CallToolResult>;
+    callTool(request: CallToolRequest, _wasmPayload?: Buffer, options?: {
+        zkPolicy?: ZkPolicy;
+        circuitName?: string;
+    }): Promise<CallToolResult>;
     private getOrCreateRpcClient;
     /**
      * Reads a specific resource by URI.

package/dist/index.d.ts

@@ -1,21 +1,48 @@
 export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOptions } from './bridge.js';
-import { L as LiopTlsOptions } from './index-BuEQtBHD.js';
-export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient, d as createChannelCredentials, e as createServerCredentials } from './index-BuEQtBHD.js';
+import { L as LiopTlsOptions } from './index-DDwiS7tf.js';
+export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient, d as createChannelCredentials, e as createServerCredentials } from './index-DDwiS7tf.js';
+import { ProofWithSignals, VerificationKey } from 'micro-zk-proofs';
+export { ProofWithSignals, VerificationKey } from 'micro-zk-proofs';
 import * as http from 'node:http';
-export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-DWe1bMoV.js';
-import { A as AuthInfo } from './types-CzRSOlOo.js';
-export { g as AuditEntry, h as AuditInterceptor, d as AuditLogger, i as AuditRecordParams, j as AuditStatus, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, l as GENESIS_HASH, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, J as JwtValidator, L as LiopLogger, r as LogEvent, s as LogInterceptor, t as LogLevel, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema, E as computeEntryHash, F as executeGatewayInterceptor, H as globalAuditLogger, K as log } from './types-CzRSOlOo.js';
-export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-B0b2vUFS.js';
+export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-B7EjCj3q.js';
+import { A as AuthInfo } from './types-rxL19f0l.js';
+export { g as AuditEntry, h as AuditInterceptor, d as AuditLogger, i as AuditRecordParams, j as AuditStatus, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, l as GENESIS_HASH, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, J as JwtValidator, L as LiopLogger, r as LogEvent, s as LogInterceptor, t as LogLevel, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema, E as computeEntryHash, F as executeGatewayInterceptor, H as globalAuditLogger, K as log } from './types-rxL19f0l.js';
+export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-Djzm6UYd.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-CdW8j8Bn.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-D2P6Z_hP.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
+export { D as DecodedReceipt, P as ProofType, R as RECEIPT_VERSION_V1, a as RECEIPT_VERSION_V2, b as ZK_JOURNAL_V2_SIZE, c as ZkJournalV2, Z as ZkPolicy, d as ZkReceipt, e as ZkVerificationError, f as ZkVerifier, g as decodeJournalV2, h as encodeJournalV2, r as receiptCodec } from './zk-CYImPsa6.js';
 import '@modelcontextprotocol/sdk/server/mcp.js';
 import 'zod';
-import './verifier-COnid_dg.js';
+import './verifier-DTn1LXDU.js';
 import 'node:events';
 
+declare const VERIFICATION_LATENCY_BUDGET_MS = 250;
+
+/**
+ * Verifies a Groth16 Zero-Knowledge proof against a verification key.
+ * Traps curve validation errors gracefully to ensure safe verification.
+ */
+declare function verifyGroth16Proof(vkey: VerificationKey, proofWithSignals: ProofWithSignals): boolean;
+/**
+ * Serializes a VerificationKey into a Buffer.
+ */
+declare function serializeVKey(vkey: VerificationKey): Buffer;
+/**
+ * Deserializes a Buffer into a typed VerificationKey.
+ */
+declare function deserializeVKey(buf: Buffer): VerificationKey;
+/**
+ * Serializes a ProofWithSignals into a Buffer.
+ */
+declare function serializeGrothProof(proofWithSignals: ProofWithSignals): Buffer;
+/**
+ * Deserializes a Buffer into a typed ProofWithSignals.
+ */
+declare function deserializeGrothProof(buf: Buffer): ProofWithSignals;
+
 /**
  * TokenEstimator — Pluggable strategy for counting tokens in text content.
  *
@@ -322,6 +349,9 @@ declare const manifestCacheSize: Gauge;
 declare const egressBlocksTotal: Counter;
 declare const zkVerificationDurationMs: Histogram;
 declare const zkVerificationsTotal: Counter;
+declare const zkProofsByTypeTotal: Counter;
+declare const zkProvingDurationMs: Histogram;
+declare const zkVkeyCacheSize: Gauge;
 declare const tokensInputTotal: Counter;
 declare const tokensOutputTotal: Counter;
 declare const tokensSavedTotal: Counter;
@@ -389,6 +419,15 @@ declare const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>>;
  * TypeScript interfaces reflecting liop_core.proto (LIOP v1)
  * Optimized for logic-on-origin and high-performance serialization.
  */
+declare enum ProofMode {
+    PROOF_MODE_LEGACY_HMAC = 0,
+    PROOF_MODE_ZK_OPTIMISTIC = 1,
+    PROOF_MODE_ZK_BLOCKING = 2
+}
+declare enum ProofType {
+    PROOF_TYPE_HMAC_LEGACY = 0,
+    PROOF_TYPE_GROTH16 = 2
+}
 interface IntentRequest {
     agent_did: string;
     capability_hash: string;
@@ -406,12 +445,15 @@ interface LogicRequest {
     inputs: Record<string, Uint8Array>;
     pqc_ciphertext: Uint8Array;
     aes_nonce: Uint8Array;
+    requested_proof_mode?: ProofMode;
 }
 interface LogicResponse {
     semantic_evidence: string;
     cryptographic_proof: Uint8Array;
     zk_receipt: Uint8Array;
     is_error: boolean;
+    proof_type?: ProofType;
+    guest_image_id?: Uint8Array;
 }
 
 type TokenProvider = string | (() => Promise<string | undefined> | string | undefined);
@@ -807,4 +849,4 @@ declare function authorizeRequest(method: string, auth: AuthInfo | null, additio
 declare const LIOP_SCOPES: readonly ["liop:tools:list", "liop:tools:call", "liop:resources:read", "liop:schema:read", "liop:mesh:query"];
 type LiopScope = (typeof LIOP_SCOPES)[number];
 
-export { type AIProvider, AesGcmWrapper, AuthInfo, Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, ErrorCode, GRPC_CHANNEL_OPTIONS, GRPC_WEB_CONSTANTS, type GatewayTopologyInfo, Gauge, type GrpcWebFrame, HeuristicTokenEstimator, Histogram, Kyber768Wrapper, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type LiopSpan, LiopTlsOptions, LiopTracer, type MeshTopologyInfo, type MetricDefinition, type MetricLabels, MetricsRegistry, type PromptConfig, RealTokenEstimator, RoutingTable, type SandboxConfig, type SpanContext, type TokenEstimator, TokenManager, type TokenManagerOptions, type TokenOperationMetric, type TokenProvider, type TokenSessionReport, TokenTelemetryEngine, type ToolDefinition, type ToolRoute, type ToolTokenBreakdown, type TopologyProbeOptions, type TopologyProbeResult, type TransportProvider, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, calculateAstInstructionFuel, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, decodeFrames, defaultTracer, dispatchGrpcWebRequest, egressBlocksTotal, encodeDataFrame, encodeTrailerFrame, fuelConsumed, generateSystemInstructions, getDefaultEnvironment, isGrpcWebRequest, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, probeTopology, protocolMetrics, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, wireEgressBytesTotal, wireSavedBytesTotal, zkVerificationDurationMs, zkVerificationsTotal };
+export { type AIProvider, AesGcmWrapper, AuthInfo, Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, ErrorCode, GRPC_CHANNEL_OPTIONS, GRPC_WEB_CONSTANTS, type GatewayTopologyInfo, Gauge, type GrpcWebFrame, HeuristicTokenEstimator, Histogram, Kyber768Wrapper, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type LiopSpan, LiopTlsOptions, LiopTracer, type MeshTopologyInfo, type MetricDefinition, type MetricLabels, MetricsRegistry, type PromptConfig, RealTokenEstimator, RoutingTable, type SandboxConfig, type SpanContext, type TokenEstimator, TokenManager, type TokenManagerOptions, type TokenOperationMetric, type TokenProvider, type TokenSessionReport, TokenTelemetryEngine, type ToolDefinition, type ToolRoute, type ToolTokenBreakdown, type TopologyProbeOptions, type TopologyProbeResult, type TransportProvider, VERIFICATION_LATENCY_BUDGET_MS, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, calculateAstInstructionFuel, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, decodeFrames, defaultTracer, deserializeGrothProof, deserializeVKey, dispatchGrpcWebRequest, egressBlocksTotal, encodeDataFrame, encodeTrailerFrame, fuelConsumed, generateSystemInstructions, getDefaultEnvironment, isGrpcWebRequest, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, probeTopology, protocolMetrics, serializeGrothProof, serializeVKey, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, verifyGroth16Proof, wireEgressBytesTotal, wireSavedBytesTotal, zkProofsByTypeTotal, zkProvingDurationMs, zkVerificationDurationMs, zkVerificationsTotal, zkVkeyCacheSize };

package/dist/index.js

@@ -1,21 +1,23 @@
 export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-7BSCUYUE.js';
-export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-FCFTYOAS.js';
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-VRDZ5IKE.js';
-export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest } from './chunk-EJ426URA.js';
+export { VERIFICATION_LATENCY_BUDGET_MS, deserializeGrothProof, deserializeVKey, serializeGrothProof, serializeVKey, verifyGroth16Proof } from './chunk-OHMZZMMC.js';
+export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-3WKFZQ34.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-E2CFIWD6.js';
+export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest } from './chunk-E7RSX476.js';
 export { RoutingTable, probeTopology } from './chunk-PUDETPL4.js';
 export { TokenManager } from './chunk-3QH44NKZ.js';
-export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-5SWHE62F.js';
+export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-T2QDHVUD.js';
 export { sanitizeOutput } from './chunk-Y62GORQF.js';
-export { LiopMcpRouter } from './chunk-VRB5HUYU.js';
-import './chunk-2STZHJ24.js';
+export { LiopMcpRouter } from './chunk-AMSFSS2I.js';
+import './chunk-ZRWNMP5L.js';
 import './chunk-IK7CGWAZ.js';
 export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
 export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest } from './chunk-WPTOJYN5.js';
-export { GRPC_CHANNEL_OPTIONS, HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createChannelCredentials, createServerCredentials, createSyncTokenEstimator, createTokenEstimator } from './chunk-UJFWPRDM.js';
-export { Counter, Gauge, Histogram, MetricsRegistry, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, protocolMetrics, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, wireEgressBytesTotal, wireSavedBytesTotal, zkVerificationDurationMs, zkVerificationsTotal } from './chunk-PAICJCKJ.js';
-export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-2KSO3W4A.js';
+export { GRPC_CHANNEL_OPTIONS, HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createChannelCredentials, createServerCredentials, createSyncTokenEstimator, createTokenEstimator } from './chunk-GFGSHQN5.js';
+export { Counter, Gauge, Histogram, MetricsRegistry, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, protocolMetrics, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, wireEgressBytesTotal, wireSavedBytesTotal, zkProofsByTypeTotal, zkProvingDurationMs, zkVerificationDurationMs, zkVerificationsTotal, zkVkeyCacheSize } from './chunk-Q3FKHJ3B.js';
+export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-YLFNJQI2.js';
+export { ProofType, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, ZK_JOURNAL_V2_SIZE, ZkVerificationError, ZkVerifier, decodeJournalV2, encodeJournalV2, receiptCodec } from './chunk-P34HDRN5.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
-export { MeshNode } from './chunk-XRDN232O.js';
+export { MeshNode } from './chunk-KB3HUVMD.js';
 import { log } from './chunk-K3DGJLUY.js';
 export { LiopLogger, log } from './chunk-K3DGJLUY.js';
 import * as crypto from 'crypto';