@nekzus/liop 2.4.0-alpha.23 → 2.4.0-alpha.25

package/README.md

@@ -60,8 +60,8 @@ This addresses the data privacy, bandwidth, and latency bottlenecks of distribut
 | **Resilient Hybrid Routing**  | Deterministic per-tool multiplexing across `http-gateway`, `p2p-grpc`, and `local` with 5-failure circuit breaker (`RoutingTable`).|
 | **OAuth 2.1 M2M Lifecycle**   | Concurrency in-flight de-duplication, 30-second preemptive refresh buffer, and reactive invalidation (`TokenManager`).            |
 | **Sliding-Window Rate Limiter**| In-memory OWASP API4:2023 rate limiting with background cleanup unreferenced intervals (`InMemoryRateLimiter`).                    |
-| **PII Shield**                | Multi-layer egress filter with Regional Presets, custom keys, and recursive floats sanitization (`sanitizeOutput`). |
-| **ZK-Receipts**               | Sovereign Zero-Knowledge Proofs: Groth16 BN254 with 144-byte binary journal (v2) and legacy HMAC-SHA256 (v1). Enforces `ZK_BLOCKING` on Tier 1 Enclaves. |
+| **ZK-Receipts**               | Tri-modal Zero-Knowledge proofs: HMAC-SHA256 (v1), Groth16 BN254 with 144-byte binary journal (v2), and dual-layer ML-DSA-65 post-quantum hybrid receipts (v2.1). Enforces `ZK_BLOCKING` on Tier 1 Enclaves. |
+| **Hardware TEE Attestation** | Pre-flight validation of confidential hardware root-of-trust evidence for AMD SEV-SNP (1,184-byte report) and AWS Nitro Enclaves (`verifyTeeAttestationDetailed`). |
 | **Worker Pool**               | Heavy computation (crypto, sandboxing) dispatched to OS threads via `piscina` with background async warmup. |
 | **Post-Quantum Ready**        | ML-KEM-768 (Kyber) + ML-DSA-65 (Dilithium) with 1-hour session lifetime and AES-256-GCM encryption.                                        |
 | **Enterprise Observability**  | Immutable SOC 2 Hash-Chain audit log (`AuditLogger`), physical wire egress tracking, Prometheus metrics (`/metrics`), and K8s probes.      |
@@ -451,25 +451,28 @@ To block arbitrary command execution (e.g., Shellshock) and prevent exposure of
 - **Unix/Linux Allowlist**: `HOME`, `LOGNAME`, `PATH`, `SHELL`, `TERM`, `USER`.
 Variables starting with shell functions `()` are dropped.
 
-### Sovereign ZK-Receipts & Groth16 Attestation
+### Sovereign Tri-Modal ZK-Receipts & Hardware Attestation
 
-LIOP ZK-Receipts provide cryptographic evidence that a computation was executed honestly under zero-trust bounds. Version 2 receipts introduce true Zero-Knowledge Groth16 proofs over the BN254 pairing-friendly elliptic curve, packing a 144-byte binary journal:
+LIOP ZK-Receipts provide cryptographic evidence that a computation was executed honestly under zero-trust bounds. The protocol implements three complementary cryptographic modes:
+- **Mode 0 (`HMAC_LEGACY`, v1)**: Session commitments sealed with the ML-KEM-768 quantum-resistant shared key.
+- **Mode 2 (`GROTH16`, v2)**: Compact Zero-Knowledge SNARK proofs over the BN254 pairing-friendly elliptic curve packing a 144-byte binary journal (~252 bytes total).
+- **Mode 3 (`GROTH16_PQC_HYBRID`, v2.1)**: Dual-layer receipts combining Groth16 BN254 mathematical proofs with an ML-DSA-65 post-quantum digital signature conforming to NIST FIPS 204 (~5.6 KB total).
 
 - **144-Byte Binary Journal Layout**:
   - `guest_image_id` (32 bytes): Sovereign enclave guest runtime image identifier
   - `logic_digest` (32 bytes): SHA-256 fingerprint of the executed JavaScript/WASM logic
   - `dataset_digest` (32 bytes): SHA-256 fingerprint of the origin dataset at execution time
   - `output_digest` (32 bytes): SHA-256 fingerprint of the sanitized computation result
-  - `fuel_consumed` (8 bytes uint64 BE): AST fuel metering units consumed
+  - `fuel_consumed` (8 bytes uint64 BE): Quantized instruction-level AST fuel units consumed
   - `execution_timestamp` (8 bytes uint64 BE): Epoch timestamp in milliseconds
-- **Tampering & Replay Mitigation**: The client computes the local SHA-256 hash of the received output and asserts strict equality with `journal.outputDigest`. Any modified bit in either the journal or curve proof causes immediate rejection.
-- **Enclave Policy Invariant (`ZK_BLOCKING`)**: Tier 1 Sovereign Enclaves configure `zkMode: "required"`, rejecting queries if a valid Groth16 proof cannot be synthesized.
+- **Tampering & Replay Mitigation**: The client computes the local SHA-256 hash of the received output and asserts strict equality with `journal.outputDigest`. Any modified bit in either the journal, curve proof, or post-quantum signature causes immediate rejection.
+- **Enclave Policy Invariant (`ZK_BLOCKING`)**: Tier 1 Sovereign Enclaves configure `zkMode: "required"`, rejecting queries if a valid Groth16 proof cannot be synthesized or if mock proofs are supplied. When `pqcSign: true` is configured, the enclave emits a Version 2.1 hybrid receipt co-signed with ML-DSA-65.
 
 ```typescript
 import { LiopServer } from "@nekzus/liop/server";
-import { LiopVerifier } from "@nekzus/liop";
+import { LiopVerifier, verifyTeeAttestationDetailed } from "@nekzus/liop";
 
-// 1. Enclave configuration with ZK_BLOCKING policy
+// 1. Enclave configuration with ZK_BLOCKING and PQC signing
 const server = new LiopServer({ name: "bank-enclave", version: "1.0.0" });
 server.tool(
   "calculate_payroll_aggregate",
@@ -478,6 +481,7 @@ server.tool(
   async () => ({ content: [{ type: "text", text: "ok" }] }),
   {
     zkMode: "required", // Enforces Groth16 proof generation (ZK_BLOCKING)
+    pqcSign: true,      // Enables ML-DSA-65 digital signature (Receipt v2.1)
     circuitName: "sum",
   }
 );
@@ -490,6 +494,13 @@ const isValid = await verifier.verifyZkReceipt(
   rawReceiptBuffer,
   { zkPolicy: "required" }
 );
+
+// 3. Pre-flight Hardware TEE Attestation (AMD SEV-SNP / AWS Nitro Enclaves)
+const teeStatus = await verifyTeeAttestationDetailed(
+  attestationBytes,
+  expectedNonce,
+  { requireHardwareSigned: true }
+);
 ```
 
 ---
@@ -505,7 +516,7 @@ The following shows a complete Logic-Injection-on-Origin execution cycle (handle
 4. Code executes inside a V8 isolate with CPU fuel limits (no Node.js globals)
 5. Taint Analyzer blocks PII side-channel derivation (charCodeAt, boolean inference)
 6. PII Shield scans output for forbidden data and keys
-7. ZK-Receipt generated (SHA-256 ImageID + HMAC-SHA256 seal)
+7. ZK-Receipt generated (Tri-modal: HMAC v1, Groth16 v2, or Groth16 + ML-DSA-65 v2.1)
 8. Result + receipt returned to the LLM (raw data never exposed)
 ```
 

package/dist/bin/agent.js

@@ -1,20 +1,21 @@
 #!/usr/bin/env node
-import { probeTopology, RoutingTable } from '../chunk-PUDETPL4.js';
+import { probeTopology, RoutingTable } from '../chunk-V47P2AQR.js';
 import { TokenManager } from '../chunk-3QH44NKZ.js';
-import { LiopServer } from '../chunk-T2QDHVUD.js';
+import { LiopServer } from '../chunk-ZU3WVVLC.js';
 import '../chunk-Y62GORQF.js';
-import { LiopMcpRouter } from '../chunk-AMSFSS2I.js';
-import '../chunk-ZRWNMP5L.js';
+import { LiopMcpRouter } from '../chunk-DSOB2JKM.js';
+import '../chunk-WXYDFCIW.js';
 import '../chunk-IK7CGWAZ.js';
 import '../chunk-7PITYWOV.js';
-import '../chunk-WPTOJYN5.js';
-import '../chunk-GFGSHQN5.js';
+import '../chunk-NXCAFF73.js';
+import '../chunk-3664H3CV.js';
+import '../chunk-JPWC6XG6.js';
 import '../chunk-Q3FKHJ3B.js';
-import { isLegacyRequest } from '../chunk-YLFNJQI2.js';
-import '../chunk-P34HDRN5.js';
+import { normalizeToolArguments, TOOL_ALIASES, isLegacyRequest } from '../chunk-KR5UZUEY.js';
+import '../chunk-FIVRGOA4.js';
 import '../chunk-FTF6AMF6.js';
 import '../chunk-ZP3VVXOI.js';
-import { MeshNode } from '../chunk-KB3HUVMD.js';
+import { MeshNode } from '../chunk-IHKKWXHJ.js';
 import { log } from '../chunk-K3DGJLUY.js';
 import * as fs from 'fs';
 import * as os from 'os';
@@ -137,6 +138,21 @@ async function resolveBootstrapNodes(liopDir) {
   if (args.length > 0) {
     bootstrapNodes = args.filter((a) => a.startsWith("/"));
   }
+  if (process.env.LIOP_NEXUS_URL || process.env.LIOP_BLG_URL) {
+    const targetUrl = process.env.LIOP_NEXUS_URL || process.env.LIOP_BLG_URL;
+    if (targetUrl) {
+      const resolved = await resolveBootstrapFromUrl(targetUrl);
+      if (resolved) {
+        const normalized = normalizeBootstrap(resolved);
+        if (!bootstrapNodes.includes(normalized)) {
+          bootstrapNodes.push(normalized);
+          log.info(
+            `[LIOP-Agent] \u2705 Added bootstrap from URL discovery: ${normalized}`
+          );
+        }
+      }
+    }
+  }
   if (bootstrapNodes.length === 0) {
     const searchDirs = [
       process.cwd(),
@@ -169,19 +185,6 @@ async function resolveBootstrapNodes(liopDir) {
       }
     }
   }
-  if (process.env.LIOP_NEXUS_URL) {
-    const nexusUrl = process.env.LIOP_NEXUS_URL;
-    const resolved = await resolveBootstrapFromUrl(nexusUrl);
-    if (resolved) {
-      const normalized = normalizeBootstrap(resolved);
-      if (!bootstrapNodes.includes(normalized)) {
-        bootstrapNodes.push(normalized);
-        log.info(
-          `[LIOP-Agent] \u2705 Added bootstrap from URL discovery: ${normalized}`
-        );
-      }
-    }
-  }
   if (bootstrapNodes.length === 0 && process.env.LIOP_BOOTSTRAP) {
     bootstrapNodes.push(process.env.LIOP_BOOTSTRAP.trim());
   }
@@ -399,6 +402,13 @@ async function runGatewayMode(gateway, tokenManager, routingTable) {
     }
     if (method === "tools/call") {
       const params = request.params;
+      if (params?.arguments) {
+        params.arguments = normalizeToolArguments(params.arguments);
+      }
+      if (params?.name) {
+        const canonicalName = TOOL_ALIASES[params.name] || params.name;
+        params.name = canonicalName;
+      }
       if (params?.name === "LiopMeshStatus") {
         const statusResponse = {
           jsonrpc: "2.0",
@@ -438,6 +448,16 @@ async function runGatewayMode(gateway, tokenManager, routingTable) {
           if (!hasStatus) {
             toolsList.unshift(LIOP_MESH_STATUS_TOOL);
           }
+          for (const [alias, target] of Object.entries(TOOL_ALIASES)) {
+            const targetDef = toolsList.find((t) => t.name === target);
+            if (targetDef && !toolsList.some((t) => t.name === alias)) {
+              toolsList.push({
+                ...targetDef,
+                name: alias,
+                description: `[Alias -> ${target}] ${targetDef.description || ""}`.trim()
+              });
+            }
+          }
           routingTable.registerGatewayTools(toolsList, gateway.mcpEndpoint);
         }
         if (!isLegacyRequest(request)) {
@@ -720,7 +740,15 @@ async function runHybridMode(topology, tokenManager, routingTable) {
     }
     if (method === "tools/call") {
       const params = request.params;
-      const toolName = params?.name || "";
+      if (params?.arguments) {
+        params.arguments = normalizeToolArguments(params.arguments);
+      }
+      const rawToolName = params?.name || "";
+      const canonicalToolName = TOOL_ALIASES[rawToolName] || rawToolName;
+      if (params?.name) {
+        params.name = canonicalToolName;
+      }
+      const toolName = canonicalToolName;
       const route = routingTable.resolve(toolName);
       if (route?.provider === "http-gateway") {
         const start = Date.now();
@@ -778,6 +806,16 @@ async function runHybridMode(topology, tokenManager, routingTable) {
       for (const t of gatewayTools) toolMap.set(t.name, t);
       for (const t of meshTools)
         if (!toolMap.has(t.name)) toolMap.set(t.name, t);
+      for (const [alias, target] of Object.entries(TOOL_ALIASES)) {
+        const targetDef = toolMap.get(target);
+        if (targetDef && !toolMap.has(alias)) {
+          toolMap.set(alias, {
+            ...targetDef,
+            name: alias,
+            description: `[Alias -> ${target}] ${targetDef.description || ""}`.trim()
+          });
+        }
+      }
       const merged = Array.from(toolMap.values()).sort(
         (a, b) => a.name.localeCompare(b.name)
       );

package/dist/bridge.d.ts

@@ -1,9 +1,9 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { L as LiopServer, a as LiopServerOptions } from './index-D2P6Z_hP.js';
+import { L as LiopServer, a as LiopServerOptions } from './index-ByzjpRCk.js';
 import 'zod';
 import './node-Djzm6UYd.js';
-import './types-rxL19f0l.js';
-import './zk-CYImPsa6.js';
+import './types-29zv9X1V.js';
+import './zk-DzYNWBgo.js';
 import 'jose';
 
 /**

package/dist/bridge.js

@@ -1,6 +1,6 @@
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-E2CFIWD6.js';
-import './chunk-YLFNJQI2.js';
-import './chunk-P34HDRN5.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-WXOWJXY6.js';
+import './chunk-KR5UZUEY.js';
+import './chunk-FIVRGOA4.js';
 import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=bridge.js.map
 //# sourceMappingURL=bridge.js.map

package/dist/{chunk-WPTOJYN5.js → chunk-3664H3CV.js}

@@ -48,6 +48,17 @@ var Dilithium65Wrapper = {
       secretKey: keys.secretKey
     };
   },
+  /**
+   * Derives the ML-DSA-65 public key from a given secret key.
+   */
+  getPublicKey(secretKey) {
+    if (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {
+      throw new Error(
+        `ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`
+      );
+    }
+    return ml_dsa65.getPublicKey(secretKey);
+  },
   /**
    * Validates and imports a raw ML-DSA-65 public key.
    */
@@ -120,62 +131,6 @@ var Dilithium65Wrapper = {
   }
 };
 
-// src/security/rbac.ts
-var SCOPE_MAP = {
-  // Protocol lifecycle — unauthenticated (MCP spec compliance)
-  initialize: [],
-  "notifications/initialized": [],
-  "notifications/cancelled": [],
-  ping: [],
-  "server/discover": [],
-  "subscriptions/listen": [],
-  // Tool operations — require explicit authorization
-  "tools/list": ["liop:tools:list"],
-  "tools/call": ["liop:tools:call"],
-  // Resource operations — read-level access
-  "resources/list": ["liop:resources:read"],
-  "resources/read": ["liop:resources:read"],
-  "resources/templates/list": ["liop:resources:read"],
-  // Prompt/schema operations — schema-level access
-  "prompts/list": ["liop:schema:read"],
-  "prompts/get": ["liop:schema:read"]
-};
-function authorizeRequest(method, auth, additionalScopes) {
-  const methodScopes = SCOPE_MAP[method];
-  if (methodScopes !== void 0 && methodScopes.length === 0) {
-    return { allowed: true };
-  }
-  if (!auth) {
-    return {
-      allowed: false,
-      reason: `Authentication required for method: ${method}`
-    };
-  }
-  const needed = [...methodScopes ?? [], ...additionalScopes ?? []];
-  if (needed.length === 0) {
-    return {
-      allowed: false,
-      reason: `Unknown method: ${method}. Access denied (fail-closed).`
-    };
-  }
-  const clientScopes = new Set(auth.scopes);
-  const missing = needed.filter((s) => !clientScopes.has(s));
-  if (missing.length > 0) {
-    return {
-      allowed: false,
-      reason: `Insufficient scopes for ${method}. Missing: ${missing.join(", ")}`
-    };
-  }
-  return { allowed: true };
-}
-var LIOP_SCOPES = [
-  "liop:tools:list",
-  "liop:tools:call",
-  "liop:resources:read",
-  "liop:schema:read",
-  "liop:mesh:query"
-];
-
-export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest };
-//# sourceMappingURL=chunk-WPTOJYN5.js.map
-//# sourceMappingURL=chunk-WPTOJYN5.js.map
+export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper };
+//# sourceMappingURL=chunk-3664H3CV.js.map
+//# sourceMappingURL=chunk-3664H3CV.js.map

package/dist/{chunk-E7RSX476.js → chunk-6MYJBM2E.js}

@@ -1,5 +1,5 @@
-import { LiopMcpRouter } from './chunk-AMSFSS2I.js';
-import { LIOP_SCOPES } from './chunk-WPTOJYN5.js';
+import { LiopMcpRouter } from './chunk-DSOB2JKM.js';
+import { LIOP_SCOPES } from './chunk-NXCAFF73.js';
 import { meshPeersConnected, manifestCacheSize, protocolMetrics } from './chunk-Q3FKHJ3B.js';
 import { log } from './chunk-K3DGJLUY.js';
 import * as http from 'http';
@@ -814,5 +814,5 @@ var LiopHybridGateway = class {
 };
 
 export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest };
-//# sourceMappingURL=chunk-E7RSX476.js.map
-//# sourceMappingURL=chunk-E7RSX476.js.map
+//# sourceMappingURL=chunk-6MYJBM2E.js.map
+//# sourceMappingURL=chunk-6MYJBM2E.js.map

package/dist/{chunk-AMSFSS2I.js → chunk-DSOB2JKM.js}

@@ -1,9 +1,10 @@
-import { LiopVerifier } from './chunk-ZRWNMP5L.js';
+import { LiopVerifier } from './chunk-WXYDFCIW.js';
 import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-import { authorizeRequest, Dilithium65Wrapper } from './chunk-WPTOJYN5.js';
-import { TokenTelemetryEngine, liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-GFGSHQN5.js';
+import { authorizeRequest } from './chunk-NXCAFF73.js';
+import { Dilithium65Wrapper } from './chunk-3664H3CV.js';
+import { TokenTelemetryEngine, liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-JPWC6XG6.js';
 import { toolCallsTotal, toolCallErrorsTotal, pqcHandshakeDurationMs, pqcHandshakesTotal, zkVerificationsTotal, wireEgressBytesTotal } from './chunk-Q3FKHJ3B.js';
-import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, adaptResponseForLegacyClient, MCP_PROTOCOL_VERSION_LEGACY, buildLegacyInitializeResponse } from './chunk-YLFNJQI2.js';
+import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, adaptResponseForLegacyClient, MCP_PROTOCOL_VERSION_LEGACY, buildLegacyInitializeResponse, TOOL_ALIASES, normalizeToolArguments } from './chunk-KR5UZUEY.js';
 import { log } from './chunk-K3DGJLUY.js';
 import * as crypto from 'crypto';
 import * as grpc from '@grpc/grpc-js';
@@ -860,12 +861,15 @@ Network ID: ${peerId}${blueprint}`;
    * by searching the manifest cache. Supports exact names and suffixed names.
    */
   resolveManifestTarget(toolName) {
+    const targetCanonical = TOOL_ALIASES[toolName] || toolName;
     for (const [peerId, { manifest }] of this.manifestCache.entries()) {
-      const tool = manifest.tools.find((t) => t.name === toolName);
+      const tool = manifest.tools.find(
+        (t) => t.name === toolName || t.name === targetCanonical
+      );
       if (tool) {
         return {
           peerId,
-          originalToolName: toolName
+          originalToolName: tool.name
         };
       }
     }
@@ -873,13 +877,16 @@ Network ID: ${peerId}${blueprint}`;
     if (parts.length > 1) {
       const suffix = parts.pop();
       const baseName = parts.join("_");
+      const canonicalBase = TOOL_ALIASES[baseName] || baseName;
       for (const [peerId, { manifest }] of this.manifestCache.entries()) {
         if (peerId.endsWith(suffix || "")) {
-          const tool = manifest.tools.find((t) => t.name === baseName);
+          const tool = manifest.tools.find(
+            (t) => t.name === baseName || t.name === canonicalBase
+          );
           if (tool) {
             return {
               peerId,
-              originalToolName: baseName
+              originalToolName: tool.name
             };
           }
         }
@@ -899,6 +906,9 @@ Network ID: ${peerId}${blueprint}`;
     return `***${peerId.slice(-8)}`;
   }
   async transcodeMcpToLiop(id, params, token) {
+    if (params?.arguments) {
+      params.arguments = normalizeToolArguments(params.arguments);
+    }
     const toolName = params.name;
     if (toolName === "LiopMeshStatus") {
       this.refreshManifestCache(true).catch(() => {
@@ -1493,5 +1503,5 @@ ${cachedToolList}` : "\nNo remote tools discovered yet.",
 };
 
 export { LiopMcpRouter };
-//# sourceMappingURL=chunk-AMSFSS2I.js.map
-//# sourceMappingURL=chunk-AMSFSS2I.js.map
+//# sourceMappingURL=chunk-DSOB2JKM.js.map
+//# sourceMappingURL=chunk-DSOB2JKM.js.map

package/dist/{chunk-OHMZZMMC.js → chunk-ET6VRUK2.js}

@@ -1,4 +1,4 @@
-import { ZkVerificationError } from './chunk-P34HDRN5.js';
+import { ZkVerificationError } from './chunk-FIVRGOA4.js';
 import { bn254, stringBigints } from 'micro-zk-proofs';
 
 var VERIFICATION_LATENCY_BUDGET_MS = 250;
@@ -54,5 +54,5 @@ function deserializeGrothProof(buf) {
 }
 
 export { VERIFICATION_LATENCY_BUDGET_MS, deserializeGrothProof, deserializeVKey, serializeGrothProof, serializeVKey, verifyGroth16Proof };
-//# sourceMappingURL=chunk-OHMZZMMC.js.map
-//# sourceMappingURL=chunk-OHMZZMMC.js.map
+//# sourceMappingURL=chunk-ET6VRUK2.js.map
+//# sourceMappingURL=chunk-ET6VRUK2.js.map

package/dist/{chunk-P34HDRN5.js → chunk-FIVRGOA4.js}

@@ -4,6 +4,7 @@ import crypto from 'crypto';
 var ProofType = /* @__PURE__ */ ((ProofType2) => {
   ProofType2[ProofType2["HMAC_LEGACY"] = 0] = "HMAC_LEGACY";
   ProofType2[ProofType2["GROTH16"] = 2] = "GROTH16";
+  ProofType2[ProofType2["GROTH16_PQC_HYBRID"] = 3] = "GROTH16_PQC_HYBRID";
   return ProofType2;
 })(ProofType || {});
 var RECEIPT_VERSION_V1 = 1;
@@ -74,6 +75,36 @@ var receiptCodec = {
     const checksum = crypto.createHash("sha256").update(payload).digest();
     return Buffer.concat([payload, checksum]);
   },
+  /**
+   * Encodes a version 2.1 Hybrid Binary Receipt (Groth16 + ML-DSA-65 co-sign).
+   * Layout:
+   * [0x02][0x03 ProofType.GROTH16_PQC_HYBRID][journalLen: 4B UInt32BE][journal: 144B]
+   * [proofLen: 2B UInt16BE][groth16 proof: ~260B]
+   * [sigLen: 2B UInt16BE][signature: 3309B]
+   * [publicKey: 1952B]
+   * [checksum: 32B SHA-256]
+   */
+  encodeHybridV2(journal, proof, pqcSignature, pqcPublicKey) {
+    const header = Buffer.alloc(6);
+    header.writeUInt8(RECEIPT_VERSION_V2, 0);
+    header.writeUInt8(3 /* GROTH16_PQC_HYBRID */, 1);
+    header.writeUInt32BE(journal.length, 2);
+    const proofLenBuf = Buffer.alloc(2);
+    proofLenBuf.writeUInt16BE(proof.length, 0);
+    const sigLenBuf = Buffer.alloc(2);
+    sigLenBuf.writeUInt16BE(pqcSignature.length, 0);
+    const payload = Buffer.concat([
+      header,
+      journal,
+      proofLenBuf,
+      proof,
+      sigLenBuf,
+      pqcSignature,
+      pqcPublicKey
+    ]);
+    const checksum = crypto.createHash("sha256").update(payload).digest();
+    return Buffer.concat([payload, checksum]);
+  },
   /**
    * Decodes any LIOP Binary Receipt (v1 HMAC or v2 ZK).
    */
@@ -128,6 +159,42 @@ var receiptCodec = {
         throw new ZkVerificationError("Receipt checksum verification failed.");
       }
       const journal = Buffer.from(raw.subarray(6, 6 + journalLen));
+      if (proofType === 3 /* GROTH16_PQC_HYBRID */) {
+        let offset = 6 + journalLen;
+        if (raw.length < offset + 2 + 32) {
+          throw new ZkVerificationError(
+            "Malformed hybrid receipt: missing proof length header."
+          );
+        }
+        const proofLen = raw.readUInt16BE(offset);
+        offset += 2;
+        if (raw.length < offset + proofLen + 2 + 32) {
+          throw new ZkVerificationError(
+            "Malformed hybrid receipt: truncated Groth16 proof."
+          );
+        }
+        const proof2 = Buffer.from(raw.subarray(offset, offset + proofLen));
+        offset += proofLen;
+        const sigLen = raw.readUInt16BE(offset);
+        offset += 2;
+        if (raw.length < offset + sigLen + 32) {
+          throw new ZkVerificationError(
+            "Malformed hybrid receipt: truncated ML-DSA-65 signature."
+          );
+        }
+        const pqcSignature = Buffer.from(raw.subarray(offset, offset + sigLen));
+        offset += sigLen;
+        const pqcPublicKey = Buffer.from(raw.subarray(offset, raw.length - 32));
+        return {
+          version: RECEIPT_VERSION_V2,
+          proofType,
+          journal,
+          proof: proof2,
+          pqcSignature,
+          pqcPublicKey,
+          raw
+        };
+      }
       const proof = Buffer.from(raw.subarray(6 + journalLen, raw.length - 32));
       return {
         version: RECEIPT_VERSION_V2,
@@ -209,5 +276,5 @@ var ZkVerifier = {
 };
 
 export { ProofType, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, ZK_JOURNAL_V2_SIZE, ZkVerificationError, ZkVerifier, decodeJournalV2, encodeJournalV2, receiptCodec };
-//# sourceMappingURL=chunk-P34HDRN5.js.map
-//# sourceMappingURL=chunk-P34HDRN5.js.map
+//# sourceMappingURL=chunk-FIVRGOA4.js.map
+//# sourceMappingURL=chunk-FIVRGOA4.js.map

package/dist/{chunk-KB3HUVMD.js → chunk-IHKKWXHJ.js}

@@ -341,31 +341,30 @@ var MeshNode = class _MeshNode {
       log.info(
         `[LIOP-Mesh] Forcing direct P2P dial to ${bootNodes.length} bootstrap nodes...`
       );
-      const maxRetries = 5;
-      for (const addr of bootNodes) {
-        let success = false;
-        let attempt = 1;
-        while (attempt <= maxRetries && !success) {
-          try {
-            await this.node.dial(multiaddr(addr));
-            log.info(`[LIOP-Mesh] \u2705 Successfully dialed ${addr}`);
-            success = true;
-          } catch (_e) {
-            const delay = Math.min(1e3 * 2 ** (attempt - 1), 3e3);
-            log.warn(
-              `[LIOP-Mesh] \u26A0\uFE0F Dial attempt ${attempt}/${maxRetries} to ${addr} failed. Retrying in ${delay / 1e3}s...`
-            );
-            if (attempt < maxRetries) {
-              await new Promise((resolve2) => setTimeout(resolve2, delay));
-            } else {
-              log.error(
-                `[LIOP-Mesh] \u274C Could not connect to bootstrap ${addr} after ${maxRetries} attempts. Continuing...`
-              );
+      const activeNode = this.node;
+      if (!activeNode) return;
+      const maxRetries = 2;
+      await Promise.allSettled(
+        bootNodes.map(async (addr) => {
+          for (let attempt = 1; attempt <= maxRetries; attempt++) {
+            try {
+              await activeNode.dial(multiaddr(addr), {
+                signal: AbortSignal.timeout(2500)
+              });
+              log.info(`[LIOP-Mesh] \u2705 Successfully dialed ${addr}`);
+              return;
+            } catch (_e) {
+              if (attempt === maxRetries) {
+                log.warn(
+                  `[LIOP-Mesh] \u26A0\uFE0F Could not connect to bootstrap ${addr} after ${maxRetries} attempts. Continuing...`
+                );
+              } else {
+                await new Promise((resolve2) => setTimeout(resolve2, 500));
+              }
             }
-            attempt++;
           }
-        }
-      }
+        })
+      );
     }
   }
   async stop() {
@@ -873,5 +872,5 @@ var MeshNode = class _MeshNode {
 };
 
 export { MeshNode };
-//# sourceMappingURL=chunk-KB3HUVMD.js.map
-//# sourceMappingURL=chunk-KB3HUVMD.js.map
+//# sourceMappingURL=chunk-IHKKWXHJ.js.map
+//# sourceMappingURL=chunk-IHKKWXHJ.js.map