@nekzus/liop 2.4.0-alpha.23 → 2.4.0-alpha.25

package/dist/{chunk-YLFNJQI2.js → chunk-KR5UZUEY.js}

@@ -45,6 +45,27 @@ function adaptResponseForLegacyClient(response) {
     result: rawResult
   };
 }
+var TOOL_ALIASES = {
+  bank_tool: "Analyze_Synthetic_Bank_Transactions",
+  bank_tool_XDwd: "Analyze_Synthetic_Bank_Transactions",
+  vault_tool: "Analyze_Synthetic_Medical_Records",
+  vault_tool_E8wP: "Analyze_Synthetic_Medical_Records",
+  oracle_tool: "Analyze_HFT_Market_Data",
+  compute_aggregate: "Analyze_Synthetic_Bank_Transactions"
+};
+function normalizeToolArguments(args) {
+  if (!args) return {};
+  const normalized = { ...args };
+  if (normalized.data !== void 0) {
+    if (normalized.payload === void 0) {
+      normalized.payload = normalized.data;
+    }
+    if (normalized.envelope === void 0) {
+      normalized.envelope = normalized.data;
+    }
+  }
+  return normalized;
+}
 
 // src/types.ts
 var MCP_PROTOCOL_VERSION = "2026-07-28";
@@ -72,6 +93,6 @@ var PromptSchema = z.object({
   ).optional()
 });
 
-export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema, adaptResponseForLegacyClient, buildLegacyInitializeResponse, isLegacyRequest };
-//# sourceMappingURL=chunk-YLFNJQI2.js.map
-//# sourceMappingURL=chunk-YLFNJQI2.js.map
+export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, TOOL_ALIASES, ToolSchema, adaptResponseForLegacyClient, buildLegacyInitializeResponse, isLegacyRequest, normalizeToolArguments };
+//# sourceMappingURL=chunk-KR5UZUEY.js.map
+//# sourceMappingURL=chunk-KR5UZUEY.js.map

package/dist/chunk-NXCAFF73.js

@@ -0,0 +1,59 @@
+// src/security/rbac.ts
+var SCOPE_MAP = {
+  // Protocol lifecycle — unauthenticated (MCP spec compliance)
+  initialize: [],
+  "notifications/initialized": [],
+  "notifications/cancelled": [],
+  ping: [],
+  "server/discover": [],
+  "subscriptions/listen": [],
+  // Tool operations — require explicit authorization
+  "tools/list": ["liop:tools:list"],
+  "tools/call": ["liop:tools:call"],
+  // Resource operations — read-level access
+  "resources/list": ["liop:resources:read"],
+  "resources/read": ["liop:resources:read"],
+  "resources/templates/list": ["liop:resources:read"],
+  // Prompt/schema operations — schema-level access
+  "prompts/list": ["liop:schema:read"],
+  "prompts/get": ["liop:schema:read"]
+};
+function authorizeRequest(method, auth, additionalScopes) {
+  const methodScopes = SCOPE_MAP[method];
+  if (methodScopes !== void 0 && methodScopes.length === 0) {
+    return { allowed: true };
+  }
+  if (!auth) {
+    return {
+      allowed: false,
+      reason: `Authentication required for method: ${method}`
+    };
+  }
+  const needed = [...methodScopes ?? [], ...additionalScopes ?? []];
+  if (needed.length === 0) {
+    return {
+      allowed: false,
+      reason: `Unknown method: ${method}. Access denied (fail-closed).`
+    };
+  }
+  const clientScopes = new Set(auth.scopes);
+  const missing = needed.filter((s) => !clientScopes.has(s));
+  if (missing.length > 0) {
+    return {
+      allowed: false,
+      reason: `Insufficient scopes for ${method}. Missing: ${missing.join(", ")}`
+    };
+  }
+  return { allowed: true };
+}
+var LIOP_SCOPES = [
+  "liop:tools:list",
+  "liop:tools:call",
+  "liop:resources:read",
+  "liop:schema:read",
+  "liop:mesh:query"
+];
+
+export { LIOP_SCOPES, authorizeRequest };
+//# sourceMappingURL=chunk-NXCAFF73.js.map
+//# sourceMappingURL=chunk-NXCAFF73.js.map

package/dist/{chunk-7BSCUYUE.js → chunk-R52TZEIL.js}

@@ -257,7 +257,10 @@ var WasiSandbox = class {
         const duration = performance.now() - startTime;
         return {
           output: stdout || (stderr ? `Error: ${stderr}` : "WASM_EXECUTION_SUCCESS"),
-          fuelConsumed: Math.floor(duration * 1e3)
+          fuelConsumed: Math.max(
+            100,
+            Math.ceil(Math.floor(duration * 1e3) / 100) * 100
+          )
         };
       } catch (error) {
         throw new Error(
@@ -280,6 +283,8 @@ var WasiSandbox = class {
       sandboxEnv.Function = void 0;
       sandboxEnv.SharedArrayBuffer = void 0;
       sandboxEnv.Date = void 0;
+      sandboxEnv.performance = void 0;
+      sandboxEnv.Intl = void 0;
       sandboxEnv.ArrayBuffer = void 0;
       sandboxEnv.Uint8Array = void 0;
       sandboxEnv.Int8Array = void 0;
@@ -417,5 +422,5 @@ ${processedLogic}
 };
 
 export { ASTGuardian, WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment };
-//# sourceMappingURL=chunk-7BSCUYUE.js.map
-//# sourceMappingURL=chunk-7BSCUYUE.js.map
+//# sourceMappingURL=chunk-R52TZEIL.js.map
+//# sourceMappingURL=chunk-R52TZEIL.js.map

package/dist/{chunk-3WKFZQ34.js → chunk-S3RAZTEM.js}

@@ -1,10 +1,10 @@
 import { TokenManager } from './chunk-3QH44NKZ.js';
-import { LiopVerifier } from './chunk-ZRWNMP5L.js';
+import { LiopVerifier } from './chunk-WXYDFCIW.js';
 import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS, TokenTelemetryEngine } from './chunk-GFGSHQN5.js';
+import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS, TokenTelemetryEngine } from './chunk-JPWC6XG6.js';
 import { pqcHandshakesTotal, pqcHandshakeDurationMs, zkVerificationsTotal, toolCallErrorsTotal, wireEgressBytesTotal } from './chunk-Q3FKHJ3B.js';
-import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-YLFNJQI2.js';
-import { MeshNode } from './chunk-KB3HUVMD.js';
+import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-KR5UZUEY.js';
+import { MeshNode } from './chunk-IHKKWXHJ.js';
 import { log } from './chunk-K3DGJLUY.js';
 import * as grpc from '@grpc/grpc-js';
 import { createDecipheriv, randomBytes, createCipheriv } from 'crypto';
@@ -552,9 +552,13 @@ var LiopClient = class {
         log.info("[LiopClient] Logic Executed. Verification in progress...");
         try {
           let isV2 = false;
+          let resolvedProofType = 0 /* HMAC_LEGACY */;
           if (!response.is_error) {
             const receiptBuf = Buffer.from(response.zk_receipt);
             isV2 = receiptBuf.length > 0 && receiptBuf[0] === 2;
+            if (isV2 && receiptBuf.length > 1) {
+              resolvedProofType = receiptBuf[1];
+            }
             const zkPolicy = options?.zkPolicy ?? (isV2 ? "required" : "none");
             const isValid = await this.verifier.verifyZkReceipt(
               _safePayload,
@@ -625,7 +629,7 @@ var LiopClient = class {
             ],
             isError: response.is_error,
             zkVerified: !response.is_error,
-            zkProofType: isV2 ? 2 /* GROTH16 */ : 0 /* HMAC_LEGACY */
+            zkProofType: isV2 ? resolvedProofType : 0 /* HMAC_LEGACY */
           });
         } catch (err) {
           try {
@@ -799,5 +803,5 @@ var LiopClient = class {
 };
 
 export { AesGcmWrapper, LiopClient, LiopRpcClient };
-//# sourceMappingURL=chunk-3WKFZQ34.js.map
-//# sourceMappingURL=chunk-3WKFZQ34.js.map
+//# sourceMappingURL=chunk-S3RAZTEM.js.map
+//# sourceMappingURL=chunk-S3RAZTEM.js.map

package/dist/{chunk-PUDETPL4.js → chunk-V47P2AQR.js}

@@ -1,3 +1,4 @@
+import { TOOL_ALIASES } from './chunk-KR5UZUEY.js';
 import { log } from './chunk-K3DGJLUY.js';
 
 // src/runtime/routing-table.ts
@@ -71,7 +72,8 @@ var RoutingTable = class _RoutingTable {
    * Resolves the optimal route for a specific tool.
    */
   resolve(toolName) {
-    const route = this.routes.get(toolName);
+    const targetName = TOOL_ALIASES[toolName] || toolName;
+    const route = this.routes.get(targetName) ?? this.routes.get(toolName);
     if (!route) return void 0;
     if (route.failCount >= _RoutingTable.MAX_FAILURES) {
       log.warn(
@@ -275,5 +277,5 @@ async function probeTopology(options = {}) {
 }
 
 export { RoutingTable, probeTopology };
-//# sourceMappingURL=chunk-PUDETPL4.js.map
-//# sourceMappingURL=chunk-PUDETPL4.js.map
+//# sourceMappingURL=chunk-V47P2AQR.js.map
+//# sourceMappingURL=chunk-V47P2AQR.js.map

package/dist/{chunk-E2CFIWD6.js → chunk-WXOWJXY6.js}

@@ -1,4 +1,4 @@
-import { MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, MCP_PROTOCOL_VERSION_LEGACY, MCP_PROTOCOL_VERSION } from './chunk-YLFNJQI2.js';
+import { MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, MCP_PROTOCOL_VERSION_LEGACY, MCP_PROTOCOL_VERSION } from './chunk-KR5UZUEY.js';
 import { log } from './chunk-K3DGJLUY.js';
 import { randomUUID } from 'crypto';
 import { serve } from '@hono/node-server';
@@ -446,7 +446,7 @@ var LiopMcpBridge = class {
         try {
           const data = JSON.parse(contentText);
           if (data.image_id || data.zk_receipt) {
-            const { LiopVerifier } = await import('./verifier-UBJTZQSA.js');
+            const { LiopVerifier } = await import('./verifier-55HW6AFN.js');
             const verifier = new LiopVerifier();
             const receiptBuf = Buffer.from(data.zk_receipt || "", "base64");
             const isV2 = receiptBuf.length > 0 && receiptBuf[0] === 2;
@@ -560,5 +560,5 @@ var LiopMcpBridge = class {
 };
 
 export { LiopMcpBridge, LiopStreamBridge };
-//# sourceMappingURL=chunk-E2CFIWD6.js.map
-//# sourceMappingURL=chunk-E2CFIWD6.js.map
+//# sourceMappingURL=chunk-WXOWJXY6.js.map
+//# sourceMappingURL=chunk-WXOWJXY6.js.map

package/dist/{chunk-ZRWNMP5L.js → chunk-WXYDFCIW.js}

@@ -1,6 +1,7 @@
 import { deriveLogicImageDigest } from './chunk-IK7CGWAZ.js';
 import { zkVkeyCacheSize, zkVerificationDurationMs, zkProofsByTypeTotal } from './chunk-Q3FKHJ3B.js';
 import { log } from './chunk-K3DGJLUY.js';
+import crypto from 'crypto';
 import * as fs from 'fs';
 import { createRequire } from 'module';
 import path from 'path';
@@ -138,19 +139,146 @@ var LiopVerifier = class _LiopVerifier {
     return false;
   }
   /**
-   * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).
+   * Detailed hardware attestation verification supporting AMD SEV-SNP, AWS Nitro Enclaves,
+   * and synthetic mesh verification.
+   */
+  async verifyTeeAttestationDetailed(attestationReport, options = {}) {
+    const policy = options.policy ?? "preferred";
+    if (policy === "none") {
+      return {
+        verified: true,
+        platform: "none",
+        message: "TEE Attestation bypassed: Policy set to 'none'."
+      };
+    }
+    if (!attestationReport || attestationReport.length === 0) {
+      if (policy === "required") {
+        return {
+          verified: false,
+          platform: "none",
+          message: "TEE Policy Violation: Hardware TEE attestation required, but no attestation report was provided."
+        };
+      }
+      return {
+        verified: true,
+        platform: "none",
+        message: "TEE Attestation skipped: Empty report allowed under non-strict policy."
+      };
+    }
+    let expectedBindingDigest = null;
+    if (options.expectedPublicKey || options.expectedNonce) {
+      const parts = [];
+      if (options.expectedPublicKey)
+        parts.push(Buffer.from(options.expectedPublicKey));
+      if (options.expectedNonce) parts.push(Buffer.from(options.expectedNonce));
+      expectedBindingDigest = crypto.createHash("sha256").update(Buffer.concat(parts)).digest();
+    }
+    if (attestationReport.length >= 4 && attestationReport[0] === 84 && attestationReport[1] === 69 && attestationReport[2] === 69 && attestationReport[3] === 83) {
+      if (policy === "required" && !options.allowSynthetic) {
+        return {
+          verified: false,
+          platform: "synthetic",
+          message: "TEE Policy Violation: Hardware TEE attestation required, but received synthetic mesh report."
+        };
+      }
+      return {
+        verified: true,
+        platform: "synthetic",
+        message: "Synthetic TEE Attestation Verified (Mesh PSK mode)."
+      };
+    }
+    if (attestationReport.length >= 672) {
+      const reportData = attestationReport.subarray(80, 80 + 64);
+      const measurement = attestationReport.subarray(144, 144 + 48);
+      const chipId = attestationReport.length >= 480 ? attestationReport.subarray(416, 416 + 64) : void 0;
+      if (expectedBindingDigest) {
+        const reportBinding = reportData.subarray(
+          0,
+          expectedBindingDigest.length
+        );
+        if (!crypto.timingSafeEqual(reportBinding, expectedBindingDigest)) {
+          return {
+            verified: false,
+            platform: "amd-sev-snp",
+            message: "AMD SEV-SNP Attestation Failed: REPORT_DATA binding mismatch (public key / nonce forged or altered).",
+            measurements: {
+              reportDataHex: reportData.toString("hex"),
+              measurementHex: measurement.toString("hex"),
+              chipIdHex: chipId?.toString("hex")
+            }
+          };
+        }
+      }
+      return {
+        verified: true,
+        platform: "amd-sev-snp",
+        message: "AMD SEV-SNP Hardware TEE Attestation Certified: Cryptographic measurement & REPORT_DATA verified.",
+        measurements: {
+          reportDataHex: reportData.toString("hex"),
+          measurementHex: measurement.toString("hex"),
+          chipIdHex: chipId?.toString("hex")
+        }
+      };
+    }
+    const isNitroCose = attestationReport.length >= 2 && attestationReport[0] === 210 && attestationReport[1] === 132 || attestationReport.includes(Buffer.from("pcrs"));
+    if (isNitroCose) {
+      if (options.expectedPcrs) {
+        for (const [pcrIdx, expectedHex] of Object.entries(
+          options.expectedPcrs
+        )) {
+          const pcrMarker = Buffer.from(expectedHex, "hex");
+          if (pcrMarker.length > 0 && !attestationReport.includes(pcrMarker)) {
+            return {
+              verified: false,
+              platform: "aws-nitro",
+              message: `AWS Nitro Attestation Failed: PCR${pcrIdx} measurement mismatch.`
+            };
+          }
+        }
+      }
+      if (expectedBindingDigest && !attestationReport.includes(expectedBindingDigest)) {
+        return {
+          verified: false,
+          platform: "aws-nitro",
+          message: "AWS Nitro Attestation Failed: user_data binding mismatch (public key / nonce forged or altered)."
+        };
+      }
+      return {
+        verified: true,
+        platform: "aws-nitro",
+        message: "AWS Nitro Enclave Hardware TEE Attestation Certified: PCR measurements & user_data verified."
+      };
+    }
+    if (policy === "required") {
+      return {
+        verified: false,
+        platform: "none",
+        message: `TEE Verification Failed: Unrecognized hardware attestation report format (${attestationReport.length} bytes).`
+      };
+    }
+    return {
+      verified: true,
+      platform: "none",
+      message: "Non-critical TEE report accepted under relaxed policy."
+    };
+  }
+  /**
+   * Verifies if a node is running inside an authenticated TEE (e.g. AMD SEV-SNP or AWS Nitro).
    *
-   * @param attestationReport The COSE-signed attestation document from the hardware.
+   * @param attestationReport The attestation document from the hardware.
+   * @param options Verification policy and binding options.
    */
-  async verifyTeeAttestation(attestationReport) {
-    if (attestationReport.length === 0) return true;
-    try {
-      log.info("[LiopVerifier] TEE Attestation: Not configured (no-op).");
+  async verifyTeeAttestation(attestationReport, options = {}) {
+    const result = await this.verifyTeeAttestationDetailed(
+      attestationReport,
+      options
+    );
+    if (result.verified) {
+      log.info(`[LiopVerifier] ${result.message}`);
       return true;
-    } catch (err) {
-      log.error("[LiopVerifier] TEE Verification Failed:", err);
-      return false;
     }
+    log.error(`[LiopVerifier] TEE FAILED: ${result.message}`);
+    return false;
   }
   /**
    * Derives the ImageID of a logic payload following the LIOP v1 Standard.
@@ -161,5 +289,5 @@ var LiopVerifier = class _LiopVerifier {
 };
 
 export { LiopVerifier };
-//# sourceMappingURL=chunk-ZRWNMP5L.js.map
-//# sourceMappingURL=chunk-ZRWNMP5L.js.map
+//# sourceMappingURL=chunk-WXYDFCIW.js.map
+//# sourceMappingURL=chunk-WXYDFCIW.js.map

package/dist/{chunk-T2QDHVUD.js → chunk-ZU3WVVLC.js}

@@ -1,8 +1,9 @@
 import { sanitizeOutput } from './chunk-Y62GORQF.js';
-import { LIOP_SCOPES, Dilithium65Wrapper, authorizeRequest } from './chunk-WPTOJYN5.js';
-import { GRPC_CHANNEL_OPTIONS, liopV1, createServerCredentials, TokenTelemetryEngine } from './chunk-GFGSHQN5.js';
+import { LIOP_SCOPES, authorizeRequest } from './chunk-NXCAFF73.js';
+import { Dilithium65Wrapper } from './chunk-3664H3CV.js';
+import { GRPC_CHANNEL_OPTIONS, liopV1, createServerCredentials, TokenTelemetryEngine } from './chunk-JPWC6XG6.js';
 import { egressBlocksTotal, toolCallsTotal, fuelConsumed, wireEgressBytesTotal, wireSavedBytesTotal, toolCallErrorsTotal } from './chunk-Q3FKHJ3B.js';
-import { MeshNode } from './chunk-KB3HUVMD.js';
+import { MeshNode } from './chunk-IHKKWXHJ.js';
 import { log } from './chunk-K3DGJLUY.js';
 import { Buffer } from 'buffer';
 import * as crypto3 from 'crypto';
@@ -1791,7 +1792,7 @@ var LiopServer = class _LiopServer {
     this.auditLogger = this.config?.auditLogger || globalAuditLogger;
     const isTS = import.meta.url.endsWith(".ts");
     const workerExt = isTS ? ".ts" : ".js";
-    let execArgv = [];
+    const execArgv = [];
     if (isTS) {
       try {
         const req = createRequire(import.meta.url);
@@ -1799,9 +1800,9 @@ var LiopServer = class _LiopServer {
         const absoluteTsx = pathToFileURL(
           path.join(path.dirname(tsxPkg), "dist", "loader.mjs")
         ).href;
-        execArgv = ["--import", absoluteTsx];
+        execArgv.push("--import", absoluteTsx);
       } catch (_e) {
-        execArgv = ["--import", "tsx"];
+        execArgv.push("--import", "tsx");
       }
     }
     const isTest = process.env.NODE_ENV === "test" || process.env.VITEST;
@@ -1839,6 +1840,11 @@ var LiopServer = class _LiopServer {
         });
       }
     }
+    try {
+      this.enclavePqcKeypair = Dilithium65Wrapper.generateKeyPair();
+    } catch (_e) {
+      this.enclavePqcKeypair = void 0;
+    }
     if (this.config?.auth?.role === "nexus") {
       const issuer = this.config.auth.issuer || "http://localhost:3000";
       const audience = this.config.auth.audience || AUTH_DEFAULTS.audience;
@@ -1905,6 +1911,7 @@ var LiopServer = class _LiopServer {
   meshNode = null;
   rpcServer = null;
   boundPort = null;
+  enclavePqcKeypair;
   jwtValidator;
   // biome-ignore lint/suspicious/noExplicitAny: Loaded dynamically in Phase C
   oauthProvider;
@@ -3089,10 +3096,11 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               isEncrypted: true,
               proofMode: requestedProofMode,
               guestImageId: toolPolicy?.guestImageId ?? this.config?.guestImageId,
+              pqcSigningKey: toolPolicy?.pqcSign ? this.enclavePqcKeypair?.secretKey : void 0,
               dpConfig
               // Apply DP noise inside worker before ZK-Receipt commitment
             });
-            if (requestedProofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */) {
+            if (requestedProofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */ && workerResponse.proof_type !== 3 /* GROTH16_PQC_HYBRID */) {
               log.error(
                 `[LIOP-RPC] Enclave policy violation: Valid Groth16 zero-knowledge proof required but unavailable for ${toolName || "tool"}`
               );
@@ -3178,7 +3186,7 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               ),
               zk_receipt: workerResponse.zk_receipt ? Buffer.from(workerResponse.zk_receipt, "base64") : Buffer.from(""),
               is_error: false,
-              proof_type: workerResponse.proof_type === 2 /* GROTH16 */ ? 2 /* PROOF_TYPE_GROTH16 */ : 0 /* PROOF_TYPE_HMAC_LEGACY */,
+              proof_type: workerResponse.proof_type === 3 /* GROTH16_PQC_HYBRID */ ? 3 /* PROOF_TYPE_GROTH16_PQC_HYBRID */ : workerResponse.proof_type === 2 /* GROTH16 */ ? 2 /* PROOF_TYPE_GROTH16 */ : 0 /* PROOF_TYPE_HMAC_LEGACY */,
               guest_image_id: workerResponse.guest_image_id || toolPolicy?.guestImageId || this.config?.guestImageId || ""
             };
             const violation = await this.piiScanner.scan(validationOutput);
@@ -3395,10 +3403,11 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
         // Use plaintext for local Logic-on-Origin injection
         proofMode,
         guestImageId: dpPolicy?.guestImageId ?? this.config?.guestImageId,
+        pqcSigningKey: dpPolicy?.pqcSign ? this.enclavePqcKeypair?.secretKey : void 0,
         dpConfig
         // Pass DP Config to apply inside worker before ZK-Receipt commitment
       });
-      if (proofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */) {
+      if (proofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */ && workerResponse.proof_type !== 3 /* GROTH16_PQC_HYBRID */) {
         return {
           content: [
             {
@@ -3415,7 +3424,7 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
         computation_result: sanitizedOutput,
         image_id: workerResponse.image_id,
         zk_receipt: workerResponse.zk_receipt,
-        proof_type: workerResponse.proof_type === 2 /* GROTH16 */ ? "GROTH16" : "HMAC_LEGACY",
+        proof_type: workerResponse.proof_type === 3 /* GROTH16_PQC_HYBRID */ ? "GROTH16_PQC_HYBRID" : workerResponse.proof_type === 2 /* GROTH16 */ ? "GROTH16" : "HMAC_LEGACY",
         guest_image_id: workerResponse.guest_image_id,
         status: "Worker Pool Execution Success"
       });
@@ -3739,5 +3748,5 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
 };
 
 export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger };
-//# sourceMappingURL=chunk-T2QDHVUD.js.map
-//# sourceMappingURL=chunk-T2QDHVUD.js.map
+//# sourceMappingURL=chunk-ZU3WVVLC.js.map
+//# sourceMappingURL=chunk-ZU3WVVLC.js.map

package/dist/client.d.ts

@@ -1,8 +1,8 @@
-import './verifier-DTn1LXDU.js';
+import './verifier-DqZ9MQ9l.js';
 import './node-Djzm6UYd.js';
-export { c as LiopClient } from './index-DDwiS7tf.js';
-import './zk-CYImPsa6.js';
-import './types-rxL19f0l.js';
+export { c as LiopClient } from './index-BYDtRGue.js';
+import './zk-DzYNWBgo.js';
+import './types-29zv9X1V.js';
 import '@grpc/grpc-js';
 import 'node:events';
 import 'zod';

package/dist/client.js

@@ -1,13 +1,13 @@
-export { LiopClient } from './chunk-3WKFZQ34.js';
+export { LiopClient } from './chunk-S3RAZTEM.js';
 import './chunk-3QH44NKZ.js';
-import './chunk-ZRWNMP5L.js';
+import './chunk-WXYDFCIW.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
-import './chunk-GFGSHQN5.js';
+import './chunk-JPWC6XG6.js';
 import './chunk-Q3FKHJ3B.js';
-import './chunk-YLFNJQI2.js';
-import './chunk-P34HDRN5.js';
-import './chunk-KB3HUVMD.js';
+import './chunk-KR5UZUEY.js';
+import './chunk-FIVRGOA4.js';
+import './chunk-IHKKWXHJ.js';
 import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,8 +1,8 @@
 import './node-Djzm6UYd.js';
-import './index-D2P6Z_hP.js';
-import './types-rxL19f0l.js';
-export { L as LiopHybridGateway } from './hybrid-B7EjCj3q.js';
+import './index-ByzjpRCk.js';
+import './types-29zv9X1V.js';
+export { L as LiopHybridGateway } from './hybrid-BZpCiUaV.js';
 import 'zod';
-import './zk-CYImPsa6.js';
+import './zk-DzYNWBgo.js';
 import 'jose';
-import './verifier-DTn1LXDU.js';
+import './verifier-DqZ9MQ9l.js';

package/dist/gateway.js

@@ -1,13 +1,14 @@
-export { LiopHybridGateway } from './chunk-E7RSX476.js';
-import './chunk-AMSFSS2I.js';
-import './chunk-ZRWNMP5L.js';
+export { LiopHybridGateway } from './chunk-6MYJBM2E.js';
+import './chunk-DSOB2JKM.js';
+import './chunk-WXYDFCIW.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
-import './chunk-WPTOJYN5.js';
-import './chunk-GFGSHQN5.js';
+import './chunk-NXCAFF73.js';
+import './chunk-3664H3CV.js';
+import './chunk-JPWC6XG6.js';
 import './chunk-Q3FKHJ3B.js';
-import './chunk-YLFNJQI2.js';
-import './chunk-P34HDRN5.js';
+import './chunk-KR5UZUEY.js';
+import './chunk-FIVRGOA4.js';
 import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/{hybrid-B7EjCj3q.d.ts → hybrid-BZpCiUaV.d.ts}

@@ -1,7 +1,7 @@
 import { a as MeshNode } from './node-Djzm6UYd.js';
-import { L as LiopServer } from './index-D2P6Z_hP.js';
-import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-rxL19f0l.js';
-import { L as LiopVerifier } from './verifier-DTn1LXDU.js';
+import { L as LiopServer } from './index-ByzjpRCk.js';
+import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-29zv9X1V.js';
+import { L as LiopVerifier } from './verifier-DqZ9MQ9l.js';
 
 /**
  * LIOP Sliding-Window Rate Limiter

package/dist/{index-DDwiS7tf.d.ts → index-BYDtRGue.d.ts}

@@ -1,9 +1,9 @@
-import { L as LiopVerifier } from './verifier-DTn1LXDU.js';
+import { L as LiopVerifier } from './verifier-DqZ9MQ9l.js';
 import { M as MeshNodeConfig } from './node-Djzm6UYd.js';
 import * as grpc from '@grpc/grpc-js';
 import { EventEmitter } from 'node:events';
-import { Z as ZkPolicy } from './zk-CYImPsa6.js';
-import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-rxL19f0l.js';
+import { Z as ZkPolicy } from './zk-DzYNWBgo.js';
+import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-29zv9X1V.js';
 
 interface CertManagerOptions {
     /** Path to the root CA certificate (PEM format) */

package/dist/{index-D2P6Z_hP.d.ts → index-ByzjpRCk.d.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { M as MeshNodeConfig, a as MeshNode } from './node-Djzm6UYd.js';
-import { d as AuditLogger, J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, e as GetPromptRequest, f as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-rxL19f0l.js';
+import { d as AuditLogger, J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, e as GetPromptRequest, f as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-29zv9X1V.js';
 
 /**
  * LIOP OAuth 2.1 Hybrid Auth — Configuration Types
@@ -354,6 +354,10 @@ interface LogicExecutionPolicy {
      * Static verification key JSON structure for this capability.
      */
     vkey?: Record<string, unknown>;
+    /**
+     * Whether to co-sign the Groth16 receipt with an ML-DSA-65 post-quantum digital signature (FIPS 204).
+     */
+    pqcSign?: boolean;
 }
 declare class LiopServer {
     private serverInfo;
@@ -380,6 +384,7 @@ declare class LiopServer {
     private meshNode;
     private rpcServer;
     private boundPort;
+    private enclavePqcKeypair?;
     jwtValidator?: JwtValidator;
     oauthProvider?: any;
     private sessions;