@nekzus/liop 2.4.0-alpha.24 → 2.4.0-alpha.25

package/README.md

@@ -60,8 +60,8 @@ This addresses the data privacy, bandwidth, and latency bottlenecks of distribut
 | **Resilient Hybrid Routing**  | Deterministic per-tool multiplexing across `http-gateway`, `p2p-grpc`, and `local` with 5-failure circuit breaker (`RoutingTable`).|
 | **OAuth 2.1 M2M Lifecycle**   | Concurrency in-flight de-duplication, 30-second preemptive refresh buffer, and reactive invalidation (`TokenManager`).            |
 | **Sliding-Window Rate Limiter**| In-memory OWASP API4:2023 rate limiting with background cleanup unreferenced intervals (`InMemoryRateLimiter`).                    |
-| **PII Shield**                | Multi-layer egress filter with Regional Presets, custom keys, and recursive floats sanitization (`sanitizeOutput`). |
-| **ZK-Receipts**               | Sovereign Zero-Knowledge Proofs: Groth16 BN254 with 144-byte binary journal (v2) and legacy HMAC-SHA256 (v1). Enforces `ZK_BLOCKING` on Tier 1 Enclaves. |
+| **ZK-Receipts**               | Tri-modal Zero-Knowledge proofs: HMAC-SHA256 (v1), Groth16 BN254 with 144-byte binary journal (v2), and dual-layer ML-DSA-65 post-quantum hybrid receipts (v2.1). Enforces `ZK_BLOCKING` on Tier 1 Enclaves. |
+| **Hardware TEE Attestation** | Pre-flight validation of confidential hardware root-of-trust evidence for AMD SEV-SNP (1,184-byte report) and AWS Nitro Enclaves (`verifyTeeAttestationDetailed`). |
 | **Worker Pool**               | Heavy computation (crypto, sandboxing) dispatched to OS threads via `piscina` with background async warmup. |
 | **Post-Quantum Ready**        | ML-KEM-768 (Kyber) + ML-DSA-65 (Dilithium) with 1-hour session lifetime and AES-256-GCM encryption.                                        |
 | **Enterprise Observability**  | Immutable SOC 2 Hash-Chain audit log (`AuditLogger`), physical wire egress tracking, Prometheus metrics (`/metrics`), and K8s probes.      |
@@ -451,25 +451,28 @@ To block arbitrary command execution (e.g., Shellshock) and prevent exposure of
 - **Unix/Linux Allowlist**: `HOME`, `LOGNAME`, `PATH`, `SHELL`, `TERM`, `USER`.
 Variables starting with shell functions `()` are dropped.
 
-### Sovereign ZK-Receipts & Groth16 Attestation
+### Sovereign Tri-Modal ZK-Receipts & Hardware Attestation
 
-LIOP ZK-Receipts provide cryptographic evidence that a computation was executed honestly under zero-trust bounds. Version 2 receipts introduce true Zero-Knowledge Groth16 proofs over the BN254 pairing-friendly elliptic curve, packing a 144-byte binary journal:
+LIOP ZK-Receipts provide cryptographic evidence that a computation was executed honestly under zero-trust bounds. The protocol implements three complementary cryptographic modes:
+- **Mode 0 (`HMAC_LEGACY`, v1)**: Session commitments sealed with the ML-KEM-768 quantum-resistant shared key.
+- **Mode 2 (`GROTH16`, v2)**: Compact Zero-Knowledge SNARK proofs over the BN254 pairing-friendly elliptic curve packing a 144-byte binary journal (~252 bytes total).
+- **Mode 3 (`GROTH16_PQC_HYBRID`, v2.1)**: Dual-layer receipts combining Groth16 BN254 mathematical proofs with an ML-DSA-65 post-quantum digital signature conforming to NIST FIPS 204 (~5.6 KB total).
 
 - **144-Byte Binary Journal Layout**:
   - `guest_image_id` (32 bytes): Sovereign enclave guest runtime image identifier
   - `logic_digest` (32 bytes): SHA-256 fingerprint of the executed JavaScript/WASM logic
   - `dataset_digest` (32 bytes): SHA-256 fingerprint of the origin dataset at execution time
   - `output_digest` (32 bytes): SHA-256 fingerprint of the sanitized computation result
-  - `fuel_consumed` (8 bytes uint64 BE): AST fuel metering units consumed
+  - `fuel_consumed` (8 bytes uint64 BE): Quantized instruction-level AST fuel units consumed
   - `execution_timestamp` (8 bytes uint64 BE): Epoch timestamp in milliseconds
-- **Tampering & Replay Mitigation**: The client computes the local SHA-256 hash of the received output and asserts strict equality with `journal.outputDigest`. Any modified bit in either the journal or curve proof causes immediate rejection.
-- **Enclave Policy Invariant (`ZK_BLOCKING`)**: Tier 1 Sovereign Enclaves configure `zkMode: "required"`, rejecting queries if a valid Groth16 proof cannot be synthesized.
+- **Tampering & Replay Mitigation**: The client computes the local SHA-256 hash of the received output and asserts strict equality with `journal.outputDigest`. Any modified bit in either the journal, curve proof, or post-quantum signature causes immediate rejection.
+- **Enclave Policy Invariant (`ZK_BLOCKING`)**: Tier 1 Sovereign Enclaves configure `zkMode: "required"`, rejecting queries if a valid Groth16 proof cannot be synthesized or if mock proofs are supplied. When `pqcSign: true` is configured, the enclave emits a Version 2.1 hybrid receipt co-signed with ML-DSA-65.
 
 ```typescript
 import { LiopServer } from "@nekzus/liop/server";
-import { LiopVerifier } from "@nekzus/liop";
+import { LiopVerifier, verifyTeeAttestationDetailed } from "@nekzus/liop";
 
-// 1. Enclave configuration with ZK_BLOCKING policy
+// 1. Enclave configuration with ZK_BLOCKING and PQC signing
 const server = new LiopServer({ name: "bank-enclave", version: "1.0.0" });
 server.tool(
   "calculate_payroll_aggregate",
@@ -478,6 +481,7 @@ server.tool(
   async () => ({ content: [{ type: "text", text: "ok" }] }),
   {
     zkMode: "required", // Enforces Groth16 proof generation (ZK_BLOCKING)
+    pqcSign: true,      // Enables ML-DSA-65 digital signature (Receipt v2.1)
     circuitName: "sum",
   }
 );
@@ -490,6 +494,13 @@ const isValid = await verifier.verifyZkReceipt(
   rawReceiptBuffer,
   { zkPolicy: "required" }
 );
+
+// 3. Pre-flight Hardware TEE Attestation (AMD SEV-SNP / AWS Nitro Enclaves)
+const teeStatus = await verifyTeeAttestationDetailed(
+  attestationBytes,
+  expectedNonce,
+  { requireHardwareSigned: true }
+);
 ```
 
 ---
@@ -505,7 +516,7 @@ The following shows a complete Logic-Injection-on-Origin execution cycle (handle
 4. Code executes inside a V8 isolate with CPU fuel limits (no Node.js globals)
 5. Taint Analyzer blocks PII side-channel derivation (charCodeAt, boolean inference)
 6. PII Shield scans output for forbidden data and keys
-7. ZK-Receipt generated (SHA-256 ImageID + HMAC-SHA256 seal)
+7. ZK-Receipt generated (Tri-modal: HMAC v1, Groth16 v2, or Groth16 + ML-DSA-65 v2.1)
 8. Result + receipt returned to the LLM (raw data never exposed)
 ```
 

package/dist/bin/agent.js

@@ -1,17 +1,18 @@
 #!/usr/bin/env node
 import { probeTopology, RoutingTable } from '../chunk-V47P2AQR.js';
 import { TokenManager } from '../chunk-3QH44NKZ.js';
-import { LiopServer } from '../chunk-JWFLXXZS.js';
+import { LiopServer } from '../chunk-ZU3WVVLC.js';
 import '../chunk-Y62GORQF.js';
-import { LiopMcpRouter } from '../chunk-IDTXJQBH.js';
-import '../chunk-ZRWNMP5L.js';
+import { LiopMcpRouter } from '../chunk-DSOB2JKM.js';
+import '../chunk-WXYDFCIW.js';
 import '../chunk-IK7CGWAZ.js';
 import '../chunk-7PITYWOV.js';
-import '../chunk-WPTOJYN5.js';
-import '../chunk-GFGSHQN5.js';
+import '../chunk-NXCAFF73.js';
+import '../chunk-3664H3CV.js';
+import '../chunk-JPWC6XG6.js';
 import '../chunk-Q3FKHJ3B.js';
 import { normalizeToolArguments, TOOL_ALIASES, isLegacyRequest } from '../chunk-KR5UZUEY.js';
-import '../chunk-P34HDRN5.js';
+import '../chunk-FIVRGOA4.js';
 import '../chunk-FTF6AMF6.js';
 import '../chunk-ZP3VVXOI.js';
 import { MeshNode } from '../chunk-IHKKWXHJ.js';

package/dist/bridge.d.ts

@@ -1,9 +1,9 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { L as LiopServer, a as LiopServerOptions } from './index-D2P6Z_hP.js';
+import { L as LiopServer, a as LiopServerOptions } from './index-ByzjpRCk.js';
 import 'zod';
 import './node-Djzm6UYd.js';
-import './types-rxL19f0l.js';
-import './zk-CYImPsa6.js';
+import './types-29zv9X1V.js';
+import './zk-DzYNWBgo.js';
 import 'jose';
 
 /**

package/dist/bridge.js

@@ -1,6 +1,6 @@
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-2VQS2XRH.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-WXOWJXY6.js';
 import './chunk-KR5UZUEY.js';
-import './chunk-P34HDRN5.js';
+import './chunk-FIVRGOA4.js';
 import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=bridge.js.map
 //# sourceMappingURL=bridge.js.map

package/dist/{chunk-WPTOJYN5.js → chunk-3664H3CV.js}

@@ -48,6 +48,17 @@ var Dilithium65Wrapper = {
       secretKey: keys.secretKey
     };
   },
+  /**
+   * Derives the ML-DSA-65 public key from a given secret key.
+   */
+  getPublicKey(secretKey) {
+    if (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {
+      throw new Error(
+        `ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`
+      );
+    }
+    return ml_dsa65.getPublicKey(secretKey);
+  },
   /**
    * Validates and imports a raw ML-DSA-65 public key.
    */
@@ -120,62 +131,6 @@ var Dilithium65Wrapper = {
   }
 };
 
-// src/security/rbac.ts
-var SCOPE_MAP = {
-  // Protocol lifecycle — unauthenticated (MCP spec compliance)
-  initialize: [],
-  "notifications/initialized": [],
-  "notifications/cancelled": [],
-  ping: [],
-  "server/discover": [],
-  "subscriptions/listen": [],
-  // Tool operations — require explicit authorization
-  "tools/list": ["liop:tools:list"],
-  "tools/call": ["liop:tools:call"],
-  // Resource operations — read-level access
-  "resources/list": ["liop:resources:read"],
-  "resources/read": ["liop:resources:read"],
-  "resources/templates/list": ["liop:resources:read"],
-  // Prompt/schema operations — schema-level access
-  "prompts/list": ["liop:schema:read"],
-  "prompts/get": ["liop:schema:read"]
-};
-function authorizeRequest(method, auth, additionalScopes) {
-  const methodScopes = SCOPE_MAP[method];
-  if (methodScopes !== void 0 && methodScopes.length === 0) {
-    return { allowed: true };
-  }
-  if (!auth) {
-    return {
-      allowed: false,
-      reason: `Authentication required for method: ${method}`
-    };
-  }
-  const needed = [...methodScopes ?? [], ...additionalScopes ?? []];
-  if (needed.length === 0) {
-    return {
-      allowed: false,
-      reason: `Unknown method: ${method}. Access denied (fail-closed).`
-    };
-  }
-  const clientScopes = new Set(auth.scopes);
-  const missing = needed.filter((s) => !clientScopes.has(s));
-  if (missing.length > 0) {
-    return {
-      allowed: false,
-      reason: `Insufficient scopes for ${method}. Missing: ${missing.join(", ")}`
-    };
-  }
-  return { allowed: true };
-}
-var LIOP_SCOPES = [
-  "liop:tools:list",
-  "liop:tools:call",
-  "liop:resources:read",
-  "liop:schema:read",
-  "liop:mesh:query"
-];
-
-export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest };
-//# sourceMappingURL=chunk-WPTOJYN5.js.map
-//# sourceMappingURL=chunk-WPTOJYN5.js.map
+export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper };
+//# sourceMappingURL=chunk-3664H3CV.js.map
+//# sourceMappingURL=chunk-3664H3CV.js.map

package/dist/{chunk-53QKIQNF.js → chunk-6MYJBM2E.js}

@@ -1,5 +1,5 @@
-import { LiopMcpRouter } from './chunk-IDTXJQBH.js';
-import { LIOP_SCOPES } from './chunk-WPTOJYN5.js';
+import { LiopMcpRouter } from './chunk-DSOB2JKM.js';
+import { LIOP_SCOPES } from './chunk-NXCAFF73.js';
 import { meshPeersConnected, manifestCacheSize, protocolMetrics } from './chunk-Q3FKHJ3B.js';
 import { log } from './chunk-K3DGJLUY.js';
 import * as http from 'http';
@@ -814,5 +814,5 @@ var LiopHybridGateway = class {
 };
 
 export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest };
-//# sourceMappingURL=chunk-53QKIQNF.js.map
-//# sourceMappingURL=chunk-53QKIQNF.js.map
+//# sourceMappingURL=chunk-6MYJBM2E.js.map
+//# sourceMappingURL=chunk-6MYJBM2E.js.map

package/dist/{chunk-IDTXJQBH.js → chunk-DSOB2JKM.js}

@@ -1,7 +1,8 @@
-import { LiopVerifier } from './chunk-ZRWNMP5L.js';
+import { LiopVerifier } from './chunk-WXYDFCIW.js';
 import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-import { authorizeRequest, Dilithium65Wrapper } from './chunk-WPTOJYN5.js';
-import { TokenTelemetryEngine, liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-GFGSHQN5.js';
+import { authorizeRequest } from './chunk-NXCAFF73.js';
+import { Dilithium65Wrapper } from './chunk-3664H3CV.js';
+import { TokenTelemetryEngine, liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-JPWC6XG6.js';
 import { toolCallsTotal, toolCallErrorsTotal, pqcHandshakeDurationMs, pqcHandshakesTotal, zkVerificationsTotal, wireEgressBytesTotal } from './chunk-Q3FKHJ3B.js';
 import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, adaptResponseForLegacyClient, MCP_PROTOCOL_VERSION_LEGACY, buildLegacyInitializeResponse, TOOL_ALIASES, normalizeToolArguments } from './chunk-KR5UZUEY.js';
 import { log } from './chunk-K3DGJLUY.js';
@@ -1502,5 +1503,5 @@ ${cachedToolList}` : "\nNo remote tools discovered yet.",
 };
 
 export { LiopMcpRouter };
-//# sourceMappingURL=chunk-IDTXJQBH.js.map
-//# sourceMappingURL=chunk-IDTXJQBH.js.map
+//# sourceMappingURL=chunk-DSOB2JKM.js.map
+//# sourceMappingURL=chunk-DSOB2JKM.js.map

package/dist/{chunk-OHMZZMMC.js → chunk-ET6VRUK2.js}

@@ -1,4 +1,4 @@
-import { ZkVerificationError } from './chunk-P34HDRN5.js';
+import { ZkVerificationError } from './chunk-FIVRGOA4.js';
 import { bn254, stringBigints } from 'micro-zk-proofs';
 
 var VERIFICATION_LATENCY_BUDGET_MS = 250;
@@ -54,5 +54,5 @@ function deserializeGrothProof(buf) {
 }
 
 export { VERIFICATION_LATENCY_BUDGET_MS, deserializeGrothProof, deserializeVKey, serializeGrothProof, serializeVKey, verifyGroth16Proof };
-//# sourceMappingURL=chunk-OHMZZMMC.js.map
-//# sourceMappingURL=chunk-OHMZZMMC.js.map
+//# sourceMappingURL=chunk-ET6VRUK2.js.map
+//# sourceMappingURL=chunk-ET6VRUK2.js.map

package/dist/{chunk-P34HDRN5.js → chunk-FIVRGOA4.js}

@@ -4,6 +4,7 @@ import crypto from 'crypto';
 var ProofType = /* @__PURE__ */ ((ProofType2) => {
   ProofType2[ProofType2["HMAC_LEGACY"] = 0] = "HMAC_LEGACY";
   ProofType2[ProofType2["GROTH16"] = 2] = "GROTH16";
+  ProofType2[ProofType2["GROTH16_PQC_HYBRID"] = 3] = "GROTH16_PQC_HYBRID";
   return ProofType2;
 })(ProofType || {});
 var RECEIPT_VERSION_V1 = 1;
@@ -74,6 +75,36 @@ var receiptCodec = {
     const checksum = crypto.createHash("sha256").update(payload).digest();
     return Buffer.concat([payload, checksum]);
   },
+  /**
+   * Encodes a version 2.1 Hybrid Binary Receipt (Groth16 + ML-DSA-65 co-sign).
+   * Layout:
+   * [0x02][0x03 ProofType.GROTH16_PQC_HYBRID][journalLen: 4B UInt32BE][journal: 144B]
+   * [proofLen: 2B UInt16BE][groth16 proof: ~260B]
+   * [sigLen: 2B UInt16BE][signature: 3309B]
+   * [publicKey: 1952B]
+   * [checksum: 32B SHA-256]
+   */
+  encodeHybridV2(journal, proof, pqcSignature, pqcPublicKey) {
+    const header = Buffer.alloc(6);
+    header.writeUInt8(RECEIPT_VERSION_V2, 0);
+    header.writeUInt8(3 /* GROTH16_PQC_HYBRID */, 1);
+    header.writeUInt32BE(journal.length, 2);
+    const proofLenBuf = Buffer.alloc(2);
+    proofLenBuf.writeUInt16BE(proof.length, 0);
+    const sigLenBuf = Buffer.alloc(2);
+    sigLenBuf.writeUInt16BE(pqcSignature.length, 0);
+    const payload = Buffer.concat([
+      header,
+      journal,
+      proofLenBuf,
+      proof,
+      sigLenBuf,
+      pqcSignature,
+      pqcPublicKey
+    ]);
+    const checksum = crypto.createHash("sha256").update(payload).digest();
+    return Buffer.concat([payload, checksum]);
+  },
   /**
    * Decodes any LIOP Binary Receipt (v1 HMAC or v2 ZK).
    */
@@ -128,6 +159,42 @@ var receiptCodec = {
         throw new ZkVerificationError("Receipt checksum verification failed.");
       }
       const journal = Buffer.from(raw.subarray(6, 6 + journalLen));
+      if (proofType === 3 /* GROTH16_PQC_HYBRID */) {
+        let offset = 6 + journalLen;
+        if (raw.length < offset + 2 + 32) {
+          throw new ZkVerificationError(
+            "Malformed hybrid receipt: missing proof length header."
+          );
+        }
+        const proofLen = raw.readUInt16BE(offset);
+        offset += 2;
+        if (raw.length < offset + proofLen + 2 + 32) {
+          throw new ZkVerificationError(
+            "Malformed hybrid receipt: truncated Groth16 proof."
+          );
+        }
+        const proof2 = Buffer.from(raw.subarray(offset, offset + proofLen));
+        offset += proofLen;
+        const sigLen = raw.readUInt16BE(offset);
+        offset += 2;
+        if (raw.length < offset + sigLen + 32) {
+          throw new ZkVerificationError(
+            "Malformed hybrid receipt: truncated ML-DSA-65 signature."
+          );
+        }
+        const pqcSignature = Buffer.from(raw.subarray(offset, offset + sigLen));
+        offset += sigLen;
+        const pqcPublicKey = Buffer.from(raw.subarray(offset, raw.length - 32));
+        return {
+          version: RECEIPT_VERSION_V2,
+          proofType,
+          journal,
+          proof: proof2,
+          pqcSignature,
+          pqcPublicKey,
+          raw
+        };
+      }
       const proof = Buffer.from(raw.subarray(6 + journalLen, raw.length - 32));
       return {
         version: RECEIPT_VERSION_V2,
@@ -209,5 +276,5 @@ var ZkVerifier = {
 };
 
 export { ProofType, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, ZK_JOURNAL_V2_SIZE, ZkVerificationError, ZkVerifier, decodeJournalV2, encodeJournalV2, receiptCodec };
-//# sourceMappingURL=chunk-P34HDRN5.js.map
-//# sourceMappingURL=chunk-P34HDRN5.js.map
+//# sourceMappingURL=chunk-FIVRGOA4.js.map
+//# sourceMappingURL=chunk-FIVRGOA4.js.map