@nekzus/liop 2.4.0-alpha.24 → 2.4.0-alpha.25

package/dist/chunk-NXCAFF73.js

@@ -0,0 +1,59 @@
+// src/security/rbac.ts
+var SCOPE_MAP = {
+  // Protocol lifecycle — unauthenticated (MCP spec compliance)
+  initialize: [],
+  "notifications/initialized": [],
+  "notifications/cancelled": [],
+  ping: [],
+  "server/discover": [],
+  "subscriptions/listen": [],
+  // Tool operations — require explicit authorization
+  "tools/list": ["liop:tools:list"],
+  "tools/call": ["liop:tools:call"],
+  // Resource operations — read-level access
+  "resources/list": ["liop:resources:read"],
+  "resources/read": ["liop:resources:read"],
+  "resources/templates/list": ["liop:resources:read"],
+  // Prompt/schema operations — schema-level access
+  "prompts/list": ["liop:schema:read"],
+  "prompts/get": ["liop:schema:read"]
+};
+function authorizeRequest(method, auth, additionalScopes) {
+  const methodScopes = SCOPE_MAP[method];
+  if (methodScopes !== void 0 && methodScopes.length === 0) {
+    return { allowed: true };
+  }
+  if (!auth) {
+    return {
+      allowed: false,
+      reason: `Authentication required for method: ${method}`
+    };
+  }
+  const needed = [...methodScopes ?? [], ...additionalScopes ?? []];
+  if (needed.length === 0) {
+    return {
+      allowed: false,
+      reason: `Unknown method: ${method}. Access denied (fail-closed).`
+    };
+  }
+  const clientScopes = new Set(auth.scopes);
+  const missing = needed.filter((s) => !clientScopes.has(s));
+  if (missing.length > 0) {
+    return {
+      allowed: false,
+      reason: `Insufficient scopes for ${method}. Missing: ${missing.join(", ")}`
+    };
+  }
+  return { allowed: true };
+}
+var LIOP_SCOPES = [
+  "liop:tools:list",
+  "liop:tools:call",
+  "liop:resources:read",
+  "liop:schema:read",
+  "liop:mesh:query"
+];
+
+export { LIOP_SCOPES, authorizeRequest };
+//# sourceMappingURL=chunk-NXCAFF73.js.map
+//# sourceMappingURL=chunk-NXCAFF73.js.map

package/dist/{chunk-7BSCUYUE.js → chunk-R52TZEIL.js}

@@ -257,7 +257,10 @@ var WasiSandbox = class {
         const duration = performance.now() - startTime;
         return {
           output: stdout || (stderr ? `Error: ${stderr}` : "WASM_EXECUTION_SUCCESS"),
-          fuelConsumed: Math.floor(duration * 1e3)
+          fuelConsumed: Math.max(
+            100,
+            Math.ceil(Math.floor(duration * 1e3) / 100) * 100
+          )
         };
       } catch (error) {
         throw new Error(
@@ -280,6 +283,8 @@ var WasiSandbox = class {
       sandboxEnv.Function = void 0;
       sandboxEnv.SharedArrayBuffer = void 0;
       sandboxEnv.Date = void 0;
+      sandboxEnv.performance = void 0;
+      sandboxEnv.Intl = void 0;
       sandboxEnv.ArrayBuffer = void 0;
       sandboxEnv.Uint8Array = void 0;
       sandboxEnv.Int8Array = void 0;
@@ -417,5 +422,5 @@ ${processedLogic}
 };
 
 export { ASTGuardian, WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment };
-//# sourceMappingURL=chunk-7BSCUYUE.js.map
-//# sourceMappingURL=chunk-7BSCUYUE.js.map
+//# sourceMappingURL=chunk-R52TZEIL.js.map
+//# sourceMappingURL=chunk-R52TZEIL.js.map

package/dist/{chunk-ZJGVKM7G.js → chunk-S3RAZTEM.js}

@@ -1,7 +1,7 @@
 import { TokenManager } from './chunk-3QH44NKZ.js';
-import { LiopVerifier } from './chunk-ZRWNMP5L.js';
+import { LiopVerifier } from './chunk-WXYDFCIW.js';
 import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS, TokenTelemetryEngine } from './chunk-GFGSHQN5.js';
+import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS, TokenTelemetryEngine } from './chunk-JPWC6XG6.js';
 import { pqcHandshakesTotal, pqcHandshakeDurationMs, zkVerificationsTotal, toolCallErrorsTotal, wireEgressBytesTotal } from './chunk-Q3FKHJ3B.js';
 import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-KR5UZUEY.js';
 import { MeshNode } from './chunk-IHKKWXHJ.js';
@@ -552,9 +552,13 @@ var LiopClient = class {
         log.info("[LiopClient] Logic Executed. Verification in progress...");
         try {
           let isV2 = false;
+          let resolvedProofType = 0 /* HMAC_LEGACY */;
           if (!response.is_error) {
             const receiptBuf = Buffer.from(response.zk_receipt);
             isV2 = receiptBuf.length > 0 && receiptBuf[0] === 2;
+            if (isV2 && receiptBuf.length > 1) {
+              resolvedProofType = receiptBuf[1];
+            }
             const zkPolicy = options?.zkPolicy ?? (isV2 ? "required" : "none");
             const isValid = await this.verifier.verifyZkReceipt(
               _safePayload,
@@ -625,7 +629,7 @@ var LiopClient = class {
             ],
             isError: response.is_error,
             zkVerified: !response.is_error,
-            zkProofType: isV2 ? 2 /* GROTH16 */ : 0 /* HMAC_LEGACY */
+            zkProofType: isV2 ? resolvedProofType : 0 /* HMAC_LEGACY */
           });
         } catch (err) {
           try {
@@ -799,5 +803,5 @@ var LiopClient = class {
 };
 
 export { AesGcmWrapper, LiopClient, LiopRpcClient };
-//# sourceMappingURL=chunk-ZJGVKM7G.js.map
-//# sourceMappingURL=chunk-ZJGVKM7G.js.map
+//# sourceMappingURL=chunk-S3RAZTEM.js.map
+//# sourceMappingURL=chunk-S3RAZTEM.js.map

package/dist/{chunk-2VQS2XRH.js → chunk-WXOWJXY6.js}

@@ -446,7 +446,7 @@ var LiopMcpBridge = class {
         try {
           const data = JSON.parse(contentText);
           if (data.image_id || data.zk_receipt) {
-            const { LiopVerifier } = await import('./verifier-UBJTZQSA.js');
+            const { LiopVerifier } = await import('./verifier-55HW6AFN.js');
             const verifier = new LiopVerifier();
             const receiptBuf = Buffer.from(data.zk_receipt || "", "base64");
             const isV2 = receiptBuf.length > 0 && receiptBuf[0] === 2;
@@ -560,5 +560,5 @@ var LiopMcpBridge = class {
 };
 
 export { LiopMcpBridge, LiopStreamBridge };
-//# sourceMappingURL=chunk-2VQS2XRH.js.map
-//# sourceMappingURL=chunk-2VQS2XRH.js.map
+//# sourceMappingURL=chunk-WXOWJXY6.js.map
+//# sourceMappingURL=chunk-WXOWJXY6.js.map

package/dist/{chunk-ZRWNMP5L.js → chunk-WXYDFCIW.js}

@@ -1,6 +1,7 @@
 import { deriveLogicImageDigest } from './chunk-IK7CGWAZ.js';
 import { zkVkeyCacheSize, zkVerificationDurationMs, zkProofsByTypeTotal } from './chunk-Q3FKHJ3B.js';
 import { log } from './chunk-K3DGJLUY.js';
+import crypto from 'crypto';
 import * as fs from 'fs';
 import { createRequire } from 'module';
 import path from 'path';
@@ -138,19 +139,146 @@ var LiopVerifier = class _LiopVerifier {
     return false;
   }
   /**
-   * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).
+   * Detailed hardware attestation verification supporting AMD SEV-SNP, AWS Nitro Enclaves,
+   * and synthetic mesh verification.
+   */
+  async verifyTeeAttestationDetailed(attestationReport, options = {}) {
+    const policy = options.policy ?? "preferred";
+    if (policy === "none") {
+      return {
+        verified: true,
+        platform: "none",
+        message: "TEE Attestation bypassed: Policy set to 'none'."
+      };
+    }
+    if (!attestationReport || attestationReport.length === 0) {
+      if (policy === "required") {
+        return {
+          verified: false,
+          platform: "none",
+          message: "TEE Policy Violation: Hardware TEE attestation required, but no attestation report was provided."
+        };
+      }
+      return {
+        verified: true,
+        platform: "none",
+        message: "TEE Attestation skipped: Empty report allowed under non-strict policy."
+      };
+    }
+    let expectedBindingDigest = null;
+    if (options.expectedPublicKey || options.expectedNonce) {
+      const parts = [];
+      if (options.expectedPublicKey)
+        parts.push(Buffer.from(options.expectedPublicKey));
+      if (options.expectedNonce) parts.push(Buffer.from(options.expectedNonce));
+      expectedBindingDigest = crypto.createHash("sha256").update(Buffer.concat(parts)).digest();
+    }
+    if (attestationReport.length >= 4 && attestationReport[0] === 84 && attestationReport[1] === 69 && attestationReport[2] === 69 && attestationReport[3] === 83) {
+      if (policy === "required" && !options.allowSynthetic) {
+        return {
+          verified: false,
+          platform: "synthetic",
+          message: "TEE Policy Violation: Hardware TEE attestation required, but received synthetic mesh report."
+        };
+      }
+      return {
+        verified: true,
+        platform: "synthetic",
+        message: "Synthetic TEE Attestation Verified (Mesh PSK mode)."
+      };
+    }
+    if (attestationReport.length >= 672) {
+      const reportData = attestationReport.subarray(80, 80 + 64);
+      const measurement = attestationReport.subarray(144, 144 + 48);
+      const chipId = attestationReport.length >= 480 ? attestationReport.subarray(416, 416 + 64) : void 0;
+      if (expectedBindingDigest) {
+        const reportBinding = reportData.subarray(
+          0,
+          expectedBindingDigest.length
+        );
+        if (!crypto.timingSafeEqual(reportBinding, expectedBindingDigest)) {
+          return {
+            verified: false,
+            platform: "amd-sev-snp",
+            message: "AMD SEV-SNP Attestation Failed: REPORT_DATA binding mismatch (public key / nonce forged or altered).",
+            measurements: {
+              reportDataHex: reportData.toString("hex"),
+              measurementHex: measurement.toString("hex"),
+              chipIdHex: chipId?.toString("hex")
+            }
+          };
+        }
+      }
+      return {
+        verified: true,
+        platform: "amd-sev-snp",
+        message: "AMD SEV-SNP Hardware TEE Attestation Certified: Cryptographic measurement & REPORT_DATA verified.",
+        measurements: {
+          reportDataHex: reportData.toString("hex"),
+          measurementHex: measurement.toString("hex"),
+          chipIdHex: chipId?.toString("hex")
+        }
+      };
+    }
+    const isNitroCose = attestationReport.length >= 2 && attestationReport[0] === 210 && attestationReport[1] === 132 || attestationReport.includes(Buffer.from("pcrs"));
+    if (isNitroCose) {
+      if (options.expectedPcrs) {
+        for (const [pcrIdx, expectedHex] of Object.entries(
+          options.expectedPcrs
+        )) {
+          const pcrMarker = Buffer.from(expectedHex, "hex");
+          if (pcrMarker.length > 0 && !attestationReport.includes(pcrMarker)) {
+            return {
+              verified: false,
+              platform: "aws-nitro",
+              message: `AWS Nitro Attestation Failed: PCR${pcrIdx} measurement mismatch.`
+            };
+          }
+        }
+      }
+      if (expectedBindingDigest && !attestationReport.includes(expectedBindingDigest)) {
+        return {
+          verified: false,
+          platform: "aws-nitro",
+          message: "AWS Nitro Attestation Failed: user_data binding mismatch (public key / nonce forged or altered)."
+        };
+      }
+      return {
+        verified: true,
+        platform: "aws-nitro",
+        message: "AWS Nitro Enclave Hardware TEE Attestation Certified: PCR measurements & user_data verified."
+      };
+    }
+    if (policy === "required") {
+      return {
+        verified: false,
+        platform: "none",
+        message: `TEE Verification Failed: Unrecognized hardware attestation report format (${attestationReport.length} bytes).`
+      };
+    }
+    return {
+      verified: true,
+      platform: "none",
+      message: "Non-critical TEE report accepted under relaxed policy."
+    };
+  }
+  /**
+   * Verifies if a node is running inside an authenticated TEE (e.g. AMD SEV-SNP or AWS Nitro).
    *
-   * @param attestationReport The COSE-signed attestation document from the hardware.
+   * @param attestationReport The attestation document from the hardware.
+   * @param options Verification policy and binding options.
    */
-  async verifyTeeAttestation(attestationReport) {
-    if (attestationReport.length === 0) return true;
-    try {
-      log.info("[LiopVerifier] TEE Attestation: Not configured (no-op).");
+  async verifyTeeAttestation(attestationReport, options = {}) {
+    const result = await this.verifyTeeAttestationDetailed(
+      attestationReport,
+      options
+    );
+    if (result.verified) {
+      log.info(`[LiopVerifier] ${result.message}`);
       return true;
-    } catch (err) {
-      log.error("[LiopVerifier] TEE Verification Failed:", err);
-      return false;
     }
+    log.error(`[LiopVerifier] TEE FAILED: ${result.message}`);
+    return false;
   }
   /**
    * Derives the ImageID of a logic payload following the LIOP v1 Standard.
@@ -161,5 +289,5 @@ var LiopVerifier = class _LiopVerifier {
 };
 
 export { LiopVerifier };
-//# sourceMappingURL=chunk-ZRWNMP5L.js.map
-//# sourceMappingURL=chunk-ZRWNMP5L.js.map
+//# sourceMappingURL=chunk-WXYDFCIW.js.map
+//# sourceMappingURL=chunk-WXYDFCIW.js.map

package/dist/{chunk-JWFLXXZS.js → chunk-ZU3WVVLC.js}

@@ -1,6 +1,7 @@
 import { sanitizeOutput } from './chunk-Y62GORQF.js';
-import { LIOP_SCOPES, Dilithium65Wrapper, authorizeRequest } from './chunk-WPTOJYN5.js';
-import { GRPC_CHANNEL_OPTIONS, liopV1, createServerCredentials, TokenTelemetryEngine } from './chunk-GFGSHQN5.js';
+import { LIOP_SCOPES, authorizeRequest } from './chunk-NXCAFF73.js';
+import { Dilithium65Wrapper } from './chunk-3664H3CV.js';
+import { GRPC_CHANNEL_OPTIONS, liopV1, createServerCredentials, TokenTelemetryEngine } from './chunk-JPWC6XG6.js';
 import { egressBlocksTotal, toolCallsTotal, fuelConsumed, wireEgressBytesTotal, wireSavedBytesTotal, toolCallErrorsTotal } from './chunk-Q3FKHJ3B.js';
 import { MeshNode } from './chunk-IHKKWXHJ.js';
 import { log } from './chunk-K3DGJLUY.js';
@@ -1791,7 +1792,7 @@ var LiopServer = class _LiopServer {
     this.auditLogger = this.config?.auditLogger || globalAuditLogger;
     const isTS = import.meta.url.endsWith(".ts");
     const workerExt = isTS ? ".ts" : ".js";
-    let execArgv = [];
+    const execArgv = [];
     if (isTS) {
       try {
         const req = createRequire(import.meta.url);
@@ -1799,9 +1800,9 @@ var LiopServer = class _LiopServer {
         const absoluteTsx = pathToFileURL(
           path.join(path.dirname(tsxPkg), "dist", "loader.mjs")
         ).href;
-        execArgv = ["--import", absoluteTsx];
+        execArgv.push("--import", absoluteTsx);
       } catch (_e) {
-        execArgv = ["--import", "tsx"];
+        execArgv.push("--import", "tsx");
       }
     }
     const isTest = process.env.NODE_ENV === "test" || process.env.VITEST;
@@ -1839,6 +1840,11 @@ var LiopServer = class _LiopServer {
         });
       }
     }
+    try {
+      this.enclavePqcKeypair = Dilithium65Wrapper.generateKeyPair();
+    } catch (_e) {
+      this.enclavePqcKeypair = void 0;
+    }
     if (this.config?.auth?.role === "nexus") {
       const issuer = this.config.auth.issuer || "http://localhost:3000";
       const audience = this.config.auth.audience || AUTH_DEFAULTS.audience;
@@ -1905,6 +1911,7 @@ var LiopServer = class _LiopServer {
   meshNode = null;
   rpcServer = null;
   boundPort = null;
+  enclavePqcKeypair;
   jwtValidator;
   // biome-ignore lint/suspicious/noExplicitAny: Loaded dynamically in Phase C
   oauthProvider;
@@ -3089,10 +3096,11 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               isEncrypted: true,
               proofMode: requestedProofMode,
               guestImageId: toolPolicy?.guestImageId ?? this.config?.guestImageId,
+              pqcSigningKey: toolPolicy?.pqcSign ? this.enclavePqcKeypair?.secretKey : void 0,
               dpConfig
               // Apply DP noise inside worker before ZK-Receipt commitment
             });
-            if (requestedProofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */) {
+            if (requestedProofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */ && workerResponse.proof_type !== 3 /* GROTH16_PQC_HYBRID */) {
               log.error(
                 `[LIOP-RPC] Enclave policy violation: Valid Groth16 zero-knowledge proof required but unavailable for ${toolName || "tool"}`
               );
@@ -3178,7 +3186,7 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               ),
               zk_receipt: workerResponse.zk_receipt ? Buffer.from(workerResponse.zk_receipt, "base64") : Buffer.from(""),
               is_error: false,
-              proof_type: workerResponse.proof_type === 2 /* GROTH16 */ ? 2 /* PROOF_TYPE_GROTH16 */ : 0 /* PROOF_TYPE_HMAC_LEGACY */,
+              proof_type: workerResponse.proof_type === 3 /* GROTH16_PQC_HYBRID */ ? 3 /* PROOF_TYPE_GROTH16_PQC_HYBRID */ : workerResponse.proof_type === 2 /* GROTH16 */ ? 2 /* PROOF_TYPE_GROTH16 */ : 0 /* PROOF_TYPE_HMAC_LEGACY */,
               guest_image_id: workerResponse.guest_image_id || toolPolicy?.guestImageId || this.config?.guestImageId || ""
             };
             const violation = await this.piiScanner.scan(validationOutput);
@@ -3395,10 +3403,11 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
         // Use plaintext for local Logic-on-Origin injection
         proofMode,
         guestImageId: dpPolicy?.guestImageId ?? this.config?.guestImageId,
+        pqcSigningKey: dpPolicy?.pqcSign ? this.enclavePqcKeypair?.secretKey : void 0,
         dpConfig
         // Pass DP Config to apply inside worker before ZK-Receipt commitment
       });
-      if (proofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */) {
+      if (proofMode === 2 /* PROOF_MODE_ZK_BLOCKING */ && workerResponse.proof_type !== 2 /* GROTH16 */ && workerResponse.proof_type !== 3 /* GROTH16_PQC_HYBRID */) {
         return {
           content: [
             {
@@ -3415,7 +3424,7 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
         computation_result: sanitizedOutput,
         image_id: workerResponse.image_id,
         zk_receipt: workerResponse.zk_receipt,
-        proof_type: workerResponse.proof_type === 2 /* GROTH16 */ ? "GROTH16" : "HMAC_LEGACY",
+        proof_type: workerResponse.proof_type === 3 /* GROTH16_PQC_HYBRID */ ? "GROTH16_PQC_HYBRID" : workerResponse.proof_type === 2 /* GROTH16 */ ? "GROTH16" : "HMAC_LEGACY",
         guest_image_id: workerResponse.guest_image_id,
         status: "Worker Pool Execution Success"
       });
@@ -3739,5 +3748,5 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
 };
 
 export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger };
-//# sourceMappingURL=chunk-JWFLXXZS.js.map
-//# sourceMappingURL=chunk-JWFLXXZS.js.map
+//# sourceMappingURL=chunk-ZU3WVVLC.js.map
+//# sourceMappingURL=chunk-ZU3WVVLC.js.map

package/dist/client.d.ts

@@ -1,8 +1,8 @@
-import './verifier-EgKmGrh7.js';
+import './verifier-DqZ9MQ9l.js';
 import './node-Djzm6UYd.js';
-export { c as LiopClient } from './index-DtovobWb.js';
-import './zk-CYImPsa6.js';
-import './types-rxL19f0l.js';
+export { c as LiopClient } from './index-BYDtRGue.js';
+import './zk-DzYNWBgo.js';
+import './types-29zv9X1V.js';
 import '@grpc/grpc-js';
 import 'node:events';
 import 'zod';

package/dist/client.js

@@ -1,12 +1,12 @@
-export { LiopClient } from './chunk-ZJGVKM7G.js';
+export { LiopClient } from './chunk-S3RAZTEM.js';
 import './chunk-3QH44NKZ.js';
-import './chunk-ZRWNMP5L.js';
+import './chunk-WXYDFCIW.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
-import './chunk-GFGSHQN5.js';
+import './chunk-JPWC6XG6.js';
 import './chunk-Q3FKHJ3B.js';
 import './chunk-KR5UZUEY.js';
-import './chunk-P34HDRN5.js';
+import './chunk-FIVRGOA4.js';
 import './chunk-IHKKWXHJ.js';
 import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,8 +1,8 @@
 import './node-Djzm6UYd.js';
-import './index-D2P6Z_hP.js';
-import './types-rxL19f0l.js';
-export { L as LiopHybridGateway } from './hybrid-Cb95yJFg.js';
+import './index-ByzjpRCk.js';
+import './types-29zv9X1V.js';
+export { L as LiopHybridGateway } from './hybrid-BZpCiUaV.js';
 import 'zod';
-import './zk-CYImPsa6.js';
+import './zk-DzYNWBgo.js';
 import 'jose';
-import './verifier-EgKmGrh7.js';
+import './verifier-DqZ9MQ9l.js';

package/dist/gateway.js

@@ -1,13 +1,14 @@
-export { LiopHybridGateway } from './chunk-53QKIQNF.js';
-import './chunk-IDTXJQBH.js';
-import './chunk-ZRWNMP5L.js';
+export { LiopHybridGateway } from './chunk-6MYJBM2E.js';
+import './chunk-DSOB2JKM.js';
+import './chunk-WXYDFCIW.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
-import './chunk-WPTOJYN5.js';
-import './chunk-GFGSHQN5.js';
+import './chunk-NXCAFF73.js';
+import './chunk-3664H3CV.js';
+import './chunk-JPWC6XG6.js';
 import './chunk-Q3FKHJ3B.js';
 import './chunk-KR5UZUEY.js';
-import './chunk-P34HDRN5.js';
+import './chunk-FIVRGOA4.js';
 import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/{hybrid-Cb95yJFg.d.ts → hybrid-BZpCiUaV.d.ts}

@@ -1,7 +1,7 @@
 import { a as MeshNode } from './node-Djzm6UYd.js';
-import { L as LiopServer } from './index-D2P6Z_hP.js';
-import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-rxL19f0l.js';
-import { L as LiopVerifier } from './verifier-EgKmGrh7.js';
+import { L as LiopServer } from './index-ByzjpRCk.js';
+import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-29zv9X1V.js';
+import { L as LiopVerifier } from './verifier-DqZ9MQ9l.js';
 
 /**
  * LIOP Sliding-Window Rate Limiter

package/dist/{index-DtovobWb.d.ts → index-BYDtRGue.d.ts}

@@ -1,9 +1,9 @@
-import { L as LiopVerifier } from './verifier-EgKmGrh7.js';
+import { L as LiopVerifier } from './verifier-DqZ9MQ9l.js';
 import { M as MeshNodeConfig } from './node-Djzm6UYd.js';
 import * as grpc from '@grpc/grpc-js';
 import { EventEmitter } from 'node:events';
-import { Z as ZkPolicy } from './zk-CYImPsa6.js';
-import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-rxL19f0l.js';
+import { Z as ZkPolicy } from './zk-DzYNWBgo.js';
+import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-29zv9X1V.js';
 
 interface CertManagerOptions {
     /** Path to the root CA certificate (PEM format) */

package/dist/{index-D2P6Z_hP.d.ts → index-ByzjpRCk.d.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { M as MeshNodeConfig, a as MeshNode } from './node-Djzm6UYd.js';
-import { d as AuditLogger, J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, e as GetPromptRequest, f as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-rxL19f0l.js';
+import { d as AuditLogger, J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, e as GetPromptRequest, f as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-29zv9X1V.js';
 
 /**
  * LIOP OAuth 2.1 Hybrid Auth — Configuration Types
@@ -354,6 +354,10 @@ interface LogicExecutionPolicy {
      * Static verification key JSON structure for this capability.
      */
     vkey?: Record<string, unknown>;
+    /**
+     * Whether to co-sign the Groth16 receipt with an ML-DSA-65 post-quantum digital signature (FIPS 204).
+     */
+    pqcSign?: boolean;
 }
 declare class LiopServer {
     private serverInfo;
@@ -380,6 +384,7 @@ declare class LiopServer {
     private meshNode;
     private rpcServer;
     private boundPort;
+    private enclavePqcKeypair?;
     jwtValidator?: JwtValidator;
     oauthProvider?: any;
     private sessions;

package/dist/index.d.ts

@@ -1,20 +1,20 @@
 export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOptions } from './bridge.js';
-import { L as LiopTlsOptions } from './index-DtovobWb.js';
-export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient, d as createChannelCredentials, e as createServerCredentials } from './index-DtovobWb.js';
+import { L as LiopTlsOptions } from './index-BYDtRGue.js';
+export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient, d as createChannelCredentials, e as createServerCredentials } from './index-BYDtRGue.js';
 import { ProofWithSignals, VerificationKey } from 'micro-zk-proofs';
 export { ProofWithSignals, VerificationKey } from 'micro-zk-proofs';
-export { L as LiopVerifier, V as VerifyZkOptions } from './verifier-EgKmGrh7.js';
+export { L as LiopVerifier, T as TeePolicy, a as TeeVerificationOptions, b as TeeVerificationResult, V as VerifyZkOptions } from './verifier-DqZ9MQ9l.js';
 import * as http from 'node:http';
-export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-Cb95yJFg.js';
-import { A as AuthInfo } from './types-rxL19f0l.js';
-export { g as AuditEntry, h as AuditInterceptor, d as AuditLogger, i as AuditRecordParams, j as AuditStatus, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, l as GENESIS_HASH, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, J as JwtValidator, L as LiopLogger, r as LogEvent, s as LogInterceptor, t as LogLevel, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema, E as computeEntryHash, F as executeGatewayInterceptor, H as globalAuditLogger, K as log } from './types-rxL19f0l.js';
+export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-BZpCiUaV.js';
+import { A as AuthInfo } from './types-29zv9X1V.js';
+export { g as AuditEntry, h as AuditInterceptor, d as AuditLogger, i as AuditRecordParams, j as AuditStatus, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, l as GENESIS_HASH, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, J as JwtValidator, L as LiopLogger, r as LogEvent, s as LogInterceptor, t as LogLevel, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema, E as computeEntryHash, F as executeGatewayInterceptor, H as globalAuditLogger, K as log } from './types-29zv9X1V.js';
 export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-Djzm6UYd.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-D2P6Z_hP.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-ByzjpRCk.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
-export { D as DecodedReceipt, P as ProofType, R as RECEIPT_VERSION_V1, a as RECEIPT_VERSION_V2, b as ZK_JOURNAL_V2_SIZE, c as ZkJournalV2, Z as ZkPolicy, d as ZkReceipt, e as ZkVerificationError, f as ZkVerifier, g as decodeJournalV2, h as encodeJournalV2, r as receiptCodec } from './zk-CYImPsa6.js';
+export { D as DecodedReceipt, P as ProofType, R as RECEIPT_VERSION_V1, a as RECEIPT_VERSION_V2, b as ZK_JOURNAL_V2_SIZE, c as ZkJournalV2, Z as ZkPolicy, d as ZkReceipt, e as ZkVerificationError, f as ZkVerifier, g as decodeJournalV2, h as encodeJournalV2, r as receiptCodec } from './zk-DzYNWBgo.js';
 import '@modelcontextprotocol/sdk/server/mcp.js';
 import 'zod';
 import 'node:events';
@@ -64,7 +64,7 @@ interface TokenEstimator {
  *
  * - Synchronous: safe for hot-path usage without async overhead
  * - Merge cache reduced to 10K entries for long-running server processes
- * - Inlined at build-time: zero external runtime dependencies in node_modules
+ * - External dependency: resolved from gpt-tokenizer in node_modules at runtime
  */
 declare class RealTokenEstimator implements TokenEstimator {
     readonly name = "o200k_base";
@@ -426,7 +426,8 @@ declare enum ProofMode {
 }
 declare enum ProofType {
     PROOF_TYPE_HMAC_LEGACY = 0,
-    PROOF_TYPE_GROTH16 = 2
+    PROOF_TYPE_GROTH16 = 2,
+    PROOF_TYPE_GROTH16_PQC_HYBRID = 3
 }
 interface IntentRequest {
     agent_did: string;
@@ -524,6 +525,10 @@ declare const Dilithium65Wrapper: {
         publicKey: Uint8Array;
         secretKey: Uint8Array;
     };
+    /**
+     * Derives the ML-DSA-65 public key from a given secret key.
+     */
+    getPublicKey(secretKey: Uint8Array): Uint8Array;
     /**
      * Validates and imports a raw ML-DSA-65 public key.
      */

package/dist/index.js

@@ -1,21 +1,22 @@
-export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-7BSCUYUE.js';
-export { VERIFICATION_LATENCY_BUDGET_MS, deserializeGrothProof, deserializeVKey, serializeGrothProof, serializeVKey, verifyGroth16Proof } from './chunk-OHMZZMMC.js';
-export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-ZJGVKM7G.js';
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-2VQS2XRH.js';
-export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest } from './chunk-53QKIQNF.js';
+export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-R52TZEIL.js';
+export { VERIFICATION_LATENCY_BUDGET_MS, deserializeGrothProof, deserializeVKey, serializeGrothProof, serializeVKey, verifyGroth16Proof } from './chunk-ET6VRUK2.js';
+export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-S3RAZTEM.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-WXOWJXY6.js';
+export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest } from './chunk-6MYJBM2E.js';
 export { RoutingTable, probeTopology } from './chunk-V47P2AQR.js';
 export { TokenManager } from './chunk-3QH44NKZ.js';
-export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-JWFLXXZS.js';
+export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-ZU3WVVLC.js';
 export { sanitizeOutput } from './chunk-Y62GORQF.js';
-export { LiopMcpRouter } from './chunk-IDTXJQBH.js';
-export { LiopVerifier } from './chunk-ZRWNMP5L.js';
+export { LiopMcpRouter } from './chunk-DSOB2JKM.js';
+export { LiopVerifier } from './chunk-WXYDFCIW.js';
 import './chunk-IK7CGWAZ.js';
 export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest } from './chunk-WPTOJYN5.js';
-export { GRPC_CHANNEL_OPTIONS, HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createChannelCredentials, createServerCredentials, createSyncTokenEstimator, createTokenEstimator } from './chunk-GFGSHQN5.js';
+export { LIOP_SCOPES, authorizeRequest } from './chunk-NXCAFF73.js';
+export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper } from './chunk-3664H3CV.js';
+export { GRPC_CHANNEL_OPTIONS, HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createChannelCredentials, createServerCredentials, createSyncTokenEstimator, createTokenEstimator } from './chunk-JPWC6XG6.js';
 export { Counter, Gauge, Histogram, MetricsRegistry, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, protocolMetrics, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, wireEgressBytesTotal, wireSavedBytesTotal, zkProofsByTypeTotal, zkProvingDurationMs, zkVerificationDurationMs, zkVerificationsTotal, zkVkeyCacheSize } from './chunk-Q3FKHJ3B.js';
 export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-KR5UZUEY.js';
-export { ProofType, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, ZK_JOURNAL_V2_SIZE, ZkVerificationError, ZkVerifier, decodeJournalV2, encodeJournalV2, receiptCodec } from './chunk-P34HDRN5.js';
+export { ProofType, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, ZK_JOURNAL_V2_SIZE, ZkVerificationError, ZkVerifier, decodeJournalV2, encodeJournalV2, receiptCodec } from './chunk-FIVRGOA4.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
 export { MeshNode } from './chunk-IHKKWXHJ.js';
 import { log } from './chunk-K3DGJLUY.js';