@nekzus/liop 2.4.0-alpha.24 → 2.4.0-alpha.26

package/dist/workers/zk-verifier.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/workers/zk-verifier.ts"],"names":[],"mappings":";;;;;;AA8CA,SAAS,cAAc,YAAA,EAAkC;AACxD,EAAA,OAAO,uBAAuB,YAAY,CAAA;AAC3C;AAUA,SAAS,sBAAsB,YAAA,EAA0C;AACxE,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAW,OAAO,IAAA,CAAK,YAAY,EAAE,QAAA,CAAS,OAAO,EAAE,IAAA,EAAK;AAClE,IAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC5C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAC1C,IAAA,IAAI,kBAAkB,CAAA,CAAA,EAAI;AACzB,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,UAAA,GAAa,KAAA;AACjB,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,IAAI,YAAA,GAAe,CAAA,CAAA;AAEnB,IAAA,KAAA,IAAS,CAAA,GAAI,aAAA,EAAe,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACrD,MAAA,MAAM,IAAA,GAAO,SAAS,CAAC,CAAA;AAEvB,MAAA,IAAI,OAAA,EAAS;AACZ,QAAA,OAAA,GAAU,KAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,SAAS,IAAA,EAAM;AAClB,QAAA,OAAA,GAAU,IAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,aAAA,EAAe;AACrD,QAAA,UAAA,GAAa,CAAC,UAAA;AACd,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AACpD,QAAA,IAAI,SAAS,GAAA,EAAK;AACjB,UAAA,UAAA,EAAA;AAAA,QACD,CAAA,MAAA,IAAW,SAAS,GAAA,EAAK;AACxB,UAAA,UAAA,EAAA;AACA,UAAA,IAAI,eAAe,CAAA,EAAG;AACrB,YAAA,YAAA,GAAe,CAAA;AACf,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,IAAI,iBAAiB,CAAA,CAAA,EAAI;AACxB,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,aAAA,EAAe,eAAe,CAAC,CAAA;AAC9D,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,MAAA,IAAI,QAAQ,iBAAA,EAAmB;AAC9B,QAAA,OAAO,MAAA;AAAA,MACR;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AAAA,EAEb;AACA,EAAA,OAAO,IAAA;AACR;AAMA,eAAe,gBACd,OAAA,EACsE;AACtE,EAAA,MAAM;AAAA,IACL,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA,OAAA;AAAA,IACA,cAAA;AAAA,IACA;AAAA,GACD,GAAI,OAAA;AAEJ,EAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,gBAAA,IAAoB,CAAC,SAAA,EAAW;AACrD,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,IAAI,cAAA;AACJ,EAAA,IAAI;AACH,IAAA,cAAA,GAAiB,YAAA,CAAa,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,SAAS,CAAC,CAAA;AAAA,EAC5D,SAAS,GAAA,EAAK;AACb,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,uBAAA,EAA2B,GAAA,CAAc,OAAO,CAAA;AAAA,KAC1D;AAAA,EACD;AAGA,EAAA,IAAI,cAAA,CAAe,YAAY,kBAAA,EAAoB;AAClD,IAAA,IAAI,aAAa,UAAA,EAAY;AAC5B,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EACC;AAAA,OACF;AAAA,IACD;AAGA,IAAA,MAAM,YAAA,GAAe,cAAc,YAAY,CAAA;AAC/C,IAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AAEnD,IAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACzC,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,4BAAA,EAA+B,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,aAAA,EAAgB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,OAChH;AAAA,IACD;AAGA,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACH,MAAA,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,cAAA,CAAe,OAAA,CAAQ,UAAU,CAAA;AAC1D,MAAA,IAAI,WAAA,CAAY,aAAa,eAAA,EAAiB;AAC7C,QAAA,OAAO;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,OAAA,EAAS,CAAA,0BAAA,EAA6B,WAAA,CAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,SACzG;AAAA,MACD;AAAA,IACD,SAAS,EAAA,EAAI;AACZ,MAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,+BAAA,EAAgC;AAAA,IACpE;AAGA,IAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC9C,MAAA,MAAM,YAAA,GAAe,MAAA,CACnB,UAAA,CAAW,QAAA,EAAU,aAAa,EAClC,MAAA,CAAO,cAAA,CAAe,OAAO,CAAA,CAC7B,MAAA,EAAO;AACT,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,cAAA,CAAe,KAAA,EAAO,YAAY,CAAA,EAAG;AAChE,QAAA,OAAO;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,OAAA,EAAS;AAAA,SACV;AAAA,MACD;AAAA,IACD;AAGA,IAAA,IAAI,mBAAmB,MAAA,EAAW;AACjC,MAAA,MAAM,WAAA,GAAc,sBAAsB,YAAY,CAAA;AACtD,MAAA,MAAM,cAAA,GACL,WAAA,KAAgB,IAAA,GAAO,WAAA,GAAc,cAAA;AAEtC,MAAA,MAAM,iBAAA,GACL,OAAO,cAAA,KAAmB,QAAA,GACvB,cAAA,GACA,mBAAmB,MAAA,GAClB,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA;AAClC,MAAA,MAAM,kBAAA,GAAqB,OACzB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,iBAAiB,CAAA,CACxB,MAAA,CAAO,KAAK,CAAA;AAEd,MAAA,IAAI,WAAA,CAAY,gBAAgB,kBAAA,EAAoB;AACnD,QAAA,OAAO;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,OAAA,EAAS,CAAA,mEAAA,EAAsE,WAAA,CAAY,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,SACjL;AAAA,MACD;AAAA,IACD;AAEA,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,IAAA;AAAA,MACV,OAAA,EAAS,6CAAA;AAAA,MACT,SAAA,EAAW;AAAA,KACZ;AAAA,EACD;AAGA,EAAA,IAAI,cAAA,CAAe,YAAY,kBAAA,EAAoB;AAClD,IAAA,IAAI,eAAe,SAAA,KAAA,CAAA,gBAAiC;AACnD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,yCAAA,EAA4C,cAAA,CAAe,SAAS,CAAA;AAAA,OAC9E;AAAA,IACD;AAEA,IAAA,IAAI,SAAA;AACJ,IAAA,IAAI;AACH,MAAA,SAAA,GAAY,eAAA,CAAgB,eAAe,OAAO,CAAA;AAAA,IACnD,SAAS,GAAA,EAAK;AACb,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,8BAAA,EAAkC,GAAA,CAAc,OAAO,CAAA;AAAA,OACjE;AAAA,IACD;AAGA,IAAA,IAAI,eAAA,EAAiB;AACpB,MAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AAC3D,MAAA,IAAI,kBAAkB,eAAA,EAAiB;AACtC,QAAA,OAAO;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,OAAA,EAAS,CAAA,6DAAA,EAAgE,aAAA,CAAc,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,EAAA;AAAA,SACrI;AAAA,MACD;AAAA,IACD;AAGA,IAAA,MAAM,mBAAA,GAAsB,cAAc,YAAY,CAAA;AACtD,IAAA,IAAI,CAAC,SAAA,CAAU,WAAA,CAAY,MAAA,CAAO,mBAAmB,CAAA,EAAG;AACvD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,SAAS,CAAA,gEAAA,EAAmE,SAAA,CAAU,YAAY,QAAA,CAAS,KAAK,EAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,EAAO,oBAAoB,QAAA,CAAS,KAAK,EAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,OACpL;AAAA,IACD;AAGA,IAAA,IAAI,OAAA,IAAW,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAClC,MAAA,IAAI;AACH,QAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,MAAA,CAAO,IAAA,CAAK,OAAO,CAAC,CAAA;AACjD,QAAA,MAAM,gBAAA,GAAmB,qBAAA,CAAsB,cAAA,CAAe,KAAK,CAAA;AACnE,QAAA,MAAM,WAAA,GAAc,kBAAA,CAAmB,IAAA,EAAM,gBAAgB,CAAA;AAE7D,QAAA,IAAI,CAAC,WAAA,EAAa;AACjB,UAAA,OAAO;AAAA,YACN,QAAA,EAAU,KAAA;AAAA,YACV,OAAA,EACC;AAAA,WACF;AAAA,QACD;AAAA,MACD,SAAS,GAAA,EAAK;AACb,QAAA,OAAO;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,OAAA,EAAS,CAAA,wCAAA,EAA4C,GAAA,CAAc,OAAO,CAAA;AAAA,SAC3E;AAAA,MACD;AAAA,IACD;AAGA,IAAA,IAAI,mBAAmB,MAAA,EAAW;AACjC,MAAA,MAAM,WAAA,GAAc,sBAAsB,YAAY,CAAA;AACtD,MAAA,MAAM,cAAA,GACL,WAAA,KAAgB,IAAA,GAAO,WAAA,GAAc,cAAA;AAEtC,MAAA,MAAM,iBAAA,GACL,OAAO,cAAA,KAAmB,QAAA,GACvB,cAAA,GACA,mBAAmB,MAAA,GAClB,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA;AAClC,MAAA,MAAM,oBAAA,GAAuB,OAC3B,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,iBAAiB,EACxB,MAAA,EAAO;AAET,MAAA,IAAI,CAAC,SAAA,CAAU,YAAA,CAAa,MAAA,CAAO,oBAAoB,CAAA,EAAG;AACzD,QAAA,OAAO;AAAA,UACN,QAAA,EAAU,KAAA;AAAA,UACV,SAAS,CAAA,yDAAA,EAA4D,SAAA,CAAU,aAAa,QAAA,CAAS,KAAK,EAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,iBAAA,EAAoB,qBAAqB,QAAA,CAAS,KAAK,EAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,SAC5L;AAAA,MACD;AAAA,IACD;AAEA,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,IAAA;AAAA,MACV,OAAA,EAAS,wDAAA;AAAA,MACT,SAAA,EAAW;AAAA,KACZ;AAAA,EACD;AAEA,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,KAAA;AAAA,IACV,OAAA,EAAS,CAAA,6BAAA,EAAgC,cAAA,CAAe,OAAO,CAAA;AAAA,GAChE;AACD;AAKA,eAAO,cACN,IAAA,EACsE;AACtE,EAAA,IAAI;AACH,IAAA,IAAI,IAAA,CAAK,WAAW,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AACA,IAAA,IAAI,IAAA,CAAK,WAAW,gBAAA,EAAkB;AACrC,MAAA,OAAO,MAAM,gBAAgB,IAAI,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACvD,SAAS,KAAA,EAAO;AACf,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,oBAAA,EAAwB,KAAA,CAAgB,OAAO,CAAA;AAAA,KACzD;AAAA,EACD;AACD","file":"zk-verifier.js","sourcesContent":["import crypto from \"node:crypto\";\nimport { parentPort } from \"node:worker_threads\";\nimport {\n\tdeserializeGrothProof,\n\tdeserializeVKey,\n\tverifyGroth16Proof,\n} from \"../crypto/groth16-verifier.js\";\nimport { deriveLogicImageDigest } from \"../crypto/logic-image-id.js\";\nimport {\n\tdecodeJournalV2,\n\tProofType,\n\tRECEIPT_VERSION_V1,\n\tRECEIPT_VERSION_V2,\n\treceiptCodec,\n\ttype ZkPolicy,\n} from \"../security/zk.js\";\n\n// Ensure this worker is used via Piscina pool\nif (!parentPort) {\n\t// Not fatal in Piscina, but handled appropriately\n}\n\n/**\n * ZK Verification Payload Structure.\n * Modeled after RISC Zero & SP1 Receipt formats.\n */\nexport interface ZkVerificationPayload {\n\taction: \"verify_receipt\" | \"warmup\";\n\t/** Original logic payload (JS/WASM) sent by client */\n\tlogicPayload?: Uint8Array;\n\t/** Expected ImageID (SHA-256) of the execution state */\n\tremoteImageIdHex?: string;\n\t/** Expected Guest ImageID (SHA-256) of the zkVM interpreter */\n\tguestImageIdHex?: string;\n\t/** Cbor-encoded or raw buffer containing the execution Receipt (Journal + Seal) */\n\tzkReceipt?: Uint8Array;\n\t/** Kyber-derived session secret to verify HMAC signature */\n\tsessionSecret?: Uint8Array;\n\t/** Serialized VerificationKey buffer for Groth16 mathematical verification */\n\tvkeyRaw?: Uint8Array;\n\t/** The expected output value of the computation for anti-replay/tampering verification */\n\texpectedOutput?: unknown;\n\t/** Enforcement policy for clearance tiers */\n\tzkPolicy?: ZkPolicy;\n}\n\nfunction deriveImageId(logicPayload: Uint8Array): Buffer {\n\treturn deriveLogicImageDigest(logicPayload);\n}\n\ninterface ZkJournal {\n\timage_id: string;\n\tdataset_hash: string;\n\toutput_hash: string;\n\tfuel: number;\n\tts: number;\n}\n\nfunction tryExtractProxyOutput(logicPayload: Uint8Array): unknown | null {\n\ttry {\n\t\tconst logicStr = Buffer.from(logicPayload).toString(\"utf-8\").trim();\n\t\tif (!logicStr.includes(\"__liop_proxy_tool\")) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst firstBraceIdx = logicStr.indexOf(\"{\");\n\t\tif (firstBraceIdx === -1) {\n\t\t\treturn null;\n\t\t}\n\n\t\tlet braceCount = 0;\n\t\tlet inDoubleQuote = false;\n\t\tlet inSingleQuote = false;\n\t\tlet inBacktick = false;\n\t\tlet escaped = false;\n\t\tlet lastBraceIdx = -1;\n\n\t\tfor (let i = firstBraceIdx; i < logicStr.length; i++) {\n\t\t\tconst char = logicStr[i];\n\n\t\t\tif (escaped) {\n\t\t\t\tescaped = false;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"\\\\\") {\n\t\t\t\tescaped = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === '\"' && !inSingleQuote && !inBacktick) {\n\t\t\t\tinDoubleQuote = !inDoubleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"'\" && !inDoubleQuote && !inBacktick) {\n\t\t\t\tinSingleQuote = !inSingleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"`\" && !inDoubleQuote && !inSingleQuote) {\n\t\t\t\tinBacktick = !inBacktick;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (!inDoubleQuote && !inSingleQuote && !inBacktick) {\n\t\t\t\tif (char === \"{\") {\n\t\t\t\t\tbraceCount++;\n\t\t\t\t} else if (char === \"}\") {\n\t\t\t\t\tbraceCount--;\n\t\t\t\t\tif (braceCount === 0) {\n\t\t\t\t\t\tlastBraceIdx = i;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (lastBraceIdx !== -1) {\n\t\t\tconst jsonStr = logicStr.slice(firstBraceIdx, lastBraceIdx + 1);\n\t\t\tconst parsed = JSON.parse(jsonStr);\n\t\t\tif (parsed?.__liop_proxy_tool) {\n\t\t\t\treturn parsed;\n\t\t\t}\n\t\t}\n\t} catch (_e) {\n\t\t// Fallback\n\t}\n\treturn null;\n}\n\n/**\n * Simulates heavy ZK-Proof cryptographic verification.\n * In a real environment, this delegates to @risc0/verifier or SP1 FFI bindings.\n */\nasync function verifyZkReceipt(\n\tpayload: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string; proofType?: string }> {\n\tconst {\n\t\tlogicPayload,\n\t\tremoteImageIdHex,\n\t\tguestImageIdHex,\n\t\tzkReceipt,\n\t\tsessionSecret,\n\t\tvkeyRaw,\n\t\texpectedOutput,\n\t\tzkPolicy,\n\t} = payload;\n\n\tif (!logicPayload || !remoteImageIdHex || !zkReceipt) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Missing required verification fields.\",\n\t\t};\n\t}\n\n\tlet decodedReceipt: ReturnType<typeof receiptCodec.decode>;\n\ttry {\n\t\tdecodedReceipt = receiptCodec.decode(Buffer.from(zkReceipt));\n\t} catch (err) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Receipt Decode Failed: ${(err as Error).message}`,\n\t\t};\n\t}\n\n\t// 1. Version 1 (HMAC Legacy Receipt)\n\tif (decodedReceipt.version === RECEIPT_VERSION_V1) {\n\t\tif (zkPolicy === \"required\") {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage:\n\t\t\t\t\t\"Policy Violation: Clearance Tier requires ZK proof (Groth16), but received legacy HMAC.\",\n\t\t\t};\n\t\t}\n\n\t\t// Calculate local ImageID (Integrity Check)\n\t\tconst localImageId = deriveImageId(logicPayload);\n\t\tconst localImageIdHex = localImageId.toString(\"hex\");\n\n\t\tif (localImageIdHex !== remoteImageIdHex) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Integrity Violation: Local (${localImageIdHex.slice(0, 8)}) != Remote (${remoteImageIdHex.slice(0, 8)})`,\n\t\t\t};\n\t\t}\n\n\t\t// Parse journal and verify imageId\n\t\tlet journalData: ZkJournal;\n\t\ttry {\n\t\t\tjournalData = JSON.parse(decodedReceipt.journal.toString()) as ZkJournal;\n\t\t\tif (journalData.image_id !== localImageIdHex) {\n\t\t\t\treturn {\n\t\t\t\t\tverified: false,\n\t\t\t\t\tmessage: `Journal ImageID mismatch: ${journalData.image_id.slice(0, 8)} != ${localImageIdHex.slice(0, 8)}`,\n\t\t\t\t};\n\t\t\t}\n\t\t} catch (_e) {\n\t\t\treturn { verified: false, message: \"Failed to parse journal data.\" };\n\t\t}\n\n\t\t// Mathematical Verification (HMAC-SHA256)\n\t\tif (sessionSecret && sessionSecret.length > 0) {\n\t\t\tconst expectedSeal = crypto\n\t\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t\t.update(decodedReceipt.journal)\n\t\t\t\t.digest();\n\t\t\tif (!crypto.timingSafeEqual(decodedReceipt.proof, expectedSeal)) {\n\t\t\t\treturn {\n\t\t\t\t\tverified: false,\n\t\t\t\t\tmessage: \"Invalid seal: HMAC verification failed.\",\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Output Hash Verification (Anti-Replay / Anti-Tampering)\n\t\tif (expectedOutput !== undefined) {\n\t\t\tconst proxyOutput = tryExtractProxyOutput(logicPayload);\n\t\t\tconst actualExpected =\n\t\t\t\tproxyOutput !== null ? proxyOutput : expectedOutput;\n\n\t\t\tconst expectedOutputStr =\n\t\t\t\ttypeof actualExpected === \"string\"\n\t\t\t\t\t? actualExpected\n\t\t\t\t\t: actualExpected === undefined\n\t\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t\t: JSON.stringify(actualExpected);\n\t\t\tconst expectedOutputHash = crypto\n\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t.update(expectedOutputStr)\n\t\t\t\t.digest(\"hex\");\n\n\t\t\tif (journalData.output_hash !== expectedOutputHash) {\n\t\t\t\treturn {\n\t\t\t\t\tverified: false,\n\t\t\t\t\tmessage: `Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${journalData.output_hash.slice(0, 8)}) != Calculated output_hash (${expectedOutputHash.slice(0, 8)})`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tverified: true,\n\t\t\tmessage: \"HMAC Commitment Verified: Integrity intact.\",\n\t\t\tproofType: \"hmac\",\n\t\t};\n\t}\n\n\t// 2. Version 2 (Groth16 / ZK Binary Receipt)\n\tif (decodedReceipt.version === RECEIPT_VERSION_V2) {\n\t\tif (decodedReceipt.proofType !== ProofType.GROTH16) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Unsupported ZK proof type in v2 receipt: ${decodedReceipt.proofType}`,\n\t\t\t};\n\t\t}\n\n\t\tlet journalV2: ReturnType<typeof decodeJournalV2>;\n\t\ttry {\n\t\t\tjournalV2 = decodeJournalV2(decodedReceipt.journal);\n\t\t} catch (err) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Failed to decode ZkJournalV2: ${(err as Error).message}`,\n\t\t\t};\n\t\t}\n\n\t\t// Verify Guest Image ID if expected\n\t\tif (guestImageIdHex) {\n\t\t\tconst actualGuestId = journalV2.guestImageId.toString(\"hex\");\n\t\t\tif (actualGuestId !== guestImageIdHex) {\n\t\t\t\treturn {\n\t\t\t\t\tverified: false,\n\t\t\t\t\tmessage: `Guest ImageID Mismatch: Injected guest environment tampered (${actualGuestId.slice(0, 8)} != ${guestImageIdHex.slice(0, 8)}).`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Verify Logic Digest (Ensures remote executed the exact user logic dispatched)\n\t\tconst expectedLogicDigest = deriveImageId(logicPayload);\n\t\tif (!journalV2.logicDigest.equals(expectedLogicDigest)) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Logic Digest Mismatch: Remote origin executed unexpected logic (${journalV2.logicDigest.toString(\"hex\").slice(0, 8)} != ${expectedLogicDigest.toString(\"hex\").slice(0, 8)})`,\n\t\t\t};\n\t\t}\n\n\t\t// Mathematical Verification via Groth16 pairing check\n\t\tif (vkeyRaw && vkeyRaw.length > 0) {\n\t\t\ttry {\n\t\t\t\tconst vkey = deserializeVKey(Buffer.from(vkeyRaw));\n\t\t\t\tconst proofWithSignals = deserializeGrothProof(decodedReceipt.proof);\n\t\t\t\tconst isMathValid = verifyGroth16Proof(vkey, proofWithSignals);\n\n\t\t\t\tif (!isMathValid) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tverified: false,\n\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\"Groth16 mathematical pairing verification failed: invalid proof.\",\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch (err) {\n\t\t\t\treturn {\n\t\t\t\t\tverified: false,\n\t\t\t\t\tmessage: `Groth16 verification failed to execute: ${(err as Error).message}`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Output Digest Verification (Anti-Replay / Anti-Tampering)\n\t\tif (expectedOutput !== undefined) {\n\t\t\tconst proxyOutput = tryExtractProxyOutput(logicPayload);\n\t\t\tconst actualExpected =\n\t\t\t\tproxyOutput !== null ? proxyOutput : expectedOutput;\n\n\t\t\tconst expectedOutputStr =\n\t\t\t\ttypeof actualExpected === \"string\"\n\t\t\t\t\t? actualExpected\n\t\t\t\t\t: actualExpected === undefined\n\t\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t\t: JSON.stringify(actualExpected);\n\t\t\tconst expectedOutputDigest = crypto\n\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t.update(expectedOutputStr)\n\t\t\t\t.digest();\n\n\t\t\tif (!journalV2.outputDigest.equals(expectedOutputDigest)) {\n\t\t\t\treturn {\n\t\t\t\t\tverified: false,\n\t\t\t\t\tmessage: `Output Digest Mismatch (Replay/Tamper attempt): Journal (${journalV2.outputDigest.toString(\"hex\").slice(0, 8)}) != Calculated (${expectedOutputDigest.toString(\"hex\").slice(0, 8)})`,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tverified: true,\n\t\t\tmessage: \"Groth16 Zero-Knowledge Proof Mathematically Certified.\",\n\t\t\tproofType: \"groth16\",\n\t\t};\n\t}\n\n\treturn {\n\t\tverified: false,\n\t\tmessage: `Unsupported receipt version: ${decodedReceipt.version}`,\n\t};\n}\n\n/**\n * Main worker entry point for Piscina.\n */\nexport default async function workerHandler(\n\ttask: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string; proofType?: string }> {\n\ttry {\n\t\tif (task.action === \"warmup\") {\n\t\t\treturn {\n\t\t\t\tverified: true,\n\t\t\t\tmessage: \"warm\",\n\t\t\t};\n\t\t}\n\t\tif (task.action === \"verify_receipt\") {\n\t\t\treturn await verifyZkReceipt(task);\n\t\t}\n\t\tthrow new Error(\"Unknown action in ZkVerifier Worker.\");\n\t} catch (error) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Verification Error: ${(error as Error).message}`,\n\t\t};\n\t}\n}\n"]}