@nekzus/liop 2.4.0-alpha.24 → 2.4.0-alpha.26

package/dist/index.js

@@ -1,147 +1,4 @@
-export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-7BSCUYUE.js';
-export { VERIFICATION_LATENCY_BUDGET_MS, deserializeGrothProof, deserializeVKey, serializeGrothProof, serializeVKey, verifyGroth16Proof } from './chunk-OHMZZMMC.js';
-export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-ZJGVKM7G.js';
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-2VQS2XRH.js';
-export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest } from './chunk-53QKIQNF.js';
-export { RoutingTable, probeTopology } from './chunk-V47P2AQR.js';
-export { TokenManager } from './chunk-3QH44NKZ.js';
-export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-JWFLXXZS.js';
-export { sanitizeOutput } from './chunk-Y62GORQF.js';
-export { LiopMcpRouter } from './chunk-IDTXJQBH.js';
-export { LiopVerifier } from './chunk-ZRWNMP5L.js';
-import './chunk-IK7CGWAZ.js';
-export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest } from './chunk-WPTOJYN5.js';
-export { GRPC_CHANNEL_OPTIONS, HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createChannelCredentials, createServerCredentials, createSyncTokenEstimator, createTokenEstimator } from './chunk-GFGSHQN5.js';
-export { Counter, Gauge, Histogram, MetricsRegistry, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, protocolMetrics, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, wireEgressBytesTotal, wireSavedBytesTotal, zkProofsByTypeTotal, zkProvingDurationMs, zkVerificationDurationMs, zkVerificationsTotal, zkVkeyCacheSize } from './chunk-Q3FKHJ3B.js';
-export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-KR5UZUEY.js';
-export { ProofType, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, ZK_JOURNAL_V2_SIZE, ZkVerificationError, ZkVerifier, decodeJournalV2, encodeJournalV2, receiptCodec } from './chunk-P34HDRN5.js';
-export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
-export { MeshNode } from './chunk-IHKKWXHJ.js';
-import { log } from './chunk-K3DGJLUY.js';
-export { LiopLogger, log } from './chunk-K3DGJLUY.js';
-import * as crypto from 'crypto';
-import { EventEmitter } from 'events';
-import * as fs from 'fs';
-
-// src/errors.ts
-var ErrorCode = /* @__PURE__ */ ((ErrorCode2) => {
-  ErrorCode2["CapabilityViolation"] = "CapabilityViolation";
-  ErrorCode2["SandboxEscape"] = "SandboxEscape";
-  ErrorCode2["PiiLeak"] = "PiiLeak";
-  ErrorCode2["InvalidIntent"] = "InvalidIntent";
-  ErrorCode2["Throttled"] = "Throttled";
-  ErrorCode2["ZkVerificationFailed"] = "ZkVerificationFailed";
-  ErrorCode2["MeshUnavailable"] = "MeshUnavailable";
-  ErrorCode2["ConnectionFailed"] = "ConnectionFailed";
-  return ErrorCode2;
-})(ErrorCode || {});
-var LiopError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "LiopError";
-    this.code = code;
-  }
-};
-var TRACEPARENT_REGEX = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
-var LiopTracer = class _LiopTracer {
-  static generateTraceId() {
-    let id;
-    do {
-      id = crypto.randomBytes(16).toString("hex");
-    } while (id === "0".repeat(32));
-    return id;
-  }
-  static generateSpanId() {
-    let id;
-    do {
-      id = crypto.randomBytes(8).toString("hex");
-    } while (id === "0".repeat(16));
-    return id;
-  }
-  static formatTraceparent(traceId, spanId, sampled = true) {
-    const flags = sampled ? "01" : "00";
-    return `00-${traceId}-${spanId}-${flags}`;
-  }
-  static parseTraceparent(header) {
-    if (!header || typeof header !== "string") {
-      return null;
-    }
-    const trimmed = header.trim();
-    const match = TRACEPARENT_REGEX.exec(trimmed);
-    if (!match) {
-      return null;
-    }
-    const [, version, traceId, spanId, flags] = match;
-    if (version === "00") {
-      if (traceId === "0".repeat(32) || spanId === "0".repeat(16)) {
-        return null;
-      }
-    }
-    const sampled = (Number.parseInt(flags, 16) & 1) === 1;
-    return {
-      traceId,
-      spanId,
-      sampled
-    };
-  }
-  static injectTraceparent(carrier, context) {
-    carrier.traceparent = _LiopTracer.formatTraceparent(
-      context.traceId,
-      context.spanId,
-      context.sampled
-    );
-  }
-  static extractTraceparent(carrier) {
-    const val = carrier.traceparent || carrier.Traceparent;
-    if (Array.isArray(val)) {
-      return _LiopTracer.parseTraceparent(val[0]);
-    }
-    return _LiopTracer.parseTraceparent(val);
-  }
-  startSpan(name, parent, attributes = {}) {
-    const traceId = parent?.traceId || _LiopTracer.generateTraceId();
-    const spanId = _LiopTracer.generateSpanId();
-    const sampled = parent ? parent.sampled : true;
-    const context = {
-      traceId,
-      spanId,
-      sampled
-    };
-    const span = {
-      name,
-      context,
-      startTime: Date.now(),
-      attributes: { ...attributes },
-      status: "OK",
-      setAttribute(key, value) {
-        this.attributes[key] = value;
-        return this;
-      },
-      recordException(err) {
-        this.status = "ERROR";
-        this.error = typeof err === "string" ? err : err.message;
-        return this;
-      },
-      end() {
-        this.endTime = Date.now();
-      }
-    };
-    return span;
-  }
-};
-var defaultTracer = new LiopTracer();
-
-// src/prompts/adapters.ts
-var PROVIDER_CONFIGS = {
-  claude: { xmlStandard: true, jsonSchemaPreferred: false },
-  openai: { xmlStandard: false, jsonSchemaPreferred: true },
-  gemini: { xmlStandard: false, jsonSchemaPreferred: true }
-};
-function generateSystemInstructions(provider) {
-  const config = PROVIDER_CONFIGS[provider];
-  let instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]
+export{d as WasiSandbox,c as calculateAstInstructionFuel,b as getDefaultEnvironment}from'./chunk-CTTTLCGL.js';export{a as VERIFICATION_LATENCY_BUDGET_MS,f as deserializeGrothProof,d as deserializeVKey,e as serializeGrothProof,c as serializeVKey,b as verifyGroth16Proof}from'./chunk-FDJMH4CB.js';export{b as AesGcmWrapper,c as LiopClient,a as LiopRpcClient}from'./chunk-WP5ER7RH.js';export{b as LiopMcpBridge,a as LiopStreamBridge}from'./chunk-P6IJ3VBD.js';export{a as GRPC_WEB_CONSTANTS,i as InMemoryRateLimiter,j as LiopHybridGateway,g as buildProtectedResourceMetadata,e as decodeFrames,f as dispatchGrpcWebRequest,c as encodeDataFrame,d as encodeTrailerFrame,h as executeGatewayInterceptor,b as isGrpcWebRequest}from'./chunk-LEXMMIQI.js';export{a as RoutingTable,b as probeTopology}from'./chunk-2XHSALII.js';export{a as TokenManager}from'./chunk-N35BC62H.js';export{f as AUTH_DEFAULTS,d as AuditLogger,b as GENESIS_HASH,g as JwtValidator,a as LiopRpcServer,m as LiopServer,i as NerScanner,j as PII_PATTERNS,k as PII_PRESETS,l as PiiScanner,c as computeEntryHash,h as createOAuthServer,e as globalAuditLogger}from'./chunk-YD2AF2M6.js';export{a as sanitizeOutput}from'./chunk-MQ5SU26J.js';export{a as LiopMcpRouter}from'./chunk-LM26HOJ6.js';export{a as LiopVerifier}from'./chunk-6KFKO6ZX.js';import'./chunk-TKLRW52V.js';export{a as Kyber768Wrapper}from'./chunk-Y675R34Z.js';export{b as LIOP_SCOPES,a as authorizeRequest}from'./chunk-XLVEDKM6.js';export{a as DILITHIUM65_CONSTANTS,b as Dilithium65Wrapper}from'./chunk-2ZYX736J.js';export{j as GRPC_CHANNEL_OPTIONS,b as HeuristicTokenEstimator,e as LiopOTelBridge,a as RealTokenEstimator,f as TokenTelemetryEngine,i as createChannelCredentials,h as createServerCredentials,d as createSyncTokenEstimator,c as createTokenEstimator}from'./chunk-ECRS6N33.js';export{a as Counter,b as Gauge,c as Histogram,d as MetricsRegistry,k as egressBlocksTotal,h as fuelConsumed,j as manifestCacheSize,i as meshPeersConnected,t as operationDurationMs,u as pqcHandshakeDurationMs,v as pqcHandshakesTotal,e as protocolMetrics,q as tokensInputTotal,r as tokensOutputTotal,s as tokensSavedTotal,g as toolCallErrorsTotal,f as toolCallsTotal,w as wireEgressBytesTotal,x as wireSavedBytesTotal,n as zkProofsByTypeTotal,o as zkProvingDurationMs,l as zkVerificationDurationMs,m as zkVerificationsTotal,p as zkVkeyCacheSize}from'./chunk-ZZMSFCJP.js';export{a as MCP_LEGACY_SUPPORT_ENABLED,h as MCP_PROTOCOL_VERSION,b as MCP_PROTOCOL_VERSION_LEGACY,k as PromptSchema,j as ResourceSchema,i as ToolSchema}from'./chunk-GWVSCZUS.js';export{a as ProofType,b as RECEIPT_VERSION_V1,c as RECEIPT_VERSION_V2,d as ZK_JOURNAL_V2_SIZE,e as ZkVerificationError,i as ZkVerifier,g as decodeJournalV2,f as encodeJournalV2,h as receiptCodec}from'./chunk-6VK2XALI.js';export{a as SWARM_KEY_BYTE_LENGTH,b as createSwarmKey,d as deserializeSwarmKey,g as loadSwarmKey,e as parseSwarmKey,f as saveSwarmKey,c as serializeSwarmKey}from'./chunk-YLCNV764.js';export{a as MeshNode}from'./chunk-V35CXJQN.js';import {b}from'./chunk-3WRKTVOF.js';export{a as LiopLogger,b as log}from'./chunk-3WRKTVOF.js';import {a}from'./chunk-AYDF3IFZ.js';import*as h from'crypto';import {EventEmitter}from'events';import*as i from'fs';var A=(o=>(o.CapabilityViolation="CapabilityViolation",o.SandboxEscape="SandboxEscape",o.PiiLeak="PiiLeak",o.InvalidIntent="InvalidIntent",o.Throttled="Throttled",o.ZkVerificationFailed="ZkVerificationFailed",o.MeshUnavailable="MeshUnavailable",o.ConnectionFailed="ConnectionFailed",o))(A||{}),y=class extends Error{static{a(this,"LiopError");}code;constructor(t,e){super(e),this.name="LiopError",this.code=t;}};var D=/^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/,g=class n{static{a(this,"LiopTracer");}static generateTraceId(){let t;do t=h.randomBytes(16).toString("hex");while(t==="0".repeat(32));return t}static generateSpanId(){let t;do t=h.randomBytes(8).toString("hex");while(t==="0".repeat(16));return t}static formatTraceparent(t,e,r=true){return `00-${t}-${e}-${r?"01":"00"}`}static parseTraceparent(t){if(!t||typeof t!="string")return null;let e=t.trim(),r=D.exec(e);if(!r)return null;let[,a,c,l,m]=r;if(a==="00"&&(c==="0".repeat(32)||l==="0".repeat(16)))return null;let o=(Number.parseInt(m,16)&1)===1;return {traceId:c,spanId:l,sampled:o}}static injectTraceparent(t,e){t.traceparent=n.formatTraceparent(e.traceId,e.spanId,e.sampled);}static extractTraceparent(t){let e=t.traceparent||t.Traceparent;return Array.isArray(e)?n.parseTraceparent(e[0]):n.parseTraceparent(e)}startSpan(t,e,r={}){let a=e?.traceId||n.generateTraceId(),c=n.generateSpanId(),l=e?e.sampled:true;return {name:t,context:{traceId:a,spanId:c,sampled:l},startTime:Date.now(),attributes:{...r},status:"OK",setAttribute(d,T){return this.attributes[d]=T,this},recordException(d){return this.status="ERROR",this.error=typeof d=="string"?d:d.message,this},end(){this.endTime=Date.now();}}}},Mt=new g;var k={claude:{xmlStandard:true,jsonSchemaPreferred:false},openai:{xmlStandard:false,jsonSchemaPreferred:true},gemini:{xmlStandard:false,jsonSchemaPreferred:true}};function Bt(n){let t=k[n],e=`[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]
 You are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.
 Unlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.
 
@@ -166,9 +23,7 @@ To prevent database reconstruction and inference attacks, numeric query outputs
 - Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.
 - Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.
 - K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.
-`;
-  if (config.xmlStandard) {
-    instructions += `
+`;return t.xmlStandard?e+=`
 ### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)
 You must wrap your logic precisely within <liop_logic> tags.
 Example:
@@ -177,9 +32,7 @@ const records = await liop.readResource("liop://vault/patients");
 const filtered = records.filter(r => r.disease === "Hypertension");
 return { alert: "High risk demographic", targetCount: filtered.length };
 </liop_logic>
-`;
-  } else if (config.jsonSchemaPreferred) {
-    instructions += `
+`:t.jsonSchemaPreferred&&(e+=`
 ### PAYLOAD FORMATTING (JSON PARSING PREFERRED)
 You must provide your logic strictly within a JSON string key called \`"logic_blob"\` inside your tool call parameters.
 Example:
@@ -187,173 +40,5 @@ Example:
   "target": "liop://vault/patients",
   "logic_blob": "const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };"
 }
-`;
-  }
-  return instructions;
-}
-var CertManager = class extends EventEmitter {
-  constructor(options) {
-    super();
-    this.options = options;
-    this.warningDays = options.warningDays ?? 30;
-    this.debounceMs = options.debounceMs ?? 150;
-    this.loadCertificates();
-    if (options.watchFiles !== false) {
-      this.setupWatchers();
-    }
-  }
-  options;
-  rootCertBuffer = null;
-  certChainBuffer = null;
-  privateKeyBuffer = null;
-  watchers = [];
-  reloadDebounceTimer = null;
-  warningDays;
-  debounceMs;
-  /**
-   * Synchronously loads or reloads certificates from filesystem into memory.
-   */
-  loadCertificates() {
-    try {
-      if (this.options.rootCertPath && fs.existsSync(this.options.rootCertPath)) {
-        this.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);
-      }
-      if (!fs.existsSync(this.options.certChainPath)) {
-        throw new Error(
-          `Certificate chain file not found: ${this.options.certChainPath}`
-        );
-      }
-      if (!fs.existsSync(this.options.privateKeyPath)) {
-        throw new Error(
-          `Private key file not found: ${this.options.privateKeyPath}`
-        );
-      }
-      this.certChainBuffer = fs.readFileSync(this.options.certChainPath);
-      this.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);
-      log.info("[CertManager] Certificates loaded successfully.");
-    } catch (error) {
-      log.error(`[CertManager] Failed to load certificates: ${error}`);
-      throw error;
-    }
-  }
-  /**
-   * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.
-   */
-  inspectCertificate() {
-    if (!this.certChainBuffer) {
-      throw new Error("[CertManager] No certificate loaded to inspect.");
-    }
-    const x509 = new crypto.X509Certificate(this.certChainBuffer);
-    const validToDate = new Date(x509.validTo);
-    const now = /* @__PURE__ */ new Date();
-    const msRemaining = validToDate.getTime() - now.getTime();
-    const daysRemaining = Math.max(
-      0,
-      Math.floor(msRemaining / (1e3 * 60 * 60 * 24))
-    );
-    const isExpired = msRemaining <= 0;
-    const isExpiringSoon = daysRemaining <= this.warningDays;
-    return {
-      subject: x509.subject,
-      issuer: x509.issuer,
-      validFrom: x509.validFrom,
-      validTo: x509.validTo,
-      fingerprint256: x509.fingerprint256,
-      daysRemaining,
-      isExpired,
-      isExpiringSoon
-    };
-  }
-  /**
-   * Sets up non-blocking filesystem watchers to detect certificate renewals
-   * and trigger hot-reloading without process restarts.
-   */
-  setupWatchers() {
-    const filesToWatch = [
-      this.options.certChainPath,
-      this.options.privateKeyPath,
-      this.options.rootCertPath
-    ].filter((p) => Boolean(p && fs.existsSync(p)));
-    for (const filePath of filesToWatch) {
-      try {
-        const watcher = fs.watch(filePath, () => {
-          this.scheduleReload();
-        });
-        this.watchers.push(watcher);
-      } catch (err) {
-        log.warn(
-          `[CertManager] Could not watch ${filePath} for hot reloading: ${err}`
-        );
-      }
-    }
-  }
-  /**
-   * Debounces reload events to ensure files have finished writing.
-   */
-  scheduleReload() {
-    if (this.reloadDebounceTimer) {
-      clearTimeout(this.reloadDebounceTimer);
-    }
-    this.reloadDebounceTimer = setTimeout(() => {
-      try {
-        this.loadCertificates();
-        const certInfo = this.inspectCertificate();
-        log.info(
-          `[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`
-        );
-        this.emit("reload", certInfo);
-      } catch (error) {
-        log.error(`[CertManager] Hot reload failed: ${error}`);
-        this.emit("error", error);
-      }
-    }, this.debounceMs);
-  }
-  /**
-   * Manually triggers a reload of certificates and emits the 'reload' event.
-   */
-  reload() {
-    this.loadCertificates();
-    const certInfo = this.inspectCertificate();
-    log.info(
-      `[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`
-    );
-    this.emit("reload", certInfo);
-    return certInfo;
-  }
-  getRootCert() {
-    return this.rootCertBuffer;
-  }
-  getCertChain() {
-    if (!this.certChainBuffer) {
-      throw new Error("[CertManager] Certificate chain not loaded.");
-    }
-    return this.certChainBuffer;
-  }
-  getPrivateKey() {
-    if (!this.privateKeyBuffer) {
-      throw new Error("[CertManager] Private key not loaded.");
-    }
-    return this.privateKeyBuffer;
-  }
-  /**
-   * Stops all active file watchers and releases resources.
-   */
-  dispose() {
-    if (this.reloadDebounceTimer) {
-      clearTimeout(this.reloadDebounceTimer);
-      this.reloadDebounceTimer = null;
-    }
-    for (const watcher of this.watchers) {
-      try {
-        watcher.close();
-      } catch {
-      }
-    }
-    this.watchers = [];
-    this.removeAllListeners();
-  }
-};
-
-export { CertManager, ErrorCode, LiopError, LiopTracer, defaultTracer, generateSystemInstructions };
-//# sourceMappingURL=index.js.map
+`),e}a(Bt,"generateSystemInstructions");var x=class extends EventEmitter{constructor(e){super();this.options=e;this.warningDays=e.warningDays??30,this.debounceMs=e.debounceMs??150,this.loadCertificates(),e.watchFiles!==false&&this.setupWatchers();}options;static{a(this,"CertManager");}rootCertBuffer=null;certChainBuffer=null;privateKeyBuffer=null;watchers=[];reloadDebounceTimer=null;warningDays;debounceMs;loadCertificates(){try{if(this.options.rootCertPath&&i.existsSync(this.options.rootCertPath)&&(this.rootCertBuffer=i.readFileSync(this.options.rootCertPath)),!i.existsSync(this.options.certChainPath))throw new Error(`Certificate chain file not found: ${this.options.certChainPath}`);if(!i.existsSync(this.options.privateKeyPath))throw new Error(`Private key file not found: ${this.options.privateKeyPath}`);this.certChainBuffer=i.readFileSync(this.options.certChainPath),this.privateKeyBuffer=i.readFileSync(this.options.privateKeyPath),b.info("[CertManager] Certificates loaded successfully.");}catch(e){throw b.error(`[CertManager] Failed to load certificates: ${e}`),e}}inspectCertificate(){if(!this.certChainBuffer)throw new Error("[CertManager] No certificate loaded to inspect.");let e=new h.X509Certificate(this.certChainBuffer),r=new Date(e.validTo),a=new Date,c=r.getTime()-a.getTime(),l=Math.max(0,Math.floor(c/(1e3*60*60*24))),m=c<=0,o=l<=this.warningDays;return {subject:e.subject,issuer:e.issuer,validFrom:e.validFrom,validTo:e.validTo,fingerprint256:e.fingerprint256,daysRemaining:l,isExpired:m,isExpiringSoon:o}}setupWatchers(){let e=[this.options.certChainPath,this.options.privateKeyPath,this.options.rootCertPath].filter(r=>!!(r&&i.existsSync(r)));for(let r of e)try{let a=i.watch(r,()=>{this.scheduleReload();});this.watchers.push(a);}catch(a){b.warn(`[CertManager] Could not watch ${r} for hot reloading: ${a}`);}}scheduleReload(){this.reloadDebounceTimer&&clearTimeout(this.reloadDebounceTimer),this.reloadDebounceTimer=setTimeout(()=>{try{this.loadCertificates();let e=this.inspectCertificate();b.info(`[CertManager] Hot reload complete. Certificate expires in ${e.daysRemaining} days.`),this.emit("reload",e);}catch(e){b.error(`[CertManager] Hot reload failed: ${e}`),this.emit("error",e);}},this.debounceMs);}reload(){this.loadCertificates();let e=this.inspectCertificate();return b.info(`[CertManager] Hot reload complete. Certificate expires in ${e.daysRemaining} days.`),this.emit("reload",e),e}getRootCert(){return this.rootCertBuffer}getCertChain(){if(!this.certChainBuffer)throw new Error("[CertManager] Certificate chain not loaded.");return this.certChainBuffer}getPrivateKey(){if(!this.privateKeyBuffer)throw new Error("[CertManager] Private key not loaded.");return this.privateKeyBuffer}dispose(){this.reloadDebounceTimer&&(clearTimeout(this.reloadDebounceTimer),this.reloadDebounceTimer=null);for(let e of this.watchers)try{e.close();}catch{}this.watchers=[],this.removeAllListeners();}};export{x as CertManager,A as ErrorCode,y as LiopError,g as LiopTracer,Mt as defaultTracer,Bt as generateSystemInstructions};//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/kyber-PULV7PQX.js

@@ -0,0 +1,2 @@
+export{a as Kyber768Wrapper}from'./chunk-Y675R34Z.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=kyber-PULV7PQX.js.map
+//# sourceMappingURL=kyber-PULV7PQX.js.map

package/dist/mesh.js

@@ -1,6 +1,2 @@
-import './chunk-FTF6AMF6.js';
-export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
-export { MeshNode } from './chunk-IHKKWXHJ.js';
-import './chunk-K3DGJLUY.js';
-//# sourceMappingURL=mesh.js.map
+import'./chunk-FTF6AMF6.js';export{a as SWARM_KEY_BYTE_LENGTH,b as createSwarmKey,d as deserializeSwarmKey,g as loadSwarmKey,e as parseSwarmKey,f as saveSwarmKey,c as serializeSwarmKey}from'./chunk-YLCNV764.js';export{a as MeshNode}from'./chunk-V35CXJQN.js';import'./chunk-3WRKTVOF.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=mesh.js.map
 //# sourceMappingURL=mesh.js.map

package/dist/server.d.ts

@@ -1,6 +1,6 @@
-export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-D2P6Z_hP.js';
+export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-ByzjpRCk.js';
 import 'zod';
 import './node-Djzm6UYd.js';
-import './types-rxL19f0l.js';
-import './zk-CYImPsa6.js';
+import './types-29zv9X1V.js';
+import './zk-DzYNWBgo.js';
 import 'jose';

package/dist/server.js

@@ -1,10 +1,2 @@
-export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner } from './chunk-JWFLXXZS.js';
-export { sanitizeOutput } from './chunk-Y62GORQF.js';
-import './chunk-WPTOJYN5.js';
-import './chunk-GFGSHQN5.js';
-import './chunk-Q3FKHJ3B.js';
-import './chunk-P34HDRN5.js';
-import './chunk-IHKKWXHJ.js';
-import './chunk-K3DGJLUY.js';
-//# sourceMappingURL=server.js.map
+export{m as LiopServer,i as NerScanner,j as PII_PATTERNS,k as PII_PRESETS,l as PiiScanner}from'./chunk-YD2AF2M6.js';export{a as sanitizeOutput}from'./chunk-MQ5SU26J.js';import'./chunk-XLVEDKM6.js';import'./chunk-2ZYX736J.js';import'./chunk-ECRS6N33.js';import'./chunk-ZZMSFCJP.js';import'./chunk-6VK2XALI.js';import'./chunk-V35CXJQN.js';import'./chunk-3WRKTVOF.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map

package/dist/{types-rxL19f0l.d.ts → types-29zv9X1V.d.ts}

@@ -1,4 +1,4 @@
-import { P as ProofType } from './zk-CYImPsa6.js';
+import { P as ProofType } from './zk-DzYNWBgo.js';
 import { z } from 'zod';
 import * as jose from 'jose';
 

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export { P as ProofType, R as RECEIPT_VERSION_V1, a as RECEIPT_VERSION_V2, b as ZK_JOURNAL_V2_SIZE, c as ZkJournalV2, Z as ZkPolicy, d as ZkReceipt } from './zk-CYImPsa6.js';
+export { P as ProofType, R as RECEIPT_VERSION_V1, a as RECEIPT_VERSION_V2, b as ZK_JOURNAL_V2_SIZE, c as ZkJournalV2, Z as ZkPolicy, d as ZkReceipt } from './zk-DzYNWBgo.js';
 import 'zod';
-export { h as AuditInterceptor, A as AuthInfo, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, r as LogEvent, s as LogInterceptor, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema } from './types-rxL19f0l.js';
+export { h as AuditInterceptor, A as AuthInfo, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, r as LogEvent, s as LogInterceptor, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema } from './types-29zv9X1V.js';
 import 'jose';

package/dist/types.js

@@ -1,4 +1,2 @@
-export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-KR5UZUEY.js';
-export { ProofType, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, ZK_JOURNAL_V2_SIZE } from './chunk-P34HDRN5.js';
-//# sourceMappingURL=types.js.map
+export{a as MCP_LEGACY_SUPPORT_ENABLED,h as MCP_PROTOCOL_VERSION,b as MCP_PROTOCOL_VERSION_LEGACY,k as PromptSchema,j as ResourceSchema,i as ToolSchema}from'./chunk-GWVSCZUS.js';export{a as ProofType,b as RECEIPT_VERSION_V1,c as RECEIPT_VERSION_V2,d as ZK_JOURNAL_V2_SIZE}from'./chunk-6VK2XALI.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=types.js.map
 //# sourceMappingURL=types.js.map

package/dist/{verifier-EgKmGrh7.d.ts → verifier-DqZ9MQ9l.d.ts}

@@ -1,5 +1,28 @@
-import { Z as ZkPolicy } from './zk-CYImPsa6.js';
+import { Z as ZkPolicy } from './zk-DzYNWBgo.js';
 
+type TeePolicy = "required" | "preferred" | "none";
+interface TeeVerificationOptions {
+    /** Enforcement policy for TEE attestation */
+    policy?: TeePolicy;
+    /** Expected cryptographic nonce used during negotiateIntent handshake */
+    expectedNonce?: Buffer | Uint8Array;
+    /** Expected enclave public key (e.g. ML-KEM-768 public key) */
+    expectedPublicKey?: Buffer | Uint8Array;
+    /** Expected platform configuration registers (PCRs) */
+    expectedPcrs?: Record<number, string>;
+    /** Allow synthetic / mesh PSK proofs in non-hardware environments */
+    allowSynthetic?: boolean;
+}
+interface TeeVerificationResult {
+    verified: boolean;
+    platform: "amd-sev-snp" | "aws-nitro" | "intel-tdx" | "synthetic" | "none";
+    message: string;
+    measurements?: {
+        reportDataHex?: string;
+        measurementHex?: string;
+        chipIdHex?: string;
+    };
+}
 interface VerifyZkOptions {
     sessionSecret?: Buffer;
     expectedOutput?: unknown;
@@ -39,15 +62,21 @@ declare class LiopVerifier {
      */
     verifyZkReceipt(logicPayload: Buffer, remoteImageIdHex: string, zkReceipt: Buffer, sessionSecretOrOptions?: Buffer | VerifyZkOptions, expectedOutput?: unknown): Promise<boolean>;
     /**
-     * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).
+     * Detailed hardware attestation verification supporting AMD SEV-SNP, AWS Nitro Enclaves,
+     * and synthetic mesh verification.
+     */
+    verifyTeeAttestationDetailed(attestationReport: Buffer, options?: TeeVerificationOptions): Promise<TeeVerificationResult>;
+    /**
+     * Verifies if a node is running inside an authenticated TEE (e.g. AMD SEV-SNP or AWS Nitro).
      *
-     * @param attestationReport The COSE-signed attestation document from the hardware.
+     * @param attestationReport The attestation document from the hardware.
+     * @param options Verification policy and binding options.
      */
-    verifyTeeAttestation(attestationReport: Buffer): Promise<boolean>;
+    verifyTeeAttestation(attestationReport: Buffer, options?: TeeVerificationOptions): Promise<boolean>;
     /**
      * Derives the ImageID of a logic payload following the LIOP v1 Standard.
      */
     deriveImageId(logicPayload: Buffer): Buffer;
 }
 
-export { LiopVerifier as L, type VerifyZkOptions as V };
+export { LiopVerifier as L, type TeePolicy as T, type VerifyZkOptions as V, type TeeVerificationOptions as a, type TeeVerificationResult as b };

package/dist/verifier-J4NQYZX5.js

@@ -0,0 +1,2 @@
+export{a as LiopVerifier}from'./chunk-6KFKO6ZX.js';import'./chunk-TKLRW52V.js';import'./chunk-ZZMSFCJP.js';import'./chunk-3WRKTVOF.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=verifier-J4NQYZX5.js.map
+//# sourceMappingURL=verifier-J4NQYZX5.js.map

package/dist/workers/logic-execution.d.ts

@@ -1,4 +1,4 @@
-import { P as ProofType } from '../zk-CYImPsa6.js';
+import { P as ProofType } from '../zk-DzYNWBgo.js';
 
 interface WorkerData {
     isWarmup?: boolean;
@@ -14,6 +14,7 @@ interface WorkerData {
     aesNonce?: Uint8Array;
     proofMode?: number;
     guestImageId?: string;
+    pqcSigningKey?: Uint8Array;
     dpConfig?: {
         epsilon: number;
         sensitivity: number;