@nekzus/liop 2.4.0-alpha.24 → 2.4.0-alpha.26

package/dist/workers/logic-execution.js

@@ -1,327 +1,2 @@
-import { ASTGuardian, WasiSandbox } from '../chunk-7BSCUYUE.js';
-import { sanitizeOutput } from '../chunk-Y62GORQF.js';
-import { normalizeLogicSource, deriveLogicImageDigest } from '../chunk-IK7CGWAZ.js';
-import { encodeJournalV2, receiptCodec } from '../chunk-P34HDRN5.js';
-import { Buffer } from 'buffer';
-import crypto2 from 'crypto';
-import { createMlKem768 } from 'mlkem';
-
-var DEFAULT_DP_CONFIG = {
-  epsilon: 1,
-  sensitivity: 1,
-  smallDatasetThreshold: 50
-};
-var EPSILON_FLOOR = 1;
-var EPSILON_FLOOR_THRESHOLD = 10;
-function laplaceSample(scale, prngState) {
-  let u;
-  do {
-    if (prngState) {
-      const hash = crypto2.createHash("sha256").update(`${prngState.seed}:${prngState.counter++}`).digest();
-      u = hash.readUInt32BE(0) / 4294967296 - 0.5;
-    } else {
-      const buf = crypto2.randomBytes(4);
-      const rawVal = buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3];
-      const cleanVal = Number.parseInt(rawVal.toString(10), 10);
-      u = cleanVal / 4294967296;
-    }
-  } while (u === 0 || u === -0.5);
-  return -scale * Math.sign(u) * Math.log(1 - 2 * Math.abs(u));
-}
-function addLaplaceNoise(value, config = {}, prngState) {
-  const merged = { ...DEFAULT_DP_CONFIG, ...config };
-  const scale = merged.sensitivity / merged.epsilon;
-  const noisyValue = value + laplaceSample(scale, prngState);
-  return Math.round(noisyValue * 1e4) / 1e4;
-}
-function deriveFieldSensitivity(key, globalSensitivity, recordCount) {
-  if (!key) return globalSensitivity;
-  const lk = key.toLowerCase();
-  const isCountWord = /count|length|size|num|gainer|loser|positive|negative|nan_|null_|empty_|finite_|non_finite_|instruments|tickers|users|records/i.test(
-    lk
-  );
-  const isTotalCount = lk === "total" || lk === "n" || lk === "total_records" || lk.startsWith("total_") || // Catch total_tickers, total_users
-  lk.startsWith("num_") || // Catch num_records, num_ticks
-  /total.*(count|items|entries|rows|records|tickers)/i.test(lk);
-  if (isCountWord || isTotalCount) return 1;
-  if (/avg|mean|average|var|variance|std|stddev|ratio|bps|drift|pct|percent|imbalance/i.test(
-    lk
-  ) && recordCount > 0) {
-    return globalSensitivity / recordCount;
-  }
-  return globalSensitivity;
-}
-function applyDpToOutput(output, config = {}, recordCount) {
-  const merged = { ...DEFAULT_DP_CONFIG, ...config };
-  if (recordCount >= merged.smallDatasetThreshold) {
-    return output;
-  }
-  if (recordCount < EPSILON_FLOOR_THRESHOLD && merged.epsilon < EPSILON_FLOOR) {
-    merged.epsilon = EPSILON_FLOOR;
-  }
-  let prngState;
-  if (merged.seed) {
-    prngState = { seed: merged.seed, counter: 0 };
-  }
-  return walkAndNoise(output, merged, recordCount, void 0, prngState);
-}
-function walkAndNoise(node, config, recordCount, currentKey, prngState) {
-  if (typeof node === "number" && Number.isFinite(node)) {
-    const fieldSensitivity = deriveFieldSensitivity(
-      currentKey,
-      config.sensitivity,
-      recordCount
-    );
-    let noisyValue = addLaplaceNoise(
-      node,
-      {
-        ...config,
-        sensitivity: fieldSensitivity
-      },
-      prngState
-    );
-    const isCountKey = currentKey != null && deriveFieldSensitivity(currentKey, config.sensitivity, recordCount) === 1;
-    if (Number.isInteger(node) || isCountKey) {
-      noisyValue = Math.round(noisyValue);
-    }
-    if (node >= 0) {
-      noisyValue = Math.max(0, noisyValue);
-    }
-    return noisyValue;
-  }
-  if (Array.isArray(node)) {
-    return node.map(
-      (item) => walkAndNoise(item, config, recordCount, currentKey, prngState)
-    );
-  }
-  if (node !== null && typeof node === "object") {
-    const result = {};
-    for (const [key, value] of Object.entries(
-      node
-    )) {
-      result[key] = walkAndNoise(value, config, recordCount, key, prngState);
-    }
-    return result;
-  }
-  return node;
-}
-
-// src/workers/logic-execution.ts
-async function processLogicExecution(data) {
-  if (typeof Object.prototype === "object" && !Object.isFrozen(Object.prototype)) {
-    Object.freeze(Object.prototype);
-    Object.freeze(Array.prototype);
-    Object.freeze(String.prototype);
-    Object.freeze(Number.prototype);
-    Object.freeze(Boolean.prototype);
-    Object.freeze(RegExp.prototype);
-    Object.freeze(Map.prototype);
-    Object.freeze(Set.prototype);
-    Object.freeze(Promise.prototype);
-    Object.freeze(Error.prototype);
-  }
-  if (data.isWarmup) {
-    return {
-      image_id: "",
-      output: "warm",
-      fuel_consumed: 0
-    };
-  }
-  if (data.sessionTimestamp !== void 0) {
-    const MAX_SESSION_KEY_LIFETIME_MS = 3600 * 1e3;
-    const age = Date.now() - data.sessionTimestamp;
-    if (age > MAX_SESSION_KEY_LIFETIME_MS) {
-      throw new Error(
-        `[LIOP-PQC] Session secret expired: Age (${Math.round(age / 1e3)}s) exceeds 3600s TTL limit.`
-      );
-    }
-    if (data.sessionTimestamp > Date.now() + 6e4) {
-      throw new Error(
-        "[LIOP-PQC] Session secret invalid: Timestamp is in the future."
-      );
-    }
-  }
-  const {
-    ciphertext,
-    secretKeyObj,
-    wasmBinary,
-    inputs,
-    aesNonce,
-    records,
-    isEncrypted = true,
-    dpConfig
-  } = data;
-  let decryptedPayload;
-  const decryptedInputs = {};
-  let sessionSecret = Buffer.alloc(32);
-  if (isEncrypted) {
-    const sk = new Uint8Array(secretKeyObj);
-    const ct = new Uint8Array(ciphertext);
-    const kem = await createMlKem768();
-    const sharedSecret = kem.decap(ct, sk);
-    const aesKey = Buffer.from(sharedSecret);
-    sessionSecret = aesKey;
-    const wasmBuffer = Buffer.from(wasmBinary);
-    const authTag = wasmBuffer.subarray(-16);
-    const encryptedData = wasmBuffer.subarray(0, -16);
-    const decipher = crypto2.createDecipheriv(
-      "aes-256-gcm",
-      aesKey,
-      Buffer.from(aesNonce || new Uint8Array(12))
-    );
-    decipher.setAuthTag(authTag);
-    let decrypted = decipher.update(encryptedData);
-    decrypted = Buffer.concat([decrypted, decipher.final()]);
-    decryptedPayload = decrypted;
-    for (const [key, encValue] of Object.entries(inputs || {})) {
-      const valBuffer = Buffer.from(encValue);
-      const inputNonce = valBuffer.subarray(0, 12);
-      const valTag = valBuffer.subarray(-16);
-      const valData = valBuffer.subarray(12, -16);
-      const valDecipher = crypto2.createDecipheriv(
-        "aes-256-gcm",
-        aesKey,
-        inputNonce
-      );
-      valDecipher.setAuthTag(valTag);
-      let valDecrypted = valDecipher.update(valData);
-      valDecrypted = Buffer.concat([valDecrypted, valDecipher.final()]);
-      decryptedInputs[key] = JSON.parse(valDecrypted.toString("utf-8"));
-    }
-  } else {
-    if (wasmBinary[0] === 0 && wasmBinary[1] === 97 && wasmBinary[2] === 115 && wasmBinary[3] === 109) {
-      decryptedPayload = Buffer.from(wasmBinary);
-    } else {
-      decryptedPayload = Buffer.from(wasmBinary).toString("utf-8");
-    }
-  }
-  const isWasm = decryptedPayload[0] === 0 && decryptedPayload[1] === 97 && decryptedPayload[2] === 115 && decryptedPayload[3] === 109;
-  if (decryptedPayload instanceof Buffer && isWasm) {
-    const wasmBytes = new Uint8Array(decryptedPayload);
-    const compiledModule = await WebAssembly.compile(wasmBytes);
-    ASTGuardian.analyze(compiledModule);
-  } else if (decryptedPayload instanceof Buffer && !isWasm) {
-    decryptedPayload = decryptedPayload.toString("utf-8");
-  }
-  if (typeof decryptedPayload === "string") {
-    decryptedPayload = normalizeLogicSource(decryptedPayload);
-  }
-  const sandbox = new WasiSandbox();
-  await sandbox.init();
-  try {
-    const result = await sandbox.execute(
-      decryptedPayload,
-      records,
-      decryptedInputs
-    );
-    let finalOutput = result.output;
-    let logicBytes;
-    if (typeof decryptedPayload === "string") {
-      logicBytes = Buffer.from(decryptedPayload, "utf-8");
-    } else {
-      logicBytes = new Uint8Array(decryptedPayload);
-    }
-    const imageId = deriveLogicImageDigest(logicBytes).toString("hex");
-    const datasetHash = crypto2.createHash("sha256").update(JSON.stringify(records || [])).digest("hex");
-    if (dpConfig) {
-      finalOutput = applyDpToOutput(
-        finalOutput,
-        {
-          ...dpConfig,
-          seed: `${datasetHash}:${imageId}`
-        },
-        records?.length || 0
-      );
-    }
-    finalOutput = sanitizeOutput(finalOutput);
-    if (data.proofMode === 1 || data.proofMode === 2) {
-      const guestImageIdBuf = data.guestImageId ? Buffer.from(data.guestImageId, "hex") : crypto2.createHash("sha256").update("liop-default-guest-v2").digest();
-      const outputStr = typeof finalOutput === "string" ? finalOutput : finalOutput === void 0 ? "undefined" : JSON.stringify(finalOutput);
-      const journalV2Buf = encodeJournalV2({
-        guestImageId: guestImageIdBuf,
-        logicDigest: Buffer.from(imageId, "hex"),
-        datasetDigest: Buffer.from(datasetHash, "hex"),
-        outputDigest: crypto2.createHash("sha256").update(outputStr).digest(),
-        fuelConsumed: BigInt(result.fuelConsumed),
-        executionTimestamp: BigInt(Date.now())
-      });
-      let proofBuf;
-      let nativeProver = null;
-      try {
-        nativeProver = await import('@nekzus/liop-zk-native');
-      } catch {
-        nativeProver = null;
-      }
-      if (nativeProver && typeof nativeProver.prove_analytical_query === "function") {
-        try {
-          const circuit = typeof decryptedInputs?.operation === "string" ? decryptedInputs.operation : "sum";
-          const inputsJson = JSON.stringify({
-            records: Array.isArray(records) ? records.map(
-              // biome-ignore lint/suspicious/noExplicitAny: record mapping
-              (r) => Number(r.amount ?? r.value ?? 1)
-            ) : [1],
-            expected_sum: typeof finalOutput === "number" ? finalOutput : void 0
-          });
-          proofBuf = await nativeProver.prove_analytical_query(
-            circuit,
-            inputsJson
-          );
-        } catch {
-          proofBuf = Buffer.alloc(128, 66);
-        }
-      } else {
-        proofBuf = Buffer.alloc(128, 66);
-      }
-      const receiptBuf2 = receiptCodec.encodeV2(
-        2 /* GROTH16 */,
-        journalV2Buf,
-        proofBuf
-      );
-      const zkReceipt2 = receiptBuf2.toString("base64");
-      return {
-        image_id: imageId,
-        zk_receipt: zkReceipt2,
-        output: finalOutput,
-        fuel_consumed: result.fuelConsumed,
-        proof_type: 2 /* GROTH16 */,
-        guest_image_id: guestImageIdBuf.toString("hex")
-      };
-    }
-    const journal = Buffer.from(
-      JSON.stringify({
-        image_id: imageId,
-        dataset_hash: datasetHash,
-        output_hash: crypto2.createHash("sha256").update(
-          typeof finalOutput === "string" ? finalOutput : finalOutput === void 0 ? "undefined" : JSON.stringify(finalOutput)
-        ).digest("hex"),
-        fuel: result.fuelConsumed,
-        ts: Date.now()
-      })
-    );
-    const seal = crypto2.createHmac("sha256", sessionSecret).update(journal).digest();
-    const journalLen = Buffer.alloc(2);
-    journalLen.writeUInt16BE(journal.length);
-    const receiptBuf = Buffer.concat([
-      Buffer.from([1]),
-      // Receipt format v1
-      journalLen,
-      journal,
-      seal
-      // 32 bytes HMAC
-    ]);
-    const zkReceipt = receiptBuf.toString("base64");
-    return {
-      image_id: imageId,
-      zk_receipt: zkReceipt,
-      output: finalOutput,
-      fuel_consumed: result.fuelConsumed,
-      proof_type: 0 /* HMAC_LEGACY */
-    };
-  } finally {
-    await sandbox.teardown();
-  }
-}
-
-export { processLogicExecution as default };
-//# sourceMappingURL=logic-execution.js.map
+import {a as a$1,d}from'../chunk-CTTTLCGL.js';import {a as a$3}from'../chunk-MQ5SU26J.js';import {a as a$2,b}from'../chunk-TKLRW52V.js';import {b as b$1}from'../chunk-2ZYX736J.js';import {f,h}from'../chunk-6VK2XALI.js';import {a}from'../chunk-AYDF3IFZ.js';import {Buffer}from'buffer';import m from'crypto';import {createMlKem768}from'mlkem';var Y={epsilon:1,sensitivity:1,smallDatasetThreshold:50},J=1,ee=10;function te(e,i){let o;do if(i)o=m.createHash("sha256").update(`${i.seed}:${i.counter++}`).digest().readUInt32BE(0)/4294967296-.5;else {let t=m.randomBytes(4),a=t[0]<<24|t[1]<<16|t[2]<<8|t[3];o=Number.parseInt(a.toString(10),10)/4294967296;}while(o===0||o===-0.5);return -e*Math.sign(o)*Math.log(1-2*Math.abs(o))}a(te,"laplaceSample");function re(e,i={},o){let t={...Y,...i},a=t.sensitivity/t.epsilon,c=e+te(a,o);return Math.round(c*1e4)/1e4}a(re,"addLaplaceNoise");function $(e,i,o){if(!e)return i;let t=e.toLowerCase(),a=/count|length|size|num|gainer|loser|positive|negative|nan_|null_|empty_|finite_|non_finite_|instruments|tickers|users|records/i.test(t),c=t==="total"||t==="n"||t==="total_records"||t.startsWith("total_")||t.startsWith("num_")||/total.*(count|items|entries|rows|records|tickers)/i.test(t);return a||c?1:/avg|mean|average|var|variance|std|stddev|ratio|bps|drift|pct|percent|imbalance/i.test(t)&&o>0?i/o:i}a($,"deriveFieldSensitivity");function Z(e,i={},o){let t={...Y,...i};if(o>=t.smallDatasetThreshold)return e;o<ee&&t.epsilon<J&&(t.epsilon=J);let a;return t.seed&&(a={seed:t.seed,counter:0}),R(e,t,o,void 0,a)}a(Z,"applyDpToOutput");function R(e,i,o,t,a){if(typeof e=="number"&&Number.isFinite(e)){let c=$(t,i.sensitivity,o),u=re(e,{...i,sensitivity:c},a),w=t!=null&&$(t,i.sensitivity,o)===1;return (Number.isInteger(e)||w)&&(u=Math.round(u)),e>=0&&(u=Math.max(0,u)),u}if(Array.isArray(e))return e.map(c=>R(c,i,o,t,a));if(e!==null&&typeof e=="object"){let c={};for(let[u,w]of Object.entries(e))c[u]=R(w,i,o,u,a);return c}return e}a(R,"walkAndNoise");async function oe(e){if(typeof Object.prototype=="object"&&!Object.isFrozen(Object.prototype)&&(Object.freeze(Object.prototype),Object.freeze(Array.prototype),Object.freeze(String.prototype),Object.freeze(Number.prototype),Object.freeze(Boolean.prototype),Object.freeze(RegExp.prototype),Object.freeze(Map.prototype),Object.freeze(Set.prototype),Object.freeze(Promise.prototype),Object.freeze(Error.prototype)),e.isWarmup)return {image_id:"",output:"warm",fuel_consumed:0};if(e.sessionTimestamp!==void 0){let n=Date.now()-e.sessionTimestamp;if(n>36e5)throw new Error(`[LIOP-PQC] Session secret expired: Age (${Math.round(n/1e3)}s) exceeds 3600s TTL limit.`);if(e.sessionTimestamp>Date.now()+6e4)throw new Error("[LIOP-PQC] Session secret invalid: Timestamp is in the future.")}let{ciphertext:i,secretKeyObj:o,wasmBinary:t,inputs:a,aesNonce:c,records:u,isEncrypted:w=true,dpConfig:z}=e,s,D={},C=Buffer.alloc(32);if(w){let p=new Uint8Array(o),n=new Uint8Array(i),g=(await createMlKem768()).decap(n,p),d=Buffer.from(g);C=d;let _=Buffer.from(t),k=_.subarray(-16),T=_.subarray(0,-16),A=m.createDecipheriv("aes-256-gcm",d,Buffer.from(c||new Uint8Array(12)));A.setAuthTag(k);let S=A.update(T);S=Buffer.concat([S,A.final()]),s=S;for(let[E,B]of Object.entries(a||{})){let y=Buffer.from(B),f=y.subarray(0,12),h=y.subarray(-16),x=y.subarray(12,-16),O=m.createDecipheriv("aes-256-gcm",d,f);O.setAuthTag(h);let v=O.update(x);v=Buffer.concat([v,O.final()]),D[E]=JSON.parse(v.toString("utf-8"));}}else t[0]===0&&t[1]===97&&t[2]===115&&t[3]===109?s=Buffer.from(t):s=Buffer.from(t).toString("utf-8");let K=s[0]===0&&s[1]===97&&s[2]===115&&s[3]===109;if(s instanceof Buffer&&K){let p=new Uint8Array(s),n=await WebAssembly.compile(p);a$1.analyze(n);}else s instanceof Buffer&&!K&&(s=s.toString("utf-8"));typeof s=="string"&&(s=a$2(s));let N=new d;await N.init();try{let p=await N.execute(s,u,D),n=p.output,I;typeof s=="string"?I=Buffer.from(s,"utf-8"):I=new Uint8Array(s);let g=b(I).toString("hex"),d=m.createHash("sha256").update(JSON.stringify(u||[])).digest("hex");if(z&&(n=Z(n,{...z,seed:`${d}:${g}`},u?.length||0)),n=a$3(n),e.proofMode===1||e.proofMode===2){let E=e.guestImageId?Buffer.from(e.guestImageId,"hex"):m.createHash("sha256").update("liop-default-guest-v2").digest(),B=typeof n=="string"?n:n===void 0?"undefined":JSON.stringify(n),y=f({guestImageId:E,logicDigest:Buffer.from(g,"hex"),datasetDigest:Buffer.from(d,"hex"),outputDigest:m.createHash("sha256").update(B).digest(),fuelConsumed:BigInt(p.fuelConsumed),executionTimestamp:BigInt(Date.now())}),f$1,h$1=null;try{h$1=await import('@nekzus/liop-zk-native');}catch{h$1=null;}if(h$1&&typeof h$1.prove_analytical_query=="function")try{let b=typeof D?.operation=="string"?D.operation:"sum",M=JSON.stringify({records:Array.isArray(u)?u.map(P=>Number(P.amount??P.value??1)):[1],expected_sum:typeof n=="number"?n:void 0});f$1=await h$1.prove_analytical_query(b,M);}catch(b){if(e.proofMode===2)throw new Error(`ZK PROOF GENERATION FAILED: Native Groth16 prover execution error: ${b instanceof Error?b.message:String(b)}`);f$1=Buffer.alloc(128,66);}else {if(e.proofMode===2)throw new Error("ZK PROOF GENERATION FAILED: Native Groth16 prover module unavailable for required policy.");f$1=Buffer.alloc(128,66);}let x,O=2;if(e.pqcSigningKey&&e.pqcSigningKey.length>0){O=3;let b=m.createHash("sha256").update(Buffer.concat([y,f$1])).digest(),M=b$1.sign(b,e.pqcSigningKey),P=b$1.getPublicKey(e.pqcSigningKey);x=h.encodeHybridV2(y,f$1,Buffer.from(M),Buffer.from(P));}else x=h.encodeV2(2,y,f$1);let v=x.toString("base64");return {image_id:g,zk_receipt:v,output:n,fuel_consumed:p.fuelConsumed,proof_type:O,guest_image_id:E.toString("hex")}}let _=Buffer.from(JSON.stringify({image_id:g,dataset_hash:d,output_hash:m.createHash("sha256").update(typeof n=="string"?n:n===void 0?"undefined":JSON.stringify(n)).digest("hex"),fuel:p.fuelConsumed,ts:Date.now()})),k=m.createHmac("sha256",C).update(_).digest(),T=Buffer.alloc(2);T.writeUInt16BE(_.length);let S=Buffer.concat([Buffer.from([1]),T,_,k]).toString("base64");return {image_id:g,zk_receipt:S,output:n,fuel_consumed:p.fuelConsumed,proof_type:0}}finally{await N.teardown();}}a(oe,"processLogicExecution");export{oe as default};//# sourceMappingURL=logic-execution.js.map
 //# sourceMappingURL=logic-execution.js.map

package/dist/workers/zk-verifier.d.ts

@@ -1,4 +1,4 @@
-import { Z as ZkPolicy } from '../zk-CYImPsa6.js';
+import { Z as ZkPolicy } from '../zk-DzYNWBgo.js';
 
 /**
  * ZK Verification Payload Structure.

package/dist/workers/zk-verifier.js

@@ -1,246 +1,2 @@
-import { deserializeVKey, deserializeGrothProof, verifyGroth16Proof } from '../chunk-OHMZZMMC.js';
-import { deriveLogicImageDigest } from '../chunk-IK7CGWAZ.js';
-import { receiptCodec, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, decodeJournalV2 } from '../chunk-P34HDRN5.js';
-import crypto from 'crypto';
-import 'worker_threads';
-
-function deriveImageId(logicPayload) {
-  return deriveLogicImageDigest(logicPayload);
-}
-function tryExtractProxyOutput(logicPayload) {
-  try {
-    const logicStr = Buffer.from(logicPayload).toString("utf-8").trim();
-    if (!logicStr.includes("__liop_proxy_tool")) {
-      return null;
-    }
-    const firstBraceIdx = logicStr.indexOf("{");
-    if (firstBraceIdx === -1) {
-      return null;
-    }
-    let braceCount = 0;
-    let inDoubleQuote = false;
-    let inSingleQuote = false;
-    let inBacktick = false;
-    let escaped = false;
-    let lastBraceIdx = -1;
-    for (let i = firstBraceIdx; i < logicStr.length; i++) {
-      const char = logicStr[i];
-      if (escaped) {
-        escaped = false;
-        continue;
-      }
-      if (char === "\\") {
-        escaped = true;
-        continue;
-      }
-      if (char === '"' && !inSingleQuote && !inBacktick) {
-        inDoubleQuote = !inDoubleQuote;
-        continue;
-      }
-      if (char === "'" && !inDoubleQuote && !inBacktick) {
-        inSingleQuote = !inSingleQuote;
-        continue;
-      }
-      if (char === "`" && !inDoubleQuote && !inSingleQuote) {
-        inBacktick = !inBacktick;
-        continue;
-      }
-      if (!inDoubleQuote && !inSingleQuote && !inBacktick) {
-        if (char === "{") {
-          braceCount++;
-        } else if (char === "}") {
-          braceCount--;
-          if (braceCount === 0) {
-            lastBraceIdx = i;
-            break;
-          }
-        }
-      }
-    }
-    if (lastBraceIdx !== -1) {
-      const jsonStr = logicStr.slice(firstBraceIdx, lastBraceIdx + 1);
-      const parsed = JSON.parse(jsonStr);
-      if (parsed?.__liop_proxy_tool) {
-        return parsed;
-      }
-    }
-  } catch (_e) {
-  }
-  return null;
-}
-async function verifyZkReceipt(payload) {
-  const {
-    logicPayload,
-    remoteImageIdHex,
-    guestImageIdHex,
-    zkReceipt,
-    sessionSecret,
-    vkeyRaw,
-    expectedOutput,
-    zkPolicy
-  } = payload;
-  if (!logicPayload || !remoteImageIdHex || !zkReceipt) {
-    return {
-      verified: false,
-      message: "Missing required verification fields."
-    };
-  }
-  let decodedReceipt;
-  try {
-    decodedReceipt = receiptCodec.decode(Buffer.from(zkReceipt));
-  } catch (err) {
-    return {
-      verified: false,
-      message: `Receipt Decode Failed: ${err.message}`
-    };
-  }
-  if (decodedReceipt.version === RECEIPT_VERSION_V1) {
-    if (zkPolicy === "required") {
-      return {
-        verified: false,
-        message: "Policy Violation: Clearance Tier requires ZK proof (Groth16), but received legacy HMAC."
-      };
-    }
-    const localImageId = deriveImageId(logicPayload);
-    const localImageIdHex = localImageId.toString("hex");
-    if (localImageIdHex !== remoteImageIdHex) {
-      return {
-        verified: false,
-        message: `Integrity Violation: Local (${localImageIdHex.slice(0, 8)}) != Remote (${remoteImageIdHex.slice(0, 8)})`
-      };
-    }
-    let journalData;
-    try {
-      journalData = JSON.parse(decodedReceipt.journal.toString());
-      if (journalData.image_id !== localImageIdHex) {
-        return {
-          verified: false,
-          message: `Journal ImageID mismatch: ${journalData.image_id.slice(0, 8)} != ${localImageIdHex.slice(0, 8)}`
-        };
-      }
-    } catch (_e) {
-      return { verified: false, message: "Failed to parse journal data." };
-    }
-    if (sessionSecret && sessionSecret.length > 0) {
-      const expectedSeal = crypto.createHmac("sha256", sessionSecret).update(decodedReceipt.journal).digest();
-      if (!crypto.timingSafeEqual(decodedReceipt.proof, expectedSeal)) {
-        return {
-          verified: false,
-          message: "Invalid seal: HMAC verification failed."
-        };
-      }
-    }
-    if (expectedOutput !== void 0) {
-      const proxyOutput = tryExtractProxyOutput(logicPayload);
-      const actualExpected = proxyOutput !== null ? proxyOutput : expectedOutput;
-      const expectedOutputStr = typeof actualExpected === "string" ? actualExpected : actualExpected === void 0 ? "undefined" : JSON.stringify(actualExpected);
-      const expectedOutputHash = crypto.createHash("sha256").update(expectedOutputStr).digest("hex");
-      if (journalData.output_hash !== expectedOutputHash) {
-        return {
-          verified: false,
-          message: `Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${journalData.output_hash.slice(0, 8)}) != Calculated output_hash (${expectedOutputHash.slice(0, 8)})`
-        };
-      }
-    }
-    return {
-      verified: true,
-      message: "HMAC Commitment Verified: Integrity intact.",
-      proofType: "hmac"
-    };
-  }
-  if (decodedReceipt.version === RECEIPT_VERSION_V2) {
-    if (decodedReceipt.proofType !== 2 /* GROTH16 */) {
-      return {
-        verified: false,
-        message: `Unsupported ZK proof type in v2 receipt: ${decodedReceipt.proofType}`
-      };
-    }
-    let journalV2;
-    try {
-      journalV2 = decodeJournalV2(decodedReceipt.journal);
-    } catch (err) {
-      return {
-        verified: false,
-        message: `Failed to decode ZkJournalV2: ${err.message}`
-      };
-    }
-    if (guestImageIdHex) {
-      const actualGuestId = journalV2.guestImageId.toString("hex");
-      if (actualGuestId !== guestImageIdHex) {
-        return {
-          verified: false,
-          message: `Guest ImageID Mismatch: Injected guest environment tampered (${actualGuestId.slice(0, 8)} != ${guestImageIdHex.slice(0, 8)}).`
-        };
-      }
-    }
-    const expectedLogicDigest = deriveImageId(logicPayload);
-    if (!journalV2.logicDigest.equals(expectedLogicDigest)) {
-      return {
-        verified: false,
-        message: `Logic Digest Mismatch: Remote origin executed unexpected logic (${journalV2.logicDigest.toString("hex").slice(0, 8)} != ${expectedLogicDigest.toString("hex").slice(0, 8)})`
-      };
-    }
-    if (vkeyRaw && vkeyRaw.length > 0) {
-      try {
-        const vkey = deserializeVKey(Buffer.from(vkeyRaw));
-        const proofWithSignals = deserializeGrothProof(decodedReceipt.proof);
-        const isMathValid = verifyGroth16Proof(vkey, proofWithSignals);
-        if (!isMathValid) {
-          return {
-            verified: false,
-            message: "Groth16 mathematical pairing verification failed: invalid proof."
-          };
-        }
-      } catch (err) {
-        return {
-          verified: false,
-          message: `Groth16 verification failed to execute: ${err.message}`
-        };
-      }
-    }
-    if (expectedOutput !== void 0) {
-      const proxyOutput = tryExtractProxyOutput(logicPayload);
-      const actualExpected = proxyOutput !== null ? proxyOutput : expectedOutput;
-      const expectedOutputStr = typeof actualExpected === "string" ? actualExpected : actualExpected === void 0 ? "undefined" : JSON.stringify(actualExpected);
-      const expectedOutputDigest = crypto.createHash("sha256").update(expectedOutputStr).digest();
-      if (!journalV2.outputDigest.equals(expectedOutputDigest)) {
-        return {
-          verified: false,
-          message: `Output Digest Mismatch (Replay/Tamper attempt): Journal (${journalV2.outputDigest.toString("hex").slice(0, 8)}) != Calculated (${expectedOutputDigest.toString("hex").slice(0, 8)})`
-        };
-      }
-    }
-    return {
-      verified: true,
-      message: "Groth16 Zero-Knowledge Proof Mathematically Certified.",
-      proofType: "groth16"
-    };
-  }
-  return {
-    verified: false,
-    message: `Unsupported receipt version: ${decodedReceipt.version}`
-  };
-}
-async function workerHandler(task) {
-  try {
-    if (task.action === "warmup") {
-      return {
-        verified: true,
-        message: "warm"
-      };
-    }
-    if (task.action === "verify_receipt") {
-      return await verifyZkReceipt(task);
-    }
-    throw new Error("Unknown action in ZkVerifier Worker.");
-  } catch (error) {
-    return {
-      verified: false,
-      message: `Verification Error: ${error.message}`
-    };
-  }
-}
-
-export { workerHandler as default };
-//# sourceMappingURL=zk-verifier.js.map
+import {d,f,b as b$3}from'../chunk-FDJMH4CB.js';import {b}from'../chunk-TKLRW52V.js';import {b as b$2}from'../chunk-2ZYX736J.js';import {h,b as b$1,c,g}from'../chunk-6VK2XALI.js';import {a}from'../chunk-AYDF3IFZ.js';import v from'crypto';import'worker_threads';function D(s){return b(s)}a(D,"deriveImageId");function O(s){try{let i=Buffer.from(s).toString("utf-8").trim();if(!i.includes("__liop_proxy_tool"))return null;let d=i.indexOf("{");if(d===-1)return null;let p=0,c=!1,n=!1,o=!1,f=!1,y=-1;for(let e=d;e<i.length;e++){let t=i[e];if(f){f=!1;continue}if(t==="\\"){f=!0;continue}if(t==='"'&&!n&&!o){c=!c;continue}if(t==="'"&&!c&&!o){n=!n;continue}if(t==="`"&&!c&&!n){o=!o;continue}if(!c&&!n&&!o){if(t==="{")p++;else if(t==="}"&&(p--,p===0)){y=e;break}}}if(y!==-1){let e=i.slice(d,y+1),t=JSON.parse(e);if(t?.__liop_proxy_tool)return t}}catch{}return null}a(O,"tryExtractProxyOutput");async function T(s){let{logicPayload:i,remoteImageIdHex:d$1,guestImageIdHex:p,zkReceipt:c$1,sessionSecret:n,vkeyRaw:o,expectedOutput:f$1,zkPolicy:y}=s;if(!i||!d$1||!c$1)return {verified:false,message:"Missing required verification fields."};let e;try{e=h.decode(Buffer.from(c$1));}catch(t){return {verified:false,message:`Receipt Decode Failed: ${t.message}`}}if(e.version===b$1){if(y==="required")return {verified:false,message:"Policy Violation: Clearance Tier requires ZK proof (Groth16), but received legacy HMAC."};let g=D(i).toString("hex");if(g!==d$1)return {verified:false,message:`Integrity Violation: Local (${g.slice(0,8)}) != Remote (${d$1.slice(0,8)})`};let u;try{if(u=JSON.parse(e.journal.toString()),u.image_id!==g)return {verified:!1,message:`Journal ImageID mismatch: ${u.image_id.slice(0,8)} != ${g.slice(0,8)}`}}catch{return {verified:false,message:"Failed to parse journal data."}}if(n&&n.length>0){let r=v.createHmac("sha256",n).update(e.journal).digest();if(!v.timingSafeEqual(e.proof,r))return {verified:false,message:"Invalid seal: HMAC verification failed."}}if(f$1!==void 0){let r=O(i),a=r!==null?r:f$1,m=typeof a=="string"?a:a===void 0?"undefined":JSON.stringify(a),l=v.createHash("sha256").update(m).digest("hex");if(u.output_hash!==l)return {verified:false,message:`Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${u.output_hash.slice(0,8)}) != Calculated output_hash (${l.slice(0,8)})`}}return {verified:true,message:"HMAC Commitment Verified: Integrity intact.",proofType:"hmac"}}if(e.version===c){if(e.proofType!==2&&e.proofType!==3)return {verified:false,message:`Unsupported ZK proof type in v2 receipt: ${e.proofType}`};if(e.proofType===3){let{pqcSignature:r,pqcPublicKey:a}=e;if(!r||!a)return {verified:false,message:"Hybrid Receipt Error: Missing ML-DSA-65 signature or public key."};let m=v.createHash("sha256").update(Buffer.concat([e.journal,e.proof])).digest();try{if(!b$2.verify(new Uint8Array(r),m,new Uint8Array(a)))return {verified:!1,message:"PQC Signature Verification Failed: ML-DSA-65 co-sign is forged or corrupted."}}catch(l){return {verified:false,message:`PQC Verification Error: ${l.message}`}}}let t;try{t=g(e.journal);}catch(r){return {verified:false,message:`Failed to decode ZkJournalV2: ${r.message}`}}if(p){let r=t.guestImageId.toString("hex");if(r!==p)return {verified:false,message:`Guest ImageID Mismatch: Injected guest environment tampered (${r.slice(0,8)} != ${p.slice(0,8)}).`}}let g$1=D(i);if(!t.logicDigest.equals(g$1))return {verified:false,message:`Logic Digest Mismatch: Remote origin executed unexpected logic (${t.logicDigest.toString("hex").slice(0,8)} != ${g$1.toString("hex").slice(0,8)})`};if(o&&o.length>0)try{let r=d(Buffer.from(o)),a=f(e.proof);if(!b$3(r,a))return {verified:!1,message:"Groth16 mathematical pairing verification failed: invalid proof."}}catch(r){return {verified:false,message:`Groth16 verification failed to execute: ${r.message}`}}if(f$1!==void 0){let r=O(i),a=r!==null?r:f$1,m=typeof a=="string"?a:a===void 0?"undefined":JSON.stringify(a),l=v.createHash("sha256").update(m).digest();if(!t.outputDigest.equals(l))return {verified:false,message:`Output Digest Mismatch (Replay/Tamper attempt): Journal (${t.outputDigest.toString("hex").slice(0,8)}) != Calculated (${l.toString("hex").slice(0,8)})`}}let u=e.proofType===3;return {verified:true,message:u?"Groth16 + ML-DSA-65 Post-Quantum Hybrid Receipt Certified.":o&&o.length>0?"Groth16 Zero-Knowledge Proof Mathematically Certified.":"Groth16 Receipt Structure and Journal Integrity Certified.",proofType:u?"groth16_pqc_hybrid":"groth16"}}return {verified:false,message:`Unsupported receipt version: ${e.version}`}}a(T,"verifyZkReceipt");async function C(s){try{if(s.action==="warmup")return {verified:!0,message:"warm"};if(s.action==="verify_receipt")return await T(s);throw new Error("Unknown action in ZkVerifier Worker.")}catch(i){return {verified:false,message:`Verification Error: ${i.message}`}}}a(C,"workerHandler");export{C as default};//# sourceMappingURL=zk-verifier.js.map
 //# sourceMappingURL=zk-verifier.js.map

package/dist/{zk-CYImPsa6.d.ts → zk-DzYNWBgo.d.ts}

@@ -1,6 +1,7 @@
 declare enum ProofType {
     HMAC_LEGACY = 0,
-    GROTH16 = 2
+    GROTH16 = 2,
+    GROTH16_PQC_HYBRID = 3
 }
 declare const RECEIPT_VERSION_V1 = 1;
 declare const RECEIPT_VERSION_V2 = 2;
@@ -49,6 +50,8 @@ interface DecodedReceipt {
     journal: Buffer;
     proof: Buffer;
     raw: Buffer;
+    pqcSignature?: Buffer;
+    pqcPublicKey?: Buffer;
 }
 declare const receiptCodec: {
     /**
@@ -56,6 +59,16 @@ declare const receiptCodec: {
      * Layout: [0x02][proofType: 1B][journalLen: 4B UInt32BE][journal][proof][checksum: 32B]
      */
     encodeV2(proofType: ProofType, journal: Buffer, proof: Buffer): Buffer;
+    /**
+     * Encodes a version 2.1 Hybrid Binary Receipt (Groth16 + ML-DSA-65 co-sign).
+     * Layout:
+     * [0x02][0x03 ProofType.GROTH16_PQC_HYBRID][journalLen: 4B UInt32BE][journal: 144B]
+     * [proofLen: 2B UInt16BE][groth16 proof: ~260B]
+     * [sigLen: 2B UInt16BE][signature: 3309B]
+     * [publicKey: 1952B]
+     * [checksum: 32B SHA-256]
+     */
+    encodeHybridV2(journal: Buffer, proof: Buffer, pqcSignature: Buffer, pqcPublicKey: Buffer): Buffer;
     /**
      * Decodes any LIOP Binary Receipt (v1 HMAC or v2 ZK).
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nekzus/liop",
-  "version": "2.4.0-alpha.24",
+  "version": "2.4.0-alpha.26",
   "description": "Official SDK for Logic-Injection-on-Origin Protocol (LIOP). Deploy Logic-on-Origin with WebAssembly at gRPC speed and bidirectional MCP compatibility.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -32,6 +32,7 @@
   "sideEffects": false,
   "files": [
     "dist",
+    "!dist/**/*.js.map",
     "README.md",
     "LICENSE",
     "NOTICE"
@@ -92,7 +93,6 @@
     "@types/node": "26.4.0",
     "@types/oidc-provider": "9.12.1",
     "@vitest/coverage-v8": "4.1.11",
-    "gpt-tokenizer": "4.0.0",
     "tsup": "8.5.1",
     "tsx": "4.23.13",
     "typescript": "6.0.3",
@@ -121,6 +121,7 @@
     "@noble/post-quantum": "0.7.1",
     "acorn": "8.18.0",
     "acorn-walk": "8.3.5",
+    "gpt-tokenizer": "4.0.0",
     "hono": "4.13.8",
     "it-pipe": "3.0.1",
     "jose": "6.2.12",
@@ -226,6 +227,9 @@
     "audit:prod:run": "tsx tests/infra/production-audit/cli/audit-run.ts",
     "audit:prod:runner": "docker compose -f tests/infra/production-audit/docker-compose.production-audit.yml run --rm audit-runner",
     "audit:prod:clean": "tsx tests/infra/production-audit/cli/audit-clean.ts",
+    "audit:local:start": "tsx tests/infra/production-audit/cli/audit-start-local.ts",
+    "audit:local:run": "tsx tests/infra/production-audit/cli/audit-run.ts --local",
+    "audit:local:runner": "docker compose -f tests/infra/production-audit/docker-compose.production-audit.yml -f tests/infra/production-audit/docker-compose.local.yml run --rm audit-runner",
     "telemetry:stream": "tsx scripts/telemetry-stream.ts"
   }
 }