@nekzus/liop 2.4.0-alpha.25 → 2.4.0-alpha.26

package/dist/chunk-ET6VRUK2.js

@@ -1,58 +0,0 @@
-import { ZkVerificationError } from './chunk-FIVRGOA4.js';
-import { bn254, stringBigints } from 'micro-zk-proofs';
-
-var VERIFICATION_LATENCY_BUDGET_MS = 250;
-function verifyGroth16Proof(vkey, proofWithSignals) {
-  if (!vkey || !proofWithSignals?.proof) {
-    return false;
-  }
-  try {
-    return bn254.groth.verifyProof(vkey, proofWithSignals);
-  } catch (_error) {
-    return false;
-  }
-}
-function serializeVKey(vkey) {
-  try {
-    const encoded = stringBigints.encode(vkey);
-    return Buffer.from(JSON.stringify(encoded), "utf-8");
-  } catch (error) {
-    throw new ZkVerificationError(
-      `Failed to serialize VerificationKey: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-function deserializeVKey(buf) {
-  try {
-    const parsed = JSON.parse(buf.toString("utf-8"));
-    return stringBigints.decode(parsed);
-  } catch (error) {
-    throw new ZkVerificationError(
-      `Failed to deserialize VerificationKey: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-function serializeGrothProof(proofWithSignals) {
-  try {
-    const encoded = stringBigints.encode(proofWithSignals);
-    return Buffer.from(JSON.stringify(encoded), "utf-8");
-  } catch (error) {
-    throw new ZkVerificationError(
-      `Failed to serialize GrothProof: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-function deserializeGrothProof(buf) {
-  try {
-    const parsed = JSON.parse(buf.toString("utf-8"));
-    return stringBigints.decode(parsed);
-  } catch (error) {
-    throw new ZkVerificationError(
-      `Failed to deserialize GrothProof: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
-export { VERIFICATION_LATENCY_BUDGET_MS, deserializeGrothProof, deserializeVKey, serializeGrothProof, serializeVKey, verifyGroth16Proof };
-//# sourceMappingURL=chunk-ET6VRUK2.js.map
-//# sourceMappingURL=chunk-ET6VRUK2.js.map

package/dist/chunk-FIVRGOA4.js

@@ -1,280 +0,0 @@
-import crypto from 'crypto';
-
-// src/security/zk.ts
-var ProofType = /* @__PURE__ */ ((ProofType2) => {
-  ProofType2[ProofType2["HMAC_LEGACY"] = 0] = "HMAC_LEGACY";
-  ProofType2[ProofType2["GROTH16"] = 2] = "GROTH16";
-  ProofType2[ProofType2["GROTH16_PQC_HYBRID"] = 3] = "GROTH16_PQC_HYBRID";
-  return ProofType2;
-})(ProofType || {});
-var RECEIPT_VERSION_V1 = 1;
-var RECEIPT_VERSION_V2 = 2;
-var ZK_JOURNAL_V2_SIZE = 144;
-var ZkVerificationError = class extends Error {
-  constructor(message) {
-    super(`ZK Verification Failed: ${message}`);
-    this.name = "ZkVerificationError";
-  }
-};
-function encodeJournalV2(fields) {
-  if (fields.guestImageId.length !== 32) {
-    throw new ZkVerificationError(
-      `Invalid guestImageId size: expected 32 bytes, got ${fields.guestImageId.length}`
-    );
-  }
-  if (fields.logicDigest.length !== 32) {
-    throw new ZkVerificationError(
-      `Invalid logicDigest size: expected 32 bytes, got ${fields.logicDigest.length}`
-    );
-  }
-  if (fields.datasetDigest.length !== 32) {
-    throw new ZkVerificationError(
-      `Invalid datasetDigest size: expected 32 bytes, got ${fields.datasetDigest.length}`
-    );
-  }
-  if (fields.outputDigest.length !== 32) {
-    throw new ZkVerificationError(
-      `Invalid outputDigest size: expected 32 bytes, got ${fields.outputDigest.length}`
-    );
-  }
-  const buf = Buffer.alloc(ZK_JOURNAL_V2_SIZE);
-  fields.guestImageId.copy(buf, 0);
-  fields.logicDigest.copy(buf, 32);
-  fields.datasetDigest.copy(buf, 64);
-  fields.outputDigest.copy(buf, 96);
-  buf.writeBigUInt64BE(BigInt(fields.fuelConsumed), 128);
-  buf.writeBigUInt64BE(BigInt(fields.executionTimestamp), 136);
-  return buf;
-}
-function decodeJournalV2(buf) {
-  if (buf.length !== ZK_JOURNAL_V2_SIZE) {
-    throw new ZkVerificationError(
-      `Invalid ZkJournalV2 size: expected ${ZK_JOURNAL_V2_SIZE} bytes, got ${buf.length}`
-    );
-  }
-  return {
-    guestImageId: Buffer.from(buf.subarray(0, 32)),
-    logicDigest: Buffer.from(buf.subarray(32, 64)),
-    datasetDigest: Buffer.from(buf.subarray(64, 96)),
-    outputDigest: Buffer.from(buf.subarray(96, 128)),
-    fuelConsumed: buf.readBigUInt64BE(128),
-    executionTimestamp: buf.readBigUInt64BE(136)
-  };
-}
-var receiptCodec = {
-  /**
-   * Encodes a version 2 Binary Receipt with trailing SHA-256 checksum.
-   * Layout: [0x02][proofType: 1B][journalLen: 4B UInt32BE][journal][proof][checksum: 32B]
-   */
-  encodeV2(proofType, journal, proof) {
-    const header = Buffer.alloc(6);
-    header.writeUInt8(RECEIPT_VERSION_V2, 0);
-    header.writeUInt8(proofType, 1);
-    header.writeUInt32BE(journal.length, 2);
-    const payload = Buffer.concat([header, journal, proof]);
-    const checksum = crypto.createHash("sha256").update(payload).digest();
-    return Buffer.concat([payload, checksum]);
-  },
-  /**
-   * Encodes a version 2.1 Hybrid Binary Receipt (Groth16 + ML-DSA-65 co-sign).
-   * Layout:
-   * [0x02][0x03 ProofType.GROTH16_PQC_HYBRID][journalLen: 4B UInt32BE][journal: 144B]
-   * [proofLen: 2B UInt16BE][groth16 proof: ~260B]
-   * [sigLen: 2B UInt16BE][signature: 3309B]
-   * [publicKey: 1952B]
-   * [checksum: 32B SHA-256]
-   */
-  encodeHybridV2(journal, proof, pqcSignature, pqcPublicKey) {
-    const header = Buffer.alloc(6);
-    header.writeUInt8(RECEIPT_VERSION_V2, 0);
-    header.writeUInt8(3 /* GROTH16_PQC_HYBRID */, 1);
-    header.writeUInt32BE(journal.length, 2);
-    const proofLenBuf = Buffer.alloc(2);
-    proofLenBuf.writeUInt16BE(proof.length, 0);
-    const sigLenBuf = Buffer.alloc(2);
-    sigLenBuf.writeUInt16BE(pqcSignature.length, 0);
-    const payload = Buffer.concat([
-      header,
-      journal,
-      proofLenBuf,
-      proof,
-      sigLenBuf,
-      pqcSignature,
-      pqcPublicKey
-    ]);
-    const checksum = crypto.createHash("sha256").update(payload).digest();
-    return Buffer.concat([payload, checksum]);
-  },
-  /**
-   * Decodes any LIOP Binary Receipt (v1 HMAC or v2 ZK).
-   */
-  decode(raw) {
-    if (!raw || raw.length === 0) {
-      throw new ZkVerificationError(
-        "Empty or malformed zero-knowledge proof array."
-      );
-    }
-    const version = raw[0];
-    if (version === RECEIPT_VERSION_V1) {
-      if (raw.length < 35) {
-        throw new ZkVerificationError(
-          "Malformed receipt: invalid header or length."
-        );
-      }
-      const journalLen = raw.readUInt16BE(1);
-      if (raw.length < 3 + journalLen + 32) {
-        throw new ZkVerificationError(
-          "Malformed receipt: truncated journal or seal."
-        );
-      }
-      const journal = Buffer.from(raw.subarray(3, 3 + journalLen));
-      const seal = Buffer.from(
-        raw.subarray(3 + journalLen, 3 + journalLen + 32)
-      );
-      return {
-        version: RECEIPT_VERSION_V1,
-        proofType: 0 /* HMAC_LEGACY */,
-        journal,
-        proof: seal,
-        raw
-      };
-    }
-    if (version === RECEIPT_VERSION_V2) {
-      if (raw.length < 38) {
-        throw new ZkVerificationError(
-          "Malformed receipt v2: buffer too short (< 38 bytes)."
-        );
-      }
-      const proofType = raw[1];
-      const journalLen = raw.readUInt32BE(2);
-      if (raw.length < 6 + journalLen + 32) {
-        throw new ZkVerificationError(
-          "Malformed receipt v2: truncated payload."
-        );
-      }
-      const payload = raw.subarray(0, raw.length - 32);
-      const expectedChecksum = raw.subarray(raw.length - 32);
-      const actualChecksum = crypto.createHash("sha256").update(payload).digest();
-      if (!crypto.timingSafeEqual(expectedChecksum, actualChecksum)) {
-        throw new ZkVerificationError("Receipt checksum verification failed.");
-      }
-      const journal = Buffer.from(raw.subarray(6, 6 + journalLen));
-      if (proofType === 3 /* GROTH16_PQC_HYBRID */) {
-        let offset = 6 + journalLen;
-        if (raw.length < offset + 2 + 32) {
-          throw new ZkVerificationError(
-            "Malformed hybrid receipt: missing proof length header."
-          );
-        }
-        const proofLen = raw.readUInt16BE(offset);
-        offset += 2;
-        if (raw.length < offset + proofLen + 2 + 32) {
-          throw new ZkVerificationError(
-            "Malformed hybrid receipt: truncated Groth16 proof."
-          );
-        }
-        const proof2 = Buffer.from(raw.subarray(offset, offset + proofLen));
-        offset += proofLen;
-        const sigLen = raw.readUInt16BE(offset);
-        offset += 2;
-        if (raw.length < offset + sigLen + 32) {
-          throw new ZkVerificationError(
-            "Malformed hybrid receipt: truncated ML-DSA-65 signature."
-          );
-        }
-        const pqcSignature = Buffer.from(raw.subarray(offset, offset + sigLen));
-        offset += sigLen;
-        const pqcPublicKey = Buffer.from(raw.subarray(offset, raw.length - 32));
-        return {
-          version: RECEIPT_VERSION_V2,
-          proofType,
-          journal,
-          proof: proof2,
-          pqcSignature,
-          pqcPublicKey,
-          raw
-        };
-      }
-      const proof = Buffer.from(raw.subarray(6 + journalLen, raw.length - 32));
-      return {
-        version: RECEIPT_VERSION_V2,
-        proofType,
-        journal,
-        proof,
-        raw
-      };
-    }
-    throw new ZkVerificationError(
-      `Unsupported receipt version: 0x${version.toString(16)}`
-    );
-  }
-};
-var ZkVerifier = {
-  /**
-   * Validates a ZK receipt using structural Binary Receipt verification.
-   * Parses the HMAC-SHA256 commitment format (v1) and verifies journal integrity.
-   *
-   * @param receipt - Complete ZkReceipt to verify
-   * @param expectedImageId - Hash or ImageID of the WASM file dispatched to the host
-   * @throws ZkVerificationError if the proof is invalid or image IDs mismatch
-   * @returns true if the proof mathematically verifies the execution
-   */
-  verify(receipt, expectedImageId, sessionSecret) {
-    if (!receipt.imageId.equals(expectedImageId)) {
-      throw new ZkVerificationError(
-        "ImageID mismatch. The remote origin executed a different WASM payload."
-      );
-    }
-    if (receipt.proof.length === 0) {
-      throw new ZkVerificationError(
-        "Empty or malformed zero-knowledge proof array."
-      );
-    }
-    const proofBuf = Buffer.from(receipt.proof);
-    if (proofBuf.length < 35 || proofBuf[0] !== 1) {
-      throw new ZkVerificationError(
-        "Malformed receipt: invalid header or length."
-      );
-    }
-    const journalLen = proofBuf.readUInt16BE(1);
-    const journal = proofBuf.subarray(3, 3 + journalLen);
-    const seal = proofBuf.subarray(3 + journalLen);
-    if (seal.length !== 32) {
-      throw new ZkVerificationError(
-        "Invalid seal: expected 32-byte HMAC-SHA256."
-      );
-    }
-    try {
-      const journalData = JSON.parse(journal.toString());
-      if (journalData.image_id !== receipt.imageId.toString("hex")) {
-        throw new ZkVerificationError(
-          "Journal imageId does not match receipt header."
-        );
-      }
-    } catch (_e) {
-      throw new ZkVerificationError("Failed to parse journal data.");
-    }
-    if (sessionSecret && sessionSecret.length > 0) {
-      const expectedSeal = crypto.createHmac("sha256", sessionSecret).update(journal).digest();
-      if (!crypto.timingSafeEqual(seal, expectedSeal)) {
-        throw new ZkVerificationError(
-          "Invalid seal: HMAC verification failed."
-        );
-      }
-    }
-    return true;
-  },
-  /**
-   * Derives a predictable ImageID (usually a Hash) from a raw WASM binary.
-   *
-   * @param wasmBytes - The raw bytes of the WASM logic file
-   * @returns The SHA-256 ImageID of the logic
-   */
-  deriveImageId(wasmBytes) {
-    return crypto.createHash("sha256").update(wasmBytes).digest();
-  }
-};
-
-export { ProofType, RECEIPT_VERSION_V1, RECEIPT_VERSION_V2, ZK_JOURNAL_V2_SIZE, ZkVerificationError, ZkVerifier, decodeJournalV2, encodeJournalV2, receiptCodec };
-//# sourceMappingURL=chunk-FIVRGOA4.js.map
-//# sourceMappingURL=chunk-FIVRGOA4.js.map