@nekzus/liop 2.4.0-alpha.25 → 2.4.0-alpha.26

package/dist/chunk-WXYDFCIW.js

@@ -1,293 +0,0 @@
-import { deriveLogicImageDigest } from './chunk-IK7CGWAZ.js';
-import { zkVkeyCacheSize, zkVerificationDurationMs, zkProofsByTypeTotal } from './chunk-Q3FKHJ3B.js';
-import { log } from './chunk-K3DGJLUY.js';
-import crypto from 'crypto';
-import * as fs from 'fs';
-import { createRequire } from 'module';
-import path from 'path';
-import { fileURLToPath, pathToFileURL } from 'url';
-import { Piscina } from 'piscina';
-
-var __filename$1 = fileURLToPath(import.meta.url);
-var __dirname$1 = path.dirname(__filename$1);
-var LiopVerifier = class _LiopVerifier {
-  // Singleton Worker Pool for heavy ZK verification
-  static zkWorkerPool = null;
-  // Static registry of embedded verification keys for canonical circuits
-  static vkeyRegistry = /* @__PURE__ */ new Map();
-  /**
-   * Registers a verification key for a canonical analytical circuit.
-   */
-  static registerVKey(circuitName, vkeyRaw) {
-    _LiopVerifier.vkeyRegistry.set(circuitName, vkeyRaw);
-    try {
-      zkVkeyCacheSize.set(_LiopVerifier.vkeyRegistry.size);
-    } catch {
-    }
-  }
-  /**
-   * Retrieves a registered verification key by circuit name.
-   */
-  static getRegisteredVKey(circuitName) {
-    return _LiopVerifier.vkeyRegistry.get(circuitName);
-  }
-  getZkPool() {
-    if (!_LiopVerifier.zkWorkerPool) {
-      const isTS = import.meta.url.endsWith(".ts");
-      const workerExt = isTS ? ".ts" : ".js";
-      let execArgv = [];
-      if (isTS) {
-        try {
-          const req = createRequire(import.meta.url);
-          const tsxPkg = req.resolve("tsx/package.json");
-          const absoluteTsx = pathToFileURL(
-            path.join(path.dirname(tsxPkg), "dist", "loader.mjs")
-          ).href;
-          execArgv = ["--import", absoluteTsx];
-        } catch (_e) {
-          execArgv = ["--import", "tsx"];
-        }
-      }
-      const workerPaths = [
-        path.resolve(__dirname$1, `./workers/zk-verifier${workerExt}`),
-        // Flat dist/ (tsup)
-        path.resolve(__dirname$1, `../workers/zk-verifier${workerExt}`)
-        // Original src/
-      ];
-      const workerFilename = workerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];
-      _LiopVerifier.zkWorkerPool = new Piscina({
-        filename: workerFilename,
-        minThreads: 1,
-        maxThreads: 2,
-        // Minimal footprint since verification is fast compared to generation
-        idleTimeout: 3e4,
-        execArgv
-      });
-      _LiopVerifier.zkWorkerPool.run({ action: "warmup" }).catch((err) => {
-        log.debug(
-          `[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`
-        );
-      });
-    }
-    return _LiopVerifier.zkWorkerPool;
-  }
-  /**
-   * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.
-   * Supports both legacy positional arguments and structured options.
-   *
-   * @param logicPayload The raw WASM or JS logic that was sent to the provider.
-   * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).
-   * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM or Groth16.
-   * @param sessionSecretOrOptions Shared secret (Buffer) or structured VerifyZkOptions.
-   * @param expectedOutput Optional expected output value for anti-replay verification.
-   */
-  async verifyZkReceipt(logicPayload, remoteImageIdHex, zkReceipt, sessionSecretOrOptions, expectedOutput) {
-    const pool = this.getZkPool();
-    if (!pool) throw new Error("Worker pool initialization failed");
-    let sessionSecret;
-    let actualExpectedOutput = expectedOutput;
-    let guestImageIdHex;
-    let vkeyRaw;
-    let zkPolicy;
-    if (Buffer.isBuffer(sessionSecretOrOptions)) {
-      sessionSecret = sessionSecretOrOptions;
-    } else if (sessionSecretOrOptions && typeof sessionSecretOrOptions === "object") {
-      sessionSecret = sessionSecretOrOptions.sessionSecret;
-      if (sessionSecretOrOptions.expectedOutput !== void 0) {
-        actualExpectedOutput = sessionSecretOrOptions.expectedOutput;
-      }
-      guestImageIdHex = sessionSecretOrOptions.guestImageIdHex;
-      vkeyRaw = sessionSecretOrOptions.vkeyRaw;
-      zkPolicy = sessionSecretOrOptions.zkPolicy;
-      if (!vkeyRaw && sessionSecretOrOptions.circuitName) {
-        vkeyRaw = _LiopVerifier.getRegisteredVKey(
-          sessionSecretOrOptions.circuitName
-        );
-      }
-    }
-    const startTime = performance.now();
-    const result = await pool.run({
-      action: "verify_receipt",
-      logicPayload: new Uint8Array(logicPayload),
-      remoteImageIdHex,
-      guestImageIdHex,
-      zkReceipt: new Uint8Array(zkReceipt),
-      sessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : void 0,
-      vkeyRaw: vkeyRaw ? new Uint8Array(vkeyRaw) : void 0,
-      expectedOutput: actualExpectedOutput,
-      zkPolicy
-    });
-    const durationMs = performance.now() - startTime;
-    try {
-      zkVerificationDurationMs.observe(
-        {
-          status: result.verified ? "verified" : "failed",
-          proof_type: result.proofType || "unknown"
-        },
-        durationMs
-      );
-      if (result.verified && result.proofType) {
-        zkProofsByTypeTotal.inc({ proof_type: result.proofType });
-      }
-    } catch {
-    }
-    if (result.verified) {
-      log.info(`[LiopVerifier] ${result.message}`);
-      return true;
-    }
-    log.error(`[LiopVerifier] FAILED: ${result.message}`);
-    return false;
-  }
-  /**
-   * Detailed hardware attestation verification supporting AMD SEV-SNP, AWS Nitro Enclaves,
-   * and synthetic mesh verification.
-   */
-  async verifyTeeAttestationDetailed(attestationReport, options = {}) {
-    const policy = options.policy ?? "preferred";
-    if (policy === "none") {
-      return {
-        verified: true,
-        platform: "none",
-        message: "TEE Attestation bypassed: Policy set to 'none'."
-      };
-    }
-    if (!attestationReport || attestationReport.length === 0) {
-      if (policy === "required") {
-        return {
-          verified: false,
-          platform: "none",
-          message: "TEE Policy Violation: Hardware TEE attestation required, but no attestation report was provided."
-        };
-      }
-      return {
-        verified: true,
-        platform: "none",
-        message: "TEE Attestation skipped: Empty report allowed under non-strict policy."
-      };
-    }
-    let expectedBindingDigest = null;
-    if (options.expectedPublicKey || options.expectedNonce) {
-      const parts = [];
-      if (options.expectedPublicKey)
-        parts.push(Buffer.from(options.expectedPublicKey));
-      if (options.expectedNonce) parts.push(Buffer.from(options.expectedNonce));
-      expectedBindingDigest = crypto.createHash("sha256").update(Buffer.concat(parts)).digest();
-    }
-    if (attestationReport.length >= 4 && attestationReport[0] === 84 && attestationReport[1] === 69 && attestationReport[2] === 69 && attestationReport[3] === 83) {
-      if (policy === "required" && !options.allowSynthetic) {
-        return {
-          verified: false,
-          platform: "synthetic",
-          message: "TEE Policy Violation: Hardware TEE attestation required, but received synthetic mesh report."
-        };
-      }
-      return {
-        verified: true,
-        platform: "synthetic",
-        message: "Synthetic TEE Attestation Verified (Mesh PSK mode)."
-      };
-    }
-    if (attestationReport.length >= 672) {
-      const reportData = attestationReport.subarray(80, 80 + 64);
-      const measurement = attestationReport.subarray(144, 144 + 48);
-      const chipId = attestationReport.length >= 480 ? attestationReport.subarray(416, 416 + 64) : void 0;
-      if (expectedBindingDigest) {
-        const reportBinding = reportData.subarray(
-          0,
-          expectedBindingDigest.length
-        );
-        if (!crypto.timingSafeEqual(reportBinding, expectedBindingDigest)) {
-          return {
-            verified: false,
-            platform: "amd-sev-snp",
-            message: "AMD SEV-SNP Attestation Failed: REPORT_DATA binding mismatch (public key / nonce forged or altered).",
-            measurements: {
-              reportDataHex: reportData.toString("hex"),
-              measurementHex: measurement.toString("hex"),
-              chipIdHex: chipId?.toString("hex")
-            }
-          };
-        }
-      }
-      return {
-        verified: true,
-        platform: "amd-sev-snp",
-        message: "AMD SEV-SNP Hardware TEE Attestation Certified: Cryptographic measurement & REPORT_DATA verified.",
-        measurements: {
-          reportDataHex: reportData.toString("hex"),
-          measurementHex: measurement.toString("hex"),
-          chipIdHex: chipId?.toString("hex")
-        }
-      };
-    }
-    const isNitroCose = attestationReport.length >= 2 && attestationReport[0] === 210 && attestationReport[1] === 132 || attestationReport.includes(Buffer.from("pcrs"));
-    if (isNitroCose) {
-      if (options.expectedPcrs) {
-        for (const [pcrIdx, expectedHex] of Object.entries(
-          options.expectedPcrs
-        )) {
-          const pcrMarker = Buffer.from(expectedHex, "hex");
-          if (pcrMarker.length > 0 && !attestationReport.includes(pcrMarker)) {
-            return {
-              verified: false,
-              platform: "aws-nitro",
-              message: `AWS Nitro Attestation Failed: PCR${pcrIdx} measurement mismatch.`
-            };
-          }
-        }
-      }
-      if (expectedBindingDigest && !attestationReport.includes(expectedBindingDigest)) {
-        return {
-          verified: false,
-          platform: "aws-nitro",
-          message: "AWS Nitro Attestation Failed: user_data binding mismatch (public key / nonce forged or altered)."
-        };
-      }
-      return {
-        verified: true,
-        platform: "aws-nitro",
-        message: "AWS Nitro Enclave Hardware TEE Attestation Certified: PCR measurements & user_data verified."
-      };
-    }
-    if (policy === "required") {
-      return {
-        verified: false,
-        platform: "none",
-        message: `TEE Verification Failed: Unrecognized hardware attestation report format (${attestationReport.length} bytes).`
-      };
-    }
-    return {
-      verified: true,
-      platform: "none",
-      message: "Non-critical TEE report accepted under relaxed policy."
-    };
-  }
-  /**
-   * Verifies if a node is running inside an authenticated TEE (e.g. AMD SEV-SNP or AWS Nitro).
-   *
-   * @param attestationReport The attestation document from the hardware.
-   * @param options Verification policy and binding options.
-   */
-  async verifyTeeAttestation(attestationReport, options = {}) {
-    const result = await this.verifyTeeAttestationDetailed(
-      attestationReport,
-      options
-    );
-    if (result.verified) {
-      log.info(`[LiopVerifier] ${result.message}`);
-      return true;
-    }
-    log.error(`[LiopVerifier] TEE FAILED: ${result.message}`);
-    return false;
-  }
-  /**
-   * Derives the ImageID of a logic payload following the LIOP v1 Standard.
-   */
-  deriveImageId(logicPayload) {
-    return deriveLogicImageDigest(logicPayload);
-  }
-};
-
-export { LiopVerifier };
-//# sourceMappingURL=chunk-WXYDFCIW.js.map
-//# sourceMappingURL=chunk-WXYDFCIW.js.map

package/dist/chunk-Y62GORQF.js

@@ -1,51 +0,0 @@
-// src/server/output-sanitizer.ts
-var DEFAULT_CONFIG = {
-  maxDecimalPlaces: 4,
-  clampNonNegative: true
-};
-function sanitizeOutput(output, config) {
-  const merged = { ...DEFAULT_CONFIG, ...config };
-  const seen = /* @__PURE__ */ new WeakSet();
-  function walk(node) {
-    if (node === null || node === void 0) {
-      return node;
-    }
-    if (typeof node === "number") {
-      if (!Number.isFinite(node)) {
-        return node;
-      }
-      let value = node;
-      if (merged.clampNonNegative && value < 0) {
-        value = 0;
-      }
-      const factor = 10 ** merged.maxDecimalPlaces;
-      value = Math.round(value * factor) / factor;
-      return value;
-    }
-    if (typeof node === "string" || typeof node === "boolean") {
-      return node;
-    }
-    if (typeof node === "object") {
-      if (seen.has(node)) {
-        return node;
-      }
-      seen.add(node);
-      if (Array.isArray(node)) {
-        return node.map((item) => walk(item));
-      }
-      const result = {};
-      for (const [key, val] of Object.entries(
-        node
-      )) {
-        result[key] = walk(val);
-      }
-      return result;
-    }
-    return node;
-  }
-  return walk(output);
-}
-
-export { sanitizeOutput };
-//# sourceMappingURL=chunk-Y62GORQF.js.map
-//# sourceMappingURL=chunk-Y62GORQF.js.map

package/dist/chunk-ZP3VVXOI.js

@@ -1,66 +0,0 @@
-import { Buffer } from 'buffer';
-import { mkdir, writeFile, readFile } from 'fs/promises';
-import { dirname } from 'path';
-import { generateKey } from '@libp2p/pnet';
-
-// src/mesh/swarm-key.ts
-var SWARM_KEY_BYTE_LENGTH = 95;
-function createSwarmKey() {
-  const psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);
-  generateKey(psk);
-  return psk;
-}
-function serializeSwarmKey(psk) {
-  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
-    );
-  }
-  return Buffer.from(psk).toString("base64");
-}
-function deserializeSwarmKey(base64Str) {
-  const trimmed = base64Str.trim();
-  const buf = Buffer.from(trimmed, "base64");
-  if (buf.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`
-    );
-  }
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function parseSwarmKey(rawText) {
-  const trimmed = rawText.trim();
-  if (trimmed.startsWith("/key/swarm/psk/")) {
-    const normalized = trimmed.replace(/\r\n/g, "\n").trimEnd();
-    const bytes = new TextEncoder().encode(normalized);
-    if (bytes.length === SWARM_KEY_BYTE_LENGTH) {
-      return bytes;
-    }
-  }
-  return deserializeSwarmKey(trimmed);
-}
-async function saveSwarmKey(psk, filePath) {
-  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
-    );
-  }
-  await mkdir(dirname(filePath), { recursive: true });
-  await writeFile(filePath, psk);
-}
-async function loadSwarmKey(filePath) {
-  const fileBuffer = await readFile(filePath);
-  if (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {
-    return new Uint8Array(
-      fileBuffer.buffer,
-      fileBuffer.byteOffset,
-      fileBuffer.byteLength
-    );
-  }
-  const text = fileBuffer.toString("utf-8");
-  return parseSwarmKey(text);
-}
-
-export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey };
-//# sourceMappingURL=chunk-ZP3VVXOI.js.map
-//# sourceMappingURL=chunk-ZP3VVXOI.js.map