@nekzus/liop 2.4.6 → 2.5.0-beta.2

package/dist/workers/zk-verifier.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/workers/zk-verifier.ts"],"names":[],"mappings":";;;;AA2BA,SAAS,cAAc,YAAA,EAAkC;AACxD,EAAA,OAAO,uBAAuB,YAAY,CAAA;AAC3C;AAUA,SAAS,sBAAsB,YAAA,EAA0C;AACxE,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAW,OAAO,IAAA,CAAK,YAAY,EAAE,QAAA,CAAS,OAAO,EAAE,IAAA,EAAK;AAClE,IAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC5C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAC1C,IAAA,IAAI,kBAAkB,CAAA,CAAA,EAAI;AACzB,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,UAAA,GAAa,KAAA;AACjB,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,IAAI,YAAA,GAAe,CAAA,CAAA;AAEnB,IAAA,KAAA,IAAS,CAAA,GAAI,aAAA,EAAe,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACrD,MAAA,MAAM,IAAA,GAAO,SAAS,CAAC,CAAA;AAEvB,MAAA,IAAI,OAAA,EAAS;AACZ,QAAA,OAAA,GAAU,KAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,SAAS,IAAA,EAAM;AAClB,QAAA,OAAA,GAAU,IAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,aAAA,EAAe;AACrD,QAAA,UAAA,GAAa,CAAC,UAAA;AACd,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AACpD,QAAA,IAAI,SAAS,GAAA,EAAK;AACjB,UAAA,UAAA,EAAA;AAAA,QACD,CAAA,MAAA,IAAW,SAAS,GAAA,EAAK;AACxB,UAAA,UAAA,EAAA;AACA,UAAA,IAAI,eAAe,CAAA,EAAG;AACrB,YAAA,YAAA,GAAe,CAAA;AACf,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,IAAI,iBAAiB,CAAA,CAAA,EAAI;AACxB,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,aAAA,EAAe,eAAe,CAAC,CAAA;AAC9D,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,MAAA,IAAI,QAAQ,iBAAA,EAAmB;AAC9B,QAAA,OAAO,MAAA;AAAA,MACR;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AAAA,EAEb;AACA,EAAA,OAAO,IAAA;AACR;AAMA,eAAe,gBACd,OAAA,EACkD;AAClD,EAAA,MAAM;AAAA,IACL,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACD,GAAI,OAAA;AAEJ,EAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,gBAAA,IAAoB,CAAC,SAAA,EAAW;AACrD,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,cAAc,YAAY,CAAA;AAC/C,EAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AAEnD,EAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACzC,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,4BAAA,EAA+B,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,aAAA,EAAgB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,KAChH;AAAA,EACD;AAGA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACxC,EAAA,IAAI,UAAA,CAAW,SAAS,EAAA,EAAI;AAE3B,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,MAAM,OAAA,GAAU,WAAW,CAAC,CAAA;AAC5B,EAAA,IAAI,YAAY,CAAA,EAAM;AACrB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,4BAA4B,OAAO,CAAA;AAAA,KAC7C;AAAA,EACD;AAEA,EAAA,MAAM,UAAA,GAAa,UAAA,CAAW,YAAA,CAAa,CAAC,CAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,IAAI,UAAU,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,CAAA,GAAI,UAAU,CAAA;AAE/C,EAAA,IAAI,IAAA,CAAK,WAAW,EAAA,EAAI;AACvB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACH,IAAA,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C,IAAA,IAAI,WAAA,CAAY,aAAa,eAAA,EAAiB;AAC7C,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,0BAAA,EAA6B,WAAA,CAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,OACzG;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,+BAAA,EAAgC;AAAA,EACpE;AAGA,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC9C,IAAA,MAAM,YAAA,GAAe,OACnB,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,YAAY,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AAAA,EACD;AAGA,EAAA,IAAI,mBAAmB,MAAA,EAAW;AACjC,IAAA,MAAM,WAAA,GAAc,sBAAsB,YAAY,CAAA;AACtD,IAAA,MAAM,cAAA,GAAiB,WAAA,KAAgB,IAAA,GAAO,WAAA,GAAc,cAAA;AAE5D,IAAA,MAAM,iBAAA,GACL,OAAO,cAAA,KAAmB,QAAA,GACvB,cAAA,GACA,mBAAmB,MAAA,GAClB,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA;AAClC,IAAA,MAAM,kBAAA,GAAqB,OACzB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,iBAAiB,CAAA,CACxB,MAAA,CAAO,KAAK,CAAA;AAEd,IAAA,IAAI,WAAA,CAAY,gBAAgB,kBAAA,EAAoB;AACnD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,mEAAA,EAAsE,WAAA,CAAY,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,OACjL;AAAA,IACD;AAAA,EACD;AAEA,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS;AAAA,GACV;AACD;AAKA,eAAO,cACN,IAAA,EACkD;AAClD,EAAA,IAAI;AACH,IAAA,IAAI,IAAA,CAAK,WAAW,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AACA,IAAA,IAAI,IAAA,CAAK,WAAW,gBAAA,EAAkB;AACrC,MAAA,OAAO,MAAM,gBAAgB,IAAI,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACvD,SAAS,KAAA,EAAO;AACf,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,oBAAA,EAAwB,KAAA,CAAgB,OAAO,CAAA;AAAA,KACzD;AAAA,EACD;AACD","file":"zk-verifier.js","sourcesContent":["import crypto from \"node:crypto\";\nimport { parentPort } from \"node:worker_threads\";\nimport { deriveLogicImageDigest } from \"../crypto/logic-image-id.js\";\n\n// Ensure this worker is used via Piscina pool\nif (!parentPort) {\n\t// Not fatal in Piscina, but handled appropriately\n}\n\n/**\n * ZK Verification Payload Structure.\n * Modeled after RISC Zero & SP1 Receipt formats.\n */\nexport interface ZkVerificationPayload {\n\taction: \"verify_receipt\" | \"warmup\";\n\t/** Original logic payload (JS/WASM) sent by client */\n\tlogicPayload?: Uint8Array;\n\t/** Expected ImageID (SHA-256) of the execution state */\n\tremoteImageIdHex?: string;\n\t/** Cbor-encoded or raw buffer containing the execution Receipt (Journal + Seal) */\n\tzkReceipt?: Uint8Array;\n\t/** Kyber-derived session secret to verify HMAC signature */\n\tsessionSecret?: Uint8Array;\n\t/** The expected output value of the computation for anti-replay/tampering verification */\n\texpectedOutput?: unknown;\n}\n\nfunction deriveImageId(logicPayload: Uint8Array): Buffer {\n\treturn deriveLogicImageDigest(logicPayload);\n}\n\ninterface ZkJournal {\n\timage_id: string;\n\tdataset_hash: string;\n\toutput_hash: string;\n\tfuel: number;\n\tts: number;\n}\n\nfunction tryExtractProxyOutput(logicPayload: Uint8Array): unknown | null {\n\ttry {\n\t\tconst logicStr = Buffer.from(logicPayload).toString(\"utf-8\").trim();\n\t\tif (!logicStr.includes(\"__liop_proxy_tool\")) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst firstBraceIdx = logicStr.indexOf(\"{\");\n\t\tif (firstBraceIdx === -1) {\n\t\t\treturn null;\n\t\t}\n\n\t\tlet braceCount = 0;\n\t\tlet inDoubleQuote = false;\n\t\tlet inSingleQuote = false;\n\t\tlet inBacktick = false;\n\t\tlet escaped = false;\n\t\tlet lastBraceIdx = -1;\n\n\t\tfor (let i = firstBraceIdx; i < logicStr.length; i++) {\n\t\t\tconst char = logicStr[i];\n\n\t\t\tif (escaped) {\n\t\t\t\tescaped = false;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"\\\\\") {\n\t\t\t\tescaped = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === '\"' && !inSingleQuote && !inBacktick) {\n\t\t\t\tinDoubleQuote = !inDoubleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"'\" && !inDoubleQuote && !inBacktick) {\n\t\t\t\tinSingleQuote = !inSingleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"`\" && !inDoubleQuote && !inSingleQuote) {\n\t\t\t\tinBacktick = !inBacktick;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (!inDoubleQuote && !inSingleQuote && !inBacktick) {\n\t\t\t\tif (char === \"{\") {\n\t\t\t\t\tbraceCount++;\n\t\t\t\t} else if (char === \"}\") {\n\t\t\t\t\tbraceCount--;\n\t\t\t\t\tif (braceCount === 0) {\n\t\t\t\t\t\tlastBraceIdx = i;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (lastBraceIdx !== -1) {\n\t\t\tconst jsonStr = logicStr.slice(firstBraceIdx, lastBraceIdx + 1);\n\t\t\tconst parsed = JSON.parse(jsonStr);\n\t\t\tif (parsed?.__liop_proxy_tool) {\n\t\t\t\treturn parsed;\n\t\t\t}\n\t\t}\n\t} catch (_e) {\n\t\t// Fallback\n\t}\n\treturn null;\n}\n\n/**\n * Simulates heavy ZK-Proof cryptographic verification.\n * In a real environment, this delegates to @risc0/verifier or SP1 FFI bindings.\n */\nasync function verifyZkReceipt(\n\tpayload: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\tconst {\n\t\tlogicPayload,\n\t\tremoteImageIdHex,\n\t\tzkReceipt,\n\t\tsessionSecret,\n\t\texpectedOutput,\n\t} = payload;\n\n\tif (!logicPayload || !remoteImageIdHex || !zkReceipt) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Missing required verification fields.\",\n\t\t};\n\t}\n\n\t// 1. Calculate local ImageID (Integrity Check)\n\tconst localImageId = deriveImageId(logicPayload);\n\tconst localImageIdHex = localImageId.toString(\"hex\");\n\n\tif (localImageIdHex !== remoteImageIdHex) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Integrity Violation: Local (${localImageIdHex.slice(0, 8)}) != Remote (${remoteImageIdHex.slice(0, 8)})`,\n\t\t};\n\t}\n\n\t// 2. Structural Verification: Deserialize Binary Receipt\n\tconst receiptBuf = Buffer.from(zkReceipt);\n\tif (receiptBuf.length < 35) {\n\t\t// 1 version + 2 len + 32 seal minimum\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Receipt too short for binary format.\",\n\t\t};\n\t}\n\n\tconst version = receiptBuf[0];\n\tif (version !== 0x01) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Unknown receipt version: ${version}`,\n\t\t};\n\t}\n\n\tconst journalLen = receiptBuf.readUInt16BE(1);\n\tconst journal = receiptBuf.subarray(3, 3 + journalLen);\n\tconst seal = receiptBuf.subarray(3 + journalLen);\n\n\tif (seal.length !== 32) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Invalid seal length (expected 32 bytes HMAC-SHA256).\",\n\t\t};\n\t}\n\n\t// 3. Parse journal and verify imageId\n\tlet journalData: ZkJournal;\n\ttry {\n\t\tjournalData = JSON.parse(journal.toString()) as ZkJournal;\n\t\tif (journalData.image_id !== localImageIdHex) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Journal ImageID mismatch: ${journalData.image_id.slice(0, 8)} != ${localImageIdHex.slice(0, 8)}`,\n\t\t\t};\n\t\t}\n\t} catch (_e) {\n\t\treturn { verified: false, message: \"Failed to parse journal data.\" };\n\t}\n\n\t// 4. Mathematical Verification (HMAC-SHA256)\n\tif (sessionSecret && sessionSecret.length > 0) {\n\t\tconst expectedSeal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tif (!crypto.timingSafeEqual(seal, expectedSeal)) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: \"Invalid seal: HMAC verification failed.\",\n\t\t\t};\n\t\t}\n\t}\n\n\t// 5. Output Hash Verification (Anti-Replay / Anti-Tampering)\n\tif (expectedOutput !== undefined) {\n\t\tconst proxyOutput = tryExtractProxyOutput(logicPayload);\n\t\tconst actualExpected = proxyOutput !== null ? proxyOutput : expectedOutput;\n\n\t\tconst expectedOutputStr =\n\t\t\ttypeof actualExpected === \"string\"\n\t\t\t\t? actualExpected\n\t\t\t\t: actualExpected === undefined\n\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t: JSON.stringify(actualExpected);\n\t\tconst expectedOutputHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(expectedOutputStr)\n\t\t\t.digest(\"hex\");\n\n\t\tif (journalData.output_hash !== expectedOutputHash) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${journalData.output_hash.slice(0, 8)}) != Calculated output_hash (${expectedOutputHash.slice(0, 8)})`,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn {\n\t\tverified: true,\n\t\tmessage: \"HMAC Commitment Verified: Integrity intact.\",\n\t};\n}\n\n/**\n * Main worker entry point for Piscina.\n */\nexport default async function workerHandler(\n\ttask: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\ttry {\n\t\tif (task.action === \"warmup\") {\n\t\t\treturn {\n\t\t\t\tverified: true,\n\t\t\t\tmessage: \"warm\",\n\t\t\t};\n\t\t}\n\t\tif (task.action === \"verify_receipt\") {\n\t\t\treturn await verifyZkReceipt(task);\n\t\t}\n\t\tthrow new Error(\"Unknown action in ZkVerifier Worker.\");\n\t} catch (error) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Verification Error: ${(error as Error).message}`,\n\t\t};\n\t}\n}\n"]}
+{"version":3,"sources":["../../src/workers/zk-verifier.ts"],"names":[],"mappings":";;;;AA8BA,SAAS,cAAc,YAAA,EAAkC;AACxD,EAAA,OAAO,uBAAuB,YAAY,CAAA;AAC3C;AAUA,SAAS,sBAAsB,YAAA,EAA0C;AACxE,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAW,OAAO,IAAA,CAAK,YAAY,EAAE,QAAA,CAAS,OAAO,EAAE,IAAA,EAAK;AAClE,IAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC5C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAC1C,IAAA,IAAI,kBAAkB,CAAA,CAAA,EAAI;AACzB,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,UAAA,GAAa,KAAA;AACjB,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,IAAI,YAAA,GAAe,CAAA,CAAA;AAEnB,IAAA,KAAA,IAAS,CAAA,GAAI,aAAA,EAAe,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACrD,MAAA,MAAM,IAAA,GAAO,SAAS,CAAC,CAAA;AAEvB,MAAA,IAAI,OAAA,EAAS;AACZ,QAAA,OAAA,GAAU,KAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,SAAS,IAAA,EAAM;AAClB,QAAA,OAAA,GAAU,IAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,aAAA,EAAe;AACrD,QAAA,UAAA,GAAa,CAAC,UAAA;AACd,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AACpD,QAAA,IAAI,SAAS,GAAA,EAAK;AACjB,UAAA,UAAA,EAAA;AAAA,QACD,CAAA,MAAA,IAAW,SAAS,GAAA,EAAK;AACxB,UAAA,UAAA,EAAA;AACA,UAAA,IAAI,eAAe,CAAA,EAAG;AACrB,YAAA,YAAA,GAAe,CAAA;AACf,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,IAAI,iBAAiB,CAAA,CAAA,EAAI;AACxB,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,aAAA,EAAe,eAAe,CAAC,CAAA;AAC9D,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,MAAA,IAAI,QAAQ,iBAAA,EAAmB;AAC9B,QAAA,OAAO,MAAA;AAAA,MACR;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AAAA,EAEb;AACA,EAAA,OAAO,IAAA;AACR;AAMA,eAAe,gBACd,OAAA,EACkD;AAClD,EAAA,MAAM;AAAA,IACL,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACD,GAAI,OAAA;AAEJ,EAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,gBAAA,IAAoB,CAAC,SAAA,EAAW;AACrD,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,cAAc,YAAY,CAAA;AAC/C,EAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AAEnD,EAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACzC,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,4BAAA,EAA+B,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,aAAA,EAAgB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,KAChH;AAAA,EACD;AAGA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACxC,EAAA,IAAI,UAAA,CAAW,SAAS,EAAA,EAAI;AAE3B,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,MAAM,OAAA,GAAU,WAAW,CAAC,CAAA;AAC5B,EAAA,IAAI,YAAY,CAAA,EAAM;AACrB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,4BAA4B,OAAO,CAAA;AAAA,KAC7C;AAAA,EACD;AAEA,EAAA,MAAM,UAAA,GAAa,UAAA,CAAW,YAAA,CAAa,CAAC,CAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,IAAI,UAAU,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,CAAA,GAAI,UAAU,CAAA;AAE/C,EAAA,IAAI,IAAA,CAAK,WAAW,EAAA,EAAI;AACvB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACH,IAAA,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C,IAAA,IAAI,WAAA,CAAY,aAAa,eAAA,EAAiB;AAC7C,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,0BAAA,EAA6B,WAAA,CAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,OACzG;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,+BAAA,EAAgC;AAAA,EACpE;AAGA,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC9C,IAAA,MAAM,YAAA,GAAe,OACnB,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,YAAY,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AAAA,EACD;AAGA,EAAA,IAAI,mBAAmB,MAAA,EAAW;AACjC,IAAA,MAAM,WAAA,GAAc,sBAAsB,YAAY,CAAA;AACtD,IAAA,MAAM,cAAA,GAAiB,WAAA,KAAgB,IAAA,GAAO,WAAA,GAAc,cAAA;AAE5D,IAAA,MAAM,iBAAA,GACL,OAAO,cAAA,KAAmB,QAAA,GACvB,cAAA,GACA,mBAAmB,MAAA,GAClB,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA;AAClC,IAAA,MAAM,kBAAA,GAAqB,OACzB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,iBAAiB,CAAA,CACxB,MAAA,CAAO,KAAK,CAAA;AAEd,IAAA,IAAI,WAAA,CAAY,gBAAgB,kBAAA,EAAoB;AACnD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,mEAAA,EAAsE,WAAA,CAAY,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,OACjL;AAAA,IACD;AAAA,EACD;AAEA,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS;AAAA,GACV;AACD;AAKA,eAAO,cACN,IAAA,EACkD;AAClD,EAAA,IAAI;AACH,IAAA,IAAI,IAAA,CAAK,WAAW,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AACA,IAAA,IAAI,IAAA,CAAK,WAAW,gBAAA,EAAkB;AACrC,MAAA,OAAO,MAAM,gBAAgB,IAAI,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACvD,SAAS,KAAA,EAAO;AACf,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,oBAAA,EAAwB,KAAA,CAAgB,OAAO,CAAA;AAAA,KACzD;AAAA,EACD;AACD","file":"zk-verifier.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport crypto from \"node:crypto\";\nimport { parentPort } from \"node:worker_threads\";\nimport { deriveLogicImageDigest } from \"../crypto/logic-image-id.js\";\n\n// Ensure this worker is used via Piscina pool\nif (!parentPort) {\n\t// Not fatal in Piscina, but handled appropriately\n}\n\n/**\n * ZK Verification Payload Structure.\n * Modeled after RISC Zero & SP1 Receipt formats.\n */\nexport interface ZkVerificationPayload {\n\taction: \"verify_receipt\" | \"warmup\";\n\t/** Original logic payload (JS/WASM) sent by client */\n\tlogicPayload?: Uint8Array;\n\t/** Expected ImageID (SHA-256) of the execution state */\n\tremoteImageIdHex?: string;\n\t/** Cbor-encoded or raw buffer containing the execution Receipt (Journal + Seal) */\n\tzkReceipt?: Uint8Array;\n\t/** Kyber-derived session secret to verify HMAC signature */\n\tsessionSecret?: Uint8Array;\n\t/** The expected output value of the computation for anti-replay/tampering verification */\n\texpectedOutput?: unknown;\n}\n\nfunction deriveImageId(logicPayload: Uint8Array): Buffer {\n\treturn deriveLogicImageDigest(logicPayload);\n}\n\ninterface ZkJournal {\n\timage_id: string;\n\tdataset_hash: string;\n\toutput_hash: string;\n\tfuel: number;\n\tts: number;\n}\n\nfunction tryExtractProxyOutput(logicPayload: Uint8Array): unknown | null {\n\ttry {\n\t\tconst logicStr = Buffer.from(logicPayload).toString(\"utf-8\").trim();\n\t\tif (!logicStr.includes(\"__liop_proxy_tool\")) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst firstBraceIdx = logicStr.indexOf(\"{\");\n\t\tif (firstBraceIdx === -1) {\n\t\t\treturn null;\n\t\t}\n\n\t\tlet braceCount = 0;\n\t\tlet inDoubleQuote = false;\n\t\tlet inSingleQuote = false;\n\t\tlet inBacktick = false;\n\t\tlet escaped = false;\n\t\tlet lastBraceIdx = -1;\n\n\t\tfor (let i = firstBraceIdx; i < logicStr.length; i++) {\n\t\t\tconst char = logicStr[i];\n\n\t\t\tif (escaped) {\n\t\t\t\tescaped = false;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"\\\\\") {\n\t\t\t\tescaped = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === '\"' && !inSingleQuote && !inBacktick) {\n\t\t\t\tinDoubleQuote = !inDoubleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"'\" && !inDoubleQuote && !inBacktick) {\n\t\t\t\tinSingleQuote = !inSingleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"`\" && !inDoubleQuote && !inSingleQuote) {\n\t\t\t\tinBacktick = !inBacktick;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (!inDoubleQuote && !inSingleQuote && !inBacktick) {\n\t\t\t\tif (char === \"{\") {\n\t\t\t\t\tbraceCount++;\n\t\t\t\t} else if (char === \"}\") {\n\t\t\t\t\tbraceCount--;\n\t\t\t\t\tif (braceCount === 0) {\n\t\t\t\t\t\tlastBraceIdx = i;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (lastBraceIdx !== -1) {\n\t\t\tconst jsonStr = logicStr.slice(firstBraceIdx, lastBraceIdx + 1);\n\t\t\tconst parsed = JSON.parse(jsonStr);\n\t\t\tif (parsed?.__liop_proxy_tool) {\n\t\t\t\treturn parsed;\n\t\t\t}\n\t\t}\n\t} catch (_e) {\n\t\t// Fallback\n\t}\n\treturn null;\n}\n\n/**\n * Simulates heavy ZK-Proof cryptographic verification.\n * In a real environment, this delegates to @risc0/verifier or SP1 FFI bindings.\n */\nasync function verifyZkReceipt(\n\tpayload: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\tconst {\n\t\tlogicPayload,\n\t\tremoteImageIdHex,\n\t\tzkReceipt,\n\t\tsessionSecret,\n\t\texpectedOutput,\n\t} = payload;\n\n\tif (!logicPayload || !remoteImageIdHex || !zkReceipt) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Missing required verification fields.\",\n\t\t};\n\t}\n\n\t// 1. Calculate local ImageID (Integrity Check)\n\tconst localImageId = deriveImageId(logicPayload);\n\tconst localImageIdHex = localImageId.toString(\"hex\");\n\n\tif (localImageIdHex !== remoteImageIdHex) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Integrity Violation: Local (${localImageIdHex.slice(0, 8)}) != Remote (${remoteImageIdHex.slice(0, 8)})`,\n\t\t};\n\t}\n\n\t// 2. Structural Verification: Deserialize Binary Receipt\n\tconst receiptBuf = Buffer.from(zkReceipt);\n\tif (receiptBuf.length < 35) {\n\t\t// 1 version + 2 len + 32 seal minimum\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Receipt too short for binary format.\",\n\t\t};\n\t}\n\n\tconst version = receiptBuf[0];\n\tif (version !== 0x01) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Unknown receipt version: ${version}`,\n\t\t};\n\t}\n\n\tconst journalLen = receiptBuf.readUInt16BE(1);\n\tconst journal = receiptBuf.subarray(3, 3 + journalLen);\n\tconst seal = receiptBuf.subarray(3 + journalLen);\n\n\tif (seal.length !== 32) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Invalid seal length (expected 32 bytes HMAC-SHA256).\",\n\t\t};\n\t}\n\n\t// 3. Parse journal and verify imageId\n\tlet journalData: ZkJournal;\n\ttry {\n\t\tjournalData = JSON.parse(journal.toString()) as ZkJournal;\n\t\tif (journalData.image_id !== localImageIdHex) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Journal ImageID mismatch: ${journalData.image_id.slice(0, 8)} != ${localImageIdHex.slice(0, 8)}`,\n\t\t\t};\n\t\t}\n\t} catch (_e) {\n\t\treturn { verified: false, message: \"Failed to parse journal data.\" };\n\t}\n\n\t// 4. Mathematical Verification (HMAC-SHA256)\n\tif (sessionSecret && sessionSecret.length > 0) {\n\t\tconst expectedSeal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tif (!crypto.timingSafeEqual(seal, expectedSeal)) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: \"Invalid seal: HMAC verification failed.\",\n\t\t\t};\n\t\t}\n\t}\n\n\t// 5. Output Hash Verification (Anti-Replay / Anti-Tampering)\n\tif (expectedOutput !== undefined) {\n\t\tconst proxyOutput = tryExtractProxyOutput(logicPayload);\n\t\tconst actualExpected = proxyOutput !== null ? proxyOutput : expectedOutput;\n\n\t\tconst expectedOutputStr =\n\t\t\ttypeof actualExpected === \"string\"\n\t\t\t\t? actualExpected\n\t\t\t\t: actualExpected === undefined\n\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t: JSON.stringify(actualExpected);\n\t\tconst expectedOutputHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(expectedOutputStr)\n\t\t\t.digest(\"hex\");\n\n\t\tif (journalData.output_hash !== expectedOutputHash) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${journalData.output_hash.slice(0, 8)}) != Calculated output_hash (${expectedOutputHash.slice(0, 8)})`,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn {\n\t\tverified: true,\n\t\tmessage: \"HMAC Commitment Verified: Integrity intact.\",\n\t};\n}\n\n/**\n * Main worker entry point for Piscina.\n */\nexport default async function workerHandler(\n\ttask: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\ttry {\n\t\tif (task.action === \"warmup\") {\n\t\t\treturn {\n\t\t\t\tverified: true,\n\t\t\t\tmessage: \"warm\",\n\t\t\t};\n\t\t}\n\t\tif (task.action === \"verify_receipt\") {\n\t\t\treturn await verifyZkReceipt(task);\n\t\t}\n\t\tthrow new Error(\"Unknown action in ZkVerifier Worker.\");\n\t} catch (error) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Verification Error: ${(error as Error).message}`,\n\t\t};\n\t}\n}\n"]}

package/package.json

@@ -1,12 +1,34 @@
 {
   "name": "@nekzus/liop",
-  "version": "2.4.6",
+  "version": "2.5.0-beta.2",
   "description": "Official SDK for Logic-Injection-on-Origin Protocol (LIOP). Deploy Logic-on-Origin with WebAssembly at gRPC speed and bidirectional MCP compatibility.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
     "liop": "./dist/bin/agent.js"
   },
+  "keywords": [
+    "liop",
+    "logic-injection-on-origin",
+    "model-context-protocol",
+    "mcp",
+    "logic-on-origin",
+    "wasi",
+    "sandbox",
+    "p2p",
+    "libp2p",
+    "zero-trust",
+    "kyber",
+    "post-quantum",
+    "ai-agent",
+    "llm",
+    "webassembly",
+    "grpc",
+    "decentralized",
+    "privacy",
+    "zk-proofs",
+    "differential-privacy"
+  ],
   "sideEffects": false,
   "files": [
     "dist",
@@ -44,22 +66,6 @@
       "import": "./dist/mesh.js"
     }
   },
-  "keywords": [
-    "liop",
-    "logic-injection-on-origin",
-    "model-context-protocol",
-    "mcp",
-    "logic-on-origin",
-    "wasi",
-    "sandbox",
-    "p2p",
-    "libp2p",
-    "zero-trust",
-    "kyber",
-    "post-quantum",
-    "ai-agent",
-    "llm"
-  ],
   "author": "Nekzus Solutions",
   "license": "Apache-2.0",
   "type": "module",
@@ -80,15 +86,15 @@
     "node": ">=20.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
+    "@biomejs/biome": "2.5.14",
     "@opentelemetry/api": "1.9.1",
-    "@opentelemetry/sdk-metrics": "2.10.0",
+    "@opentelemetry/sdk-metrics": "2.11.0",
     "@types/node": "26.4.0",
-    "@types/oidc-provider": "9.11.1",
+    "@types/oidc-provider": "9.12.1",
     "@vitest/coverage-v8": "4.1.11",
     "gpt-tokenizer": "4.0.0",
     "tsup": "8.5.1",
-    "tsx": "4.23.12",
+    "tsx": "4.23.13",
     "typescript": "6.0.3",
     "vitest": "4.1.11"
   },
@@ -99,36 +105,37 @@
     "@grpc/proto-loader": "0.8.1",
     "@hono/node-server": "2.1.1",
     "@libp2p/autonat": "^3.0.27",
-    "@libp2p/bootstrap": "12.0.30",
+    "@libp2p/bootstrap": "12.0.32",
     "@libp2p/circuit-relay-v2": "^4.2.12",
     "@libp2p/crypto": "5.1.23",
     "@libp2p/dcutr": "^3.0.27",
-    "@libp2p/identify": "4.1.13",
-    "@libp2p/kad-dht": "16.4.4",
+    "@libp2p/identify": "4.1.14",
+    "@libp2p/kad-dht": "16.4.5",
     "@libp2p/mdns": "^12.0.30",
     "@libp2p/peer-id": "6.0.15",
-    "@libp2p/ping": "3.1.12",
-    "@libp2p/tcp": "11.0.27",
-    "@libp2p/websockets": "10.1.20",
+    "@libp2p/ping": "3.1.13",
+    "@libp2p/pnet": "^3.0.29",
+    "@libp2p/tcp": "11.0.28",
+    "@libp2p/websockets": "10.1.21",
     "@multiformats/multiaddr": "13.0.3",
-    "@noble/post-quantum": "0.7.0",
+    "@noble/post-quantum": "0.7.1",
     "acorn": "8.18.0",
     "acorn-walk": "8.3.5",
-    "hono": "4.13.5",
+    "hono": "4.13.8",
     "it-pipe": "3.0.1",
-    "jose": "6.2.10",
-    "libp2p": "3.3.9",
+    "jose": "6.2.12",
+    "libp2p": "3.3.11",
     "mlkem": "2.7.0",
     "multiformats": "14.0.5",
-    "oidc-provider": "9.11.5",
+    "oidc-provider": "9.12.2",
     "optional": "0.1.4",
-    "piscina": "5.3.1",
+    "piscina": "5.3.2",
     "uint8arrays": "6.1.1",
-    "zod": "4.4.3"
+    "zod": "4.6.5"
   },
   "optionalDependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
-    "compromise": "14.16.0"
+    "compromise": "14.17.0"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
@@ -145,9 +152,9 @@
   "overrides": {
     "content-type": "1.0.5",
     "protobufjs": "^7.6.1",
-    "piscina": "5.3.1",
+    "piscina": "5.3.2",
     "ws": "^8.21.0",
-    "hono": "4.13.5",
+    "hono": "4.13.8",
     "fast-uri": "^3.1.5",
     "brace-expansion": "^1.1.18",
     "ip-address": "^10.3.1",
@@ -213,6 +220,11 @@
     "demo:playground-web-build": "pnpm --filter playground-web build",
     "demo:playground": "tsx tests/infra/cli/demo-playground.ts",
     "demo:playground:rebuild": "tsx tests/infra/cli/demo-playground-rebuild.ts",
-    "demo:client-sdk": "tsx tests/infra/cli/demo-client.ts"
+    "demo:client-sdk": "tsx tests/infra/cli/demo-client.ts",
+    "audit:prod:start": "tsx tests/infra/production-audit/cli/audit-start.ts",
+    "audit:prod:run": "tsx tests/infra/production-audit/cli/audit-run.ts",
+    "audit:prod:runner": "docker compose -f tests/infra/production-audit/docker-compose.production-audit.yml run --rm audit-runner",
+    "audit:prod:clean": "tsx tests/infra/production-audit/cli/audit-clean.ts",
+    "telemetry:stream": "tsx scripts/telemetry-stream.ts"
   }
 }

package/dist/chunk-32ADSAJS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/crypto/verifier.ts"],"names":["__filename","__dirname"],"mappings":";;;;;;;;AAQA,IAAMA,YAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,WAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,YAAU,CAAA;AASlC,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA;AAAA,EAEzB,OAAe,YAAA,GAA+B,IAAA;AAAA,EAEtC,SAAA,GAAY;AACnB,IAAA,IAAI,CAAC,cAAa,YAAA,EAAc;AAC/B,MAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA,CAAY,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAC3C,MAAA,MAAM,SAAA,GAAY,OAAO,KAAA,GAAQ,KAAA;AAEjC,MAAA,IAAI,WAAqB,EAAC;AAC1B,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACzC,UAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,kBAAkB,CAAA;AAC7C,UAAA,MAAM,WAAA,GAAc,aAAA;AAAA,YACnB,KAAK,IAAA,CAAK,IAAA,CAAK,QAAQ,MAAM,CAAA,EAAG,QAAQ,YAAY;AAAA,WACrD,CAAE,IAAA;AACF,UAAA,QAAA,GAAW,CAAC,YAAY,WAAW,CAAA;AAAA,QACpC,SAAS,EAAA,EAAI;AACZ,UAAA,QAAA,GAAW,CAAC,YAAY,KAAK,CAAA;AAAA,QAC9B;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QACnB,IAAA,CAAK,OAAA,CAAQC,WAAA,EAAW,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAE,CAAA;AAAA;AAAA,QAC3D,IAAA,CAAK,OAAA,CAAQA,WAAA,EAAW,CAAA,sBAAA,EAAyB,SAAS,CAAA,CAAE;AAAA;AAAA,OAC7D;AAEA,MAAA,MAAM,cAAA,GACL,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAS,cAAW,CAAC,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA;AAE3D,MAAA,aAAA,CAAa,YAAA,GAAe,IAAI,OAAA,CAAQ;AAAA,QACvC,QAAA,EAAU,cAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY,CAAA;AAAA;AAAA,QACZ,WAAA,EAAa,GAAA;AAAA,QACb;AAAA,OACA,CAAA;AAGD,MAAA,aAAA,CAAa,YAAA,CAAa,IAAI,EAAE,MAAA,EAAQ,UAAU,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAClE,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,CAAA,sDAAA,EAAyD,IAAI,OAAO,CAAA;AAAA,SACrE;AAAA,MACD,CAAC,CAAA;AAAA,IACF;AACA,IAAA,OAAO,aAAA,CAAa,YAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,eAAA,CACZ,YAAA,EACA,gBAAA,EACA,SAAA,EACA,eACA,cAAA,EACmB;AACnB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAC9D,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI;AAAA,MAC7B,MAAA,EAAQ,gBAAA;AAAA,MACR,YAAA,EAAc,IAAI,UAAA,CAAW,YAAY,CAAA;AAAA,MACzC,gBAAA;AAAA,MACA,SAAA,EAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AAAA,MACnC,aAAA,EAAe,aAAA,GAAgB,IAAI,UAAA,CAAW,aAAa,CAAA,GAAI,MAAA;AAAA,MAC/D;AAAA,KACA,CAAA;AAED,IAAA,IAAI,OAAO,QAAA,EAAU;AACpB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,qBACZ,iBAAA,EACmB;AACnB,IAAA,IAAI,iBAAA,CAAkB,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE3C,IAAA,IAAI;AAKH,MAAA,GAAA,CAAI,KAAK,yDAAyD,CAAA;AAClE,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,GAAA,EAAK;AACb,MAAA,GAAA,CAAI,KAAA,CAAM,2CAA2C,GAAG,CAAA;AACxD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,YAAA,EAA8B;AAClD,IAAA,OAAO,uBAAuB,YAAY,CAAA;AAAA,EAC3C;AACD","file":"chunk-32ADSAJS.js","sourcesContent":["import * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Piscina } from \"piscina\";\nimport { log } from \"../utils/logger.js\";\nimport { deriveLogicImageDigest } from \"./logic-image-id.js\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\n/**\n * LIOP Tier-0 Industrial Verifier\n *\n * This engine is responsible for the trustless verification of remote logic execution.\n * It validates both the integrity of the code (ZkImageID) and the mathematical proof\n * of its execution (ZkSeal), as well as hardware-level attestation (TEE).\n */\nexport class LiopVerifier {\n\t// Singleton Worker Pool for heavy ZK verification\n\tprivate static zkWorkerPool: Piscina | null = null;\n\n\tprivate getZkPool() {\n\t\tif (!LiopVerifier.zkWorkerPool) {\n\t\t\tconst isTS = import.meta.url.endsWith(\".ts\");\n\t\t\tconst workerExt = isTS ? \".ts\" : \".js\";\n\n\t\t\tlet execArgv: string[] = [];\n\t\t\tif (isTS) {\n\t\t\t\ttry {\n\t\t\t\t\tconst req = createRequire(import.meta.url);\n\t\t\t\t\tconst tsxPkg = req.resolve(\"tsx/package.json\");\n\t\t\t\t\tconst absoluteTsx = pathToFileURL(\n\t\t\t\t\t\tpath.join(path.dirname(tsxPkg), \"dist\", \"loader.mjs\"),\n\t\t\t\t\t).href;\n\t\t\t\t\texecArgv = [\"--import\", absoluteTsx];\n\t\t\t\t} catch (_e) {\n\t\t\t\t\texecArgv = [\"--import\", \"tsx\"];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Support both flat dist/ and original src/ structure\n\t\t\tconst workerPaths = [\n\t\t\t\tpath.resolve(__dirname, `./workers/zk-verifier${workerExt}`), // Flat dist/ (tsup)\n\t\t\t\tpath.resolve(__dirname, `../workers/zk-verifier${workerExt}`), // Original src/\n\t\t\t];\n\n\t\t\tconst workerFilename =\n\t\t\t\tworkerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];\n\n\t\t\tLiopVerifier.zkWorkerPool = new Piscina({\n\t\t\t\tfilename: workerFilename,\n\t\t\t\tminThreads: 1,\n\t\t\t\tmaxThreads: 2, // Minimal footprint since verification is fast compared to generation\n\t\t\t\tidleTimeout: 30000,\n\t\t\t\texecArgv,\n\t\t\t});\n\n\t\t\t// Pre-warm the verification worker\n\t\t\tLiopVerifier.zkWorkerPool.run({ action: \"warmup\" }).catch((err) => {\n\t\t\t\tlog.debug(\n\t\t\t\t\t`[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`,\n\t\t\t\t);\n\t\t\t});\n\t\t}\n\t\treturn LiopVerifier.zkWorkerPool;\n\t}\n\n\t/**\n\t * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.\n\t *\n\t * @param logicPayload The raw WASM or JS logic that was sent to the provider.\n\t * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).\n\t * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM.\n\t */\n\tpublic async verifyZkReceipt(\n\t\tlogicPayload: Buffer,\n\t\tremoteImageIdHex: string,\n\t\tzkReceipt: Buffer,\n\t\tsessionSecret?: Buffer,\n\t\texpectedOutput?: unknown,\n\t): Promise<boolean> {\n\t\tconst pool = this.getZkPool();\n\t\tif (!pool) throw new Error(\"Worker pool initialization failed\");\n\t\tconst result = await pool.run({\n\t\t\taction: \"verify_receipt\",\n\t\t\tlogicPayload: new Uint8Array(logicPayload),\n\t\t\tremoteImageIdHex,\n\t\t\tzkReceipt: new Uint8Array(zkReceipt),\n\t\t\tsessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : undefined,\n\t\t\texpectedOutput,\n\t\t});\n\n\t\tif (result.verified) {\n\t\t\tlog.info(`[LiopVerifier] ${result.message}`);\n\t\t\treturn true;\n\t\t}\n\n\t\tlog.error(`[LiopVerifier] FAILED: ${result.message}`);\n\t\treturn false;\n\t}\n\n\t/**\n\t * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).\n\t *\n\t * @param attestationReport The COSE-signed attestation document from the hardware.\n\t */\n\tpublic async verifyTeeAttestation(\n\t\tattestationReport: Buffer,\n\t): Promise<boolean> {\n\t\tif (attestationReport.length === 0) return true; // Optional in Mesh Alpha\n\n\t\ttry {\n\t\t\t// Architecture for AWS Nitro Enclaves:\n\t\t\t// 1. Decode CBOR/COSE\n\t\t\t// 2. Verify Signature against AWS Nitro Root CA\n\t\t\t// 3. Compare PCRs\n\t\t\tlog.info(\"[LiopVerifier] TEE Attestation: Not configured (no-op).\");\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tlog.error(\"[LiopVerifier] TEE Verification Failed:\", err);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Derives the ImageID of a logic payload following the LIOP v1 Standard.\n\t */\n\tpublic deriveImageId(logicPayload: Buffer): Buffer {\n\t\treturn deriveLogicImageDigest(logicPayload);\n\t}\n}\n"]}