@nekzus/liop 2.5.0-beta.1 → 2.5.0-beta.3

package/dist/types-29zv9X1V.d.ts

@@ -0,0 +1,455 @@
+import { P as ProofType } from './zk-DzYNWBgo.js';
+import { z } from 'zod';
+import * as jose from 'jose';
+
+/**
+ * Technology-agnostic cryptographic audit interceptor.
+ *
+ * Fires asynchronously (fire-and-forget) AFTER each AuditEntry
+ * has been sealed (hash computed, chain linked, and optionally
+ * persisted to JSONL). The interceptor receives a frozen deep-clone
+ * of the completed AuditEntry — mutations cannot tamper with the
+ * hash chain.
+ *
+ * Use cases: forward audit entries to TypeSafe Jev for threat
+ * pattern detection, stream to SOC 2 SIEM aggregators, trigger
+ * PagerDuty alerts on BLOCKED_EGRESS/POLICY_VIOLATION statuses,
+ * or feed into compliance dashboards.
+ */
+type AuditInterceptor = (entry: Readonly<AuditEntry>) => void | Promise<void>;
+
+type AuditStatus = "SUCCESS" | "BLOCKED_EGRESS" | "ERROR" | "POLICY_VIOLATION" | "TAINT_ANALYSIS_VIOLATION";
+interface AuditEntry {
+    id: string;
+    timestamp: string;
+    traceId: string;
+    agentDid: string;
+    peerId: string;
+    toolName: string;
+    datasetHash: string;
+    fuelConsumed: number;
+    outputHash: string;
+    zkReceiptSig: string;
+    status: AuditStatus;
+    prevEntryHash: string;
+    entryHash: string;
+}
+interface AuditRecordParams {
+    timestamp?: string;
+    traceId?: string;
+    agentDid: string;
+    peerId: string;
+    toolName: string;
+    datasetHash?: string;
+    fuelConsumed: number;
+    outputHash?: string;
+    zkReceiptSig?: string;
+    status: AuditStatus;
+}
+declare const GENESIS_HASH: string;
+declare function computeEntryHash(entryWithoutHash: Omit<AuditEntry, "entryHash">): string;
+declare class AuditLogger {
+    private entries;
+    private lastEntryHash;
+    private filePath?;
+    private interceptor?;
+    constructor(filePath?: string);
+    /**
+     * Registers a technology-agnostic audit interceptor.
+     * The interceptor fires AFTER the entry is sealed (hash computed)
+     * and appended to the chain. It receives a frozen deep-clone
+     * that cannot tamper with the hash chain.
+     * Pass `undefined` to disable interception (zero overhead).
+     */
+    setInterceptor(interceptor: AuditInterceptor | undefined): void;
+    recordExecution(params: AuditRecordParams): AuditEntry;
+    getEntries(): readonly AuditEntry[];
+    getEntryCount(): number;
+    verifyIntegrity(): {
+        valid: boolean;
+        totalEntries: number;
+        brokenIndex?: number;
+        reason?: string;
+    };
+    exportJsonl(): string;
+    private loadFromFile;
+}
+declare const globalAuditLogger: AuditLogger;
+
+/**
+ * LIOP JWT Validator — Token Verification Engine
+ *
+ * Validates JWT Access Tokens using the `jose` library.
+ * Supports two modes:
+ *   - Local JWKS (Nexus role): Keys in memory, zero network latency.
+ *   - Remote JWKS (Node role): Fetched from Nexus /oidc/jwks with 10min cache.
+ *
+ * Standards: NIST SP 800-207 (continuous verification), OWASP API-A01
+ * Source: panva/jose DeepWiki — createRemoteJWKSet, jwtVerify
+ */
+
+/**
+ * Authorization context extracted from a validated JWT.
+ * Compatible with MCP TypeScript SDK AuthInfo interface.
+ */
+interface AuthInfo {
+    /** Raw JWT string. */
+    token: string;
+    /** Subject claim (client_id for M2M flows). */
+    clientId: string;
+    /** Space-delimited scopes parsed into an array. */
+    scopes: string[];
+    /** Token expiration timestamp (Unix seconds). */
+    expiresAt?: number;
+}
+/**
+ * JWT Validator with dual-mode JWKS resolution.
+ *
+ * - Nexus role: `new JwtValidator(issuer, audience, localJwks)` (createLocalJWKSet)
+ * - Node role: `new JwtValidator(issuer, audience, new URL(jwksUri))` (createRemoteJWKSet)
+ */
+declare class JwtValidator {
+    private readonly jwksResolver;
+    private readonly issuer;
+    private readonly audience;
+    constructor(issuer: string, audience: string, jwksSource: URL | jose.JSONWebKeySet);
+    /**
+     * Validates a JWT access token and extracts authorization context.
+     *
+     * Checks performed (jose.jwtVerify):
+     * - Cryptographic signature verification (EdDSA or ES256)
+     * - Issuer claim matches configured issuer
+     * - Audience claim matches configured audience
+     * - Token is not expired (with clock tolerance for mesh skew)
+     * - Required claims (sub, scope) are present
+     *
+     * @throws JOSEError if validation fails (expired, wrong issuer, bad signature, etc.)
+     */
+    validate(token: string): Promise<AuthInfo>;
+    /**
+     * Builds a complete set of issuer URL aliases for the LIOP demo topology.
+     *
+     * The LIOP mesh runs on Docker Desktop with the following network layout:
+     *   Container hostnames: "nexus", "liop-nexus" (internal port 3000)
+     *   Host-published ports: 13000 (HTTP/MCP), 13001 (libp2p TCP)
+     *   Loopback addresses: 127.0.0.1, localhost
+     *
+     * The Nexus OAuth server may set its issuer to any of these depending on
+     * how it was configured, and nodes may resolve it via LIOP_NEXUS_URL
+     * which varies by context. This method generates all equivalent aliases
+     * so that jose.jwtVerify accepts the token regardless of which alias
+     * was used as `iss` in the JWT.
+     *
+     * Security note: This does NOT weaken validation — the cryptographic
+     * signature is still verified against the same JWKS keys. Only the
+     * string comparison of the `iss` claim is relaxed across known aliases.
+     */
+    private buildIssuerAliases;
+    /**
+     * Returns the configured issuer URL for PRM (RFC 9728) metadata.
+     */
+    getIssuer(): string;
+    /**
+     * Returns the configured audience for PRM metadata.
+     */
+    getAudience(): string;
+}
+
+/**
+ * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.
+ * Remove this file when MCP v1 (2025-11-25) reaches EOL.
+ *
+ * SUNSET INSTRUCTION: Delete this file, then grep for "@mcp-legacy" in the
+ * codebase to find and remove all remaining legacy seams.
+ */
+/**
+ * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.
+ * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.
+ */
+declare const MCP_LEGACY_SUPPORT_ENABLED = true;
+/**
+ * @mcp-legacy Legacy protocol version constant.
+ */
+declare const MCP_PROTOCOL_VERSION_LEGACY: "2025-11-25";
+
+/**
+ * Verdict returned by a GatewayInterceptor function.
+ * Determines whether the request is admitted into the routing pipeline.
+ */
+interface GatewayAdmissionResult {
+    /** true = request passes to router.dispatch(). false = rejected at perimeter. */
+    allowed: boolean;
+    /** Human-readable denial reason (included in JSON-RPC error response). */
+    reason?: string;
+    /** Custom JSON-RPC error code. Defaults to -32099 when omitted. */
+    errorCode?: number;
+    /** Opaque metadata bag for telemetry or audit logging downstream. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Contextual information passed to the interceptor alongside the request.
+ * Contains only non-sensitive, non-cryptographic perimeter metadata.
+ */
+interface GatewayInterceptorContext {
+    /** Originating client IP address (post-JWT, post-rate-limit). */
+    clientIp: string;
+    /** Authenticated identity from JWT validation, or null for unauthenticated gateways. */
+    authInfo: AuthInfo | null;
+    /** Transport protocol that received this request. */
+    protocol: "http1" | "http2";
+    /** Abort signal that fires when the interceptor timeout expires. */
+    signal: AbortSignal;
+}
+/**
+ * Technology-agnostic admission function.
+ * The developer implements this in their application code, connecting
+ * any decision engine (TypeSafe Jev, ONNX, regex rules, custom logic).
+ *
+ * Receives a frozen deep-clone of the request to prevent prototype pollution.
+ * May return synchronously or asynchronously.
+ */
+type GatewayInterceptor = (request: Readonly<McpRequest>, context: GatewayInterceptorContext) => Promise<GatewayAdmissionResult> | GatewayAdmissionResult;
+/**
+ * Configuration for the perimeter admission hook.
+ */
+interface GatewayInterceptorOptions {
+    /** The interceptor function. When undefined, the gateway skips interception entirely. */
+    interceptor?: GatewayInterceptor;
+    /** Maximum milliseconds to wait for the interceptor. Default: 2500. */
+    timeoutMs?: number;
+    /** Behavior when the interceptor throws or times out. Default: "closed". */
+    failMode?: "closed" | "open";
+}
+/**
+ * Executes the interceptor with timeout enforcement via AbortSignal.timeout(),
+ * prototype pollution isolation via structuredClone + Object.freeze,
+ * and fail-mode policy enforcement.
+ *
+ * AbortSignal.timeout() is stable since Node.js 17.3 (available in Node.js 20+ LTS).
+ * Promise.race guarantees the gateway never blocks beyond timeoutMs even if the
+ * interceptor ignores the signal.
+ */
+declare function executeGatewayInterceptor(request: McpRequest, context: Omit<GatewayInterceptorContext, "signal">, options: Required<Pick<GatewayInterceptorOptions, "interceptor">> & GatewayInterceptorOptions): Promise<GatewayAdmissionResult>;
+
+type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
+/**
+ * LiopLogger - Structured Logging Abstraction
+ * Configurable via `process.env.LIOP_LOG_LEVEL`.
+ * Emits strictly to stderr to comply with MCP stdio protocols.
+ */
+declare class LiopLogger {
+    private static instance;
+    private level;
+    private interceptor?;
+    private _isIntercepting;
+    private constructor();
+    static getInstance(): LiopLogger;
+    private setLevelFromEnv;
+    setLevel(level: LogLevel): void;
+    /**
+     * Registers a technology-agnostic log interceptor.
+     * Pass `undefined` to disable interception (zero overhead).
+     */
+    setInterceptor(interceptor: LogInterceptor | undefined): void;
+    private shouldLog;
+    private formatMessage;
+    /**
+     * Fire-and-forget async dispatch to the registered interceptor.
+     * Recursion guard prevents infinite loops when the interceptor
+     * itself triggers logging (directly or transitively).
+     */
+    private emitToInterceptor;
+    error(message: string, ...args: unknown[]): void;
+    warn(message: string, ...args: unknown[]): void;
+    info(message: string, ...args: unknown[]): void;
+    debug(message: string, ...args: unknown[]): void;
+}
+declare const log: LiopLogger;
+
+/**
+ * Structured snapshot of an operational log event.
+ * Frozen copy — mutations have no effect on the logger.
+ */
+interface LogEvent {
+    /** ISO 8601 timestamp of the log emission. */
+    timestamp: string;
+    /** Severity level that triggered this event. */
+    level: LogLevel;
+    /** Formatted log message (already interpolated by LiopLogger). */
+    message: string;
+    /** Additional variadic arguments passed to the log method. */
+    args: readonly unknown[];
+}
+/**
+ * Technology-agnostic operational log interceptor.
+ *
+ * Fires asynchronously (fire-and-forget) after each log emission
+ * that passes the current level filter. The interceptor receives
+ * a frozen snapshot of the log event. Errors thrown by the
+ * interceptor are caught silently and never propagate to the caller.
+ *
+ * Use cases: forward logs to TypeSafe Jev for anomaly detection,
+ * stream to a SIEM (Splunk, Datadog), aggregate in NotebookLM,
+ * or persist to a custom observability backend.
+ */
+type LogInterceptor = (event: Readonly<LogEvent>) => void | Promise<void>;
+
+/**
+ * Protocol Version Identifiers
+ */
+declare const MCP_PROTOCOL_VERSION: "2026-07-28";
+
+/**
+ * Protocol Era Classification
+ */
+type McpEra = "legacy" | "modern";
+/**
+ * Caching Hints for MCP 2026-07-28 Spec
+ */
+interface CacheableResult {
+    ttlMs?: number;
+    cacheScope?: "public" | "private";
+}
+/**
+ * Multi-Round-Trip Requests (MRTR) Specification Types
+ */
+interface InputRequest {
+    id: string;
+    message: string;
+    schema?: Record<string, unknown>;
+}
+interface InputResponse {
+    id: string;
+    value: unknown;
+}
+interface InputRequiredResult {
+    resultType: "input_required";
+    inputRequests: InputRequest[];
+    requestState?: string;
+}
+/**
+ * Modern Envelope Metadata (_meta)
+ */
+interface McpRequestMeta {
+    "io.modelcontextprotocol/protocolVersion"?: string;
+    "io.modelcontextprotocol/clientInfo"?: {
+        name: string;
+        version: string;
+    };
+    "io.modelcontextprotocol/clientCapabilities"?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/**
+ * Base Protocol Types representing parity with Model Context Protocol
+ */
+declare const ToolSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+type Tool = z.infer<typeof ToolSchema>;
+declare const ResourceSchema: z.ZodObject<{
+    uri: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    mimeType: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type Resource = z.infer<typeof ResourceSchema>;
+declare const PromptSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    arguments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        required: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+type Prompt = z.infer<typeof PromptSchema>;
+interface CallToolRequest {
+    name: string;
+    arguments?: Record<string, unknown>;
+}
+interface CallToolResult {
+    content: Array<{
+        type: "text" | "image" | "resource";
+        text?: string;
+        data?: string;
+        mimeType?: string;
+        resource?: {
+            uri: string;
+            text?: string;
+            blob?: string;
+        };
+    }>;
+    isError?: boolean;
+    zkVerified?: boolean;
+    zkProofType?: ProofType;
+}
+interface GetPromptRequest {
+    name: string;
+    arguments?: Record<string, string>;
+}
+interface GetPromptResult {
+    description?: string;
+    messages: Array<{
+        role: "user" | "assistant";
+        content: {
+            type: "text";
+            text: string;
+        } | {
+            type: "image";
+            data: string;
+            mimeType: string;
+        } | {
+            type: "resource";
+            resource: {
+                uri: string;
+                text?: string;
+                blob?: string;
+            };
+        };
+    }>;
+}
+interface ServerInfo {
+    name: string;
+    version: string;
+    capabilities?: {
+        prompts?: {
+            listChanged?: boolean;
+        };
+        resources?: {
+            subscribe?: boolean;
+            listChanged?: boolean;
+        };
+        tools?: {
+            listChanged?: boolean;
+        };
+        /** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */
+        logging?: Record<string, unknown>;
+    };
+}
+interface DiscoverResult {
+    resultType: "complete";
+    supportedVersions: string[];
+    capabilities: ServerInfo["capabilities"];
+    serverInfo: ServerInfo;
+    instructions?: string;
+}
+interface McpRequest {
+    method: string;
+    params?: unknown;
+    id?: string | number | null;
+    jsonrpc?: "2.0";
+}
+interface McpResponse {
+    jsonrpc: "2.0";
+    id?: string | number | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+
+export { type AuthInfo as A, ToolSchema as B, type CallToolRequest as C, type DiscoverResult as D, computeEntryHash as E, executeGatewayInterceptor as F, type GatewayInterceptorOptions as G, globalAuditLogger as H, type InputRequest as I, JwtValidator as J, log as K, LiopLogger as L, type McpEra as M, type Prompt as P, type Resource as R, type ServerInfo as S, type Tool as T, type CallToolResult as a, type McpRequest as b, type McpResponse as c, AuditLogger as d, type GetPromptRequest as e, type GetPromptResult as f, type AuditEntry as g, type AuditInterceptor as h, type AuditRecordParams as i, type AuditStatus as j, type CacheableResult as k, GENESIS_HASH as l, type GatewayAdmissionResult as m, type GatewayInterceptor as n, type GatewayInterceptorContext as o, type InputRequiredResult as p, type InputResponse as q, type LogEvent as r, type LogInterceptor as s, type LogLevel as t, MCP_LEGACY_SUPPORT_ENABLED as u, MCP_PROTOCOL_VERSION as v, MCP_PROTOCOL_VERSION_LEGACY as w, type McpRequestMeta as x, PromptSchema as y, ResourceSchema as z };

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+export { P as ProofType, R as RECEIPT_VERSION_V1, a as RECEIPT_VERSION_V2, b as ZK_JOURNAL_V2_SIZE, c as ZkJournalV2, Z as ZkPolicy, d as ZkReceipt } from './zk-DzYNWBgo.js';
 import 'zod';
-export { A as AuthInfo, e as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, G as GetPromptRequest, d as GetPromptResult, I as InputRequest, f as InputRequiredResult, g as InputResponse, h as MCP_LEGACY_SUPPORT_ENABLED, i as MCP_PROTOCOL_VERSION, j as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, k as McpRequestMeta, c as McpResponse, P as Prompt, l as PromptSchema, R as Resource, m as ResourceSchema, S as ServerInfo, T as Tool, n as ToolSchema } from './types-lJIxBlWF.js';
+export { h as AuditInterceptor, A as AuthInfo, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, r as LogEvent, s as LogInterceptor, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema } from './types-29zv9X1V.js';
 import 'jose';

package/dist/types.js

@@ -1,3 +1,2 @@
-export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-PYKRQAER.js';
-//# sourceMappingURL=types.js.map
+export{a as MCP_LEGACY_SUPPORT_ENABLED,h as MCP_PROTOCOL_VERSION,b as MCP_PROTOCOL_VERSION_LEGACY,k as PromptSchema,j as ResourceSchema,i as ToolSchema}from'./chunk-GWVSCZUS.js';export{a as ProofType,b as RECEIPT_VERSION_V1,c as RECEIPT_VERSION_V2,d as ZK_JOURNAL_V2_SIZE}from'./chunk-6VK2XALI.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=types.js.map
 //# sourceMappingURL=types.js.map

package/dist/verifier-DqZ9MQ9l.d.ts

@@ -0,0 +1,82 @@
+import { Z as ZkPolicy } from './zk-DzYNWBgo.js';
+
+type TeePolicy = "required" | "preferred" | "none";
+interface TeeVerificationOptions {
+    /** Enforcement policy for TEE attestation */
+    policy?: TeePolicy;
+    /** Expected cryptographic nonce used during negotiateIntent handshake */
+    expectedNonce?: Buffer | Uint8Array;
+    /** Expected enclave public key (e.g. ML-KEM-768 public key) */
+    expectedPublicKey?: Buffer | Uint8Array;
+    /** Expected platform configuration registers (PCRs) */
+    expectedPcrs?: Record<number, string>;
+    /** Allow synthetic / mesh PSK proofs in non-hardware environments */
+    allowSynthetic?: boolean;
+}
+interface TeeVerificationResult {
+    verified: boolean;
+    platform: "amd-sev-snp" | "aws-nitro" | "intel-tdx" | "synthetic" | "none";
+    message: string;
+    measurements?: {
+        reportDataHex?: string;
+        measurementHex?: string;
+        chipIdHex?: string;
+    };
+}
+interface VerifyZkOptions {
+    sessionSecret?: Buffer;
+    expectedOutput?: unknown;
+    guestImageIdHex?: string;
+    vkeyRaw?: Buffer;
+    zkPolicy?: ZkPolicy;
+    circuitName?: string;
+}
+/**
+ * LIOP Tier-0 Industrial Verifier
+ *
+ * This engine is responsible for the trustless verification of remote logic execution.
+ * It validates both the integrity of the code (ZkImageID) and the mathematical proof
+ * of its execution (ZkSeal/Groth16), as well as hardware-level attestation (TEE).
+ */
+declare class LiopVerifier {
+    private static zkWorkerPool;
+    private static vkeyRegistry;
+    /**
+     * Registers a verification key for a canonical analytical circuit.
+     */
+    static registerVKey(circuitName: string, vkeyRaw: Buffer): void;
+    /**
+     * Retrieves a registered verification key by circuit name.
+     */
+    static getRegisteredVKey(circuitName: string): Buffer | undefined;
+    private getZkPool;
+    /**
+     * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.
+     * Supports both legacy positional arguments and structured options.
+     *
+     * @param logicPayload The raw WASM or JS logic that was sent to the provider.
+     * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).
+     * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM or Groth16.
+     * @param sessionSecretOrOptions Shared secret (Buffer) or structured VerifyZkOptions.
+     * @param expectedOutput Optional expected output value for anti-replay verification.
+     */
+    verifyZkReceipt(logicPayload: Buffer, remoteImageIdHex: string, zkReceipt: Buffer, sessionSecretOrOptions?: Buffer | VerifyZkOptions, expectedOutput?: unknown): Promise<boolean>;
+    /**
+     * Detailed hardware attestation verification supporting AMD SEV-SNP, AWS Nitro Enclaves,
+     * and synthetic mesh verification.
+     */
+    verifyTeeAttestationDetailed(attestationReport: Buffer, options?: TeeVerificationOptions): Promise<TeeVerificationResult>;
+    /**
+     * Verifies if a node is running inside an authenticated TEE (e.g. AMD SEV-SNP or AWS Nitro).
+     *
+     * @param attestationReport The attestation document from the hardware.
+     * @param options Verification policy and binding options.
+     */
+    verifyTeeAttestation(attestationReport: Buffer, options?: TeeVerificationOptions): Promise<boolean>;
+    /**
+     * Derives the ImageID of a logic payload following the LIOP v1 Standard.
+     */
+    deriveImageId(logicPayload: Buffer): Buffer;
+}
+
+export { LiopVerifier as L, type TeePolicy as T, type VerifyZkOptions as V, type TeeVerificationOptions as a, type TeeVerificationResult as b };

package/dist/verifier-J4NQYZX5.js

@@ -0,0 +1,2 @@
+export{a as LiopVerifier}from'./chunk-6KFKO6ZX.js';import'./chunk-TKLRW52V.js';import'./chunk-ZZMSFCJP.js';import'./chunk-3WRKTVOF.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=verifier-J4NQYZX5.js.map
+//# sourceMappingURL=verifier-J4NQYZX5.js.map

package/dist/workers/logic-execution.d.ts

@@ -1,3 +1,5 @@
+import { P as ProofType } from '../zk-DzYNWBgo.js';
+
 interface WorkerData {
     isWarmup?: boolean;
     ciphertext?: Uint8Array;
@@ -10,6 +12,9 @@ interface WorkerData {
     sessionTimestamp?: number;
     isEncrypted?: boolean;
     aesNonce?: Uint8Array;
+    proofMode?: number;
+    guestImageId?: string;
+    pqcSigningKey?: Uint8Array;
     dpConfig?: {
         epsilon: number;
         sensitivity: number;
@@ -21,6 +26,8 @@ declare function processLogicExecution(data: WorkerData): Promise<{
     output: unknown;
     fuel_consumed: number;
     zk_receipt?: string;
+    proof_type?: ProofType;
+    guest_image_id?: string;
 }>;
 
 export { type WorkerData, processLogicExecution as default };