@nekzus/liop 2.6.1 → 2.7.1

package/dist/workers/logic-execution.js

@@ -1,272 +1,2 @@
-import { ASTGuardian, WasiSandbox } from '../chunk-7BSCUYUE.js';
-import { sanitizeOutput } from '../chunk-Y62GORQF.js';
-import { normalizeLogicSource, deriveLogicImageDigest } from '../chunk-IK7CGWAZ.js';
-import { Buffer } from 'buffer';
-import crypto2 from 'crypto';
-import { createMlKem768 } from 'mlkem';
-
-var DEFAULT_DP_CONFIG = {
-  epsilon: 1,
-  sensitivity: 1,
-  smallDatasetThreshold: 50
-};
-var EPSILON_FLOOR = 1;
-var EPSILON_FLOOR_THRESHOLD = 10;
-function laplaceSample(scale, prngState) {
-  let u;
-  do {
-    if (prngState) {
-      const hash = crypto2.createHash("sha256").update(`${prngState.seed}:${prngState.counter++}`).digest();
-      u = hash.readUInt32BE(0) / 4294967296 - 0.5;
-    } else {
-      const buf = crypto2.randomBytes(4);
-      const rawVal = buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3];
-      const cleanVal = Number.parseInt(rawVal.toString(10), 10);
-      u = cleanVal / 4294967296;
-    }
-  } while (u === 0 || u === -0.5);
-  return -scale * Math.sign(u) * Math.log(1 - 2 * Math.abs(u));
-}
-function addLaplaceNoise(value, config = {}, prngState) {
-  const merged = { ...DEFAULT_DP_CONFIG, ...config };
-  const scale = merged.sensitivity / merged.epsilon;
-  const noisyValue = value + laplaceSample(scale, prngState);
-  return Math.round(noisyValue * 1e4) / 1e4;
-}
-function deriveFieldSensitivity(key, globalSensitivity, recordCount) {
-  if (!key) return globalSensitivity;
-  const lk = key.toLowerCase();
-  const isCountWord = /count|length|size|num|gainer|loser|positive|negative|nan_|null_|empty_|finite_|non_finite_|instruments|tickers|users|records/i.test(
-    lk
-  );
-  const isTotalCount = lk === "total" || lk === "n" || lk === "total_records" || lk.startsWith("total_") || // Catch total_tickers, total_users
-  lk.startsWith("num_") || // Catch num_records, num_ticks
-  /total.*(count|items|entries|rows|records|tickers)/i.test(lk);
-  if (isCountWord || isTotalCount) return 1;
-  if (/avg|mean|average|var|variance|std|stddev|ratio|bps|drift|pct|percent|imbalance/i.test(
-    lk
-  ) && recordCount > 0) {
-    return globalSensitivity / recordCount;
-  }
-  return globalSensitivity;
-}
-function applyDpToOutput(output, config = {}, recordCount) {
-  const merged = { ...DEFAULT_DP_CONFIG, ...config };
-  if (recordCount >= merged.smallDatasetThreshold) {
-    return output;
-  }
-  if (recordCount < EPSILON_FLOOR_THRESHOLD && merged.epsilon < EPSILON_FLOOR) {
-    merged.epsilon = EPSILON_FLOOR;
-  }
-  let prngState;
-  if (merged.seed) {
-    prngState = { seed: merged.seed, counter: 0 };
-  }
-  return walkAndNoise(output, merged, recordCount, void 0, prngState);
-}
-function walkAndNoise(node, config, recordCount, currentKey, prngState) {
-  if (typeof node === "number" && Number.isFinite(node)) {
-    const fieldSensitivity = deriveFieldSensitivity(
-      currentKey,
-      config.sensitivity,
-      recordCount
-    );
-    let noisyValue = addLaplaceNoise(
-      node,
-      {
-        ...config,
-        sensitivity: fieldSensitivity
-      },
-      prngState
-    );
-    const isCountKey = currentKey != null && deriveFieldSensitivity(currentKey, config.sensitivity, recordCount) === 1;
-    if (Number.isInteger(node) || isCountKey) {
-      noisyValue = Math.round(noisyValue);
-    }
-    if (node >= 0) {
-      noisyValue = Math.max(0, noisyValue);
-    }
-    return noisyValue;
-  }
-  if (Array.isArray(node)) {
-    return node.map(
-      (item) => walkAndNoise(item, config, recordCount, currentKey, prngState)
-    );
-  }
-  if (node !== null && typeof node === "object") {
-    const result = {};
-    for (const [key, value] of Object.entries(
-      node
-    )) {
-      result[key] = walkAndNoise(value, config, recordCount, key, prngState);
-    }
-    return result;
-  }
-  return node;
-}
-
-// src/workers/logic-execution.ts
-async function processLogicExecution(data) {
-  if (typeof Object.prototype === "object" && !Object.isFrozen(Object.prototype)) {
-    Object.freeze(Object.prototype);
-    Object.freeze(Array.prototype);
-    Object.freeze(String.prototype);
-    Object.freeze(Number.prototype);
-    Object.freeze(Boolean.prototype);
-    Object.freeze(RegExp.prototype);
-    Object.freeze(Map.prototype);
-    Object.freeze(Set.prototype);
-    Object.freeze(Promise.prototype);
-    Object.freeze(Error.prototype);
-  }
-  if (data.isWarmup) {
-    return {
-      image_id: "",
-      output: "warm",
-      fuel_consumed: 0
-    };
-  }
-  if (data.sessionTimestamp !== void 0) {
-    const MAX_SESSION_KEY_LIFETIME_MS = 3600 * 1e3;
-    const age = Date.now() - data.sessionTimestamp;
-    if (age > MAX_SESSION_KEY_LIFETIME_MS) {
-      throw new Error(
-        `[LIOP-PQC] Session secret expired: Age (${Math.round(age / 1e3)}s) exceeds 3600s TTL limit.`
-      );
-    }
-    if (data.sessionTimestamp > Date.now() + 6e4) {
-      throw new Error(
-        "[LIOP-PQC] Session secret invalid: Timestamp is in the future."
-      );
-    }
-  }
-  const {
-    ciphertext,
-    secretKeyObj,
-    wasmBinary,
-    inputs,
-    aesNonce,
-    records,
-    isEncrypted = true,
-    dpConfig
-  } = data;
-  let decryptedPayload;
-  const decryptedInputs = {};
-  let sessionSecret = Buffer.alloc(32);
-  if (isEncrypted) {
-    const sk = new Uint8Array(secretKeyObj);
-    const ct = new Uint8Array(ciphertext);
-    const kem = await createMlKem768();
-    const sharedSecret = kem.decap(ct, sk);
-    const aesKey = Buffer.from(sharedSecret);
-    sessionSecret = aesKey;
-    const wasmBuffer = Buffer.from(wasmBinary);
-    const authTag = wasmBuffer.subarray(-16);
-    const encryptedData = wasmBuffer.subarray(0, -16);
-    const decipher = crypto2.createDecipheriv(
-      "aes-256-gcm",
-      aesKey,
-      Buffer.from(aesNonce || new Uint8Array(12))
-    );
-    decipher.setAuthTag(authTag);
-    let decrypted = decipher.update(encryptedData);
-    decrypted = Buffer.concat([decrypted, decipher.final()]);
-    decryptedPayload = decrypted;
-    for (const [key, encValue] of Object.entries(inputs || {})) {
-      const valBuffer = Buffer.from(encValue);
-      const inputNonce = valBuffer.subarray(0, 12);
-      const valTag = valBuffer.subarray(-16);
-      const valData = valBuffer.subarray(12, -16);
-      const valDecipher = crypto2.createDecipheriv(
-        "aes-256-gcm",
-        aesKey,
-        inputNonce
-      );
-      valDecipher.setAuthTag(valTag);
-      let valDecrypted = valDecipher.update(valData);
-      valDecrypted = Buffer.concat([valDecrypted, valDecipher.final()]);
-      decryptedInputs[key] = JSON.parse(valDecrypted.toString("utf-8"));
-    }
-  } else {
-    if (wasmBinary[0] === 0 && wasmBinary[1] === 97 && wasmBinary[2] === 115 && wasmBinary[3] === 109) {
-      decryptedPayload = Buffer.from(wasmBinary);
-    } else {
-      decryptedPayload = Buffer.from(wasmBinary).toString("utf-8");
-    }
-  }
-  const isWasm = decryptedPayload[0] === 0 && decryptedPayload[1] === 97 && decryptedPayload[2] === 115 && decryptedPayload[3] === 109;
-  if (decryptedPayload instanceof Buffer && isWasm) {
-    const wasmBytes = new Uint8Array(decryptedPayload);
-    const compiledModule = await WebAssembly.compile(wasmBytes);
-    ASTGuardian.analyze(compiledModule);
-  } else if (decryptedPayload instanceof Buffer && !isWasm) {
-    decryptedPayload = decryptedPayload.toString("utf-8");
-  }
-  if (typeof decryptedPayload === "string") {
-    decryptedPayload = normalizeLogicSource(decryptedPayload);
-  }
-  const sandbox = new WasiSandbox();
-  await sandbox.init();
-  try {
-    const result = await sandbox.execute(
-      decryptedPayload,
-      records,
-      decryptedInputs
-    );
-    let finalOutput = result.output;
-    let logicBytes;
-    if (typeof decryptedPayload === "string") {
-      logicBytes = Buffer.from(decryptedPayload, "utf-8");
-    } else {
-      logicBytes = new Uint8Array(decryptedPayload);
-    }
-    const imageId = deriveLogicImageDigest(logicBytes).toString("hex");
-    const datasetHash = crypto2.createHash("sha256").update(JSON.stringify(records || [])).digest("hex");
-    if (dpConfig) {
-      finalOutput = applyDpToOutput(
-        finalOutput,
-        {
-          ...dpConfig,
-          seed: `${datasetHash}:${imageId}`
-        },
-        records?.length || 0
-      );
-    }
-    finalOutput = sanitizeOutput(finalOutput);
-    const journal = Buffer.from(
-      JSON.stringify({
-        image_id: imageId,
-        dataset_hash: datasetHash,
-        output_hash: crypto2.createHash("sha256").update(
-          typeof finalOutput === "string" ? finalOutput : finalOutput === void 0 ? "undefined" : JSON.stringify(finalOutput)
-        ).digest("hex"),
-        fuel: result.fuelConsumed,
-        ts: Date.now()
-      })
-    );
-    const seal = crypto2.createHmac("sha256", sessionSecret).update(journal).digest();
-    const journalLen = Buffer.alloc(2);
-    journalLen.writeUInt16BE(journal.length);
-    const receiptBuf = Buffer.concat([
-      Buffer.from([1]),
-      // Receipt format v1
-      journalLen,
-      journal,
-      seal
-      // 32 bytes HMAC
-    ]);
-    const zkReceipt = receiptBuf.toString("base64");
-    return {
-      image_id: imageId,
-      zk_receipt: zkReceipt,
-      output: finalOutput,
-      fuel_consumed: result.fuelConsumed
-    };
-  } finally {
-    await sandbox.teardown();
-  }
-}
-
-export { processLogicExecution as default };
-//# sourceMappingURL=logic-execution.js.map
+import {a as a$1,d}from'../chunk-CTTTLCGL.js';import {a as a$3}from'../chunk-MQ5SU26J.js';import {a as a$2,b}from'../chunk-TKLRW52V.js';import {b as b$1}from'../chunk-2ZYX736J.js';import {f,h}from'../chunk-6VK2XALI.js';import {a}from'../chunk-AYDF3IFZ.js';import {Buffer}from'buffer';import m from'crypto';import {createMlKem768}from'mlkem';var Y={epsilon:1,sensitivity:1,smallDatasetThreshold:50},J=1,ee=10;function te(e,i){let o;do if(i)o=m.createHash("sha256").update(`${i.seed}:${i.counter++}`).digest().readUInt32BE(0)/4294967296-.5;else {let t=m.randomBytes(4),a=t[0]<<24|t[1]<<16|t[2]<<8|t[3];o=Number.parseInt(a.toString(10),10)/4294967296;}while(o===0||o===-0.5);return -e*Math.sign(o)*Math.log(1-2*Math.abs(o))}a(te,"laplaceSample");function re(e,i={},o){let t={...Y,...i},a=t.sensitivity/t.epsilon,c=e+te(a,o);return Math.round(c*1e4)/1e4}a(re,"addLaplaceNoise");function $(e,i,o){if(!e)return i;let t=e.toLowerCase(),a=/count|length|size|num|gainer|loser|positive|negative|nan_|null_|empty_|finite_|non_finite_|instruments|tickers|users|records/i.test(t),c=t==="total"||t==="n"||t==="total_records"||t.startsWith("total_")||t.startsWith("num_")||/total.*(count|items|entries|rows|records|tickers)/i.test(t);return a||c?1:/avg|mean|average|var|variance|std|stddev|ratio|bps|drift|pct|percent|imbalance/i.test(t)&&o>0?i/o:i}a($,"deriveFieldSensitivity");function Z(e,i={},o){let t={...Y,...i};if(o>=t.smallDatasetThreshold)return e;o<ee&&t.epsilon<J&&(t.epsilon=J);let a;return t.seed&&(a={seed:t.seed,counter:0}),R(e,t,o,void 0,a)}a(Z,"applyDpToOutput");function R(e,i,o,t,a){if(typeof e=="number"&&Number.isFinite(e)){let c=$(t,i.sensitivity,o),u=re(e,{...i,sensitivity:c},a),w=t!=null&&$(t,i.sensitivity,o)===1;return (Number.isInteger(e)||w)&&(u=Math.round(u)),e>=0&&(u=Math.max(0,u)),u}if(Array.isArray(e))return e.map(c=>R(c,i,o,t,a));if(e!==null&&typeof e=="object"){let c={};for(let[u,w]of Object.entries(e))c[u]=R(w,i,o,u,a);return c}return e}a(R,"walkAndNoise");async function oe(e){if(typeof Object.prototype=="object"&&!Object.isFrozen(Object.prototype)&&(Object.freeze(Object.prototype),Object.freeze(Array.prototype),Object.freeze(String.prototype),Object.freeze(Number.prototype),Object.freeze(Boolean.prototype),Object.freeze(RegExp.prototype),Object.freeze(Map.prototype),Object.freeze(Set.prototype),Object.freeze(Promise.prototype),Object.freeze(Error.prototype)),e.isWarmup)return {image_id:"",output:"warm",fuel_consumed:0};if(e.sessionTimestamp!==void 0){let n=Date.now()-e.sessionTimestamp;if(n>36e5)throw new Error(`[LIOP-PQC] Session secret expired: Age (${Math.round(n/1e3)}s) exceeds 3600s TTL limit.`);if(e.sessionTimestamp>Date.now()+6e4)throw new Error("[LIOP-PQC] Session secret invalid: Timestamp is in the future.")}let{ciphertext:i,secretKeyObj:o,wasmBinary:t,inputs:a,aesNonce:c,records:u,isEncrypted:w=true,dpConfig:z}=e,s,D={},C=Buffer.alloc(32);if(w){let p=new Uint8Array(o),n=new Uint8Array(i),g=(await createMlKem768()).decap(n,p),d=Buffer.from(g);C=d;let _=Buffer.from(t),k=_.subarray(-16),T=_.subarray(0,-16),A=m.createDecipheriv("aes-256-gcm",d,Buffer.from(c||new Uint8Array(12)));A.setAuthTag(k);let S=A.update(T);S=Buffer.concat([S,A.final()]),s=S;for(let[E,B]of Object.entries(a||{})){let y=Buffer.from(B),f=y.subarray(0,12),h=y.subarray(-16),x=y.subarray(12,-16),O=m.createDecipheriv("aes-256-gcm",d,f);O.setAuthTag(h);let v=O.update(x);v=Buffer.concat([v,O.final()]),D[E]=JSON.parse(v.toString("utf-8"));}}else t[0]===0&&t[1]===97&&t[2]===115&&t[3]===109?s=Buffer.from(t):s=Buffer.from(t).toString("utf-8");let K=s[0]===0&&s[1]===97&&s[2]===115&&s[3]===109;if(s instanceof Buffer&&K){let p=new Uint8Array(s),n=await WebAssembly.compile(p);a$1.analyze(n);}else s instanceof Buffer&&!K&&(s=s.toString("utf-8"));typeof s=="string"&&(s=a$2(s));let N=new d;await N.init();try{let p=await N.execute(s,u,D),n=p.output,I;typeof s=="string"?I=Buffer.from(s,"utf-8"):I=new Uint8Array(s);let g=b(I).toString("hex"),d=m.createHash("sha256").update(JSON.stringify(u||[])).digest("hex");if(z&&(n=Z(n,{...z,seed:`${d}:${g}`},u?.length||0)),n=a$3(n),e.proofMode===1||e.proofMode===2){let E=e.guestImageId?Buffer.from(e.guestImageId,"hex"):m.createHash("sha256").update("liop-default-guest-v2").digest(),B=typeof n=="string"?n:n===void 0?"undefined":JSON.stringify(n),y=f({guestImageId:E,logicDigest:Buffer.from(g,"hex"),datasetDigest:Buffer.from(d,"hex"),outputDigest:m.createHash("sha256").update(B).digest(),fuelConsumed:BigInt(p.fuelConsumed),executionTimestamp:BigInt(Date.now())}),f$1,h$1=null;try{h$1=await import('@nekzus/liop-zk-native');}catch{h$1=null;}if(h$1&&typeof h$1.prove_analytical_query=="function")try{let b=typeof D?.operation=="string"?D.operation:"sum",M=JSON.stringify({records:Array.isArray(u)?u.map(P=>Number(P.amount??P.value??1)):[1],expected_sum:typeof n=="number"?n:void 0});f$1=await h$1.prove_analytical_query(b,M);}catch(b){if(e.proofMode===2)throw new Error(`ZK PROOF GENERATION FAILED: Native Groth16 prover execution error: ${b instanceof Error?b.message:String(b)}`);f$1=Buffer.alloc(128,66);}else {if(e.proofMode===2)throw new Error("ZK PROOF GENERATION FAILED: Native Groth16 prover module unavailable for required policy.");f$1=Buffer.alloc(128,66);}let x,O=2;if(e.pqcSigningKey&&e.pqcSigningKey.length>0){O=3;let b=m.createHash("sha256").update(Buffer.concat([y,f$1])).digest(),M=b$1.sign(b,e.pqcSigningKey),P=b$1.getPublicKey(e.pqcSigningKey);x=h.encodeHybridV2(y,f$1,Buffer.from(M),Buffer.from(P));}else x=h.encodeV2(2,y,f$1);let v=x.toString("base64");return {image_id:g,zk_receipt:v,output:n,fuel_consumed:p.fuelConsumed,proof_type:O,guest_image_id:E.toString("hex")}}let _=Buffer.from(JSON.stringify({image_id:g,dataset_hash:d,output_hash:m.createHash("sha256").update(typeof n=="string"?n:n===void 0?"undefined":JSON.stringify(n)).digest("hex"),fuel:p.fuelConsumed,ts:Date.now()})),k=m.createHmac("sha256",C).update(_).digest(),T=Buffer.alloc(2);T.writeUInt16BE(_.length);let S=Buffer.concat([Buffer.from([1]),T,_,k]).toString("base64");return {image_id:g,zk_receipt:S,output:n,fuel_consumed:p.fuelConsumed,proof_type:0}}finally{await N.teardown();}}a(oe,"processLogicExecution");export{oe as default};//# sourceMappingURL=logic-execution.js.map
 //# sourceMappingURL=logic-execution.js.map

package/dist/workers/zk-verifier.d.ts

@@ -1,3 +1,5 @@
+import { Z as ZkPolicy } from '../zk-DzYNWBgo.js';
+
 /**
  * ZK Verification Payload Structure.
  * Modeled after RISC Zero & SP1 Receipt formats.
@@ -8,12 +10,18 @@ interface ZkVerificationPayload {
     logicPayload?: Uint8Array;
     /** Expected ImageID (SHA-256) of the execution state */
     remoteImageIdHex?: string;
+    /** Expected Guest ImageID (SHA-256) of the zkVM interpreter */
+    guestImageIdHex?: string;
     /** Cbor-encoded or raw buffer containing the execution Receipt (Journal + Seal) */
     zkReceipt?: Uint8Array;
     /** Kyber-derived session secret to verify HMAC signature */
     sessionSecret?: Uint8Array;
+    /** Serialized VerificationKey buffer for Groth16 mathematical verification */
+    vkeyRaw?: Uint8Array;
     /** The expected output value of the computation for anti-replay/tampering verification */
     expectedOutput?: unknown;
+    /** Enforcement policy for clearance tiers */
+    zkPolicy?: ZkPolicy;
 }
 /**
  * Main worker entry point for Piscina.
@@ -21,6 +29,7 @@ interface ZkVerificationPayload {
 declare function workerHandler(task: ZkVerificationPayload): Promise<{
     verified: boolean;
     message: string;
+    proofType?: string;
 }>;
 
 export { type ZkVerificationPayload, workerHandler as default };

package/dist/workers/zk-verifier.js

@@ -1,174 +1,2 @@
-import { deriveLogicImageDigest } from '../chunk-IK7CGWAZ.js';
-import crypto from 'crypto';
-import 'worker_threads';
-
-function deriveImageId(logicPayload) {
-  return deriveLogicImageDigest(logicPayload);
-}
-function tryExtractProxyOutput(logicPayload) {
-  try {
-    const logicStr = Buffer.from(logicPayload).toString("utf-8").trim();
-    if (!logicStr.includes("__liop_proxy_tool")) {
-      return null;
-    }
-    const firstBraceIdx = logicStr.indexOf("{");
-    if (firstBraceIdx === -1) {
-      return null;
-    }
-    let braceCount = 0;
-    let inDoubleQuote = false;
-    let inSingleQuote = false;
-    let inBacktick = false;
-    let escaped = false;
-    let lastBraceIdx = -1;
-    for (let i = firstBraceIdx; i < logicStr.length; i++) {
-      const char = logicStr[i];
-      if (escaped) {
-        escaped = false;
-        continue;
-      }
-      if (char === "\\") {
-        escaped = true;
-        continue;
-      }
-      if (char === '"' && !inSingleQuote && !inBacktick) {
-        inDoubleQuote = !inDoubleQuote;
-        continue;
-      }
-      if (char === "'" && !inDoubleQuote && !inBacktick) {
-        inSingleQuote = !inSingleQuote;
-        continue;
-      }
-      if (char === "`" && !inDoubleQuote && !inSingleQuote) {
-        inBacktick = !inBacktick;
-        continue;
-      }
-      if (!inDoubleQuote && !inSingleQuote && !inBacktick) {
-        if (char === "{") {
-          braceCount++;
-        } else if (char === "}") {
-          braceCount--;
-          if (braceCount === 0) {
-            lastBraceIdx = i;
-            break;
-          }
-        }
-      }
-    }
-    if (lastBraceIdx !== -1) {
-      const jsonStr = logicStr.slice(firstBraceIdx, lastBraceIdx + 1);
-      const parsed = JSON.parse(jsonStr);
-      if (parsed?.__liop_proxy_tool) {
-        return parsed;
-      }
-    }
-  } catch (_e) {
-  }
-  return null;
-}
-async function verifyZkReceipt(payload) {
-  const {
-    logicPayload,
-    remoteImageIdHex,
-    zkReceipt,
-    sessionSecret,
-    expectedOutput
-  } = payload;
-  if (!logicPayload || !remoteImageIdHex || !zkReceipt) {
-    return {
-      verified: false,
-      message: "Missing required verification fields."
-    };
-  }
-  const localImageId = deriveImageId(logicPayload);
-  const localImageIdHex = localImageId.toString("hex");
-  if (localImageIdHex !== remoteImageIdHex) {
-    return {
-      verified: false,
-      message: `Integrity Violation: Local (${localImageIdHex.slice(0, 8)}) != Remote (${remoteImageIdHex.slice(0, 8)})`
-    };
-  }
-  const receiptBuf = Buffer.from(zkReceipt);
-  if (receiptBuf.length < 35) {
-    return {
-      verified: false,
-      message: "Receipt too short for binary format."
-    };
-  }
-  const version = receiptBuf[0];
-  if (version !== 1) {
-    return {
-      verified: false,
-      message: `Unknown receipt version: ${version}`
-    };
-  }
-  const journalLen = receiptBuf.readUInt16BE(1);
-  const journal = receiptBuf.subarray(3, 3 + journalLen);
-  const seal = receiptBuf.subarray(3 + journalLen);
-  if (seal.length !== 32) {
-    return {
-      verified: false,
-      message: "Invalid seal length (expected 32 bytes HMAC-SHA256)."
-    };
-  }
-  let journalData;
-  try {
-    journalData = JSON.parse(journal.toString());
-    if (journalData.image_id !== localImageIdHex) {
-      return {
-        verified: false,
-        message: `Journal ImageID mismatch: ${journalData.image_id.slice(0, 8)} != ${localImageIdHex.slice(0, 8)}`
-      };
-    }
-  } catch (_e) {
-    return { verified: false, message: "Failed to parse journal data." };
-  }
-  if (sessionSecret && sessionSecret.length > 0) {
-    const expectedSeal = crypto.createHmac("sha256", sessionSecret).update(journal).digest();
-    if (!crypto.timingSafeEqual(seal, expectedSeal)) {
-      return {
-        verified: false,
-        message: "Invalid seal: HMAC verification failed."
-      };
-    }
-  }
-  if (expectedOutput !== void 0) {
-    const proxyOutput = tryExtractProxyOutput(logicPayload);
-    const actualExpected = proxyOutput !== null ? proxyOutput : expectedOutput;
-    const expectedOutputStr = typeof actualExpected === "string" ? actualExpected : actualExpected === void 0 ? "undefined" : JSON.stringify(actualExpected);
-    const expectedOutputHash = crypto.createHash("sha256").update(expectedOutputStr).digest("hex");
-    if (journalData.output_hash !== expectedOutputHash) {
-      return {
-        verified: false,
-        message: `Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${journalData.output_hash.slice(0, 8)}) != Calculated output_hash (${expectedOutputHash.slice(0, 8)})`
-      };
-    }
-  }
-  return {
-    verified: true,
-    message: "HMAC Commitment Verified: Integrity intact."
-  };
-}
-async function workerHandler(task) {
-  try {
-    if (task.action === "warmup") {
-      return {
-        verified: true,
-        message: "warm"
-      };
-    }
-    if (task.action === "verify_receipt") {
-      return await verifyZkReceipt(task);
-    }
-    throw new Error("Unknown action in ZkVerifier Worker.");
-  } catch (error) {
-    return {
-      verified: false,
-      message: `Verification Error: ${error.message}`
-    };
-  }
-}
-
-export { workerHandler as default };
-//# sourceMappingURL=zk-verifier.js.map
+import {d,f,b as b$3}from'../chunk-FDJMH4CB.js';import {b}from'../chunk-TKLRW52V.js';import {b as b$2}from'../chunk-2ZYX736J.js';import {h,b as b$1,c,g}from'../chunk-6VK2XALI.js';import {a}from'../chunk-AYDF3IFZ.js';import v from'crypto';import'worker_threads';function D(s){return b(s)}a(D,"deriveImageId");function O(s){try{let i=Buffer.from(s).toString("utf-8").trim();if(!i.includes("__liop_proxy_tool"))return null;let d=i.indexOf("{");if(d===-1)return null;let p=0,c=!1,n=!1,o=!1,f=!1,y=-1;for(let e=d;e<i.length;e++){let t=i[e];if(f){f=!1;continue}if(t==="\\"){f=!0;continue}if(t==='"'&&!n&&!o){c=!c;continue}if(t==="'"&&!c&&!o){n=!n;continue}if(t==="`"&&!c&&!n){o=!o;continue}if(!c&&!n&&!o){if(t==="{")p++;else if(t==="}"&&(p--,p===0)){y=e;break}}}if(y!==-1){let e=i.slice(d,y+1),t=JSON.parse(e);if(t?.__liop_proxy_tool)return t}}catch{}return null}a(O,"tryExtractProxyOutput");async function T(s){let{logicPayload:i,remoteImageIdHex:d$1,guestImageIdHex:p,zkReceipt:c$1,sessionSecret:n,vkeyRaw:o,expectedOutput:f$1,zkPolicy:y}=s;if(!i||!d$1||!c$1)return {verified:false,message:"Missing required verification fields."};let e;try{e=h.decode(Buffer.from(c$1));}catch(t){return {verified:false,message:`Receipt Decode Failed: ${t.message}`}}if(e.version===b$1){if(y==="required")return {verified:false,message:"Policy Violation: Clearance Tier requires ZK proof (Groth16), but received legacy HMAC."};let g=D(i).toString("hex");if(g!==d$1)return {verified:false,message:`Integrity Violation: Local (${g.slice(0,8)}) != Remote (${d$1.slice(0,8)})`};let u;try{if(u=JSON.parse(e.journal.toString()),u.image_id!==g)return {verified:!1,message:`Journal ImageID mismatch: ${u.image_id.slice(0,8)} != ${g.slice(0,8)}`}}catch{return {verified:false,message:"Failed to parse journal data."}}if(n&&n.length>0){let r=v.createHmac("sha256",n).update(e.journal).digest();if(!v.timingSafeEqual(e.proof,r))return {verified:false,message:"Invalid seal: HMAC verification failed."}}if(f$1!==void 0){let r=O(i),a=r!==null?r:f$1,m=typeof a=="string"?a:a===void 0?"undefined":JSON.stringify(a),l=v.createHash("sha256").update(m).digest("hex");if(u.output_hash!==l)return {verified:false,message:`Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${u.output_hash.slice(0,8)}) != Calculated output_hash (${l.slice(0,8)})`}}return {verified:true,message:"HMAC Commitment Verified: Integrity intact.",proofType:"hmac"}}if(e.version===c){if(e.proofType!==2&&e.proofType!==3)return {verified:false,message:`Unsupported ZK proof type in v2 receipt: ${e.proofType}`};if(e.proofType===3){let{pqcSignature:r,pqcPublicKey:a}=e;if(!r||!a)return {verified:false,message:"Hybrid Receipt Error: Missing ML-DSA-65 signature or public key."};let m=v.createHash("sha256").update(Buffer.concat([e.journal,e.proof])).digest();try{if(!b$2.verify(new Uint8Array(r),m,new Uint8Array(a)))return {verified:!1,message:"PQC Signature Verification Failed: ML-DSA-65 co-sign is forged or corrupted."}}catch(l){return {verified:false,message:`PQC Verification Error: ${l.message}`}}}let t;try{t=g(e.journal);}catch(r){return {verified:false,message:`Failed to decode ZkJournalV2: ${r.message}`}}if(p){let r=t.guestImageId.toString("hex");if(r!==p)return {verified:false,message:`Guest ImageID Mismatch: Injected guest environment tampered (${r.slice(0,8)} != ${p.slice(0,8)}).`}}let g$1=D(i);if(!t.logicDigest.equals(g$1))return {verified:false,message:`Logic Digest Mismatch: Remote origin executed unexpected logic (${t.logicDigest.toString("hex").slice(0,8)} != ${g$1.toString("hex").slice(0,8)})`};if(o&&o.length>0)try{let r=d(Buffer.from(o)),a=f(e.proof);if(!b$3(r,a))return {verified:!1,message:"Groth16 mathematical pairing verification failed: invalid proof."}}catch(r){return {verified:false,message:`Groth16 verification failed to execute: ${r.message}`}}if(f$1!==void 0){let r=O(i),a=r!==null?r:f$1,m=typeof a=="string"?a:a===void 0?"undefined":JSON.stringify(a),l=v.createHash("sha256").update(m).digest();if(!t.outputDigest.equals(l))return {verified:false,message:`Output Digest Mismatch (Replay/Tamper attempt): Journal (${t.outputDigest.toString("hex").slice(0,8)}) != Calculated (${l.toString("hex").slice(0,8)})`}}let u=e.proofType===3;return {verified:true,message:u?"Groth16 + ML-DSA-65 Post-Quantum Hybrid Receipt Certified.":o&&o.length>0?"Groth16 Zero-Knowledge Proof Mathematically Certified.":"Groth16 Receipt Structure and Journal Integrity Certified.",proofType:u?"groth16_pqc_hybrid":"groth16"}}return {verified:false,message:`Unsupported receipt version: ${e.version}`}}a(T,"verifyZkReceipt");async function C(s){try{if(s.action==="warmup")return {verified:!0,message:"warm"};if(s.action==="verify_receipt")return await T(s);throw new Error("Unknown action in ZkVerifier Worker.")}catch(i){return {verified:false,message:`Verification Error: ${i.message}`}}}a(C,"workerHandler");export{C as default};//# sourceMappingURL=zk-verifier.js.map
 //# sourceMappingURL=zk-verifier.js.map

package/dist/zk-DzYNWBgo.d.ts

@@ -0,0 +1,104 @@
+declare enum ProofType {
+    HMAC_LEGACY = 0,
+    GROTH16 = 2,
+    GROTH16_PQC_HYBRID = 3
+}
+declare const RECEIPT_VERSION_V1 = 1;
+declare const RECEIPT_VERSION_V2 = 2;
+declare const ZK_JOURNAL_V2_SIZE = 144;
+interface ZkJournalV2 {
+    /** Image ID (SHA-256) of the guest interpreter */
+    guestImageId: Buffer;
+    /** SHA-256 digest of injected logic */
+    logicDigest: Buffer;
+    /** SHA-256 digest of dataset records */
+    datasetDigest: Buffer;
+    /** SHA-256 digest of sanitized output */
+    outputDigest: Buffer;
+    /** Micro-instruction fuel consumed */
+    fuelConsumed: bigint;
+    /** Timestamp in milliseconds since unix epoch */
+    executionTimestamp: bigint;
+}
+type ZkPolicy = "none" | "optimistic" | "required";
+interface ZkReceipt {
+    /** Cryptographic proof generated by a zero-knowledge VM (e.g., RISC Zero, SP1) or Groth16 */
+    proof: Buffer;
+    /** The public inputs/outputs of the execution (the "Journal" in RISC Zero terminology) */
+    journal: Buffer;
+    /** The expected image ID / verification key of the WASM binary that was executed */
+    imageId: Buffer;
+    /** Type of cryptographic proof (HMAC legacy or Groth16) */
+    proofType?: ProofType;
+    /** Binary receipt version (0x01 or 0x02) */
+    version?: number;
+}
+declare class ZkVerificationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Serializes a structured ZkJournalV2 into a strictly validated 144-byte binary layout.
+ */
+declare function encodeJournalV2(fields: ZkJournalV2): Buffer;
+/**
+ * Deserializes and validates a 144-byte binary buffer into a typed ZkJournalV2.
+ */
+declare function decodeJournalV2(buf: Buffer): ZkJournalV2;
+interface DecodedReceipt {
+    version: number;
+    proofType: ProofType;
+    journal: Buffer;
+    proof: Buffer;
+    raw: Buffer;
+    pqcSignature?: Buffer;
+    pqcPublicKey?: Buffer;
+}
+declare const receiptCodec: {
+    /**
+     * Encodes a version 2 Binary Receipt with trailing SHA-256 checksum.
+     * Layout: [0x02][proofType: 1B][journalLen: 4B UInt32BE][journal][proof][checksum: 32B]
+     */
+    encodeV2(proofType: ProofType, journal: Buffer, proof: Buffer): Buffer;
+    /**
+     * Encodes a version 2.1 Hybrid Binary Receipt (Groth16 + ML-DSA-65 co-sign).
+     * Layout:
+     * [0x02][0x03 ProofType.GROTH16_PQC_HYBRID][journalLen: 4B UInt32BE][journal: 144B]
+     * [proofLen: 2B UInt16BE][groth16 proof: ~260B]
+     * [sigLen: 2B UInt16BE][signature: 3309B]
+     * [publicKey: 1952B]
+     * [checksum: 32B SHA-256]
+     */
+    encodeHybridV2(journal: Buffer, proof: Buffer, pqcSignature: Buffer, pqcPublicKey: Buffer): Buffer;
+    /**
+     * Decodes any LIOP Binary Receipt (v1 HMAC or v2 ZK).
+     */
+    decode(raw: Buffer): DecodedReceipt;
+};
+/**
+ * ZK-Proofs Verifier for Logic-Injection-on-Origin Protocol (LIOP)
+ *
+ * Validates that an executed Logic (WASM) actually produced the reported output,
+ * verifying the Zero-Knowledge receipt generated by the remote host's Trusted Execution
+ * Environment (TEE) or zkVM (Zero-Knowledge Virtual Machine).
+ */
+declare const ZkVerifier: {
+    /**
+     * Validates a ZK receipt using structural Binary Receipt verification.
+     * Parses the HMAC-SHA256 commitment format (v1) and verifies journal integrity.
+     *
+     * @param receipt - Complete ZkReceipt to verify
+     * @param expectedImageId - Hash or ImageID of the WASM file dispatched to the host
+     * @throws ZkVerificationError if the proof is invalid or image IDs mismatch
+     * @returns true if the proof mathematically verifies the execution
+     */
+    verify(receipt: ZkReceipt, expectedImageId: Buffer, sessionSecret?: Buffer): boolean;
+    /**
+     * Derives a predictable ImageID (usually a Hash) from a raw WASM binary.
+     *
+     * @param wasmBytes - The raw bytes of the WASM logic file
+     * @returns The SHA-256 ImageID of the logic
+     */
+    deriveImageId(wasmBytes: Buffer): Buffer;
+};
+
+export { type DecodedReceipt as D, ProofType as P, RECEIPT_VERSION_V1 as R, type ZkPolicy as Z, RECEIPT_VERSION_V2 as a, ZK_JOURNAL_V2_SIZE as b, type ZkJournalV2 as c, type ZkReceipt as d, ZkVerificationError as e, ZkVerifier as f, decodeJournalV2 as g, encodeJournalV2 as h, receiptCodec as r };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nekzus/liop",
-  "version": "2.6.1",
+  "version": "2.7.1",
   "description": "Official SDK for Logic-Injection-on-Origin Protocol (LIOP). Deploy Logic-on-Origin with WebAssembly at gRPC speed and bidirectional MCP compatibility.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -32,6 +32,7 @@
   "sideEffects": false,
   "files": [
     "dist",
+    "!dist/**/*.js.map",
     "README.md",
     "LICENSE",
     "NOTICE"
@@ -92,7 +93,6 @@
     "@types/node": "26.4.0",
     "@types/oidc-provider": "9.12.1",
     "@vitest/coverage-v8": "4.1.11",
-    "gpt-tokenizer": "4.0.0",
     "tsup": "8.5.1",
     "tsx": "4.23.13",
     "typescript": "6.0.3",
@@ -121,10 +121,12 @@
     "@noble/post-quantum": "0.7.1",
     "acorn": "8.18.0",
     "acorn-walk": "8.3.5",
+    "gpt-tokenizer": "4.0.0",
     "hono": "4.13.8",
     "it-pipe": "3.0.1",
     "jose": "6.2.12",
     "libp2p": "3.3.11",
+    "micro-zk-proofs": "0.3.1",
     "mlkem": "2.7.0",
     "multiformats": "14.0.5",
     "oidc-provider": "9.12.2",
@@ -225,6 +227,9 @@
     "audit:prod:run": "tsx tests/infra/production-audit/cli/audit-run.ts",
     "audit:prod:runner": "docker compose -f tests/infra/production-audit/docker-compose.production-audit.yml run --rm audit-runner",
     "audit:prod:clean": "tsx tests/infra/production-audit/cli/audit-clean.ts",
+    "audit:local:start": "tsx tests/infra/production-audit/cli/audit-start-local.ts",
+    "audit:local:run": "tsx tests/infra/production-audit/cli/audit-run.ts --local",
+    "audit:local:runner": "docker compose -f tests/infra/production-audit/docker-compose.production-audit.yml -f tests/infra/production-audit/docker-compose.local.yml run --rm audit-runner",
     "telemetry:stream": "tsx scripts/telemetry-stream.ts"
   }
 }