@svrnsec/pulse 0.3.0 → 0.4.0

package/dist/pulse.esm.js

@@ -1,3 +1,4 @@
+import { createRequire } from 'module';
 import { randomFillSync } from 'node:crypto';
 
 /**
@@ -778,9 +779,9 @@ async function collectEntropy(opts = {}) {
     const hotQE  = detectQuantizationEntropy(hotTimings);
 
     phases = {
-      cold: { n: coldN, timings: coldTimings, qe: coldQE, mean: _mean$1(coldTimings) },
-      load: { n: loadN, timings: loadTimings, qe: detectQuantizationEntropy(loadTimings), mean: _mean$1(loadTimings) },
-      hot:  { n: hotN,  timings: hotTimings,  qe: hotQE,  mean: _mean$1(hotTimings)  },
+      cold: { n: coldN, timings: coldTimings, qe: coldQE, mean: _mean$4(coldTimings) },
+      load: { n: loadN, timings: loadTimings, qe: detectQuantizationEntropy(loadTimings), mean: _mean$4(loadTimings) },
+      hot:  { n: hotN,  timings: hotTimings,  qe: hotQE,  mean: _mean$4(hotTimings)  },
       // The key signal: entropy growth under load.
       // Real silicon: hotQE / coldQE typically 1.05 – 1.40
       // VM:           hotQE / coldQE typically 0.95 – 1.05 (flat)
@@ -834,7 +835,7 @@ async function collectEntropy(opts = {}) {
   };
 }
 
-function _mean$1(arr) {
+function _mean$4(arr) {
   return arr.length ? arr.reduce((s, v) => s + v, 0) / arr.length : 0;
 }
 
@@ -974,11 +975,11 @@ class BioCollector {
 
     const mouseStats = {
       sampleCount:      iei.length,
-      ieiMean:          _mean(iei),
-      ieiCV:            _cv(iei),
+      ieiMean:          _mean$3(iei),
+      ieiCV:            _cv$1(iei),
       velocityP50:      _percentile$1(velocities, 50),
       velocityP95:      _percentile$1(velocities, 95),
-      angularJerkMean:  _mean(angJerk),
+      angularJerkMean:  _mean$3(angJerk),
       pressureVariance: _variance(pressure),
     };
 
@@ -991,10 +992,10 @@ class BioCollector {
 
     const keyStats = {
       sampleCount:   dwellTimes.length,
-      dwellMean:     _mean(dwellTimes),
-      dwellCV:       _cv(dwellTimes),
-      ikiMean:       _mean(iki),
-      ikiCV:         _cv(iki),
+      dwellMean:     _mean$3(dwellTimes),
+      dwellCV:       _cv$1(dwellTimes),
+      ikiMean:       _mean$3(iki),
+      ikiCV:         _cv$1(iki),
     };
 
     // ── Interference Coefficient ──────────────────────────────────────────
@@ -1030,20 +1031,20 @@ class BioCollector {
 // Statistical helpers (private)
 // ---------------------------------------------------------------------------
 
-function _mean(arr) {
+function _mean$3(arr) {
   if (!arr.length) return 0;
   return arr.reduce((a, b) => a + b, 0) / arr.length;
 }
 
 function _variance(arr) {
   if (arr.length < 2) return 0;
-  const m = _mean(arr);
+  const m = _mean$3(arr);
   return arr.reduce((s, v) => s + (v - m) ** 2, 0) / (arr.length - 1);
 }
 
-function _cv(arr) {
+function _cv$1(arr) {
   if (!arr.length) return 0;
-  const m = _mean(arr);
+  const m = _mean$3(arr);
   if (m === 0) return 0;
   return Math.sqrt(_variance(arr)) / Math.abs(m);
 }
@@ -1100,7 +1101,7 @@ function _computeInterference(mouseEvents, keyEvents, timings) {
   if (!allInputTimes.length) return 0;
 
   const WINDOW_MS = 16;
-  const meanTiming = _mean(timings);
+  const meanTiming = _mean$3(timings);
 
   // We need absolute timestamps for the probe samples.
   // We don't have them directly – use relative index spacing as a proxy.
@@ -1125,8 +1126,8 @@ function _computeInterference(mouseEvents, keyEvents, timings) {
 function _pearson(X, Y) {
   const n   = X.length;
   if (n < 2) return 0;
-  const mx  = _mean(X);
-  const my  = _mean(Y);
+  const mx  = _mean$3(X);
+  const my  = _mean$3(Y);
   let num = 0, da = 0, db = 0;
   for (let i = 0; i < n; i++) {
     const a = X[i] - mx;
@@ -1743,9 +1744,9 @@ function blake3HexStr(str) {
  * @param {string}  p.nonce    – server-issued challenge nonce (hex)
  * @returns {ProofPayload}
  */
-function buildProof({ entropy, jitter, bio, canvas, audio, nonce }) {
+function buildProof({ entropy, jitter, bio, canvas, audio, enf, gpu, dram, llm, nonce }) {
   if (!nonce || typeof nonce !== 'string') {
-    throw new Error('@sovereign/pulse: nonce is required for anti-replay protection');
+    throw new Error('@svrnsec/pulse: nonce is required for anti-replay protection');
   }
 
   // Hash the raw timing arrays IN-BROWSER so we can prove their integrity
@@ -1827,12 +1828,68 @@ function buildProof({ entropy, jitter, bio, canvas, audio, nonce }) {
         jitterMeanMs:         _round$1(audio.jitterMeanMs,        4),
         jitterP95Ms:          _round$1(audio.jitterP95Ms,         4),
       },
+
+      // ── Electrical Network Frequency ─────────────────────────────────────
+      enf: enf ? {
+        available:       enf.enfAvailable,
+        ripplePresent:   enf.ripplePresent,
+        gridFrequency:   enf.gridFrequency,
+        gridRegion:      enf.gridRegion,
+        ripplePower:     _round$1(enf.ripplePower,    4),
+        enfDeviation:    _round$1(enf.enfDeviation,   3),
+        snr50hz:         _round$1(enf.snr50hz,        2),
+        snr60hz:         _round$1(enf.snr60hz,        2),
+        sampleRateHz:    _round$1(enf.sampleRateHz,   1),
+        verdict:         enf.verdict,
+        isVmIndicator:   enf.isVmIndicator,
+        capturedAt:      enf.temporalAnchor?.capturedAt ?? null,
+      } : null,
+
+      // ── WebGPU thermal variance ───────────────────────────────────────────
+      gpu: gpu ? {
+        available:       gpu.gpuPresent,
+        isSoftware:      gpu.isSoftware,
+        vendorString:    gpu.vendorString,
+        dispatchCV:      _round$1(gpu.dispatchCV,     4),
+        thermalGrowth:   _round$1(gpu.thermalGrowth,  4),
+        verdict:         gpu.verdict,
+      } : null,
+
+      // ── DRAM refresh cycle ────────────────────────────────────────────────
+      dram: dram ? {
+        refreshPresent:  dram.refreshPresent,
+        refreshPeriodMs: _round$1(dram.refreshPeriodMs, 2),
+        peakPower:       _round$1(dram.peakPower,        4),
+        verdict:         dram.verdict,
+      } : null,
+
+      // ── LLM / AI agent behavioral fingerprint ────────────────────────────
+      llm: llm ? {
+        aiConf:             _round$1(llm.aiConf,            3),
+        thinkTimePattern:   llm.thinkTimePattern,
+        correctionRate:     _round$1(llm.correctionRate,    3),
+        rhythmicity:        _round$1(llm.rhythmicity,       3),
+        pauseDistribution:  llm.pauseDistribution,
+        verdict:            llm.verdict,
+        matchedModel:       llm.matchedModel ?? null,
+      } : null,
     },
 
-    // Top-level classification summary
+    // Top-level classification summary — all signal layers combined
     classification: {
-      jitterScore:  _round$1(jitter.score, 4),
-      flags:        jitter.flags ?? [],
+      jitterScore:    _round$1(jitter.score, 4),
+      flags:          jitter.flags ?? [],
+      enfVerdict:     enf?.verdict  ?? 'unavailable',
+      gpuVerdict:     gpu?.verdict  ?? 'unavailable',
+      dramVerdict:    dram?.verdict ?? 'unavailable',
+      llmVerdict:     llm?.verdict  ?? 'unavailable',
+      // Combined VM confidence: any hard signal raises this
+      vmIndicators: [
+        enf?.isVmIndicator  ? 'enf_no_grid'     : null,
+        gpu?.isSoftware     ? 'gpu_software'     : null,
+        dram?.verdict === 'virtual' ? 'dram_no_refresh' : null,
+        llm?.aiConf > 0.7   ? 'llm_agent'        : null,
+      ].filter(Boolean),
     },
   };
 
@@ -1916,7 +1973,7 @@ function _round$1(v, decimals) {
 // ---------------------------------------------------------------------------
 // Known software-renderer substrings (VM / headless environment indicators)
 // ---------------------------------------------------------------------------
-const SOFTWARE_RENDERER_PATTERNS = [
+const SOFTWARE_RENDERER_PATTERNS$1 = [
   'llvmpipe', 'swiftshader', 'softpipe', 'mesa offscreen',
   'microsoft basic render', 'vmware svga', 'virtualbox',
   'parallels', 'angle (', 'google swiftshader',
@@ -1970,7 +2027,7 @@ async function collectCanvasFingerprint() {
 
       // Software-renderer detection
       const rendererLc = (result.webglRenderer ?? '').toLowerCase();
-      result.isSoftwareRenderer = SOFTWARE_RENDERER_PATTERNS.some(p =>
+      result.isSoftwareRenderer = SOFTWARE_RENDERER_PATTERNS$1.some(p =>
         rendererLc.includes(p)
       );
 
@@ -2140,217 +2197,1798 @@ function _compileShader(gl, type, source) {
 }
 
 /**
- * @sovereign/pulse — AudioContext Oscillator Jitter
+ * @sovereign/pulse — AudioContext Oscillator Jitter
+ *
+ * Measures the scheduling jitter of the browser's audio pipeline.
+ * Real audio hardware callbacks are driven by a hardware interrupt (IRQ)
+ * from the sound card; the timing reflects the actual interrupt latency
+ * of the physical device.  VM audio drivers (if present at all) are
+ * emulated and show either unrealistically low jitter or burst-mode
+ * scheduling artefacts that are statistically distinguishable.
+ */
+
+/**
+ * @param {object} [opts]
+ * @param {number} [opts.durationMs=2000]  - how long to collect audio callbacks
+ * @param {number} [opts.bufferSize=256]   - ScriptProcessorNode buffer size
+ * @returns {Promise<AudioJitter>}
+ */
+async function collectAudioJitter(opts = {}) {
+  const { durationMs = 2000, bufferSize = 256 } = opts;
+
+  const base = {
+    available:         false,
+    workletAvailable:  false,
+    callbackJitterCV:  0,
+    noiseFloorMean:    0,
+    sampleRate:        0,
+    callbackCount:     0,
+    jitterTimings:     [],
+  };
+
+  if (typeof AudioContext === 'undefined' && typeof webkitAudioContext === 'undefined') {
+    return base; // Node.js / server environment
+  }
+
+  let ctx;
+  try {
+    ctx = new (window.AudioContext || window.webkitAudioContext)();
+  } catch (_) {
+    return base;
+  }
+
+  // Some browsers require a user gesture before AudioContext can run.
+  if (ctx.state === 'suspended') {
+    try {
+      await ctx.resume();
+    } catch (_) {
+      await ctx.close().catch(() => {});
+      return base;
+    }
+  }
+
+  const sampleRate       = ctx.sampleRate;
+  const expectedInterval = (bufferSize / sampleRate) * 1000; // ms per callback
+
+  const jitterTimings = []; // absolute AudioContext.currentTime at each callback
+  const callbackDeltas = [];
+
+  await new Promise((resolve) => {
+    // ── AudioWorklet (preferred — runs on dedicated real-time thread) ──────
+    const useWorklet = typeof AudioWorkletNode !== 'undefined';
+    base.workletAvailable = useWorklet;
+
+    if (useWorklet) {
+      // Inline worklet: send currentTime back via MessagePort every buffer
+      const workletCode = `
+        class PulseProbe extends AudioWorkletProcessor {
+          process(inputs, outputs) {
+            this.port.postMessage({ t: currentTime });
+            // Pass-through silence
+            for (const out of outputs)
+              for (const ch of out) ch.fill(0);
+            return true;
+          }
+        }
+        registerProcessor('pulse-probe', PulseProbe);
+      `;
+      const blob    = new Blob([workletCode], { type: 'application/javascript' });
+      const blobUrl = URL.createObjectURL(blob);
+
+      ctx.audioWorklet.addModule(blobUrl).then(() => {
+        const node = new AudioWorkletNode(ctx, 'pulse-probe');
+        node.port.onmessage = (e) => {
+          jitterTimings.push(e.data.t * 1000); // convert to ms
+        };
+        node.connect(ctx.destination);
+
+        setTimeout(async () => {
+          node.disconnect();
+          URL.revokeObjectURL(blobUrl);
+          resolve(node);
+        }, durationMs);
+      }).catch(() => {
+        URL.revokeObjectURL(blobUrl);
+        _fallbackScriptProcessor(ctx, bufferSize, durationMs, jitterTimings, resolve);
+      });
+
+    } else {
+      _fallbackScriptProcessor(ctx, bufferSize, durationMs, jitterTimings, resolve);
+    }
+  });
+
+  // ── Compute deltas between successive callback times ────────────────────
+  for (let i = 1; i < jitterTimings.length; i++) {
+    callbackDeltas.push(jitterTimings[i] - jitterTimings[i - 1]);
+  }
+
+  // ── Noise floor via AnalyserNode ─────────────────────────────────────────
+  // Feed a silent oscillator through an analyser; the FFT magnitude at silence
+  // reveals the hardware's thermal noise floor (varies per ADC/DAC chipset).
+  const noiseFloor = await _measureNoiseFloor(ctx);
+
+  await ctx.close().catch(() => {});
+
+  // ── Statistics ────────────────────────────────────────────────────────────
+  const mean = callbackDeltas.length
+    ? callbackDeltas.reduce((s, v) => s + v, 0) / callbackDeltas.length
+    : 0;
+  const variance = callbackDeltas.length > 1
+    ? callbackDeltas.reduce((s, v) => s + (v - mean) ** 2, 0) / (callbackDeltas.length - 1)
+    : 0;
+  const jitterCV = mean > 0 ? Math.sqrt(variance) / mean : 0;
+
+  return {
+    available:         true,
+    workletAvailable:  base.workletAvailable,
+    callbackJitterCV:  jitterCV,
+    noiseFloorMean:    noiseFloor.mean,
+    noiseFloorStd:     noiseFloor.std,
+    sampleRate,
+    callbackCount:     jitterTimings.length,
+    expectedIntervalMs: expectedInterval,
+    // Only include summary stats, not raw timings (privacy / size)
+    jitterMeanMs:      mean,
+    jitterP95Ms:       _percentile(callbackDeltas, 95),
+  };
+}
+
+/**
+ * @typedef {object} AudioJitter
+ * @property {boolean} available
+ * @property {boolean} workletAvailable
+ * @property {number}  callbackJitterCV
+ * @property {number}  noiseFloorMean
+ * @property {number}  sampleRate
+ * @property {number}  callbackCount
+ */
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+function _fallbackScriptProcessor(ctx, bufferSize, durationMs, jitterTimings, resolve) {
+  // ScriptProcessorNode is deprecated but universally supported.
+  const proc = ctx.createScriptProcessor(bufferSize, 1, 1);
+  proc.onaudioprocess = () => {
+    jitterTimings.push(ctx.currentTime * 1000);
+  };
+  // Connect to keep the graph alive
+  const osc = ctx.createOscillator();
+  osc.frequency.value = 1; // sub-audible
+  osc.connect(proc);
+  proc.connect(ctx.destination);
+  osc.start();
+
+  setTimeout(() => {
+    osc.stop();
+    osc.disconnect();
+    proc.disconnect();
+    resolve(proc);
+  }, durationMs);
+}
+
+async function _measureNoiseFloor(ctx) {
+  try {
+    const analyser = ctx.createAnalyser();
+    analyser.fftSize = 256;
+    analyser.connect(ctx.destination);
+
+    // Silent source
+    const buf  = ctx.createBuffer(1, ctx.sampleRate * 0.1, ctx.sampleRate);
+    const src  = ctx.createBufferSource();
+    src.buffer = buf;
+    src.connect(analyser);
+    src.start();
+
+    await new Promise(r => setTimeout(r, 150));
+
+    const data = new Float32Array(analyser.frequencyBinCount);
+    analyser.getFloatFrequencyData(data);
+    analyser.disconnect();
+
+    // Limit to 32 bins to keep the payload small
+    const trimmed = Array.from(data.slice(0, 32)).map(v =>
+      isFinite(v) ? Math.pow(10, v / 20) : 0 // dB → linear
+    );
+    const mean = trimmed.reduce((s, v) => s + v, 0) / trimmed.length;
+    const std  = Math.sqrt(
+      trimmed.reduce((s, v) => s + (v - mean) ** 2, 0) / trimmed.length
+    );
+    return { mean, std };
+  } catch (_) {
+    return { mean: 0, std: 0 };
+  }
+}
+
+function _percentile(arr, p) {
+  if (!arr.length) return 0;
+  const sorted = [...arr].sort((a, b) => a - b);
+  const idx    = (p / 100) * (sorted.length - 1);
+  const lo     = Math.floor(idx);
+  const hi     = Math.ceil(idx);
+  return sorted[lo] + (sorted[hi] - sorted[lo]) * (idx - lo);
+}
+
+/**
+ * @sovereign/pulse — WebGPU Thermal Variance Probe
+ *
+ * Runs a compute shader on the GPU and measures dispatch timing variance.
+ *
+ * Why this works
+ * ──────────────
+ * Real consumer GPUs (GTX 1650, RX 6600, M2 GPU) have thermal noise in shader
+ * execution timing that increases under sustained load — the same thermodynamic
+ * principle as the CPU probe but in silicon designed for parallel throughput.
+ *
+ * Cloud VMs with software GPU emulation (SwiftShader, llvmpipe, Mesa's softpipe)
+ * execute shaders on the CPU and produce near-deterministic timing — flat CV,
+ * no thermal growth across phases, no dispatch jitter.
+ *
+ * VMs with GPU passthrough (rare in practice, requires dedicated hardware) pass
+ * this check — which is correct, they have real GPU silicon.
+ *
+ * Signals
+ * ───────
+ *   gpuPresent      false = WebGPU absent = software renderer = high VM probability
+ *   isSoftware      true  = SwiftShader/llvmpipe detected by adapter info
+ *   dispatchCV      coefficient of variation across dispatch timings
+ *   thermalGrowth   (hotDispatchMean - coldDispatchMean) / coldDispatchMean
+ *   vendorString    GPU vendor from adapter info (Intel, NVIDIA, AMD, Apple, etc.)
+ */
+
+/* ─── WebGPU availability ────────────────────────────────────────────────── */
+
+function isWebGPUAvailable() {
+  return typeof navigator !== 'undefined' && 'gpu' in navigator;
+}
+
+/* ─── Software renderer detection ───────────────────────────────────────── */
+
+const SOFTWARE_RENDERER_PATTERNS = [
+  /swiftshader/i,
+  /llvmpipe/i,
+  /softpipe/i,
+  /microsoft basic render/i,
+  /angle \(.*software/i,
+  /cpu/i,
+];
+
+function detectSoftwareRenderer(adapterInfo) {
+  const desc = [
+    adapterInfo?.vendor   ?? '',
+    adapterInfo?.device   ?? '',
+    adapterInfo?.description ?? '',
+    adapterInfo?.architecture ?? '',
+  ].join(' ');
+
+  return SOFTWARE_RENDERER_PATTERNS.some(p => p.test(desc));
+}
+
+/* ─── Compute shader ─────────────────────────────────────────────────────── */
+
+// A compute workload that is trivially parallelisable but forces the GPU to
+// actually execute — matrix-multiply on 64 × 64 tiles across 256 workgroups.
+// Light enough that it doesn't block UI; heavy enough to generate thermal signal.
+const SHADER_SRC = /* wgsl */ `
+  struct Matrix {
+    values: array<f32, 4096>,  // 64x64
+  };
+
+  @group(0) @binding(0) var<storage, read>       matA : Matrix;
+  @group(0) @binding(1) var<storage, read>       matB : Matrix;
+  @group(0) @binding(2) var<storage, read_write> matC : Matrix;
+
+  @compute @workgroup_size(8, 8)
+  fn main(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let row = gid.x;
+    let col = gid.y;
+    if (row >= 64u || col >= 64u) { return; }
+
+    var acc: f32 = 0.0;
+    for (var k = 0u; k < 64u; k++) {
+      acc += matA.values[row * 64u + k] * matB.values[k * 64u + col];
+    }
+    matC.values[row * 64u + col] = acc;
+  }
+`;
+
+/* ─── collectGpuEntropy ─────────────────────────────────────────────────── */
+
+/**
+ * @param {object}  [opts]
+ * @param {number}  [opts.iterations=60]      – dispatch rounds per phase
+ * @param {boolean} [opts.phased=true]         – cold / load / hot phases
+ * @param {number}  [opts.timeoutMs=8000]      – hard abort if GPU stalls
+ * @returns {Promise<GpuEntropyResult>}
+ */
+async function collectGpuEntropy(opts = {}) {
+  const { iterations = 60, phased = true, timeoutMs = 8000 } = opts;
+
+  if (!isWebGPUAvailable()) {
+    return _noGpu('WebGPU not available in this environment');
+  }
+
+  let adapter, device;
+  try {
+    adapter = await Promise.race([
+      navigator.gpu.requestAdapter({ powerPreference: 'high-performance' }),
+      _timeout(timeoutMs, 'requestAdapter timed out'),
+    ]);
+    if (!adapter) return _noGpu('No WebGPU adapter found');
+
+    device = await Promise.race([
+      adapter.requestDevice(),
+      _timeout(timeoutMs, 'requestDevice timed out'),
+    ]);
+  } catch (err) {
+    return _noGpu(`WebGPU init failed: ${err.message}`);
+  }
+
+  const adapterInfo = adapter.info ?? {};
+  const isSoftware  = detectSoftwareRenderer(adapterInfo);
+
+  // Compile the shader module once
+  const shaderModule = device.createShaderModule({ code: SHADER_SRC });
+
+  // Create persistent GPU buffers (64×64 float32 = 16 KB each)
+  const bufSize = 4096 * 4; // 4096 floats × 4 bytes
+  const bufA = _createBuffer(device, bufSize, GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
+  const bufB = _createBuffer(device, bufSize, GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_DST);
+  const bufC = _createBuffer(device, bufSize, GPUBufferUsage.STORAGE | GPUBufferUsage.COPY_SRC);
+
+  // Seed with random data
+  const matData = new Float32Array(4096).map(() => Math.random());
+  device.queue.writeBuffer(bufA, 0, matData);
+  device.queue.writeBuffer(bufB, 0, matData);
+
+  const pipeline = device.createComputePipeline({
+    layout: 'auto',
+    compute: { module: shaderModule, entryPoint: 'main' },
+  });
+
+  const bindGroup = device.createBindGroup({
+    layout: pipeline.getBindGroupLayout(0),
+    entries: [
+      { binding: 0, resource: { buffer: bufA } },
+      { binding: 1, resource: { buffer: bufB } },
+      { binding: 2, resource: { buffer: bufC } },
+    ],
+  });
+
+  // ── Probe ──────────────────────────────────────────────────────────────
+  async function runPhase(n) {
+    const timings = [];
+    for (let i = 0; i < n; i++) {
+      const t0 = performance.now();
+      const encoder = device.createCommandEncoder();
+      const pass    = encoder.beginComputePass();
+      pass.setPipeline(pipeline);
+      pass.setBindGroup(0, bindGroup);
+      pass.dispatchWorkgroups(8, 8); // 64 workgroups total
+      pass.end();
+      device.queue.submit([encoder.finish()]);
+      await device.queue.onSubmittedWorkDone();
+      const t1 = performance.now();
+      timings.push(t1 - t0);
+    }
+    return timings;
+  }
+
+  let coldTimings, loadTimings, hotTimings;
+
+  if (phased) {
+    coldTimings = await runPhase(Math.floor(iterations * 0.25));
+    loadTimings = await runPhase(Math.floor(iterations * 0.50));
+    hotTimings  = await runPhase(iterations - coldTimings.length - loadTimings.length);
+  } else {
+    coldTimings = await runPhase(iterations);
+    loadTimings = [];
+    hotTimings  = [];
+  }
+
+  // Cleanup
+  bufA.destroy(); bufB.destroy(); bufC.destroy();
+  device.destroy();
+
+  const allTimings = [...coldTimings, ...loadTimings, ...hotTimings];
+  const mean       = _mean$2(allTimings);
+  const cv         = mean > 0 ? _std$1(allTimings) / mean : 0;
+
+  const coldMean = _mean$2(coldTimings);
+  const hotMean  = _mean$2(hotTimings.length ? hotTimings : coldTimings);
+  const thermalGrowth = coldMean > 0 ? (hotMean - coldMean) / coldMean : 0;
+
+  return {
+    gpuPresent:    true,
+    isSoftware,
+    vendor:        adapterInfo.vendor      ?? 'unknown',
+    architecture:  adapterInfo.architecture ?? 'unknown',
+    timings:       allTimings,
+    dispatchCV:    cv,
+    thermalGrowth,
+    coldMean,
+    hotMean,
+    // Heuristic: real GPU → thermalGrowth > 0.02 and CV > 0.04
+    // Software renderer → thermalGrowth ≈ 0, CV < 0.02
+    verdict: isSoftware ? 'software_renderer'
+      : thermalGrowth > 0.02 && cv > 0.04 ? 'real_gpu'
+      : thermalGrowth < 0 && cv < 0.02   ? 'virtual_gpu'
+      : 'ambiguous',
+  };
+}
+
+/* ─── helpers ────────────────────────────────────────────────────────────── */
+
+function _noGpu(reason) {
+  return { gpuPresent: false, isSoftware: false, vendor: null,
+           architecture: null, timings: [], dispatchCV: 0,
+           thermalGrowth: 0, coldMean: 0, hotMean: 0,
+           verdict: 'no_gpu', reason };
+}
+
+function _createBuffer(device, size, usage) {
+  return device.createBuffer({ size, usage });
+}
+
+function _mean$2(arr) {
+  return arr.length ? arr.reduce((s, v) => s + v, 0) / arr.length : 0;
+}
+
+function _std$1(arr) {
+  const m = _mean$2(arr);
+  return Math.sqrt(arr.reduce((s, v) => s + (v - m) ** 2, 0) / arr.length);
+}
+
+function _timeout(ms, msg) {
+  return new Promise((_, reject) => setTimeout(() => reject(new Error(msg)), ms));
+}
+
+/**
+ * @typedef {object} GpuEntropyResult
+ * @property {boolean}  gpuPresent
+ * @property {boolean}  isSoftware
+ * @property {string|null} vendor
+ * @property {string|null} architecture
+ * @property {number[]}  timings
+ * @property {number}    dispatchCV
+ * @property {number}    thermalGrowth
+ * @property {string}    verdict   'real_gpu' | 'virtual_gpu' | 'software_renderer' | 'no_gpu' | 'ambiguous'
+ */
+
+/**
+ * @sovereign/pulse — DRAM Refresh Cycle Detector
+ *
+ * DDR4 DRAM refreshes every 7.8 ms (tREFI per JEDEC JESD79-4). During a
+ * refresh, the memory controller stalls all access requests for ~350 ns.
+ * In a tight sequential memory access loop this appears as a periodic
+ * slowdown — detectable as a ~128Hz peak in the autocorrelation of access
+ * timings.
+ *
+ * Virtual machines do not have physical DRAM. The hypervisor's memory
+ * subsystem does not reproduce the refresh cycle because:
+ *   1. The guest never touches real DRAM directly — there is always a
+ *      hypervisor-controlled indirection layer.
+ *   2. EPT/NPT (Extended/Nested Page Tables) absorb the timing.
+ *   3. The hypervisor's memory balloon driver further smooths access latency.
+ *
+ * What we detect
+ * ──────────────
+ *   refreshPeriodMs     estimated DRAM refresh period (should be ~7.8ms on real DDR4)
+ *   refreshPresent      true if the ~7.8ms periodicity is statistically significant
+ *   peakLag             autocorrelation lag with the highest power (units: sample index)
+ *   peakPower           autocorrelation power at peakLag (0–1)
+ *   verdict             'dram' | 'virtual' | 'ambiguous'
+ *
+ * Calibration
+ * ───────────
+ * We allocate a buffer large enough to exceed all CPU caches (typically
+ * L3 = 8–32 MB on consumer parts). Sequential reads then go to DRAM, not
+ * cache. The refresh stall is only visible when we're actually hitting DRAM —
+ * a cache-resident access loop shows no refresh signal.
+ *
+ * Buffer size: 64 MB — comfortably above L3 on all tested platforms.
+ * Sampling interval: ~1 ms per iteration (chosen to resolve 7.8ms at ≥8 pts).
+ * Total probe time: ~400 ms — well within the fingerprint collection window.
+ */
+
+const DRAM_REFRESH_MS    = 7.8;   // JEDEC DDR4 nominal
+const DRAM_REFRESH_SLACK = 1.5;   // ±1.5 ms acceptable range for real hardware
+const BUFFER_MB          = 64;    // must exceed L3 cache
+const PROBE_ITERATIONS$1   = 400;   // ~400 ms total
+
+/* ─── collectDramTimings ─────────────────────────────────────────────────── */
+
+/**
+ * @param {object} [opts]
+ * @param {number} [opts.iterations=400]
+ * @param {number} [opts.bufferMb=64]
+ * @returns {{ timings: number[], refreshPeriodMs: number|null,
+ *             refreshPresent: boolean, peakLag: number, peakPower: number,
+ *             verdict: string }}
+ */
+function collectDramTimings(opts = {}) {
+  const {
+    iterations = PROBE_ITERATIONS$1,
+    bufferMb   = BUFFER_MB,
+  } = opts;
+
+  // ── Allocate cache-busting buffer ────────────────────────────────────────
+  const nElements  = (bufferMb * 1024 * 1024) / 8;  // 64-bit doubles
+  let   buf;
+
+  try {
+    buf = new Float64Array(nElements);
+    // Touch every cache line to ensure OS actually maps the pages
+    const stride = 64 / 8; // 64-byte cache lines, 8 bytes per element
+    for (let i = 0; i < nElements; i += stride) buf[i] = i;
+  } catch {
+    // Allocation failure (memory constrained) — cannot run this probe
+    return _noSignal('buffer allocation failed');
+  }
+
+  // ── Sequential access loop ───────────────────────────────────────────────
+  // Each iteration does a full sequential pass over `passElements` worth of
+  // the buffer. Pass size is tuned so each iteration takes ~1 ms wall-clock,
+  // giving us enough resolution to see the 7.8 ms refresh cycle.
+  //
+  // We start with a small pass and auto-calibrate to hit the 1 ms target.
+  const passElements = _calibratePassSize(buf);
+
+  const timings = new Float64Array(iterations);
+  let   checksum = 0;
+
+  for (let iter = 0; iter < iterations; iter++) {
+    const t0 = performance.now();
+    for (let i = 0; i < passElements; i++) checksum += buf[i];
+    timings[iter] = performance.now() - t0;
+  }
+
+  // Prevent dead-code elimination
+  if (checksum === 0) buf[0] = 1;
+
+  // ── Autocorrelation over timings ─────────────────────────────────────────
+  // The refresh stall appears as elevated autocorrelation at lag ≈ 7.8 / Δt
+  // where Δt is the mean iteration time in ms.
+  const meanIterMs = _mean$1(timings);
+  if (meanIterMs <= 0) return _noSignal('zero mean iteration time');
+
+  const targetLag  = Math.round(DRAM_REFRESH_MS / meanIterMs);
+  const maxLag     = Math.min(Math.round(50 / meanIterMs), iterations >> 1);
+
+  const ac = _autocorr(Array.from(timings), maxLag);
+
+  // Find the peak in the range [targetLag ± slack]
+  const slackLags = Math.round(DRAM_REFRESH_SLACK / meanIterMs);
+  const lagLo     = Math.max(1, targetLag - slackLags);
+  const lagHi     = Math.min(maxLag, targetLag + slackLags);
+
+  let peakPower = -Infinity;
+  let peakLag   = targetLag;
+  for (let l = lagLo; l <= lagHi; l++) {
+    if (ac[l - 1] > peakPower) {
+      peakPower = ac[l - 1];
+      peakLag   = l;
+    }
+  }
+
+  // Baseline: average autocorrelation outside the refresh window
+  const baseline = _mean$1(
+    Array.from({ length: maxLag }, (_, i) => ac[i])
+      .filter((_, i) => i + 1 < lagLo || i + 1 > lagHi)
+  );
+
+  const snr              = baseline > 0 ? peakPower / baseline : 0;
+  const refreshPresent   = peakPower > 0.15 && snr > 1.8;
+  const refreshPeriodMs  = refreshPresent ? peakLag * meanIterMs : null;
+
+  const verdict =
+    refreshPresent && refreshPeriodMs !== null &&
+    Math.abs(refreshPeriodMs - DRAM_REFRESH_MS) < DRAM_REFRESH_SLACK
+      ? 'dram'
+      : peakPower < 0.05
+        ? 'virtual'
+        : 'ambiguous';
+
+  return {
+    timings:         Array.from(timings),
+    refreshPeriodMs,
+    refreshPresent,
+    peakLag,
+    peakPower:       +peakPower.toFixed(4),
+    snr:             +snr.toFixed(2),
+    meanIterMs:      +meanIterMs.toFixed(3),
+    verdict,
+  };
+}
+
+/* ─── helpers ────────────────────────────────────────────────────────────── */
+
+function _noSignal(reason) {
+  return {
+    timings: [], refreshPeriodMs: null, refreshPresent: false,
+    peakLag: 0, peakPower: 0, snr: 0, meanIterMs: 0,
+    verdict: 'ambiguous', reason,
+  };
+}
+
+/**
+ * Run a quick calibration pass to find how many elements to read per
+ * iteration so each iteration takes approximately 1 ms.
+ */
+function _calibratePassSize(buf) {
+  const target  = 1.0; // ms
+  let   n       = Math.min(100_000, buf.length);
+  let   elapsed = 0;
+  let   dummy   = 0;
+
+  // Warm up
+  for (let i = 0; i < n; i++) dummy += buf[i];
+
+  // Measure
+  const t0 = performance.now();
+  for (let i = 0; i < n; i++) dummy += buf[i];
+  elapsed = performance.now() - t0;
+  if (dummy === 0) buf[0] = 1; // prevent DCE
+
+  if (elapsed <= 0) return n;
+  return Math.min(buf.length, Math.round(n * (target / elapsed)));
+}
+
+function _mean$1(arr) {
+  if (!arr.length) return 0;
+  return arr.reduce((s, v) => s + v, 0) / arr.length;
+}
+
+function _autocorr(data, maxLag) {
+  const n    = data.length;
+  const mean = _mean$1(data);
+  let   v    = 0;
+  for (let i = 0; i < n; i++) v += (data[i] - mean) ** 2;
+  v /= n;
+
+  const result = new Float64Array(maxLag);
+  if (v < 1e-14) return result;
+
+  for (let lag = 1; lag <= maxLag; lag++) {
+    let cov = 0;
+    for (let i = 0; i < n - lag; i++) {
+      cov += (data[i] - mean) * (data[i + lag] - mean);
+    }
+    result[lag - 1] = cov / ((n - lag) * v);
+  }
+  return result;
+}
+
+/**
+ * @sovereign/pulse — SharedArrayBuffer Microsecond Timer
+ *
+ * Bypasses browser timer clamping (Brave 100µs cap, Firefox 20µs cap, Safari
+ * 1ms cap) using Atomics.wait() which is exempt from clamping because it maps
+ * directly to OS-level futex/semaphore primitives.
+ *
+ * Requirements
+ * ────────────
+ * The page must be served with Cross-Origin Isolation headers:
+ *   Cross-Origin-Opener-Policy: same-origin
+ *   Cross-Origin-Embedder-Policy: require-corp
+ *
+ * These are mandatory for security (Spectre mitigations) and are already
+ * required by WebGPU, WebAssembly threads, and SharedArrayBuffer in all
+ * modern browsers.
+ *
+ * What we measure
+ * ───────────────
+ *   resolution        the true timer resolution (pre-clamp) in microseconds
+ *   isClamped         true if performance.now() is artificially reduced
+ *   clampAmount       how much performance.now() was rounded (µs)
+ *   highResTimings    entropy probe timings at true microsecond resolution
+ *
+ * Why this matters
+ * ────────────────
+ * With 1ms clamping, a VM's flat distribution and a real device's noisy
+ * distribution can look similar — both get quantized to the same step.
+ * At 1µs resolution, the difference between EJR=1.01 and EJR=1.24 is
+ * unmistakable. This upgrade alone materially improves detection accuracy
+ * on Brave and Firefox where timer clamping was previously a confound.
+ */
+
+/* ─── availability ───────────────────────────────────────────────────────── */
+
+function isSabAvailable() {
+  return (
+    typeof SharedArrayBuffer !== 'undefined' &&
+    typeof Atomics            !== 'undefined' &&
+    typeof Atomics.wait       === 'function'  &&
+    crossOriginIsolated === true              // window flag set by COOP+COEP headers
+  );
+}
+
+/* ─── Atomics-based high-resolution clock ───────────────────────────────── */
+
+let _sab  = null;
+let _i32  = null;
+
+function _initSab() {
+  if (!_sab) {
+    _sab = new SharedArrayBuffer(4);
+    _i32 = new Int32Array(_sab);
+  }
+}
+
+/**
+ * Wait exactly `us` microseconds using Atomics.wait().
+ * Returns wall-clock elapsed in milliseconds.
+ * Much more accurate than setTimeout(fn, 0) or performance.now() loops.
+ *
+ * @param {number} us – microseconds to wait
+ * @returns {number}  actual elapsed ms
+ */
+function _atomicsWait(us) {
+  _initSab();
+  const t0 = performance.now();
+  Atomics.wait(_i32, 0, 0, us / 1000); // Atomics.wait timeout is in ms
+  return performance.now() - t0;
+}
+
+/* ─── measureClamp ───────────────────────────────────────────────────────── */
+
+/**
+ * Determine the true timer resolution by comparing a series of
+ * sub-millisecond Atomics.wait() calls against performance.now() deltas.
+ *
+ * @returns {{ isClamped: boolean, clampAmountUs: number, resolutionUs: number }}
+ */
+function measureClamp() {
+  if (!isSabAvailable()) {
+    return { isClamped: false, clampAmountUs: 0, resolutionUs: 1000 };
+  }
+
+  // Measure the minimum non-zero performance.now() delta
+  const performanceDeltas = [];
+  for (let i = 0; i < 100; i++) {
+    const t0 = performance.now();
+    let t1 = t0;
+    while (t1 === t0) t1 = performance.now();
+    performanceDeltas.push((t1 - t0) * 1000); // convert to µs
+  }
+  performanceDeltas.sort((a, b) => a - b);
+  const perfResolutionUs = performanceDeltas[Math.floor(performanceDeltas.length * 0.1)]; // 10th percentile
+
+  // Measure actual OS timer resolution via Atomics.wait
+  const atomicsDeltas = [];
+  for (let i = 0; i < 20; i++) {
+    const elapsedMs = _atomicsWait(100); // wait 100µs
+    atomicsDeltas.push(Math.abs(elapsedMs * 1000 - 100)); // error from target
+  }
+  const atomicsErrorUs = atomicsDeltas.reduce((s, v) => s + v, 0) / atomicsDeltas.length;
+  const trueResolutionUs = Math.max(1, atomicsErrorUs);
+
+  const isClamped    = perfResolutionUs > trueResolutionUs * 5;
+  const clampAmountUs = isClamped ? perfResolutionUs - trueResolutionUs : 0;
+
+  return { isClamped, clampAmountUs, resolutionUs: perfResolutionUs };
+}
+
+/* ─── collectHighResTimings ──────────────────────────────────────────────── */
+
+/**
+ * Collect entropy probe timings at Atomics-level resolution.
+ * Falls back to performance.now() if SAB is unavailable.
+ *
+ * The probe itself is identical to the WASM matrix probe — CPU work unit
+ * timed with the highest available clock. The difference: on a clamped
+ * browser this replaces quantized 100µs buckets with true µs measurements.
+ *
+ * @param {object} opts
+ * @param {number} [opts.iterations=200]
+ * @param {number} [opts.matrixSize=32]     – smaller than WASM probe (no SIMD here)
+ * @returns {{ timings: number[], usingAtomics: boolean, resolutionUs: number }}
+ */
+function collectHighResTimings(opts = {}) {
+  const { iterations = 200, matrixSize = 32 } = opts;
+
+  const usingAtomics = isSabAvailable();
+  const clampInfo    = usingAtomics ? measureClamp() : { resolutionUs: 1000 };
+
+  // Simple matrix multiply work unit (JS — no WASM needed for the clock probe)
+  const N = matrixSize;
+  const A = new Float64Array(N * N).map(() => Math.random());
+  const B = new Float64Array(N * N).map(() => Math.random());
+  const C = new Float64Array(N * N);
+
+  const timings = new Array(iterations);
+
+  for (let iter = 0; iter < iterations; iter++) {
+    C.fill(0);
+
+    if (usingAtomics) {
+      // ── Atomics path: start timing, do work, read Atomics-calibrated time ──
+      // We use a sliding window approach: measure with Atomics.wait(0) which
+      // returns immediately but the OS schedules give us a high-res timestamp
+      // via the before/after pattern on the shared memory notification.
+      _initSab();
+
+      const tAtomicsBefore = _getAtomicsTs();
+      for (let i = 0; i < N; i++) {
+        for (let k = 0; k < N; k++) {
+          const aik = A[i * N + k];
+          for (let j = 0; j < N; j++) C[i * N + j] += aik * B[k * N + j];
+        }
+      }
+      const tAtomicsAfter = _getAtomicsTs();
+      timings[iter] = (tAtomicsAfter - tAtomicsBefore) * 1000; // µs → ms
+
+    } else {
+      // ── Standard path: use performance.now() ──
+      const t0 = performance.now();
+      for (let i = 0; i < N; i++) {
+        for (let k = 0; k < N; k++) {
+          const aik = A[i * N + k];
+          for (let j = 0; j < N; j++) C[i * N + j] += aik * B[k * N + j];
+        }
+      }
+      timings[iter] = performance.now() - t0;
+    }
+  }
+
+  return {
+    timings,
+    usingAtomics,
+    resolutionUs: clampInfo.resolutionUs,
+    isClamped:    clampInfo.isClamped ?? false,
+    clampAmountUs: clampInfo.clampAmountUs ?? 0,
+  };
+}
+
+/* ─── internal Atomics timestamp ─────────────────────────────────────────── */
+
+// Use a write to shared memory + memory fence as a timestamp anchor.
+// This forces the CPU to flush its store buffer, giving a hardware-ordered
+// time reference that survives compiler reordering.
+function _getAtomicsTs() {
+  _initSab();
+  Atomics.store(_i32, 0, Atomics.load(_i32, 0) + 1);
+  return performance.now();
+}
+
+/**
+ * @sovereign/pulse — Electrical Network Frequency (ENF) Detection
+ *
+ * ┌─────────────────────────────────────────────────────────────────────────┐
+ * │  WHAT THIS IS                                                           │
+ * │                                                                         │
+ * │  Power grids operate at a nominal frequency — 60 Hz in the Americas,   │
+ * │  50 Hz in Europe, Asia, Africa, and Australia. This frequency is not   │
+ * │  perfectly stable. It deviates by ±0.05 Hz in real time as generators  │
+ * │  spin up and down to match load. These deviations are unique, logged   │
+ * │  by grid operators, and have been used in forensics since 2010 to      │
+ * │  timestamp recordings to within seconds.                               │
+ * │                                                                         │
+ * │  We are the first to measure it from a browser.                        │
+ * └─────────────────────────────────────────────────────────────────────────┘
+ *
+ * Signal path
+ * ───────────
+ *   AC mains (50/60 Hz)
+ *     → ATX power supply (full-wave rectified → 100/120 Hz ripple on DC rail)
+ *     → Voltage Regulator Module (VRM) on motherboard
+ *     → CPU Vcore (supply voltage to processor dies)
+ *     → Transistor switching speed (slightly modulated by Vcore)
+ *     → Matrix multiply loop timing (measurably longer when Vcore dips)
+ *     → Our microsecond-resolution timing probe
+ *
+ * The ripple amplitude at the timing layer is ~10–100 ns — invisible to
+ * performance.now() at 1 ms resolution, clearly visible with Atomics-based
+ * microsecond timing. This is why this module depends on sabTimer.js.
+ *
+ * What we detect
+ * ──────────────
+ *   gridFrequency    50.0 or 60.0 Hz (nominal), ±0.5 Hz measured
+ *   gridRegion       'americas' (60 Hz) | 'emea_apac' (50 Hz) | 'unknown'
+ *   ripplePresent    true if the 100/120 Hz harmonic is statistically significant
+ *   ripplePower      power of the dominant grid harmonic (0–1)
+ *   enfDeviation     precise measured frequency – nominal (Hz) — temporal fingerprint
+ *   temporalHash     BLAKE3 of (enfDeviation + timestamp) — attestation anchor
+ *
+ * What this proves
+ * ───────────────
+ *   1. The device is connected to a real AC power grid (rules out cloud VMs,
+ *      UPS-backed datacenter servers, and battery-only devices off-grid)
+ *   2. The geographic grid region (50 Hz vs 60 Hz — no IP, no location API)
+ *   3. A temporal fingerprint that can be cross-referenced against public ENF
+ *      logs (e.g., www.gridwatch.templar.linux.org.uk) to verify the session
+ *      timestamp is authentic
+ *
+ * Why VMs fail
+ * ────────────
+ *   Datacenter power is conditioned, filtered, and UPS-backed. Grid frequency
+ *   deviations are removed before they reach the server. Cloud VMs receive
+ *   perfectly regulated power — the ENF signal does not exist in their timing
+ *   measurements. This is a physical property of datacenter infrastructure,
+ *   not a software configuration that can be patched or spoofed.
+ *
+ *   A VM attempting to inject synthetic ENF ripple into its virtual clock
+ *   would need to:
+ *     1. Know the real-time ENF of the target grid region (requires live API)
+ *     2. Modulate the virtual TSC at sub-microsecond precision
+ *     3. Match the precise VRM transfer function of the target motherboard
+ *   This is not a realistic attack surface.
+ *
+ * Battery devices
+ * ───────────────
+ *   Laptops on battery have no AC ripple. The module detects this via absence
+ *   of both 100 Hz and 120 Hz signal, combined with very low ripple variance.
+ *   This is handled by the 'battery_or_conditioned' verdict — treated as
+ *   inconclusive rather than VM (real laptops exist).
+ *
+ * Required: crossOriginIsolated = true (COOP + COEP headers)
+ * The SAB microsecond timer is required for ENF detection. On browsers where
+ * it is unavailable, the module returns { enfAvailable: false }.
+ */
+
+
+// ── Grid frequency constants ──────────────────────────────────────────────────
+const GRID_60HZ_NOMINAL   = 60.0;  // Americas, parts of Japan & Korea
+const GRID_50HZ_NOMINAL   = 50.0;  // EMEA, APAC, most of Asia
+const RIPPLE_60HZ         = 120.0; // Full-wave rectified: 2 × 60 Hz
+const RIPPLE_50HZ         = 100.0; // Full-wave rectified: 2 × 50 Hz
+const RIPPLE_SLACK_HZ     = 2.0;   // ±2 Hz around nominal (accounts for VRM response)
+const MIN_RIPPLE_POWER    = 0.04;  // Minimum power ratio to declare ripple present
+const SNR_THRESHOLD       = 2.0;   // Signal-to-noise ratio for confident detection
+
+// ── Probe parameters ──────────────────────────────────────────────────────────
+// We need enough samples at sufficient rate to resolve 100–120 Hz.
+// Nyquist: sample_rate > 240 Hz (need >2× the highest target frequency).
+// With ~1 ms per iteration, 100 Hz ≈ 10 samples per cycle — adequate.
+// We want at least 20 full cycles → 200 iterations minimum.
+const PROBE_ITERATIONS    = 512;   // power of 2 for clean FFT
+const PROBE_MATRIX_SIZE   = 16;    // small matrix → ~1 ms/iter → ~500 Hz sample rate
+
+/* ─── collectEnfTimings ─────────────────────────────────────────────────────── */
+
+/**
+ * @param {object}  [opts]
+ * @param {number}  [opts.iterations=512]
+ * @returns {Promise<EnfResult>}
+ */
+async function collectEnfTimings(opts = {}) {
+  const { iterations = PROBE_ITERATIONS } = opts;
+
+  if (!isSabAvailable()) {
+    return _noEnf('SharedArrayBuffer not available — COOP+COEP headers required');
+  }
+
+  // Collect high-resolution CPU timing series
+  const { timings, resolutionUs } = collectHighResTimings({
+    iterations,
+    matrixSize: PROBE_MATRIX_SIZE,
+  });
+
+  if (timings.length < 128) {
+    return _noEnf('insufficient timing samples');
+  }
+
+  // Estimate the sample rate from actual timing
+  const meanIterMs = timings.reduce((s, v) => s + v, 0) / timings.length;
+  const sampleRateHz = meanIterMs > 0 ? 1000 / meanIterMs : 0;
+
+  if (sampleRateHz < 60) {
+    return _noEnf(`sample rate too low for ENF detection: ${sampleRateHz.toFixed(0)} Hz`);
+  }
+
+  // ── Power Spectral Density ────────────────────────────────────────────────
+  timings.length;
+  const psd     = _computePsd(timings, sampleRateHz);
+
+  // Find the dominant frequency peak
+  const peakIdx  = psd.reduce((best, v, i) => v > psd[best] ? i : best, 0);
+  psd.freqs[peakIdx];
+
+  // Power in 100 Hz window vs 120 Hz window
+  const power100 = _bandPower$1(psd, RIPPLE_50HZ,  RIPPLE_SLACK_HZ);
+  const power120 = _bandPower$1(psd, RIPPLE_60HZ,  RIPPLE_SLACK_HZ);
+  const baseline = _baselinePower(psd, [
+    [RIPPLE_50HZ - RIPPLE_SLACK_HZ, RIPPLE_50HZ + RIPPLE_SLACK_HZ],
+    [RIPPLE_60HZ - RIPPLE_SLACK_HZ, RIPPLE_60HZ + RIPPLE_SLACK_HZ],
+  ]);
+
+  const snr100 = baseline > 0 ? power100 / baseline : 0;
+  const snr120 = baseline > 0 ? power120 / baseline : 0;
+
+  // ── Verdict ───────────────────────────────────────────────────────────────
+  const has100 = power100 > MIN_RIPPLE_POWER && snr100 > SNR_THRESHOLD;
+  const has120 = power120 > MIN_RIPPLE_POWER && snr120 > SNR_THRESHOLD;
+
+  let gridFrequency = null;
+  let gridRegion    = 'unknown';
+  let ripplePower   = 0;
+  let nominalHz     = null;
+
+  if (has120 && power120 >= power100) {
+    gridFrequency = GRID_60HZ_NOMINAL;
+    gridRegion    = 'americas';
+    ripplePower   = power120;
+    nominalHz     = RIPPLE_60HZ;
+  } else if (has100) {
+    gridFrequency = GRID_50HZ_NOMINAL;
+    gridRegion    = 'emea_apac';
+    ripplePower   = power100;
+    nominalHz     = RIPPLE_50HZ;
+  }
+
+  const ripplePresent = has100 || has120;
+
+  // ── ENF deviation (temporal fingerprint) ─────────────────────────────────
+  // The precise ripple frequency deviates from nominal by ±0.1 Hz in real time.
+  // We measure the peak frequency in the ripple band to extract this deviation.
+  let enfDeviation = null;
+  if (ripplePresent && nominalHz !== null) {
+    const preciseRippleFreq = _precisePeakFreq(psd, nominalHz, RIPPLE_SLACK_HZ);
+    enfDeviation = +(preciseRippleFreq - nominalHz).toFixed(3); // Hz deviation from nominal
+  }
+
+  // ── Verdict ───────────────────────────────────────────────────────────────
+  const verdict =
+    !ripplePresent                     ? 'no_grid_signal'    // VM, UPS, or battery
+    : gridRegion === 'americas'        ? 'grid_60hz'
+    : gridRegion === 'emea_apac'       ? 'grid_50hz'
+    : 'grid_detected_region_unknown';
+
+  const isVmIndicator = !ripplePresent && sampleRateHz > 100;
+  // High sample rate + no ripple = conditioned power (datacenter)
+
+  return {
+    enfAvailable:   true,
+    ripplePresent,
+    gridFrequency,
+    gridRegion,
+    ripplePower:    +ripplePower.toFixed(4),
+    snr50hz:        +snr100.toFixed(2),
+    snr60hz:        +snr120.toFixed(2),
+    enfDeviation,
+    sampleRateHz:   +sampleRateHz.toFixed(1),
+    resolutionUs,
+    verdict,
+    isVmIndicator,
+    // For cross-referencing against public ENF databases (forensic timestamp)
+    temporalAnchor: enfDeviation !== null ? {
+      nominalHz,
+      measuredRippleHz: +(nominalHz + enfDeviation).toFixed(4),
+      capturedAt:       Date.now(),
+      // Matches format used by ENF forensic databases:
+      // https://www.enf.cc | UK National Grid ESO data
+      gridHz:           gridFrequency,
+    } : null,
+  };
+}
+
+/* ─── Power Spectral Density (Welch-inspired DFT) ───────────────────────── */
+
+function _computePsd(signal, sampleRateHz) {
+  const n       = signal.length;
+  const mean    = signal.reduce((s, v) => s + v, 0) / n;
+
+  // Remove DC offset and apply Hann window
+  const windowed = signal.map((v, i) => {
+    const w = 0.5 * (1 - Math.cos((2 * Math.PI * i) / (n - 1))); // Hann
+    return (v - mean) * w;
+  });
+
+  // DFT up to Nyquist — only need up to ~200 Hz so we cap bins
+  const maxFreq = Math.min(200, sampleRateHz / 2);
+  const maxBin  = Math.floor(maxFreq * n / sampleRateHz);
+
+  const powers = new Float64Array(maxBin);
+  const freqs  = new Float64Array(maxBin);
+
+  for (let k = 1; k < maxBin; k++) {
+    let re = 0, im = 0;
+    for (let t = 0; t < n; t++) {
+      const angle = (2 * Math.PI * k * t) / n;
+      re += windowed[t] * Math.cos(angle);
+      im -= windowed[t] * Math.sin(angle);
+    }
+    powers[k] = (re * re + im * im) / (n * n);
+    freqs[k]  = (k * sampleRateHz) / n;
+  }
+
+  // Normalise powers so they sum to 1 (makes thresholds sample-count-independent)
+  const total = powers.reduce((s, v) => s + v, 0);
+  if (total > 0) for (let i = 0; i < powers.length; i++) powers[i] /= total;
+
+  return { powers, freqs };
+}
+
+function _bandPower$1(psd, centerHz, halfwidthHz) {
+  let power = 0;
+  for (let i = 0; i < psd.freqs.length; i++) {
+    if (Math.abs(psd.freqs[i] - centerHz) <= halfwidthHz) {
+      power += psd.powers[i];
+    }
+  }
+  return power;
+}
+
+function _baselinePower(psd, excludeBands) {
+  let sum = 0, count = 0;
+  for (let i = 0; i < psd.freqs.length; i++) {
+    const f = psd.freqs[i];
+    const excluded = excludeBands.some(([lo, hi]) => f >= lo && f <= hi);
+    if (!excluded && f > 10 && f < 200) { sum += psd.powers[i]; count++; }
+  }
+  return count > 0 ? sum / count : 0;
+}
+
+function _precisePeakFreq(psd, centerHz, halfwidthHz) {
+  // Quadratic interpolation around the peak bin for sub-bin precision
+  let peakBin = 0, peakPow = -Infinity;
+  for (let i = 0; i < psd.freqs.length; i++) {
+    if (Math.abs(psd.freqs[i] - centerHz) <= halfwidthHz && psd.powers[i] > peakPow) {
+      peakPow = psd.powers[i]; peakBin = i;
+    }
+  }
+  if (peakBin <= 0 || peakBin >= psd.powers.length - 1) return psd.freqs[peakBin];
+
+  // Quadratic peak interpolation (Jacobsen method)
+  const alpha = psd.powers[peakBin - 1];
+  const beta  = psd.powers[peakBin];
+  const gamma = psd.powers[peakBin + 1];
+  const denom = alpha - 2 * beta + gamma;
+  if (Math.abs(denom) < 1e-14) return psd.freqs[peakBin];
+  const deltaBin = 0.5 * (alpha - gamma) / denom;
+  const binWidth = psd.freqs[1] - psd.freqs[0];
+  return psd.freqs[peakBin] + deltaBin * binWidth;
+}
+
+function _noEnf(reason) {
+  return {
+    enfAvailable: false, ripplePresent: false, gridFrequency: null,
+    gridRegion: 'unknown', ripplePower: 0, snr50hz: 0, snr60hz: 0,
+    enfDeviation: null, sampleRateHz: 0, resolutionUs: 0,
+    verdict: 'unavailable', isVmIndicator: false, temporalAnchor: null, reason,
+  };
+}
+
+/**
+ * @typedef {object} EnfResult
+ * @property {boolean}      enfAvailable
+ * @property {boolean}      ripplePresent    false = VM / datacenter / battery
+ * @property {number|null}  gridFrequency    50 or 60 Hz
+ * @property {string}       gridRegion       'americas' | 'emea_apac' | 'unknown'
+ * @property {number}       ripplePower      normalised PSD power at grid harmonic
+ * @property {number|null}  enfDeviation     Hz deviation from nominal (temporal fingerprint)
+ * @property {string}       verdict
+ * @property {boolean}      isVmIndicator    true if signal absence + high sample rate
+ * @property {object|null}  temporalAnchor   forensic timestamp anchor
+ */
+
+/**
+ * @sovereign/pulse — LLM / AI Agent Behavioral Fingerprint
+ *
+ * Detects automation driven by large language models, headless browsers
+ * controlled by AI agents (AutoGPT, CrewAI, browser-use, Playwright+LLM,
+ * Selenium+GPT-4), and synthetic user emulators.
+ *
+ * Why LLMs are detectable at the behavioral layer
+ * ───────────────────────────────────────────────
+ * A human interacting with a browser produces a signal shaped by:
+ *   – Motor control noise (Fitts' Law, signal-dependent noise in arm movement)
+ *   – Cognitive processing time (fixation → decision → motor initiation)
+ *   – Error and correction cycles (overshooting, backspacing, re-reading)
+ *   – Physiological rhythms (micro-tremor at 8–12 Hz, respiration at 0.2–0.3 Hz)
+ *
+ * An LLM agent produces:
+ *   – Think-time spikes at multiples of the model's token generation latency
+ *     (GPT-4 Turbo: ~50ms/token; Claude 3: ~30ms/token)
+ *   – Mouse paths generated by a trajectory model (no signal-dependent noise)
+ *   – Keystrokes at WPM limited by the agent's typing function, not human anatomy
+ *   – Absent micro-corrections (humans correct 7–12% of keystrokes; agents: 0%)
+ *
+ * Signals
+ * ───────
+ *   thinkTimePattern    peak in inter-event timing at known LLM token latencies
+ *   mousePathSmoothness  human paths are fractal; LLM paths are piecewise linear
+ *   correctionRate       keystrokes followed by Backspace (human: 7–12%, LLM: <1%)
+ *   pauseDistribution    human pauses are Pareto-distributed; LLM pauses are uniform
+ *   rhythmicity          presence of physiological tremor (8–12 Hz) in pointer data
+ *   eventGapCV           coefficient of variation of inter-event gaps
+ *
+ * Scoring
+ * ───────
+ * Each signal contributes a weight to an overall `aiConf` score (0–1).
+ * A score above 0.70 indicates likely AI agent. Above 0.85 is high confidence.
+ * The score is designed to be combined with the physics layer — AI agents running
+ * on real hardware (a human's machine being remote-controlled) will pass the
+ * physics check but fail the behavioral check.
+ */
+
+// ── Known LLM token latency ranges (ms per token, observed empirically) ──────
+// These appear as periodic peaks in inter-event timing when the LLM is
+// "thinking" between actions.
+const LLM_LATENCY_RANGES = [
+  { name: 'gpt-4-turbo',     minMs: 40,  maxMs:  80 },
+  { name: 'gpt-4o',          minMs: 20,  maxMs:  50 },
+  { name: 'claude-3-sonnet', minMs: 25,  maxMs:  60 },
+  { name: 'claude-3-opus',   minMs: 50,  maxMs: 120 },
+  { name: 'gemini-1.5-pro',  minMs: 30,  maxMs:  70 },
+  { name: 'llama-3-70b',     minMs: 15,  maxMs:  45 },
+];
+
+// ── Human physiological constants ─────────────────────────────────────────────
+const HUMAN_TREMOR_HZ_LO    = 8;    // micro-tremor band low (Hz)
+const HUMAN_TREMOR_HZ_HI    = 12;   // micro-tremor band high (Hz)
+const HUMAN_CORRECTION_MIN  = 0.05; // minimum human backspace rate
+const HUMAN_CORRECTION_MAX  = 0.18; // maximum human backspace rate
+
+/* ─── Public API ─────────────────────────────────────────────────────────── */
+
+/**
+ * Analyse collected behavioral signals for AI agent indicators.
+ *
+ * @param {object} signals
+ * @param {Array<{t:number, x:number, y:number}>} [signals.mouseEvents]   – {t ms, x, y}
+ * @param {Array<{t:number, key:string}>}          [signals.keyEvents]     – {t ms, key}
+ * @param {Array<number>}                          [signals.interEventGaps] – ms between any UI events
+ * @returns {LlmFingerprint}
+ */
+function detectLlmAgent(signals = {}) {
+  const {
+    mouseEvents    = [],
+    keyEvents      = [],
+    interEventGaps = [],
+  } = signals;
+
+  const checks = [];
+
+  // ── 1. Think-time pattern ────────────────────────────────────────────────
+  if (interEventGaps.length >= 20) {
+    const thinkCheck = _analyseThinkTime(interEventGaps);
+    checks.push(thinkCheck);
+  }
+
+  // ── 2. Mouse path smoothness ─────────────────────────────────────────────
+  if (mouseEvents.length >= 30) {
+    const pathCheck = _analyseMousePath(mouseEvents);
+    checks.push(pathCheck);
+  }
+
+  // ── 3. Keystroke correction rate ─────────────────────────────────────────
+  if (keyEvents.length >= 15) {
+    const corrCheck = _analyseCorrectionRate(keyEvents);
+    checks.push(corrCheck);
+  }
+
+  // ── 4. Physiological tremor ───────────────────────────────────────────────
+  if (mouseEvents.length >= 50) {
+    const tremorCheck = _analyseTremor(mouseEvents);
+    checks.push(tremorCheck);
+  }
+
+  // ── 5. Inter-event gap distribution ──────────────────────────────────────
+  if (interEventGaps.length >= 30) {
+    const gapCheck = _analyseGapDistribution(interEventGaps);
+    checks.push(gapCheck);
+  }
+
+  if (!checks.length) {
+    return { aiConf: 0, humanConf: 0, checks: [], verdict: 'insufficient_data',
+             dataPoints: { mouseEvents: mouseEvents.length,
+                           keyEvents: keyEvents.length,
+                           gaps: interEventGaps.length } };
+  }
+
+  // Weighted average — weight by how many data points each check had
+  const totalWeight = checks.reduce((s, c) => s + c.weight, 0);
+  const aiConf      = checks.reduce((s, c) => s + c.aiScore   * c.weight, 0) / totalWeight;
+  const humanConf   = checks.reduce((s, c) => s + c.humanScore * c.weight, 0) / totalWeight;
+
+  const verdict =
+    aiConf    > 0.85 ? 'ai_agent_high_confidence'
+    : aiConf  > 0.70 ? 'ai_agent_likely'
+    : humanConf > 0.75 ? 'human_likely'
+    : 'ambiguous';
+
+  return {
+    aiConf:    +aiConf.toFixed(3),
+    humanConf: +humanConf.toFixed(3),
+    checks,
+    verdict,
+    dataPoints: {
+      mouseEvents: mouseEvents.length,
+      keyEvents:   keyEvents.length,
+      gaps:        interEventGaps.length,
+    },
+  };
+}
+
+/* ─── Internal checks ────────────────────────────────────────────────────── */
+
+function _analyseThinkTime(gaps) {
+  // Look for peaks in gap histogram that align with known LLM latency ranges
+  const histogram = _histogram(gaps, 200); // 200 bins over the gap range
+
+  let matchScore = 0;
+  const matched  = [];
+
+  for (const llm of LLM_LATENCY_RANGES) {
+    const binPower = _histogramPowerInRange(histogram, llm.minMs, llm.maxMs);
+    if (binPower > 0.15) { // >15% of all gaps fall in this LLM's latency range
+      matchScore = Math.max(matchScore, binPower);
+      matched.push(llm.name);
+    }
+  }
+
+  // Human think times follow a Pareto distribution: many short, exponentially
+  // fewer long pauses. A spike at a fixed latency range is anomalous.
+  const cv       = _cv(gaps);
+  const isPareto = cv > 1.0; // Pareto CV is always > 1
+
+  return {
+    name:       'think_time',
+    aiScore:    matchScore > 0.20 ? Math.min(1, matchScore * 3) : 0,
+    humanScore: isPareto && matchScore < 0.10 ? 0.8 : 0.2,
+    weight:     Math.min(gaps.length / 50, 1),
+    detail:     { matchedLlms: matched, peakBinPower: matchScore, isPareto },
+  };
+}
+
+function _analyseMousePath(events) {
+  // Compute path curvature at each triplet of points
+  // Human paths are fractal (self-similar at multiple scales); AI paths are
+  // smooth cubic splines or straight lines with programmatic waypoints.
+  const curvatures = [];
+  for (let i = 1; i < events.length - 1; i++) {
+    const p0 = events[i - 1];
+    const p1 = events[i];
+    const p2 = events[i + 1];
+
+    const d01 = Math.hypot(p1.x - p0.x, p1.y - p0.y);
+    const d12 = Math.hypot(p2.x - p1.x, p2.y - p1.y);
+    const d02 = Math.hypot(p2.x - p0.x, p2.y - p0.y);
+
+    // Curvature = deviation from straight line (0 = straight, 1 = sharp turn)
+    if (d01 + d12 > 0) {
+      curvatures.push(1 - (d02 / (d01 + d12)));
+    }
+  }
+
+  if (!curvatures.length) return { name: 'mouse_path', aiScore: 0, humanScore: 0.5, weight: 0.1, detail: {} };
+
+  const meanCurv = _mean(curvatures);
+  const cvCurv   = _cv(curvatures);
+
+  // Human: moderate mean curvature (0.05–0.25), high CV (varying turns)
+  // AI agent: very low mean curvature (near-straight lines), low CV (consistent)
+  const isTooSmooth  = meanCurv < 0.02 && cvCurv < 0.3;
+  const isTooRegular = cvCurv < 0.2 && meanCurv > 0 && meanCurv < 0.05;
+
+  // Velocity profile: human acceleration follows a bell curve (min jerk model)
+  // AI: piecewise constant velocity (linear interpolation between waypoints)
+  const speeds = [];
+  for (let i = 1; i < events.length; i++) {
+    const dt = events[i].t - events[i - 1].t;
+    const ds = Math.hypot(events[i].x - events[i - 1].x, events[i].y - events[i - 1].y);
+    if (dt > 0) speeds.push(ds / dt);
+  }
+  const speedCV = _cv(speeds);
+
+  // Human speed is highly variable (CV > 0.5); AI speed is consistent (CV < 0.3)
+  const aiScore = (
+    (isTooSmooth  ? 0.40 : 0) +
+    (isTooRegular ? 0.30 : 0) +
+    (speedCV < 0.25 ? 0.30 : speedCV < 0.40 ? 0.15 : 0)
+  );
+
+  return {
+    name:       'mouse_path',
+    aiScore:    Math.min(1, aiScore),
+    humanScore: aiScore < 0.2 ? 0.8 : 0.2,
+    weight:     Math.min(events.length / 100, 1),
+    detail:     { meanCurvature: +meanCurv.toFixed(4), curvatureCV: +cvCurv.toFixed(3), speedCV: +speedCV.toFixed(3) },
+  };
+}
+
+function _analyseCorrectionRate(keyEvents) {
+  const total      = keyEvents.length;
+  const backspaces = keyEvents.filter(e => e.key === 'Backspace').length;
+  const rate       = backspaces / total;
+
+  // Human: 5–18% correction rate (typos, editing)
+  // AI agent: <1% (generates correct text directly from LLM output)
+  const isTooClean = rate < HUMAN_CORRECTION_MIN;
+  const isHuman    = rate >= HUMAN_CORRECTION_MIN && rate <= HUMAN_CORRECTION_MAX;
+
+  return {
+    name:       'correction_rate',
+    aiScore:    isTooClean ? 0.75 : 0,
+    humanScore: isHuman    ? 0.85 : 0.2,
+    weight:     Math.min(total / 30, 1),
+    detail:     { correctionRate: +rate.toFixed(3), backspaces, total },
+  };
+}
+
+function _analyseTremor(mouseEvents) {
+  // Extract velocity time series and look for 8–12 Hz component
+  // Human hands exhibit involuntary micro-tremor in this band.
+  if (mouseEvents.length < 50) return { name: 'tremor', aiScore: 0, humanScore: 0.5, weight: 0.1, detail: {} };
+
+  const dt       = (mouseEvents[mouseEvents.length - 1].t - mouseEvents[0].t) / (mouseEvents.length - 1);
+  const sampleHz = dt > 0 ? 1000 / dt : 0;
+
+  if (sampleHz < 30) {
+    // Not enough temporal resolution to detect 8–12 Hz
+    return { name: 'tremor', aiScore: 0, humanScore: 0.5, weight: 0.1, detail: { reason: 'low_sample_rate' } };
+  }
+
+  // Compute x-velocity series
+  const vx = [];
+  for (let i = 1; i < mouseEvents.length; i++) {
+    const dtt = mouseEvents[i].t - mouseEvents[i - 1].t;
+    vx.push(dtt > 0 ? (mouseEvents[i].x - mouseEvents[i - 1].x) / dtt : 0);
+  }
+
+  // Rough power estimation in the tremor band using DFT on a windowed segment
+  const n        = Math.min(vx.length, 256);
+  const segment  = vx.slice(0, n);
+  const tremorPower = _bandPower(segment, sampleHz, HUMAN_TREMOR_HZ_LO, HUMAN_TREMOR_HZ_HI);
+  const totalPower  = _bandPower(segment, sampleHz, 0, sampleHz / 2);
+  const tremorRatio = totalPower > 0 ? tremorPower / totalPower : 0;
+
+  // Human: some tremor power present (ratio > 0.03)
+  // AI: tremor band is silent (ratio ≈ 0)
+  const hasTremor = tremorRatio > 0.03;
+
+  return {
+    name:       'tremor',
+    aiScore:    hasTremor ? 0 : 0.55,
+    humanScore: hasTremor ? 0.75 : 0.1,
+    weight:     0.6,
+    detail:     { tremorRatio: +tremorRatio.toFixed(4), sampleHz: +sampleHz.toFixed(1), hasTremor },
+  };
+}
+
+function _analyseGapDistribution(gaps) {
+  // Human inter-event gaps follow a heavy-tailed Pareto/lognormal distribution.
+  // AI agents produce gaps that cluster around fixed latencies (think-time = API call)
+  // making the distribution multimodal with low overall entropy.
+  const cv      = _cv(gaps);
+  const skew    = _skewness(gaps);
+  const entropy = _shannonEntropy(gaps, 50);
+
+  // Human: high CV (>0.8), right-skewed (skew > 1), decent entropy (>3 bits)
+  // AI: moderate CV, low skew, low entropy (gaps cluster at API latency values)
+  const humanScore = (
+    (cv    > 0.8 ? 0.35 : cv    > 0.5 ? 0.15 : 0) +
+    (skew  > 1.0 ? 0.35 : skew  > 0.5 ? 0.15 : 0) +
+    (entropy > 3.5 ? 0.30 : entropy > 2.5 ? 0.15 : 0)
+  );
+
+  const aiScore = (
+    (cv    < 0.4  ? 0.40 : 0) +
+    (skew  < 0.3  ? 0.30 : 0) +
+    (entropy < 2.0 ? 0.30 : 0)
+  );
+
+  return {
+    name:       'gap_distribution',
+    aiScore:    Math.min(1, aiScore),
+    humanScore: Math.min(1, humanScore),
+    weight:     Math.min(gaps.length / 60, 1),
+    detail:     { cv: +cv.toFixed(3), skewness: +skew.toFixed(3), entropyBits: +entropy.toFixed(2) },
+  };
+}
+
+/* ─── Math helpers ───────────────────────────────────────────────────────── */
+
+function _mean(arr) {
+  return arr.length ? arr.reduce((s, v) => s + v, 0) / arr.length : 0;
+}
+
+function _std(arr) {
+  const m = _mean(arr);
+  return Math.sqrt(arr.reduce((s, v) => s + (v - m) ** 2, 0) / arr.length);
+}
+
+function _cv(arr) {
+  const m = _mean(arr);
+  return m > 0 ? _std(arr) / m : 0;
+}
+
+function _skewness(arr) {
+  const m = _mean(arr);
+  const s = _std(arr);
+  if (s === 0) return 0;
+  const n = arr.length;
+  return arr.reduce((sum, v) => sum + ((v - m) / s) ** 3, 0) / n;
+}
+
+function _shannonEntropy(values, bins) {
+  if (!values.length) return 0;
+  const min = Math.min(...values);
+  const max = Math.max(...values);
+  if (max === min) return 0;
+  const width = (max - min) / bins;
+  const counts = new Array(bins).fill(0);
+  for (const v of values) {
+    const b = Math.min(bins - 1, Math.floor((v - min) / width));
+    counts[b]++;
+  }
+  const n = values.length;
+  return -counts.reduce((s, c) => {
+    if (c === 0) return s;
+    const p = c / n;
+    return s + p * Math.log2(p);
+  }, 0);
+}
+
+function _histogram(values, bins) {
+  if (!values.length) return { bins: [], min: 0, max: 0, binWidth: 0 };
+  const min = Math.min(...values);
+  const max = Math.max(...values) + 1e-9;
+  const binWidth = (max - min) / bins;
+  const counts   = new Array(bins).fill(0);
+  for (const v of values) counts[Math.floor((v - min) / binWidth)]++;
+  return { bins: counts, min, max, binWidth };
+}
+
+function _histogramPowerInRange(hist, lo, hi) {
+  const total = hist.bins.reduce((s, c) => s + c, 0);
+  if (!total) return 0;
+  let power = 0;
+  for (let i = 0; i < hist.bins.length; i++) {
+    const center = hist.min + (i + 0.5) * hist.binWidth;
+    if (center >= lo && center <= hi) power += hist.bins[i];
+  }
+  return power / total;
+}
+
+// Discrete Fourier Transform power in a frequency band (O(n²) DFT — n ≤ 256)
+function _bandPower(signal, sampleHz, fLo, fHi) {
+  const n = signal.length;
+  let power = 0;
+  for (let k = 0; k < n / 2; k++) {
+    const freq = (k * sampleHz) / n;
+    if (freq < fLo || freq > fHi) continue;
+    let re = 0, im = 0;
+    for (let t = 0; t < n; t++) {
+      const angle = (2 * Math.PI * k * t) / n;
+      re += signal[t] * Math.cos(angle);
+      im -= signal[t] * Math.sin(angle);
+    }
+    power += (re * re + im * im) / (n * n);
+  }
+  return power;
+}
+
+/**
+ * @typedef {object} LlmFingerprint
+ * @property {number}   aiConf        0–1 AI agent confidence
+ * @property {number}   humanConf     0–1 human confidence
+ * @property {object[]} checks        per-signal breakdown
+ * @property {string}   verdict
+ * @property {object}   dataPoints
+ */
+
+/**
+ * @svrnsec/pulse — Update Notifier
  *
- * Measures the scheduling jitter of the browser's audio pipeline.
- * Real audio hardware callbacks are driven by a hardware interrupt (IRQ)
- * from the sound card; the timing reflects the actual interrupt latency
- * of the physical device.  VM audio drivers (if present at all) are
- * emulated and show either unrealistically low jitter or burst-mode
- * scheduling artefacts that are statistically distinguishable.
+ * Checks the npm registry for a newer version and prints a styled terminal
+ * notice when one is available. Non-blocking — the check runs in the
+ * background and only displays if a newer version is found before the
+ * process exits.
+ *
+ * Zero dependencies. Pure Node.js https module.
+ * Silent in browser environments and when stdout is not a TTY.
  */
 
-/**
- * @param {object} [opts]
- * @param {number} [opts.durationMs=2000]  - how long to collect audio callbacks
- * @param {number} [opts.bufferSize=256]   - ScriptProcessorNode buffer size
- * @returns {Promise<AudioJitter>}
- */
-async function collectAudioJitter(opts = {}) {
-  const { durationMs = 2000, bufferSize = 256 } = opts;
 
-  const base = {
-    available:         false,
-    workletAvailable:  false,
-    callbackJitterCV:  0,
-    noiseFloorMean:    0,
-    sampleRate:        0,
-    callbackCount:     0,
-    jitterTimings:     [],
-  };
+/* ─── version from package.json ─────────────────────────────────────────── */
 
-  if (typeof AudioContext === 'undefined' && typeof webkitAudioContext === 'undefined') {
-    return base; // Node.js / server environment
-  }
+let _currentVersion = '0.0.0';
+try {
+  const require = createRequire(import.meta.url);
+  _currentVersion = require('../package.json').version;
+} catch {}
 
-  let ctx;
-  try {
-    ctx = new (window.AudioContext || window.webkitAudioContext)();
-  } catch (_) {
-    return base;
-  }
+const CURRENT_VERSION = _currentVersion;
 
-  // Some browsers require a user gesture before AudioContext can run.
-  if (ctx.state === 'suspended') {
-    try {
-      await ctx.resume();
-    } catch (_) {
-      await ctx.close().catch(() => {});
-      return base;
-    }
-  }
+/* ─── ANSI helpers ───────────────────────────────────────────────────────── */
 
-  const sampleRate       = ctx.sampleRate;
-  const expectedInterval = (bufferSize / sampleRate) * 1000; // ms per callback
+const isTTY$1   = () =>
+  typeof process !== 'undefined' &&
+  process.stdout?.isTTY === true &&
+  process.env?.NO_COLOR == null &&
+  process.env?.PULSE_NO_UPDATE == null;
 
-  const jitterTimings = []; // absolute AudioContext.currentTime at each callback
-  const callbackDeltas = [];
+const isNode  = () => typeof process !== 'undefined' && typeof window === 'undefined';
 
-  await new Promise((resolve) => {
-    // ── AudioWorklet (preferred — runs on dedicated real-time thread) ──────
-    const useWorklet = typeof AudioWorkletNode !== 'undefined';
-    base.workletAvailable = useWorklet;
+const C = {
+  reset:     '\x1b[0m',
+  bold:      '\x1b[1m',
+  yellow:    '\x1b[33m',
+  // bright foreground
+  bgray:     '\x1b[90m',
+  bred:      '\x1b[91m',
+  bgreen:    '\x1b[92m',
+  byellow:   '\x1b[93m',
+  bcyan:     '\x1b[96m',
+  bwhite:    '\x1b[97m'};
 
-    if (useWorklet) {
-      // Inline worklet: send currentTime back via MessagePort every buffer
-      const workletCode = `
-        class PulseProbe extends AudioWorkletProcessor {
-          process(inputs, outputs) {
-            this.port.postMessage({ t: currentTime });
-            // Pass-through silence
-            for (const out of outputs)
-              for (const ch of out) ch.fill(0);
-            return true;
-          }
-        }
-        registerProcessor('pulse-probe', PulseProbe);
-      `;
-      const blob    = new Blob([workletCode], { type: 'application/javascript' });
-      const blobUrl = URL.createObjectURL(blob);
+const c$1  = isTTY$1;
+const ft = (code, s) => c$1() ? `${code}${s}${C.reset}` : s;
 
-      ctx.audioWorklet.addModule(blobUrl).then(() => {
-        const node = new AudioWorkletNode(ctx, 'pulse-probe');
-        node.port.onmessage = (e) => {
-          jitterTimings.push(e.data.t * 1000); // convert to ms
-        };
-        node.connect(ctx.destination);
+/* ─── box renderer ───────────────────────────────────────────────────────── */
 
-        setTimeout(async () => {
-          node.disconnect();
-          URL.revokeObjectURL(blobUrl);
-          resolve(node);
-        }, durationMs);
-      }).catch(() => {
-        URL.revokeObjectURL(blobUrl);
-        _fallbackScriptProcessor(ctx, bufferSize, durationMs, jitterTimings, resolve);
-      });
+/**
+ * Render a bordered notification box to stderr.
+ * Uses box-drawing characters and ANSI colors when the terminal supports them.
+ */
+function _box(lines, opts = {}) {
+  const { borderColor = C.yellow, titleColor = C.bwhite } = opts;
+  const pad   = 2;
+  const width = Math.max(...lines.map(l => _visLen(l))) + pad * 2;
+  const hr    = '─'.repeat(width);
+  const bc    = (s) => c$1() ? `${borderColor}${s}${C.reset}` : s;
+
+  const out = [
+    bc(`╭${hr}╮`),
+    ...lines.map(l => {
+      const vis  = _visLen(l);
+      const fill = ' '.repeat(Math.max(0, width - vis - pad * 2));
+      return bc('│') + ' '.repeat(pad) + (c$1() ? l : _stripAnsi(l)) + fill + ' '.repeat(pad) + bc('│');
+    }),
+    bc(`╰${hr}╯`),
+  ];
 
-    } else {
-      _fallbackScriptProcessor(ctx, bufferSize, durationMs, jitterTimings, resolve);
-    }
-  });
+  process.stderr.write('\n' + out.join('\n') + '\n\n');
+}
 
-  // ── Compute deltas between successive callback times ────────────────────
-  for (let i = 1; i < jitterTimings.length; i++) {
-    callbackDeltas.push(jitterTimings[i] - jitterTimings[i - 1]);
+/* ─── version comparison ─────────────────────────────────────────────────── */
+
+function _semverGt(a, b) {
+  const pa = a.replace(/[^0-9.]/g, '').split('.').map(Number);
+  const pb = b.replace(/[^0-9.]/g, '').split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    const da = pa[i] ?? 0, db = pb[i] ?? 0;
+    if (da > db) return true;
+    if (da < db) return false;
   }
+  return false;
+}
 
-  // ── Noise floor via AnalyserNode ─────────────────────────────────────────
-  // Feed a silent oscillator through an analyser; the FFT magnitude at silence
-  // reveals the hardware's thermal noise floor (varies per ADC/DAC chipset).
-  const noiseFloor = await _measureNoiseFloor(ctx);
+/* ─── registry fetch ─────────────────────────────────────────────────────── */
 
-  await ctx.close().catch(() => {});
+async function _fetchLatest(pkg) {
+  return new Promise((resolve) => {
+    let resolved = false;
+    const done = (v) => { if (!resolved) { resolved = true; resolve(v); } };
 
-  // ── Statistics ────────────────────────────────────────────────────────────
-  const mean = callbackDeltas.length
-    ? callbackDeltas.reduce((s, v) => s + v, 0) / callbackDeltas.length
-    : 0;
-  const variance = callbackDeltas.length > 1
-    ? callbackDeltas.reduce((s, v) => s + (v - mean) ** 2, 0) / (callbackDeltas.length - 1)
-    : 0;
-  const jitterCV = mean > 0 ? Math.sqrt(variance) / mean : 0;
+    const timeout = setTimeout(() => done(null), 3_000);
 
-  return {
-    available:         true,
-    workletAvailable:  base.workletAvailable,
-    callbackJitterCV:  jitterCV,
-    noiseFloorMean:    noiseFloor.mean,
-    noiseFloorStd:     noiseFloor.std,
-    sampleRate,
-    callbackCount:     jitterTimings.length,
-    expectedIntervalMs: expectedInterval,
-    // Only include summary stats, not raw timings (privacy / size)
-    jitterMeanMs:      mean,
-    jitterP95Ms:       _percentile(callbackDeltas, 95),
-  };
+    try {
+      const https = require$1('https');
+      const req   = https.get(
+        `https://registry.npmjs.org/${encodeURIComponent(pkg)}/latest`,
+        { headers: { 'Accept': 'application/json', 'User-Agent': `${pkg}/${_currentVersion}` } },
+        (res) => {
+          let body = '';
+          res.setEncoding('utf8');
+          res.on('data', d => body += d);
+          res.on('end', () => {
+            clearTimeout(timeout);
+            try { done(JSON.parse(body).version ?? null); } catch { done(null); }
+          });
+        }
+      );
+      req.on('error', () => { clearTimeout(timeout); done(null); });
+      req.end();
+    } catch {
+      clearTimeout(timeout);
+      done(null);
+    }
+  });
+}
+function require$1(m) {
+  if (typeof globalThis.require === 'function') return globalThis.require(m);
+  // CJS interop — only used server-side
+  if (typeof process !== 'undefined') {
+    const mod = process.mainModule?.require ?? (() => null);
+    return mod(m);
+  }
+  return null;
 }
 
+/* ─── checkForUpdate ─────────────────────────────────────────────────────── */
+
 /**
- * @typedef {object} AudioJitter
- * @property {boolean} available
- * @property {boolean} workletAvailable
- * @property {number}  callbackJitterCV
- * @property {number}  noiseFloorMean
- * @property {number}  sampleRate
- * @property {number}  callbackCount
+ * Check npm for a newer version of @svrnsec/pulse.
+ * Call once at process startup — the result is shown before process exit
+ * (or immediately if already resolved).
+ *
+ * @param {object} [opts]
+ * @param {boolean} [opts.silent=false]  suppress output even when update exists
+ * @param {string}  [opts.pkg='@svrnsec/pulse']
+ * @returns {Promise<{ current: string, latest: string|null, updateAvailable: boolean }>}
  */
+async function checkForUpdate(opts = {}) {
+  const { silent = false, pkg = '@svrnsec/pulse' } = opts;
 
-// ---------------------------------------------------------------------------
-// Internal helpers
-// ---------------------------------------------------------------------------
+  if (!isNode()) return { current: _currentVersion, latest: null, updateAvailable: false };
 
-function _fallbackScriptProcessor(ctx, bufferSize, durationMs, jitterTimings, resolve) {
-  // ScriptProcessorNode is deprecated but universally supported.
-  const proc = ctx.createScriptProcessor(bufferSize, 1, 1);
-  proc.onaudioprocess = () => {
-    jitterTimings.push(ctx.currentTime * 1000);
-  };
-  // Connect to keep the graph alive
-  const osc = ctx.createOscillator();
-  osc.frequency.value = 1; // sub-audible
-  osc.connect(proc);
-  proc.connect(ctx.destination);
-  osc.start();
+  const latest = await _fetchLatest(pkg);
+  const updateAvailable = latest != null && _semverGt(latest, _currentVersion);
 
-  setTimeout(() => {
-    osc.stop();
-    osc.disconnect();
-    proc.disconnect();
-    resolve(proc);
-  }, durationMs);
+  if (updateAvailable && !silent && isTTY$1()) {
+    _showUpdateBox(_currentVersion, latest, pkg);
+  }
+
+  return { current: _currentVersion, latest, updateAvailable };
 }
 
-async function _measureNoiseFloor(ctx) {
-  try {
-    const analyser = ctx.createAnalyser();
-    analyser.fftSize = 256;
-    analyser.connect(ctx.destination);
+/* ─── notifyOnExit ───────────────────────────────────────────────────────── */
 
-    // Silent source
-    const buf  = ctx.createBuffer(1, ctx.sampleRate * 0.1, ctx.sampleRate);
-    const src  = ctx.createBufferSource();
-    src.buffer = buf;
-    src.connect(analyser);
-    src.start();
+let _notifyRegistered = false;
 
-    await new Promise(r => setTimeout(r, 150));
+/**
+ * Register a one-time process 'exit' listener that prints the update notice
+ * after your application's own output has finished. This is the least
+ * intrusive way to show the notification.
+ *
+ * Called automatically by the package initialiser — you do not need to call
+ * this manually unless you want to control the timing.
+ *
+ * @param {object} [opts]
+ * @param {string} [opts.pkg='@svrnsec/pulse']
+ */
+function notifyOnExit(opts = {}) {
+  if (!isNode() || _notifyRegistered) return;
+  _notifyRegistered = true;
 
-    const data = new Float32Array(analyser.frequencyBinCount);
-    analyser.getFloatFrequencyData(data);
-    analyser.disconnect();
+  const pkg = opts.pkg ?? '@svrnsec/pulse';
+  let _latest = null;
 
-    // Limit to 32 bins to keep the payload small
-    const trimmed = Array.from(data.slice(0, 32)).map(v =>
-      isFinite(v) ? Math.pow(10, v / 20) : 0 // dB → linear
-    );
-    const mean = trimmed.reduce((s, v) => s + v, 0) / trimmed.length;
-    const std  = Math.sqrt(
-      trimmed.reduce((s, v) => s + (v - mean) ** 2, 0) / trimmed.length
-    );
-    return { mean, std };
-  } catch (_) {
-    return { mean: 0, std: 0 };
-  }
+  // Start the background check immediately
+  _fetchLatest(pkg).then(v => { _latest = v; }).catch(() => {});
+
+  // Show the box just before the process exits (after all user output)
+  process.on('exit', () => {
+    if (_latest && _semverGt(_latest, _currentVersion) && isTTY$1()) {
+      _showUpdateBox(_currentVersion, _latest, pkg);
+    }
+  });
 }
 
-function _percentile(arr, p) {
-  if (!arr.length) return 0;
-  const sorted = [...arr].sort((a, b) => a - b);
-  const idx    = (p / 100) * (sorted.length - 1);
-  const lo     = Math.floor(idx);
-  const hi     = Math.ceil(idx);
-  return sorted[lo] + (sorted[hi] - sorted[lo]) * (idx - lo);
+/* ─── _showUpdateBox ─────────────────────────────────────────────────────── */
+
+function _showUpdateBox(current, latest, pkg) {
+  const arrow  = ft(C.bgray, '→');
+  const oldV   = ft(C.bred,    current);
+  const newV   = ft(C.bgreen + C.bold, latest);
+  const cmd    = ft(C.bcyan + C.bold, `npm i ${pkg}@latest`);
+  const notice = ft(C.byellow + C.bold, '  UPDATE AVAILABLE  ');
+
+  _box([
+    notice,
+    '',
+    `  ${oldV}  ${arrow}  ${newV}`,
+    '',
+    `  Run:  ${cmd}`,
+    '',
+    ft(C.bgray, `  Changelog: https://github.com/ayronny14-alt/Svrn-Pulse-Security/releases`),
+  ], { borderColor: C.byellow });
+}
+
+/* ─── ANSI utilities ─────────────────────────────────────────────────────── */
+
+// Measure visible length of string (strip ANSI escape codes)
+function _visLen(s) {
+  return _stripAnsi(s).length;
+}
+
+function _stripAnsi(s) {
+  // eslint-disable-next-line no-control-regex
+  return s.replace(/\x1b\[[0-9;]*m/g, '');
 }
 
 /**
@@ -4460,6 +6098,260 @@ function _computeEvidenceWeight(payload) {
   );
 }
 
+/**
+ * @svrnsec/pulse — Terminal Result Renderer
+ *
+ * Pretty-prints probe results to the terminal for Node.js server usage.
+ * Used by middleware and the CLI so developers see clean, actionable output
+ * during integration and debugging — not raw JSON.
+ *
+ * Zero dependencies. Pure ANSI escape codes.
+ * Automatically disabled when stdout is not a TTY or NO_COLOR is set.
+ */
+
+/* ─── TTY guard ──────────────────────────────────────────────────────────── */
+
+const isTTY = () =>
+  typeof process !== 'undefined' &&
+  process.stderr?.isTTY === true &&
+  process.env?.NO_COLOR == null;
+
+const c = isTTY;
+
+/* ─── ANSI color palette ─────────────────────────────────────────────────── */
+
+const A = {
+  reset:   '\x1b[0m',
+  bold:    '\x1b[1m',
+  cyan:    '\x1b[36m',
+  gray:    '\x1b[90m',
+  // foreground — bright
+  bred:    '\x1b[91m',
+  bgreen:  '\x1b[92m',
+  byellow: '\x1b[93m',
+  bmagenta:'\x1b[95m',
+  bcyan:   '\x1b[96m',
+  bwhite:  '\x1b[97m',
+};
+
+const paint = (code, s) => c() ? `${code}${s}${A.reset}` : s;
+const bold  = (s) => paint(A.bold,    s);
+const gray  = (s) => paint(A.gray,    s);
+const cyan  = (s) => paint(A.cyan,    s);
+const green = (s) => paint(A.bgreen,  s);
+const red   = (s) => paint(A.bred,    s);
+const yel   = (s) => paint(A.byellow, s);
+const mag   = (s) => paint(A.bmagenta,s);
+const wh    = (s) => paint(A.bwhite,  s);
+
+function stripAnsi(s) {
+  // eslint-disable-next-line no-control-regex
+  return s.replace(/\x1b\[[0-9;]*m/g, '');
+}
+const visLen = (s) => stripAnsi(s).length;
+
+/* ─── bar renderer ───────────────────────────────────────────────────────── */
+
+/**
+ * Render a horizontal progress / confidence bar.
+ * @param {number}  pct      0–1
+ * @param {number}  width    character width of the bar
+ * @param {string}  fillCode ANSI color code for filled blocks
+ */
+function bar(pct, width = 20, fillCode = A.bgreen) {
+  const filled = Math.round(Math.min(1, Math.max(0, pct)) * width);
+  const empty  = width - filled;
+  const fill   = c() ? `${fillCode}${'█'.repeat(filled)}${A.reset}` : '█'.repeat(filled);
+  const void_  = gray('░'.repeat(empty));
+  return fill + void_;
+}
+
+/* ─── verdict badge ──────────────────────────────────────────────────────── */
+
+function verdictBadge(result) {
+  if (!result) return gray('  PENDING   ');
+  const { valid, score, confidence } = result;
+
+  if (valid && confidence === 'high')   return green('  ✓ PASS     ');
+  if (valid && confidence === 'medium') return yel('  ⚠ PASS     ');
+  if (!valid && score < 0.3)            return red('  ✗ BLOCKED  ');
+  return yel('  ⚠ REVIEW  ');
+}
+
+/* ─── renderProbeResult ──────────────────────────────────────────────────── */
+
+/**
+ * Print a formatted probe result card to stderr.
+ *
+ * @param {object} opts
+ * @param {object}  opts.payload          - ProofPayload from pulse()
+ * @param {string}  opts.hash             - BLAKE3 hex commitment
+ * @param {object}  [opts.result]         - ValidationResult (server-side verify)
+ * @param {object}  [opts.enf]            - EnfResult if available
+ * @param {object}  [opts.gpu]            - GpuEntropyResult if available
+ * @param {object}  [opts.dram]           - DramResult if available
+ * @param {object}  [opts.llm]            - LlmResult if available
+ * @param {number}  [opts.elapsedMs]      - total probe time
+ */
+function renderProbeResult({ payload, hash, result, enf, gpu, dram, llm, elapsedMs }) {
+  if (!c()) return;
+
+  const W    = 54;
+  gray('─'.repeat(W));
+  const vbar = gray('│');
+
+  const row = (label, value, valueColor = A.bwhite) => {
+    const lbl  = gray(label.padEnd(24));
+    const val  = c() ? `${valueColor}${value}${A.reset}` : String(value);
+    const line = `  ${lbl}${val}`;
+    const pad  = ' '.repeat(Math.max(0, W - visLen(line) - 2));
+    process.stderr.write(`${vbar}${line}${pad}  ${vbar}\n`);
+  };
+
+  const blank = () => {
+    process.stderr.write(`${vbar}${' '.repeat(W + 2)}${vbar}\n`);
+  };
+
+  const section = (title) => {
+    const t   = `  ${bold(title)}`;
+    const pad = ' '.repeat(Math.max(0, W - visLen(t) - 2));
+    process.stderr.write(`${vbar}${t}${pad}  ${vbar}\n`);
+  };
+
+  const badge = verdictBadge(result);
+  const hashShort = hash ? hash.slice(0, 16) + '…' : 'pending';
+  const elapsed   = elapsedMs ? `${(elapsedMs / 1000).toFixed(2)}s` : '—';
+
+  const sigs = payload?.signals ?? {};
+  const cls  = payload?.classification ?? {};
+  const jScore = cls.jitterScore ?? 0;
+
+  // ── Physics signals ──────────────────────────────────────────────────────
+  const qe        = sigs.entropy?.quantizationEntropy ?? 0;
+  const hurst     = sigs.entropy?.hurstExponent ?? 0;
+  const cv        = sigs.entropy?.timingsCV ?? 0;
+  const ejrClass  = qe >= 1.08 ? A.bgreen : qe >= 0.95 ? A.byellow : A.bred;
+  const hwConf    = result?.confidence === 'high' ? 1.0 : result?.confidence === 'medium' ? 0.65 : 0.3;
+  const vmConf    = 1 - hwConf;
+
+  // ── ENF signals ──────────────────────────────────────────────────────────
+  const enfRegion = enf?.gridRegion === 'americas' ? '60 Hz  Americas'
+    : enf?.gridRegion === 'emea_apac'              ? '50 Hz  EMEA/APAC'
+    : enf?.enfAvailable === false                  ? 'unavailable'
+    : '—';
+  const enfColor = enf?.ripplePresent ? A.bgreen : enf?.enfAvailable === false ? A.gray : A.byellow;
+
+  // ── GPU signals ──────────────────────────────────────────────────────────
+  const gpuStr    = gpu?.gpuPresent
+    ? (gpu.isSoftware ? red('Software renderer') : green(gpu.vendorString ?? 'GPU detected'))
+    : gray('unavailable');
+
+  // ── DRAM signals ─────────────────────────────────────────────────────────
+  const dramStr   = dram?.refreshPresent
+    ? green(`${(dram.refreshPeriodMs ?? 0).toFixed(1)} ms  (DDR4 JEDEC ✓)`)
+    : dram ? red('No refresh cycle (VM)') : gray('unavailable');
+
+  // ── LLM signals ──────────────────────────────────────────────────────────
+  const llmStr    = llm
+    ? (llm.aiConf > 0.7 ? red(`AI agent  ${(llm.aiConf * 100).toFixed(0)}%`) : green(`Human  ${((1 - llm.aiConf) * 100).toFixed(0)}%`))
+    : gray('no bio data');
+
+  // ── Render ───────────────────────────────────────────────────────────────
+  const topTitle  = `  ${mag('SVRN')}${wh(':PULSE')}  ${badge}`;
+  const topPad    = ' '.repeat(Math.max(0, W - visLen(topTitle) - 2));
+  const topBorder = gray('╭' + '─'.repeat(W + 2) + '╮');
+  const botBorder = gray('╰' + '─'.repeat(W + 2) + '╯');
+
+  process.stderr.write('\n');
+  process.stderr.write(topBorder + '\n');
+  process.stderr.write(`${vbar}${topTitle}${topPad}  ${vbar}\n`);
+  process.stderr.write(gray('├' + '─'.repeat(W + 2) + '┤') + '\n');
+  blank();
+
+  section('PHYSICS LAYER');
+  blank();
+  row('Jitter score',     (jScore * 100).toFixed(1) + '%',    jScore > 0.7 ? A.bgreen : jScore > 0.45 ? A.byellow : A.bred);
+  row('QE (entropy)',     qe.toFixed(3),                       ejrClass);
+  row('Hurst exponent',   hurst.toFixed(4),                    Math.abs(hurst - 0.5) < 0.1 ? A.bgreen : A.byellow);
+  row('Timing CV',        cv.toFixed(4),                       cv > 0.08 ? A.bgreen : A.byellow);
+  row('Timer granularity',`${((sigs.entropy?.timerGranularityMs ?? 0) * 1000).toFixed(1)} µs`, A.bcyan);
+  blank();
+
+  const hwBar = bar(hwConf, 18, A.bgreen);
+  const vmBar = bar(vmConf, 18, A.bred);
+  row('HW confidence',    hwBar + '  ' + (hwConf * 100).toFixed(0) + '%');
+  row('VM confidence',    vmBar + '  ' + (vmConf * 100).toFixed(0) + '%');
+
+  blank();
+  process.stderr.write(gray('├' + '─'.repeat(W + 2) + '┤') + '\n');
+  blank();
+
+  section('SIGNAL LAYERS');
+  blank();
+  row('Grid (ENF)',        enfRegion,   enfColor);
+  process.stderr.write(`${vbar}  ${gray('GPU (thermal)')}${' '.repeat(10)}${gpuStr}  ${vbar}\n`);
+  process.stderr.write(`${vbar}  ${gray('DRAM refresh')} ${' '.repeat(11)}${dramStr}  ${vbar}\n`);
+  process.stderr.write(`${vbar}  ${gray('Behavioral (LLM)')}${' '.repeat(7)}${llmStr}  ${vbar}\n`);
+
+  blank();
+  process.stderr.write(gray('├' + '─'.repeat(W + 2) + '┤') + '\n');
+  blank();
+
+  section('PROOF');
+  blank();
+  row('BLAKE3',           hashShort,   A.bcyan);
+  row('Nonce',            (payload?.nonce ?? '').slice(0, 16) + '…', A.gray);
+  row('Elapsed',          elapsed,     A.gray);
+  if (result) {
+    row('Server verdict', result.valid ? 'valid' : 'rejected', result.valid ? A.bgreen : A.bred);
+    row('Score',          ((result.score ?? 0) * 100).toFixed(1) + '%', A.bwhite);
+    if ((result.riskFlags ?? []).length > 0) {
+      blank();
+      row('Risk flags', result.riskFlags.join(', '), A.byellow);
+    }
+  }
+  blank();
+  process.stderr.write(botBorder + '\n\n');
+}
+
+/* ─── renderError ────────────────────────────────────────────────────────── */
+
+/**
+ * Print a formatted error card for pulse() failures.
+ * @param {Error|string} err
+ */
+function renderError(err) {
+  if (!c()) return;
+  const msg  = err?.message ?? String(err);
+  const W    = 54;
+  const vbar = gray('│');
+
+  process.stderr.write('\n');
+  process.stderr.write(red('╭' + '─'.repeat(W + 2) + '╮') + '\n');
+  process.stderr.write(`${red('│')}  ${red('✗')} ${bold('SVRN:PULSE — probe failed')}${' '.repeat(Math.max(0, W - 28))}  ${red('│')}\n`);
+  process.stderr.write(red('├' + '─'.repeat(W + 2) + '┤') + '\n');
+  process.stderr.write(`${vbar}  ${gray(msg.slice(0, W - 2).padEnd(W))}  ${vbar}\n`);
+  process.stderr.write(red('╰' + '─'.repeat(W + 2) + '╯') + '\n\n');
+}
+
+/* ─── renderUpdateBanner ─────────────────────────────────────────────────── */
+
+/**
+ * Render a simple one-line update available hint inline (used by middleware).
+ * @param {string} latest
+ */
+function renderInlineUpdateHint(latest) {
+  if (!c()) return;
+  process.stderr.write(
+    gray('  ╴╴╴  ') +
+    yel('update available ') +
+    gray(latest) +
+    '  ' + cyan('npm i @svrnsec/pulse@latest') +
+    gray('  ╴╴╴') +
+    '\n'
+  );
+}
+
 /**
  * @sovereign/pulse
  *
@@ -4507,6 +6399,11 @@ function _computeEvidenceWeight(payload) {
  */
 
 
+// Register background update check — fires once at process startup.
+// Shows a styled notification box after the process exits if a newer version
+// is available. No-op in browser environments and non-TTY outputs.
+notifyOnExit();
+
 // ---------------------------------------------------------------------------
 // Hosted API mode — pulse({ apiKey }) with zero server setup
 // ---------------------------------------------------------------------------
@@ -4662,25 +6559,47 @@ async function _runProbe(opts) {
   const bioSnapshot = bio.snapshot(entropyResult.timings);
 
   if (requireBio && !bioSnapshot.hasActivity) {
-    throw new Error('@sovereign/pulse: no bio activity detected (requireBio=true)');
+    throw new Error('@svrnsec/pulse: no bio activity detected (requireBio=true)');
   }
 
   _emit(onProgress, 'bio_done');
 
-  // ── Phase 4: Jitter analysis ───────────────────────────────────────────────
+  // ── Phase 4: Extended signal collection (non-blocking, best-effort) ───────
+  // ENF, GPU, DRAM, and LLM detectors run in parallel after the core probe.
+  // Each gracefully returns a null/unavailable result if the environment does
+  // not support it (e.g. no WebGPU, no SharedArrayBuffer, no bio events).
+  const [enfResult, gpuResult, dramResult, llmResult] = await Promise.all([
+    collectEnfTimings().catch(() => null),
+    collectGpuEntropy().catch(() => null),
+    collectDramTimings().catch(() => null),
+    Promise.resolve(detectLlmAgent(bioSnapshot)).catch(() => null),
+  ]);
+
+  _emit(onProgress, 'extended_done', {
+    enf:  enfResult?.verdict,
+    gpu:  gpuResult?.verdict,
+    dram: dramResult?.verdict,
+    llm:  llmResult?.aiConf,
+  });
+
+  // ── Phase 5: Jitter analysis ───────────────────────────────────────────────
   const jitterAnalysis = classifyJitter(entropyResult.timings, {
     autocorrelations: entropyResult.autocorrelations,
   });
 
   _emit(onProgress, 'analysis_done');
 
-  // ── Phase 5: Build proof & commitment ─────────────────────────────────────
+  // ── Phase 6: Build proof & commitment ─────────────────────────────────────
   const payload    = buildProof({
     entropy: entropyResult,
     jitter:  jitterAnalysis,
     bio:     bioSnapshot,
     canvas:  canvasResult,
     audio:   audioResult,
+    enf:     enfResult,
+    gpu:     gpuResult,
+    dram:    dramResult,
+    llm:     llmResult,
     nonce,
   });
 
@@ -4690,9 +6609,13 @@ async function _runProbe(opts) {
     score:      jitterAnalysis.score,
     confidence: _scoreToLabel(jitterAnalysis.score),
     flags:      jitterAnalysis.flags,
+    enf:        enfResult?.verdict,
+    gpu:        gpuResult?.verdict,
+    dram:       dramResult?.verdict,
+    llmConf:    llmResult?.aiConf ?? null,
   });
 
-  return commitment;
+  return { ...commitment, extended: { enf: enfResult, gpu: gpuResult, dram: dramResult, llm: llmResult } };
 }
 
 // ---------------------------------------------------------------------------
@@ -4898,5 +6821,5 @@ var pulse_core = /*#__PURE__*/Object.freeze({
   run_memory_probe: run_memory_probe
 });
 
-export { Fingerprint, detectProvider, generateNonce, pulse, runHeuristicEngine, validateProof };
+export { CURRENT_VERSION, Fingerprint, checkForUpdate, collectDramTimings, collectEnfTimings, collectGpuEntropy, detectLlmAgent, detectProvider, generateNonce, pulse, renderError, renderInlineUpdateHint, renderProbeResult, runHeuristicEngine, validateProof };
 //# sourceMappingURL=pulse.esm.js.map