@nekzus/liop-studio 1.0.0-alpha.2 → 1.0.0-alpha.21

package/README.md

@@ -1,53 +1,96 @@
-# @nekzus/liop-studio
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/Nekzus/LIOP/main/docs/logo/dark.svg">
+    <img alt="Logic-Injection-on-Origin Protocol Logo" src="https://raw.githubusercontent.com/Nekzus/LIOP/main/docs/logo/light.svg" width="600">
+  </picture>
+
+  <h1>@nekzus/liop-studio</h1>
+  <p><strong>LIOP Sovereign Studio & Network Scanner</strong></p>
+  <p>Interactive developer studio, real-time telemetry console, and zero-trust capability scanner for the Logic-Injection-on-Origin Protocol (LIOP) and Model Context Protocol (MCP).</p>
+
+  <p align="center">
+    <a href="https://www.npmjs.com/package/@nekzus/liop-studio"><img src="https://img.shields.io/npm/v/@nekzus/liop-studio.svg" alt="npm version"></a>
+    <a href="https://github.com/Nekzus/LIOP/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License"></a>
+    <a href="https://nekzus-32.mintlify.app/typescript-sdk/playground"><img src="https://img.shields.io/badge/docs-mintlify-0D9373?style=flat" alt="Docs"></a>
+    <a href="https://deepwiki.com/Nekzus/LIOP"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a>
+  </p>
+</div>
 
-[![npm version](https://img.shields.io/npm/v/@nekzus/liop-studio.svg)](https://www.npmjs.com/package/@nekzus/liop-studio)
-[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
-[![Documentation](https://img.shields.io/badge/docs-mintlify-4E46E5.svg)](https://nekzus-32.mintlify.app/)
+---
+
+## Official Documentation
+
+Interactive guides and architectural deep dives for LIOP Studio and Playground are hosted on Mintlify:
+
+| Documentation Section | Focus Area | Canonical Guide |
+|---|---|---|
+| **Studio & Playground** | Web console architecture, 5-tab output inspector, and execution flows | [Playground & Studio Guide](https://nekzus-32.mintlify.app/typescript-sdk/playground) |
+| **Observability Runbook** | Prometheus metrics catalog and 26-panel Grafana master dashboard | [Observability Runbook](https://nekzus-32.mintlify.app/operations/observability-runbook) |
+| **TypeScript SDK** | Core runtime integration, client negotiation, and server sandboxing | [SDK Overview](https://nekzus-32.mintlify.app/typescript-sdk/overview) |
+
+---
+
+## Overview
+
+`@nekzus/liop-studio` provides both a full-featured web dashboard and a headless CLI scanner to interact with LIOP sovereign enclaves and standard MCP servers. It allows developers and security auditors to test Logic-Injection-on-Origin payloads, measure AST instruction fuel consumption, trace post-quantum cryptographic handshakes, and inspect ZK-Receipts in real time.
 
-> **LIOP Sovereign Studio & Mesh Scanner**: Developer studio, interactive testbed, and network scanner for the Logic-Injection-on-Origin Protocol (LIOP) and Model Context Protocol (MCP).
+### Key Capabilities
+
+- **Interactive Web Console (`:16000`)**: Full-featured React 19 UI with real-time SSE execution streaming, CodeMirror 6 code editor, and live cluster health monitoring.
+- **5-Tab Results Inspector**:
+  - `Output`: Archetype-specific formatted data and sanitized JSON structures.
+  - `Debug`: Granular step-by-step traces across AST validation, sandbox execution, and egress filtering.
+  - `Telemetry`: In-situ AST fuel consumption (quantized to 100 units), BPE token counting (`o200k_base`), and wire egress savings.
+  - `Export`: Auto-generated client integration snippets (TypeScript SDK, Python, cURL, gRPC).
+  - `History`: In-memory inspection of the last 20 execution runs.
+- **Headless Network Scanner**: CLI command (`scan`) to perform non-interactive health probes and capability discovery over HTTP, gRPC, and P2P multiaddrs.
+- **Dual Dynamic Themes**: High-contrast OLED Obsidian (`#000000`) and Slate Navy (`#0f172a`) modes backed by semantic CSS custom properties.
 
 ---
 
-## 🚀 Quickstart
+## Quickstart
 
 ### 1. Launch Interactive Studio (Web UI)
+
+Run the studio directly using `npx` (serves the web interface on `http://localhost:16000`):
+
 ```bash
-# Launch on default port (http://localhost:16000)
+# Launch default web console on port 16000
 npx @nekzus/liop-studio
 
-# Launch targeting a specific MCP endpoint
-npx @nekzus/liop-studio --http "http://localhost:3000/mcp"
+# Launch targeting a specific MCP HTTP endpoint
+npx @nekzus/liop-studio --http "http://localhost:15000/mcp"
 
-# Launch targeting a native LIOP gRPC node
-npx @nekzus/liop-studio --grpc "127.0.0.1:50051"
+# Launch targeting a native LIOP gRPC enclave
+npx @nekzus/liop-studio --grpc "127.0.0.1:15011"
 ```
 
-### 2. Run Headless Network & Capability Scan (CLI)
+### 2. Run Headless Capability Scan (CLI)
+
+Perform instant health, discovery, and security scans from terminal scripts or CI pipelines:
+
 ```bash
-# Quick health and capabilities scan of an MCP or LIOP server
-npx @nekzus/liop-studio scan http://localhost:3000/mcp
+# Quick health and capabilities scan of an HTTP MCP / LIOP gateway
+npx @nekzus/liop-studio scan http://localhost:15000/mcp
 
-# Scan a native gRPC node
-npx @nekzus/liop-studio scan 127.0.0.1:50051
+# Scan a native gRPC sovereign enclave
+npx @nekzus/liop-studio scan 127.0.0.1:15011
 
 # Scan a P2P DHT multiaddr
-npx @nekzus/liop-studio scan /ip4/127.0.0.1/tcp/4000/p2p/12D3KooW...
+npx @nekzus/liop-studio scan /ip4/127.0.0.1/tcp/15001/p2p/12D3KooW...
 ```
 
 ---
 
-## 🛡️ Security Guardrails
-- **CWE-78 Command Injection Defense**: Stdio subprocess execution strictly enforces `{ shell: false }` with executable and argument sanitization.
-- **CWE-918 SSRF Protection**: All outbound HTTP probes validate URLs and block cloud metadata IP addresses (`169.254.169.254`).
-- **NIST SP 800-53 Timing Side-Channel Protection**: Deterministic instruction fuel quantized to 100 units.
-- **Zero-Trust Origin Execution**: V8 Isolate sandboxing with poisoned globals and frozen prototypes.
-
----
+## Security & Sandboxing Guardrails
 
-## 📚 Documentation
-For complete guides, API references, and architecture specifications, visit the [official LIOP documentation](https://nekzus-32.mintlify.app/).
+- **CWE-78 Command Injection Defense**: Stdio subprocess spawning strictly enforces `{ shell: false }` with rigorous argument and binary sanitization.
+- **CWE-918 SSRF Protection**: All outbound HTTP probes validate destination addresses and explicitly block cloud metadata IPs (`169.254.169.254`).
+- **NIST SP 800-53 Timing Side-Channel Elimination**: Deterministic AST instruction fuel scoring quantized into 100-unit buckets (`stddev = 0`).
+- **Zero-Trust V8 Sandbox**: PAYLOAD execution occurs within isolated V8 contexts with 25 poisoned globals and 11 frozen prototypes.
 
 ---
 
-## 📄 License
-Apache-2.0. Copyright 2026 Nekzus Solutions and contributors.
+## License
+
+Licensed under the [Apache License, Version 2.0](../../LICENSE). Copyright 2026 [Nekzus Solutions](https://github.com/Nekzus) and contributors.

package/dist/cli/index.js

@@ -5,9 +5,9 @@ import { Command } from "commander";
 import pc2 from "picocolors";
 
 // src/server/index.ts
-import path from "path";
+import path2 from "path";
 import process3 from "process";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { TokenTelemetryEngine as TokenTelemetryEngine5 } from "@nekzus/liop";
@@ -63,10 +63,29 @@ function validateHttpTarget(targetUrl) {
   }
   return parsed;
 }
-function validateHostHeader(host, allowedHosts = ["localhost", "127.0.0.1", "0.0.0.0"]) {
+function validateHostHeader(host, allowedHosts = [
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "::1",
+  "[::1]"
+]) {
   if (!host) return false;
-  const hostname = host.split(":")[0].toLowerCase();
-  return allowedHosts.includes(hostname);
+  const trimmed = host.trim();
+  let hostname;
+  if (trimmed.startsWith("[")) {
+    const closingIndex = trimmed.indexOf("]");
+    hostname = closingIndex !== -1 ? trimmed.slice(0, closingIndex + 1) : trimmed;
+  } else if (trimmed.includes(":") && trimmed.indexOf(":") !== trimmed.lastIndexOf(":")) {
+    hostname = trimmed;
+  } else {
+    hostname = trimmed.split(":")[0];
+  }
+  hostname = hostname.toLowerCase();
+  return allowedHosts.some((allowed) => {
+    const normAllowed = allowed.toLowerCase();
+    return normAllowed === hostname || hostname === "[::1]" && normAllowed === "::1" || hostname === "::1" && normAllowed === "[::1]";
+  });
 }
 
 // src/transports/grpc.transport.ts
@@ -91,7 +110,8 @@ var DEFAULT_PRESET_PROFILES = [
     role: "Clinical Healthcare & EHR Patient Records",
     isolation: "pnet Swarm Key (PSK) + HIPAA Strict Mode",
     dataset: "2,500 clinical EHR patient records",
-    defaultTool: "Analyze_Synthetic_Medical_Records"
+    defaultTool: "Analyze_Synthetic_Medical_Records",
+    defaultTools: ["Analyze_Synthetic_Medical_Records"]
   },
   {
     id: "bank",
@@ -103,7 +123,8 @@ var DEFAULT_PRESET_PROFILES = [
     role: "Core Banking & Financial Settlement",
     isolation: "pnet Swarm Key (PSK) + Differential Privacy",
     dataset: "1,500 synthetic accounts ($148M balance)",
-    defaultTool: "Analyze_Synthetic_Bank_Transactions"
+    defaultTool: "Analyze_Synthetic_Bank_Transactions",
+    defaultTools: ["Analyze_Synthetic_Bank_Transactions"]
   },
   {
     id: "blg",
@@ -114,7 +135,12 @@ var DEFAULT_PRESET_PROFILES = [
     tierLabel: "Tier 1: Sovereign Enclaves (In-Situ Origin)",
     role: "Dual-NIC Perimeter Security Bridge (Tier 1 <-> Tier 2)",
     isolation: "6-Layer Zero-Trust + AST Guardian + Egress Shield",
-    defaultTool: "BLG_Inspect_Enclave_Perimeter"
+    defaultTool: "BLG_Inspect_Enclave_Perimeter",
+    defaultTools: [
+      "BLG_Inspect_Enclave_Perimeter",
+      "BLG_Execute_Healthcare_Analytics",
+      "BLG_Execute_Banking_Analytics"
+    ]
   },
   {
     id: "oracle",
@@ -126,7 +152,8 @@ var DEFAULT_PRESET_PROFILES = [
     role: "Real-time High Frequency Trading Market Simulator",
     isolation: "Consortium Node + 50ms Tick Streaming Buffer",
     dataset: "8 Instruments + L2 Orderbook",
-    defaultTool: "Analyze_HFT_Market_Data"
+    defaultTool: "Analyze_HFT_Market_Data",
+    defaultTools: ["Analyze_HFT_Market_Data", "LiopMeshStatus"]
   },
   {
     id: "relay",
@@ -136,7 +163,8 @@ var DEFAULT_PRESET_PROFILES = [
     tierLabel: "Tier 2: Consortium Routing & Gateways",
     role: "Kademlia DHT & libp2p Circuit Relay v2 Node",
     isolation: "Public Swarm Mesh Relay",
-    defaultTool: "LiopMeshStatus"
+    defaultTool: "LiopMeshStatus",
+    defaultTools: ["LiopMeshStatus"]
   },
   {
     id: "nexus",
@@ -146,7 +174,8 @@ var DEFAULT_PRESET_PROFILES = [
     tierLabel: "Tier 2: Consortium Routing & Gateways",
     role: "OAuth 2.1 RFC 8707 Auth Server & Mesh Authority",
     isolation: "Zero-Trust Identity Provider",
-    defaultTool: "Authenticate_Client"
+    defaultTool: "Authenticate_Client",
+    defaultTools: ["Authenticate_Client"]
   },
   {
     id: "edge",
@@ -158,7 +187,8 @@ var DEFAULT_PRESET_PROFILES = [
     role: "Edge Telemetry & Hostile 3G WAN Industrial Node",
     isolation: "WAN Jitter/Loss Resistant Client",
     dataset: "Edge Telemetry Sensors (Pressure, RPM, Temp)",
-    defaultTool: "Analyze_IoT_Sensor_Data"
+    defaultTool: "Analyze_IoT_Sensor_Data",
+    defaultTools: ["Analyze_IoT_Sensor_Data"]
   }
 ];
 var NetworkDiscoveryEngine = class _NetworkDiscoveryEngine {
@@ -191,7 +221,7 @@ var NetworkDiscoveryEngine = class _NetworkDiscoveryEngine {
   /**
    * Probe a specific HTTP/Health endpoint dynamically.
    */
-  async probeHttpNode(host, port, timeoutMs = 1200) {
+  async probeHttpNode(host, port, timeoutMs = 3500) {
     const url = `http://${host}:${port}`;
     const t0 = performance.now();
     const controller = new AbortController();
@@ -278,7 +308,7 @@ var NetworkDiscoveryEngine = class _NetworkDiscoveryEngine {
             peerId: probe.peerId || `peer-${profile.id}`,
             multiaddrs: probe.multiaddrs || [],
             version: probe.version || "2.5.0",
-            tools: probe.tools && probe.tools.length > 0 ? probe.tools : [],
+            tools: probe.tools && probe.tools.length > 0 ? probe.tools : profile.defaultTools || (profile.defaultTool ? [profile.defaultTool] : []),
             role: profile.role,
             isolation: profile.isolation,
             dataset: profile.dataset,
@@ -300,7 +330,7 @@ var NetworkDiscoveryEngine = class _NetworkDiscoveryEngine {
             peerId: `peer-${profile.id}`,
             multiaddrs: [],
             version: "2.5.0",
-            tools: [],
+            tools: profile.defaultTools || (profile.defaultTool ? [profile.defaultTool] : []),
             role: profile.role,
             isolation: profile.isolation,
             dataset: profile.dataset,
@@ -338,7 +368,7 @@ var NetworkDiscoveryEngine = class _NetworkDiscoveryEngine {
       const probe = await this.probeHttpNode(host, matchedProfile.httpPort);
       const isOnline = status === "online" || Boolean(probe?.tools) && (probe?.tools?.length ?? 0) > 0;
       const nodeName = probe?.name?.replace("PRODUCTION-", "").replace(/-/g, " ") || matchedProfile.defaultName;
-      const defaultTools = matchedProfile.defaultTool ? [matchedProfile.defaultTool] : ["Execute_WASI_Logic"];
+      const defaultTools = matchedProfile.defaultTools || (matchedProfile.defaultTool ? [matchedProfile.defaultTool] : ["Execute_WASI_Logic"]);
       const tools = isOnline ? probe?.tools && probe.tools.length > 0 ? probe.tools : defaultTools : [];
       const enriched = isOnline && probe?.enrichedTools && probe.enrichedTools.length > 0 ? probe.enrichedTools : tools.map((t) => ({
         name: t,
@@ -456,16 +486,22 @@ var GrpcTransport = class {
   connected = false;
   target;
   token;
+  tlsConfig;
   constructor(options) {
     this.target = options.target.replace(/^grpc:\/\//, "");
     this.token = options.token;
+    this.tlsConfig = options.tls;
   }
   isConnected() {
     return this.connected && this.client !== null;
   }
   async connect() {
     const tokenProvider = this.token || createStudioTokenProvider();
-    this.client = new LiopRpcClient(this.target, void 0, tokenProvider);
+    const tls = this.tlsConfig || {
+      insecure: true,
+      suppressWarning: true
+    };
+    this.client = new LiopRpcClient(this.target, tls, tokenProvider);
     this.connected = true;
   }
   async disconnect() {
@@ -1180,9 +1216,7 @@ var MeshTransport = class {
       if (!this.isConnected()) {
         await this.connect();
       }
-      const clientAny = this.client;
-      const peerId = clientAny.meshNode?.getPeerId?.()?.toString() || "UnknownPeer";
-      const _connections = clientAny.meshNode?.node?.getConnections?.() || [];
+      const peerId = this.client.peerId ?? "UnknownPeer";
       const latencyMs = Math.max(1, Math.round(performance.now() - tStart));
       const discovery = NetworkDiscoveryEngine.getInstance();
       const meshDiscovered = await discovery.scanNetwork("127.0.0.1").catch(() => []);
@@ -1867,12 +1901,40 @@ function createTransport(config) {
   }
 }
 
-// src/server/index.ts
+// src/version.ts
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
 var __dirname = path.dirname(fileURLToPath(import.meta.url));
+function getPackageVersion() {
+  try {
+    let currentDir = __dirname;
+    for (let i = 0; i < 4; i++) {
+      const candidate = path.join(currentDir, "package.json");
+      if (fs.existsSync(candidate)) {
+        const raw = fs.readFileSync(candidate, "utf-8");
+        const parsed = JSON.parse(raw);
+        if (parsed.name === "@nekzus/liop-studio" && typeof parsed.version === "string") {
+          return parsed.version;
+        }
+      }
+      currentDir = path.dirname(currentDir);
+    }
+  } catch {
+  }
+  return "1.0.0-alpha.5";
+}
+var STUDIO_VERSION = getPackageVersion();
+
+// src/server/index.ts
+var __dirname2 = path2.dirname(fileURLToPath2(import.meta.url));
 function createStudioServer(options = {}) {
+  if (!process3.env.LIOP_SUPPRESS_TLS_WARNING) {
+    process3.env.LIOP_SUPPRESS_TLS_WARNING = "true";
+  }
   const app = new Hono();
   const port = options.port || 16e3;
-  const distPath = options.distPath || path.resolve(__dirname, "../../ui/dist");
+  const distPath = options.distPath || path2.resolve(__dirname2, "../../ui/dist");
   let activeConfig = options.initialTarget || {
     type: "http",
     http: { url: process3.env.LIOP_MCP_URL || "http://127.0.0.1:15000/mcp" }
@@ -1892,7 +1954,7 @@ function createStudioServer(options = {}) {
   app.use(
     "/*",
     serveStatic({
-      root: path.relative(process3.cwd(), distPath).replace(/\\/g, "/"),
+      root: distPath,
       rewriteRequestPath: (pathStr) => {
         if (!pathStr.includes(".") && !pathStr.startsWith("/api") && pathStr !== "/health") {
           return "/index.html";
@@ -1905,7 +1967,7 @@ function createStudioServer(options = {}) {
     const isConnected = activeTransport.isConnected() && lastReport?.status === "online";
     return c.json({
       status: isConnected ? "healthy" : "offline",
-      version: "1.0.0",
+      version: STUDIO_VERSION,
       targetType: activeConfig.type,
       connected: isConnected
     });
@@ -1921,7 +1983,7 @@ function createStudioServer(options = {}) {
       connected: isConnected,
       toolsCount: isConnected ? lastReport?.totalTools || 0 : 0,
       latencyMs: isConnected ? lastReport?.latencyMs || 0 : 0,
-      version: "1.0.0",
+      version: STUDIO_VERSION,
       serverInfo: lastReport?.serverInfo
     });
   });
@@ -2186,7 +2248,11 @@ function resolveTargetConfig(target, options = {}) {
   if (isGrpcExplicit || /^([a-zA-Z0-9.-]+):(\d+)$/.test(trimmed) || trimmed.startsWith("grpc://")) {
     return {
       type: "grpc",
-      grpc: { target: trimmed, token }
+      grpc: {
+        target: trimmed,
+        token,
+        tls: { insecure: true, suppressWarning: true }
+      }
     };
   }
   const parts = trimmed.split(/\s+/);
@@ -2199,6 +2265,9 @@ function resolveTargetConfig(target, options = {}) {
   };
 }
 async function runScan(targetStr, options) {
+  if (!process4.env.LIOP_SUPPRESS_TLS_WARNING) {
+    process4.env.LIOP_SUPPRESS_TLS_WARNING = "true";
+  }
   const config = resolveTargetConfig(targetStr, options.token);
   const transport = createTransport(config);
   try {
@@ -2226,14 +2295,24 @@ async function main() {
   const program = new Command();
   program.name("liop-studio").description(
     "LIOP Sovereign Studio & Mesh Scanner (Universal MCP / LIOP Inspector)"
-  ).version("1.0.0-alpha.0").option("-p, --port <port>", "Port to bind local Studio server", "16000").option("--no-open", "Do not automatically open browser on launch").option(
+  ).version(STUDIO_VERSION).option("-p, --port <port>", "Port to bind local Studio server", "16000").option("--no-open", "Do not automatically open browser on launch").option(
     "--stdio <command>",
     "Initial target: Stdio command (e.g. 'node server.js')"
   ).option("--http <url>", "Initial target: HTTP / SSE MCP URL").option("--grpc <target>", "Initial target: Native LIOP gRPC endpoint").option("--mesh <multiaddr>", "Initial target: Libp2p P2P bootstrap node").option(
     "--token <token>",
     "Bearer or access token for target authentication"
+  ).option("--tls-ca <path>", "Path to root CA certificate for gRPC target").option(
+    "--tls-cert <path>",
+    "Path to client certificate chain for gRPC target"
+  ).option("--tls-key <path>", "Path to client private key for gRPC target").option(
+    "--insecure",
+    "Explicitly permit unencrypted gRPC credentials",
+    true
   ).action(async (options) => {
     const port = Number.parseInt(options.port, 10) || 16e3;
+    if (!options.tlsCa && !options.tlsCert && !options.tlsKey) {
+      process5.env.LIOP_SUPPRESS_TLS_WARNING = "true";
+    }
     let initialTarget;
     if (options.stdio) {
       const parts = options.stdio.trim().split(/\s+/);
@@ -2249,7 +2328,18 @@ async function main() {
     } else if (options.grpc) {
       initialTarget = {
         type: "grpc",
-        grpc: { target: options.grpc, token: options.token }
+        grpc: {
+          target: options.grpc,
+          token: options.token,
+          tls: options.tlsCa ? {
+            rootCert: options.tlsCa,
+            certChain: options.tlsCert,
+            privateKey: options.tlsKey
+          } : {
+            insecure: true,
+            suppressWarning: true
+          }
+        }
       };
     } else if (options.mesh) {
       initialTarget = {