@nekzus/liop 1.0.0-alpha.1

package/dist/index.js

@@ -0,0 +1,357 @@
+export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-7BSCUYUE.js';
+export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-T7R5HUFD.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-BOISQ45Z.js';
+export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, isGrpcWebRequest } from './chunk-3L2O2XKG.js';
+export { RoutingTable, probeTopology } from './chunk-UCVP3XAL.js';
+export { TokenManager } from './chunk-ESRXG36Y.js';
+export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-HD2N3IJX.js';
+export { sanitizeOutput } from './chunk-Y62GORQF.js';
+export { LiopMcpRouter } from './chunk-L6J72C5X.js';
+export { HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-DZ2FQGJD.js';
+import './chunk-PEN3KFLF.js';
+import './chunk-IK7CGWAZ.js';
+export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
+export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest } from './chunk-VH4K4U45.js';
+export { GRPC_CHANNEL_OPTIONS } from './chunk-TKRX6CFI.js';
+export { Counter, Gauge, Histogram, MetricsRegistry, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, protocolMetrics, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, wireEgressBytesTotal, wireSavedBytesTotal, zkVerificationDurationMs, zkVerificationsTotal } from './chunk-PAICJCKJ.js';
+export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-EG46XMJT.js';
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
+export { MeshNode } from './chunk-7RXOIDXP.js';
+import { log } from './chunk-HA6YZ42O.js';
+import * as crypto from 'crypto';
+import { EventEmitter } from 'events';
+import * as fs from 'fs';
+
+// src/errors.ts
+var ErrorCode = /* @__PURE__ */ ((ErrorCode2) => {
+  ErrorCode2["CapabilityViolation"] = "CapabilityViolation";
+  ErrorCode2["SandboxEscape"] = "SandboxEscape";
+  ErrorCode2["PiiLeak"] = "PiiLeak";
+  ErrorCode2["InvalidIntent"] = "InvalidIntent";
+  ErrorCode2["Throttled"] = "Throttled";
+  ErrorCode2["ZkVerificationFailed"] = "ZkVerificationFailed";
+  ErrorCode2["MeshUnavailable"] = "MeshUnavailable";
+  ErrorCode2["ConnectionFailed"] = "ConnectionFailed";
+  return ErrorCode2;
+})(ErrorCode || {});
+var LiopError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "LiopError";
+    this.code = code;
+  }
+};
+var TRACEPARENT_REGEX = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
+var LiopTracer = class _LiopTracer {
+  static generateTraceId() {
+    let id;
+    do {
+      id = crypto.randomBytes(16).toString("hex");
+    } while (id === "0".repeat(32));
+    return id;
+  }
+  static generateSpanId() {
+    let id;
+    do {
+      id = crypto.randomBytes(8).toString("hex");
+    } while (id === "0".repeat(16));
+    return id;
+  }
+  static formatTraceparent(traceId, spanId, sampled = true) {
+    const flags = sampled ? "01" : "00";
+    return `00-${traceId}-${spanId}-${flags}`;
+  }
+  static parseTraceparent(header) {
+    if (!header || typeof header !== "string") {
+      return null;
+    }
+    const trimmed = header.trim();
+    const match = TRACEPARENT_REGEX.exec(trimmed);
+    if (!match) {
+      return null;
+    }
+    const [, version, traceId, spanId, flags] = match;
+    if (version === "00") {
+      if (traceId === "0".repeat(32) || spanId === "0".repeat(16)) {
+        return null;
+      }
+    }
+    const sampled = (Number.parseInt(flags, 16) & 1) === 1;
+    return {
+      traceId,
+      spanId,
+      sampled
+    };
+  }
+  static injectTraceparent(carrier, context) {
+    carrier.traceparent = _LiopTracer.formatTraceparent(
+      context.traceId,
+      context.spanId,
+      context.sampled
+    );
+  }
+  static extractTraceparent(carrier) {
+    const val = carrier.traceparent || carrier.Traceparent;
+    if (Array.isArray(val)) {
+      return _LiopTracer.parseTraceparent(val[0]);
+    }
+    return _LiopTracer.parseTraceparent(val);
+  }
+  startSpan(name, parent, attributes = {}) {
+    const traceId = parent?.traceId || _LiopTracer.generateTraceId();
+    const spanId = _LiopTracer.generateSpanId();
+    const sampled = parent ? parent.sampled : true;
+    const context = {
+      traceId,
+      spanId,
+      sampled
+    };
+    const span = {
+      name,
+      context,
+      startTime: Date.now(),
+      attributes: { ...attributes },
+      status: "OK",
+      setAttribute(key, value) {
+        this.attributes[key] = value;
+        return this;
+      },
+      recordException(err) {
+        this.status = "ERROR";
+        this.error = typeof err === "string" ? err : err.message;
+        return this;
+      },
+      end() {
+        this.endTime = Date.now();
+      }
+    };
+    return span;
+  }
+};
+var defaultTracer = new LiopTracer();
+
+// src/prompts/adapters.ts
+var PROVIDER_CONFIGS = {
+  claude: { xmlStandard: true, jsonSchemaPreferred: false },
+  openai: { xmlStandard: false, jsonSchemaPreferred: true },
+  gemini: { xmlStandard: false, jsonSchemaPreferred: true }
+};
+function generateSystemInstructions(provider) {
+  const config = PROVIDER_CONFIGS[provider];
+  let instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]
+You are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.
+Unlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.
+
+### CORE PARADIGM
+When you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.
+The node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.
+
+### EXECUTION RULES
+1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.
+2. Rely only on standard ECMA script features (No Node.js polyfills).
+3. The logic must end by returning the calculated insights, not the raw data.
+
+### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)
+To prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:
+- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.
+- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).
+- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.
+
+### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS
+- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).
+  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').
+- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.
+- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.
+- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.
+`;
+  if (config.xmlStandard) {
+    instructions += `
+### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)
+You must wrap your logic precisely within <liop_logic> tags.
+Example:
+<liop_logic>
+const records = await liop.readResource("liop://vault/patients");
+const filtered = records.filter(r => r.disease === "Hypertension");
+return { alert: "High risk demographic", targetCount: filtered.length };
+</liop_logic>
+`;
+  } else if (config.jsonSchemaPreferred) {
+    instructions += `
+### PAYLOAD FORMATTING (JSON PARSING PREFERRED)
+You must provide your logic strictly within a JSON string key called \`"logic_blob"\` inside your tool call parameters.
+Example:
+{
+  "target": "liop://vault/patients",
+  "logic_blob": "const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };"
+}
+`;
+  }
+  return instructions;
+}
+var CertManager = class extends EventEmitter {
+  constructor(options) {
+    super();
+    this.options = options;
+    this.warningDays = options.warningDays ?? 30;
+    this.debounceMs = options.debounceMs ?? 150;
+    this.loadCertificates();
+    if (options.watchFiles !== false) {
+      this.setupWatchers();
+    }
+  }
+  options;
+  rootCertBuffer = null;
+  certChainBuffer = null;
+  privateKeyBuffer = null;
+  watchers = [];
+  reloadDebounceTimer = null;
+  warningDays;
+  debounceMs;
+  /**
+   * Synchronously loads or reloads certificates from filesystem into memory.
+   */
+  loadCertificates() {
+    try {
+      if (this.options.rootCertPath && fs.existsSync(this.options.rootCertPath)) {
+        this.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);
+      }
+      if (!fs.existsSync(this.options.certChainPath)) {
+        throw new Error(
+          `Certificate chain file not found: ${this.options.certChainPath}`
+        );
+      }
+      if (!fs.existsSync(this.options.privateKeyPath)) {
+        throw new Error(
+          `Private key file not found: ${this.options.privateKeyPath}`
+        );
+      }
+      this.certChainBuffer = fs.readFileSync(this.options.certChainPath);
+      this.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);
+      log.info("[CertManager] Certificates loaded successfully.");
+    } catch (error) {
+      log.error(`[CertManager] Failed to load certificates: ${error}`);
+      throw error;
+    }
+  }
+  /**
+   * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.
+   */
+  inspectCertificate() {
+    if (!this.certChainBuffer) {
+      throw new Error("[CertManager] No certificate loaded to inspect.");
+    }
+    const x509 = new crypto.X509Certificate(this.certChainBuffer);
+    const validToDate = new Date(x509.validTo);
+    const now = /* @__PURE__ */ new Date();
+    const msRemaining = validToDate.getTime() - now.getTime();
+    const daysRemaining = Math.max(
+      0,
+      Math.floor(msRemaining / (1e3 * 60 * 60 * 24))
+    );
+    const isExpired = msRemaining <= 0;
+    const isExpiringSoon = daysRemaining <= this.warningDays;
+    return {
+      subject: x509.subject,
+      issuer: x509.issuer,
+      validFrom: x509.validFrom,
+      validTo: x509.validTo,
+      fingerprint256: x509.fingerprint256,
+      daysRemaining,
+      isExpired,
+      isExpiringSoon
+    };
+  }
+  /**
+   * Sets up non-blocking filesystem watchers to detect certificate renewals
+   * and trigger hot-reloading without process restarts.
+   */
+  setupWatchers() {
+    const filesToWatch = [
+      this.options.certChainPath,
+      this.options.privateKeyPath,
+      this.options.rootCertPath
+    ].filter((p) => Boolean(p && fs.existsSync(p)));
+    for (const filePath of filesToWatch) {
+      try {
+        const watcher = fs.watch(filePath, () => {
+          this.scheduleReload();
+        });
+        this.watchers.push(watcher);
+      } catch (err) {
+        log.warn(
+          `[CertManager] Could not watch ${filePath} for hot reloading: ${err}`
+        );
+      }
+    }
+  }
+  /**
+   * Debounces reload events to ensure files have finished writing.
+   */
+  scheduleReload() {
+    if (this.reloadDebounceTimer) {
+      clearTimeout(this.reloadDebounceTimer);
+    }
+    this.reloadDebounceTimer = setTimeout(() => {
+      try {
+        this.loadCertificates();
+        const certInfo = this.inspectCertificate();
+        log.info(
+          `[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`
+        );
+        this.emit("reload", certInfo);
+      } catch (error) {
+        log.error(`[CertManager] Hot reload failed: ${error}`);
+        this.emit("error", error);
+      }
+    }, this.debounceMs);
+  }
+  /**
+   * Manually triggers a reload of certificates and emits the 'reload' event.
+   */
+  reload() {
+    this.loadCertificates();
+    const certInfo = this.inspectCertificate();
+    log.info(
+      `[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`
+    );
+    this.emit("reload", certInfo);
+    return certInfo;
+  }
+  getRootCert() {
+    return this.rootCertBuffer;
+  }
+  getCertChain() {
+    if (!this.certChainBuffer) {
+      throw new Error("[CertManager] Certificate chain not loaded.");
+    }
+    return this.certChainBuffer;
+  }
+  getPrivateKey() {
+    if (!this.privateKeyBuffer) {
+      throw new Error("[CertManager] Private key not loaded.");
+    }
+    return this.privateKeyBuffer;
+  }
+  /**
+   * Stops all active file watchers and releases resources.
+   */
+  dispose() {
+    if (this.reloadDebounceTimer) {
+      clearTimeout(this.reloadDebounceTimer);
+      this.reloadDebounceTimer = null;
+    }
+    for (const watcher of this.watchers) {
+      try {
+        watcher.close();
+      } catch {
+      }
+    }
+    this.watchers = [];
+    this.removeAllListeners();
+  }
+};
+
+export { CertManager, ErrorCode, LiopError, LiopTracer, defaultTracer, generateSystemInstructions };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/observability/tracing.ts","../src/prompts/adapters.ts","../src/security/cert-manager.ts"],"names":["ErrorCode","crypto2"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAGO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;ACQA,IAAM,iBAAA,GACL,6DAAA;AAEM,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAc,eAAA,GAA0B;AACvC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC3C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,cAAA,GAAyB;AACtC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC1C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,MAAA,EACA,UAAU,IAAA,EACD;AACT,IAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,GAAO,IAAA;AAC/B,IAAA,OAAO,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,EAAI,MAAM,IAAI,KAAK,CAAA,CAAA;AAAA,EACxC;AAAA,EAEA,OAAc,iBAAiB,MAAA,EAA4C;AAC1E,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,MAAA,OAAO,IAAA;AAAA,IACR;AACA,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,GAAG,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,GAAI,KAAA;AAE5C,IAAA,IAAI,YAAY,IAAA,EAAM;AACrB,MAAA,IAAI,OAAA,KAAY,IAAI,MAAA,CAAO,EAAE,KAAK,MAAA,KAAW,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AAC5D,QAAA,OAAO,IAAA;AAAA,MACR;AAAA,IACD;AAEA,IAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,IAAI,CAAA,MAAU,CAAA;AACxD,IAAA,OAAO;AAAA,MACN,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,OAAA,EACO;AACP,IAAA,OAAA,CAAQ,cAAc,WAAA,CAAW,iBAAA;AAAA,MAChC,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACT;AAAA,EACD;AAAA,EAEA,OAAc,mBACb,OAAA,EACqB;AACrB,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,WAAA,CAAW,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,WAAA,CAAW,iBAAiB,GAAG,CAAA;AAAA,EACvC;AAAA,EAEO,SAAA,CACN,IAAA,EACA,MAAA,EACA,UAAA,GAAwD,EAAC,EAC9C;AACX,IAAA,MAAM,OAAA,GAAU,MAAA,EAAQ,OAAA,IAAW,WAAA,CAAW,eAAA,EAAgB;AAC9D,IAAA,MAAM,MAAA,GAAS,YAAW,cAAA,EAAe;AACzC,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,MAAA,CAAO,OAAA,GAAU,IAAA;AAE1C,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC5B,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,MAAM,IAAA,GAAiB;AAAA,MACtB,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,MACpB,UAAA,EAAY,EAAE,GAAG,UAAA,EAAW;AAAA,MAC5B,MAAA,EAAQ,IAAA;AAAA,MACR,YAAA,CAAa,KAAK,KAAA,EAAO;AACxB,QAAA,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,gBAAgB,GAAA,EAAK;AACpB,QAAA,IAAA,CAAK,MAAA,GAAS,OAAA;AACd,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAO,GAAA,KAAQ,QAAA,GAAW,MAAM,GAAA,CAAI,OAAA;AACjD,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,GAAA,GAAM;AACL,QAAA,IAAA,CAAK,OAAA,GAAU,KAAK,GAAA,EAAI;AAAA,MACzB;AAAA,KACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAEO,IAAM,aAAA,GAAgB,IAAI,UAAA;;;AChIjC,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR;ACrCO,IAAM,WAAA,GAAN,cAA0B,YAAA,CAAa;AAAA,EAS7C,YAA6B,OAAA,EAA6B;AACzD,IAAA,KAAA,EAAM;AADsB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAE5B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,EAAA;AAC1C,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,GAAA;AACxC,IAAA,IAAA,CAAK,gBAAA,EAAiB;AAEtB,IAAA,IAAI,OAAA,CAAQ,eAAe,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,aAAA,EAAc;AAAA,IACpB;AAAA,EACD;AAAA,EAT6B,OAAA;AAAA,EARrB,cAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAiC,IAAA;AAAA,EACjC,gBAAA,GAAkC,IAAA;AAAA,EAClC,WAA2B,EAAC;AAAA,EAC5B,mBAAA,GAA6C,IAAA;AAAA,EACpC,WAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA,EAgBV,gBAAA,GAAyB;AAC/B,IAAA,IAAI;AACH,MAAA,IACC,KAAK,OAAA,CAAQ,YAAA,IACV,cAAW,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA,EACtC;AACD,QAAA,IAAA,CAAK,cAAA,GAAoB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA;AAAA,MAChE;AAEA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC/C,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kCAAA,EAAqC,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAAA,SAChE;AAAA,MACD;AACA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAAA,SAC3D;AAAA,MACD;AAEA,MAAA,IAAA,CAAK,eAAA,GAAqB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AACjE,MAAA,IAAA,CAAK,gBAAA,GAAsB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAEnE,MAAA,GAAA,CAAI,KAAK,iDAAiD,CAAA;AAAA,IAC3D,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,KAAA;AAAA,IACP;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAA,GAA+B;AACrC,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,IAAA,GAAO,IAAWC,MAAA,CAAA,eAAA,CAAgB,IAAA,CAAK,eAAe,CAAA;AAC5D,IAAA,MAAM,WAAA,GAAc,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,MAAM,WAAA,GAAc,WAAA,CAAY,OAAA,EAAQ,GAAI,IAAI,OAAA,EAAQ;AACxD,IAAA,MAAM,gBAAgB,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA;AAAA,MACA,KAAK,KAAA,CAAM,WAAA,IAAe,GAAA,GAAO,EAAA,GAAK,KAAK,EAAA,CAAG;AAAA,KAC/C;AACA,IAAA,MAAM,YAAY,WAAA,IAAe,CAAA;AACjC,IAAA,MAAM,cAAA,GAAiB,iBAAiB,IAAA,CAAK,WAAA;AAE7C,IAAA,OAAO;AAAA,MACN,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,aAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC7B,IAAA,MAAM,YAAA,GAAe;AAAA,MACpB,KAAK,OAAA,CAAQ,aAAA;AAAA,MACb,KAAK,OAAA,CAAQ,cAAA;AAAA,MACb,KAAK,OAAA,CAAQ;AAAA,KACd,CAAE,OAAO,CAAC,CAAA,KAAmB,QAAQ,CAAA,IAAQ,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AAE3D,IAAA,KAAA,MAAW,YAAY,YAAA,EAAc;AACpC,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAa,EAAA,CAAA,KAAA,CAAM,QAAA,EAAU,MAAM;AACxC,UAAA,IAAA,CAAK,cAAA,EAAe;AAAA,QACrB,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,MAC3B,SAAS,GAAA,EAAK;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,8BAAA,EAAiC,QAAQ,CAAA,oBAAA,EAAuB,GAAG,CAAA;AAAA,SACpE;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAA,GAAuB;AAC9B,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AAAA,IACtC;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,WAAW,MAAM;AAC3C,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,QAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,SACpF;AACA,QAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACf,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAE,CAAA;AACrD,QAAA,IAAA,CAAK,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,MACzB;AAAA,IACD,CAAA,EAAG,KAAK,UAAU,CAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKO,MAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,KACpF;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAC5B,IAAA,OAAO,QAAA;AAAA,EACR;AAAA,EAEO,WAAA,GAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC9D;AACA,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACb;AAAA,EAEO,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC3B,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACxD;AACA,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AACrC,MAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA;AAAA,IAC5B;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACpC,MAAA,IAAI;AACH,QAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,MACf,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AACA,IAAA,IAAA,CAAK,WAAW,EAAC;AACjB,IAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,EACzB;AACD","file":"index.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)\n * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.\n * Spec: https://www.w3.org/TR/trace-context/\n */\n\nimport * as crypto from \"node:crypto\";\n\nexport interface SpanContext {\n\ttraceId: string;\n\tspanId: string;\n\tsampled: boolean;\n}\n\nexport interface LiopSpan {\n\treadonly name: string;\n\treadonly context: SpanContext;\n\treadonly startTime: number;\n\tendTime?: number;\n\tattributes: Record<string, string | number | boolean>;\n\tstatus: \"OK\" | \"ERROR\";\n\terror?: string;\n\tsetAttribute(key: string, value: string | number | boolean): LiopSpan;\n\trecordException(error: Error | string): LiopSpan;\n\tend(): void;\n}\n\nconst TRACEPARENT_REGEX =\n\t/^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;\n\nexport class LiopTracer {\n\tpublic static generateTraceId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(16).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(32));\n\t\treturn id;\n\t}\n\n\tpublic static generateSpanId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(8).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(16));\n\t\treturn id;\n\t}\n\n\tpublic static formatTraceparent(\n\t\ttraceId: string,\n\t\tspanId: string,\n\t\tsampled = true,\n\t): string {\n\t\tconst flags = sampled ? \"01\" : \"00\";\n\t\treturn `00-${traceId}-${spanId}-${flags}`;\n\t}\n\n\tpublic static parseTraceparent(header?: string | null): SpanContext | null {\n\t\tif (!header || typeof header !== \"string\") {\n\t\t\treturn null;\n\t\t}\n\t\tconst trimmed = header.trim();\n\t\tconst match = TRACEPARENT_REGEX.exec(trimmed);\n\t\tif (!match) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst [, version, traceId, spanId, flags] = match;\n\t\t// Version 00 cannot have all-zeros traceId or spanId\n\t\tif (version === \"00\") {\n\t\t\tif (traceId === \"0\".repeat(32) || spanId === \"0\".repeat(16)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t}\n\n\t\tconst sampled = (Number.parseInt(flags, 16) & 0x01) === 1;\n\t\treturn {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\t}\n\n\tpublic static injectTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t\tcontext: SpanContext,\n\t): void {\n\t\tcarrier.traceparent = LiopTracer.formatTraceparent(\n\t\t\tcontext.traceId,\n\t\t\tcontext.spanId,\n\t\t\tcontext.sampled,\n\t\t);\n\t}\n\n\tpublic static extractTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t): SpanContext | null {\n\t\tconst val = carrier.traceparent || carrier.Traceparent;\n\t\tif (Array.isArray(val)) {\n\t\t\treturn LiopTracer.parseTraceparent(val[0]);\n\t\t}\n\t\treturn LiopTracer.parseTraceparent(val);\n\t}\n\n\tpublic startSpan(\n\t\tname: string,\n\t\tparent?: SpanContext | null,\n\t\tattributes: Record<string, string | number | boolean> = {},\n\t): LiopSpan {\n\t\tconst traceId = parent?.traceId || LiopTracer.generateTraceId();\n\t\tconst spanId = LiopTracer.generateSpanId();\n\t\tconst sampled = parent ? parent.sampled : true;\n\n\t\tconst context: SpanContext = {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\n\t\tconst span: LiopSpan = {\n\t\t\tname,\n\t\t\tcontext,\n\t\t\tstartTime: Date.now(),\n\t\t\tattributes: { ...attributes },\n\t\t\tstatus: \"OK\",\n\t\t\tsetAttribute(key, value) {\n\t\t\t\tthis.attributes[key] = value;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\trecordException(err) {\n\t\t\t\tthis.status = \"ERROR\";\n\t\t\t\tthis.error = typeof err === \"string\" ? err : err.message;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\tend() {\n\t\t\t\tthis.endTime = Date.now();\n\t\t\t},\n\t\t};\n\n\t\treturn span;\n\t}\n}\n\nexport const defaultTracer = new LiopTracer();\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Certificate Manager (CertManager)\n * Provides automated certificate monitoring, X.509 validity inspection,\n * and hot-reloading for mutual TLS (mTLS) without node restarts.\n *\n * Compliance:\n * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS\n * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification\n */\n\nimport * as crypto from \"node:crypto\";\nimport { EventEmitter } from \"node:events\";\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface CertManagerOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCertPath?: string;\n\t/** Path to the server/client certificate chain (PEM format) */\n\tcertChainPath: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKeyPath: string;\n\t/** Expiration warning threshold in days (default: 30) */\n\twarningDays?: number;\n\t/** Enable file watching for automatic hot-reloading (default: true) */\n\twatchFiles?: boolean;\n\t/** Debounce delay in ms for hot reloading (default: 150) */\n\tdebounceMs?: number;\n}\n\nexport interface CertInfo {\n\tsubject: string;\n\tissuer: string;\n\tvalidFrom: string;\n\tvalidTo: string;\n\tfingerprint256: string;\n\tdaysRemaining: number;\n\tisExpired: boolean;\n\tisExpiringSoon: boolean;\n}\n\nexport class CertManager extends EventEmitter {\n\tprivate rootCertBuffer: Buffer | null = null;\n\tprivate certChainBuffer: Buffer | null = null;\n\tprivate privateKeyBuffer: Buffer | null = null;\n\tprivate watchers: fs.FSWatcher[] = [];\n\tprivate reloadDebounceTimer: NodeJS.Timeout | null = null;\n\tprivate readonly warningDays: number;\n\tprivate readonly debounceMs: number;\n\n\tconstructor(private readonly options: CertManagerOptions) {\n\t\tsuper();\n\t\tthis.warningDays = options.warningDays ?? 30;\n\t\tthis.debounceMs = options.debounceMs ?? 150;\n\t\tthis.loadCertificates();\n\n\t\tif (options.watchFiles !== false) {\n\t\t\tthis.setupWatchers();\n\t\t}\n\t}\n\n\t/**\n\t * Synchronously loads or reloads certificates from filesystem into memory.\n\t */\n\tpublic loadCertificates(): void {\n\t\ttry {\n\t\t\tif (\n\t\t\t\tthis.options.rootCertPath &&\n\t\t\t\tfs.existsSync(this.options.rootCertPath)\n\t\t\t) {\n\t\t\t\tthis.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);\n\t\t\t}\n\n\t\t\tif (!fs.existsSync(this.options.certChainPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Certificate chain file not found: ${this.options.certChainPath}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!fs.existsSync(this.options.privateKeyPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Private key file not found: ${this.options.privateKeyPath}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tthis.certChainBuffer = fs.readFileSync(this.options.certChainPath);\n\t\t\tthis.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);\n\n\t\t\tlog.info(\"[CertManager] Certificates loaded successfully.\");\n\t\t} catch (error) {\n\t\t\tlog.error(`[CertManager] Failed to load certificates: ${error}`);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.\n\t */\n\tpublic inspectCertificate(): CertInfo {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] No certificate loaded to inspect.\");\n\t\t}\n\n\t\tconst x509 = new crypto.X509Certificate(this.certChainBuffer);\n\t\tconst validToDate = new Date(x509.validTo);\n\t\tconst now = new Date();\n\t\tconst msRemaining = validToDate.getTime() - now.getTime();\n\t\tconst daysRemaining = Math.max(\n\t\t\t0,\n\t\t\tMath.floor(msRemaining / (1000 * 60 * 60 * 24)),\n\t\t);\n\t\tconst isExpired = msRemaining <= 0;\n\t\tconst isExpiringSoon = daysRemaining <= this.warningDays;\n\n\t\treturn {\n\t\t\tsubject: x509.subject,\n\t\t\tissuer: x509.issuer,\n\t\t\tvalidFrom: x509.validFrom,\n\t\t\tvalidTo: x509.validTo,\n\t\t\tfingerprint256: x509.fingerprint256,\n\t\t\tdaysRemaining,\n\t\t\tisExpired,\n\t\t\tisExpiringSoon,\n\t\t};\n\t}\n\n\t/**\n\t * Sets up non-blocking filesystem watchers to detect certificate renewals\n\t * and trigger hot-reloading without process restarts.\n\t */\n\tprivate setupWatchers(): void {\n\t\tconst filesToWatch = [\n\t\t\tthis.options.certChainPath,\n\t\t\tthis.options.privateKeyPath,\n\t\t\tthis.options.rootCertPath,\n\t\t].filter((p): p is string => Boolean(p && fs.existsSync(p)));\n\n\t\tfor (const filePath of filesToWatch) {\n\t\t\ttry {\n\t\t\t\tconst watcher = fs.watch(filePath, () => {\n\t\t\t\t\tthis.scheduleReload();\n\t\t\t\t});\n\t\t\t\tthis.watchers.push(watcher);\n\t\t\t} catch (err) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[CertManager] Could not watch ${filePath} for hot reloading: ${err}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Debounces reload events to ensure files have finished writing.\n\t */\n\tprivate scheduleReload(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t}\n\n\t\tthis.reloadDebounceTimer = setTimeout(() => {\n\t\t\ttry {\n\t\t\t\tthis.loadCertificates();\n\t\t\t\tconst certInfo = this.inspectCertificate();\n\t\t\t\tlog.info(\n\t\t\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t\t\t);\n\t\t\t\tthis.emit(\"reload\", certInfo);\n\t\t\t} catch (error) {\n\t\t\t\tlog.error(`[CertManager] Hot reload failed: ${error}`);\n\t\t\t\tthis.emit(\"error\", error);\n\t\t\t}\n\t\t}, this.debounceMs);\n\t}\n\n\t/**\n\t * Manually triggers a reload of certificates and emits the 'reload' event.\n\t */\n\tpublic reload(): CertInfo {\n\t\tthis.loadCertificates();\n\t\tconst certInfo = this.inspectCertificate();\n\t\tlog.info(\n\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t);\n\t\tthis.emit(\"reload\", certInfo);\n\t\treturn certInfo;\n\t}\n\n\tpublic getRootCert(): Buffer | null {\n\t\treturn this.rootCertBuffer;\n\t}\n\n\tpublic getCertChain(): Buffer {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Certificate chain not loaded.\");\n\t\t}\n\t\treturn this.certChainBuffer;\n\t}\n\n\tpublic getPrivateKey(): Buffer {\n\t\tif (!this.privateKeyBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Private key not loaded.\");\n\t\t}\n\t\treturn this.privateKeyBuffer;\n\t}\n\n\t/**\n\t * Stops all active file watchers and releases resources.\n\t */\n\tpublic dispose(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t\tthis.reloadDebounceTimer = null;\n\t\t}\n\t\tfor (const watcher of this.watchers) {\n\t\t\ttry {\n\t\t\t\twatcher.close();\n\t\t\t} catch {\n\t\t\t\t// Ignore watcher close errors\n\t\t\t}\n\t\t}\n\t\tthis.watchers = [];\n\t\tthis.removeAllListeners();\n\t}\n}\n"]}

package/dist/kyber-CGOA7Q6A.js

@@ -0,0 +1,3 @@
+export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
+//# sourceMappingURL=kyber-CGOA7Q6A.js.map
+//# sourceMappingURL=kyber-CGOA7Q6A.js.map

package/dist/kyber-CGOA7Q6A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"kyber-CGOA7Q6A.js"}

package/dist/mesh.d.ts

@@ -0,0 +1,32 @@
+export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-B0b2vUFS.js';
+
+declare const SWARM_KEY_BYTE_LENGTH = 95;
+/**
+ * Creates a freshly generated 95-byte Pre-Shared Key (PSK) for libp2p Private Networks (pnet).
+ * Follows the canonical format `/key/swarm/psk/1.0.0/\n/base16/\n<hex>\n`.
+ */
+declare function createSwarmKey(): Uint8Array;
+/**
+ * Serializes a 95-byte PSK into a Base64 string for safe environment variable passing or JSON config.
+ */
+declare function serializeSwarmKey(psk: Uint8Array): string;
+/**
+ * Deserializes a Base64-encoded string into a 95-byte PSK Uint8Array.
+ */
+declare function deserializeSwarmKey(base64Str: string): Uint8Array;
+/**
+ * Parses raw text format PSK or Base64 string into a 95-byte PSK Uint8Array.
+ * Allows loading either the canonical multiline text (`/key/swarm/psk/1.0.0/...`) or Base64.
+ */
+declare function parseSwarmKey(rawText: string): Uint8Array;
+/**
+ * Saves a 95-byte Swarm Key to a file on disk (written as canonical text).
+ */
+declare function saveSwarmKey(psk: Uint8Array, filePath: string): Promise<void>;
+/**
+ * Loads a 95-byte Swarm Key from a file on disk.
+ * Supports both raw binary/canonical format and Base64-encoded text.
+ */
+declare function loadSwarmKey(filePath: string): Promise<Uint8Array>;
+
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey };

package/dist/mesh.js

@@ -0,0 +1,6 @@
+import './chunk-FTF6AMF6.js';
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
+export { MeshNode } from './chunk-7RXOIDXP.js';
+import './chunk-HA6YZ42O.js';
+//# sourceMappingURL=mesh.js.map
+//# sourceMappingURL=mesh.js.map

package/dist/mesh.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"mesh.js"}

package/dist/node-B0b2vUFS.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Manifest describing a node's capabilities in the LIOP Mesh.
+ * Exchanged via the /liop/manifest/1.0.0 protocol stream.
+ */
+interface LiopManifest {
+    peerId: string;
+    grpcPort: number;
+    tools: Array<{
+        name: string;
+        description?: string;
+        inputSchema?: Record<string, unknown>;
+    }>;
+    resources: Array<{
+        name: string;
+        uri: string;
+        description?: string;
+        mimeType?: string;
+        text?: string;
+    }>;
+    serverInfo: {
+        name: string;
+        version: string;
+    };
+    taxonomy?: {
+        domain: string;
+        clearanceTier: number;
+        executionTypes: string[];
+    };
+    authRequired?: boolean;
+    /** Canonical slug for deterministic token resolution. Agents resolve LIOP_TOKEN_<tokenSlug>. Must match /^[A-Z][A-Z0-9_]*$/. */
+    tokenSlug?: string;
+    /** ML-DSA-65 (FIPS 204) Post-Quantum Digital Signature for Manifest Attestation (Base64) */
+    pqcSignature?: string;
+    /** ML-DSA-65 (FIPS 204) Post-Quantum Public Key (Base64) */
+    pqcPublicKey?: string;
+}
+interface MeshNodeConfig {
+    listenAddresses?: string[];
+    bootstrapNodes?: string[];
+    identityPath?: string;
+    enableWAN?: boolean;
+    dhtStoragePath?: string;
+    /** Optional function to translate multiaddrs (e.g. for Docker NAT traversal). Return null to drop an address. */
+    addressMapper?: (addr: string) => string | null;
+    /** Enable AutoNAT reachability detection (default: true) */
+    enableAutoNAT?: boolean;
+    /** Enable Circuit Relay v2 transport & server for NAT traversal (default: true) */
+    enableRelay?: boolean;
+    /** Enable DCUtR decentralized hole punching (default: true) */
+    enableDcutr?: boolean;
+    /** Enable mDNS peer discovery for local networks (default: false in WAN, true in LAN) */
+    enableMdns?: boolean;
+    /**
+     * Pre-Shared Key for libp2p Private Network isolation (Tier 1 Enclave Hardening).
+     * When provided, the node will reject ALL connections from peers that do not
+     * possess the identical 95-byte PSK at the transport framing layer,
+     * BEFORE the Noise XX handshake is attempted.
+     * @see https://github.com/libp2p/specs/blob/master/pnet/Private-Networks-PSK-V1.md
+     */
+    swarmKey?: Uint8Array;
+}
+/**
+ * P2P Mesh Node backed by libp2p + Kademlia DHT.
+ *
+ * Provides capability advertisement via CID-based content routing
+ * and decentralized peer discovery.
+ */
+declare class MeshNode {
+    private node;
+    private config;
+    private manifestDialFailureState;
+    private static readonly MANIFEST_DIAL_BASE_COOLDOWN_MS;
+    private static readonly MANIFEST_DIAL_MAX_COOLDOWN_MS;
+    private static readonly MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS;
+    /**
+     * Buffer of capability hashes that have been announced.
+     * Used to re-announce capabilities when new peers connect
+     * (critical for small / isolated clusters where the initial
+     * provide() finds zero peers in the routing table).
+     */
+    private announcedCapabilities;
+    /** Guards against concurrent re-announcement storms. */
+    private reannouncing;
+    /** Callback that returns the local node's manifest on request. */
+    private manifestProvider;
+    /** Flag to ensure the manifest protocol is only registered once. */
+    private manifestProtocolRegistered;
+    /** Local Ed25519 Private Key for protocol signatures */
+    private localPrivateKey;
+    constructor(config?: MeshNodeConfig);
+    private shouldSkipManifestDial;
+    private recordManifestDialFailure;
+    private clearManifestDialFailure;
+    /**
+     * Loads a persistent identity from disk or generates a new Ed25519 keypair.
+     * Uses privateKeyToProtobuf/privateKeyFromProtobuf (libp2p v3.x official API).
+     */
+    private loadOrCreateIdentity;
+    /**
+     * Persists the private key to disk using protobuf serialization (libp2p v3.x).
+     */
+    private saveIdentity;
+    /**
+     * Creates a CID v1 (raw codec 0x55) from a SHA-256 hash of the capability string.
+     * Required by @libp2p/kad-dht v16+ for provide/findProviders.
+     */
+    private capabilityToCID;
+    /**
+     * Re-announces all buffered capabilities after a new peer connects.
+     * Uses a small delay to allow the DHT protocol handshake to complete.
+     */
+    private reannounceAll;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private loadRoutingTable;
+    private saveRoutingTable;
+    /**
+     * Internal logic to register protocol handlers against the libp2p node.
+     * Can be called multiple times; handles idempotent registration.
+     */
+    private applyHandlers;
+    /**
+     * Registers a callback as the manifest provider.
+     * Will be applied immediately if the node is already initialized.
+     */
+    registerManifestHandler(provider: () => LiopManifest): void;
+    /**
+     * Queries a remote peer's manifest by opening a /liop/manifest/1.0.0 stream.
+     * Returns null if the peer doesn't support the protocol or is unreachable.
+     */
+    queryManifest(peerIdStr: string): Promise<LiopManifest | null>;
+    /**
+     * Discovers all peers in the DHT that have announced "liop:manifest".
+     * Returns their PeerIDs for subsequent manifest queries.
+     */
+    discoverManifestProviders(): Promise<string[]>;
+    /**
+     * Announces this node as a manifest provider in the DHT.
+     * Should be called after tools/resources have been registered.
+     */
+    announceManifest(): Promise<void>;
+    /**
+     * Returns the current size of the routing table for diagnostic purposes.
+     */
+    getRoutingTableSize(): number;
+    getPeerId(): string;
+    sign(data: Uint8Array): Promise<Uint8Array>;
+    getMultiaddrs(): string[];
+    announceCapability(hash: string): Promise<void>;
+    findProviders(hash: string): Promise<string[]>;
+    resolvePeer(peerIdStr: string): Promise<string[]>;
+    isStarted(): boolean;
+    getPeers(): string[];
+    /**
+     * Returns true if this MeshNode was booted inside an isolated libp2p private network (pnet PSK).
+     */
+    isPrivateNetwork(): boolean;
+    /**
+     * Returns the configured 95-byte Swarm Key, or undefined if running in a public/consortium mesh.
+     */
+    getSwarmKey(): Uint8Array | undefined;
+}
+
+export { type LiopManifest as L, type MeshNodeConfig as M, MeshNode as a };