@nekzus/liop 2.1.0-alpha.1 → 2.1.0-alpha.10

package/dist/chunk-QLCOEP5J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/crypto/kyber.ts"],"names":[],"mappings":";;;AAcA,IAAI,WAAA,GAAiE,IAAA;AAErE,eAAe,cAAA,GAAiB;AAC/B,EAAA,IAAI,CAAC,WAAA,EAAa;AACjB,IAAA,WAAA,GAAc,MAAM,cAAA,EAAe;AAAA,EACpC;AACA,EAAA,OAAO,WAAA;AACR;AAEO,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,WAAW,IAAA,EAAM;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,0DAAA,EAA6D,OAAO,MAAM,CAAA,CAAA;AAAA,OAC3E;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,sBAAsB,SAAA,EAGzB;AACF,IAAA,IAAI;AACH,MAAA,IAAI,SAAA,CAAU,WAAW,IAAA,EAAM;AAC9B,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MAClE;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,MAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,GAAA,CAAI,MAAM,SAAS,CAAA;AAEpC,MAAA,OAAO;AAAA,QACN,UAAA,EAAY,EAAA;AAAA,QACZ,YAAA,EAAc;AAAA,OACf;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAyC,MAAgB,OAAO,CAAA;AAAA,OACjE;AAAA,IACD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAA,GAGH;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,IAAI,eAAA,EAAgB;AACrC,IAAA,OAAO;AAAA,MACN,SAAA,EAAW,EAAA;AAAA,MACX,SAAA,EAAW;AAAA,KACZ;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CACL,UAAA,EACA,SAAA,EACsB;AACtB,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,EAAY,SAAS,CAAA;AAAA,EACvC;AACD","file":"chunk-QLCOEP5J.js","sourcesContent":["import { createMlKem768 } from \"mlkem\";\n\n/**\n * LIOP Post-Quantum Cryptography Wrapper\n * Implements ML-KEM-768 (NIST FIPS 203) for Zero-Trust secure key encapsulation\n * directly compatible with `pqcrypto-kyber` on the Mesh-Node Backend.\n *\n * Uses the `mlkem` package which provides:\n * - FIPS 203 compliance (ML-KEM standard)\n * - Constant-time validation (KyberSlash patched)\n * - ~3.5x performance improvement over legacy crystals-kyber\n */\n\n/** Lazy-initialized singleton for the ML-KEM-768 engine */\nlet kemInstance: Awaited<ReturnType<typeof createMlKem768>> | null = null;\n\nasync function getKemInstance() {\n\tif (!kemInstance) {\n\t\tkemInstance = await createMlKem768();\n\t}\n\treturn kemInstance;\n}\n\nexport const Kyber768Wrapper = {\n\t/**\n\t * Extracts and validates the 1184-byte Public Key from the Rust LIOP Data Node\n\t * @param buffer Raw buffer sent via gRPC IntentResponse\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== 1184) {\n\t\t\tthrow new Error(\n\t\t\t\t`Kyber768 Public Key must be exactly 1184 bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Encapsulates a shared secret using the server's public key.\n\t * Returns the 1088-byte ciphertext to be sent back, and the 32-byte shared AES secret.\n\t */\n\tasync encapsulateAsymmetric(publicKey: Uint8Array): Promise<{\n\t\tciphertext: Uint8Array;\n\t\tsharedSecret: Uint8Array;\n\t}> {\n\t\ttry {\n\t\t\tif (publicKey.length !== 1184) {\n\t\t\t\tthrow new Error(\"Kyber768 Public Key must be exactly 1184 bytes.\");\n\t\t\t}\n\n\t\t\tconst kem = await getKemInstance();\n\t\t\tconst [ct, ss] = kem.encap(publicKey);\n\n\t\t\treturn {\n\t\t\t\tciphertext: ct,\n\t\t\t\tsharedSecret: ss,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to perform PQC encapsulation: ${(error as Error).message}`,\n\t\t\t);\n\t\t}\n\t},\n\n\t/**\n\t * Generates a Kyber768 KeyPair for the server to accept intents.\n\t */\n\tasync generateKeyPair(): Promise<{\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t}> {\n\t\tconst kem = await getKemInstance();\n\t\tconst [pk, sk] = kem.generateKeyPair();\n\t\treturn {\n\t\t\tpublicKey: pk,\n\t\t\tsecretKey: sk,\n\t\t};\n\t},\n\n\t/**\n\t * Decapsulates the shared secret using the server's secret key.\n\t * Zero-fills the shared secret buffer after extraction for side-channel protection.\n\t */\n\tasync decapsulateSymmetric(\n\t\tciphertext: Uint8Array,\n\t\tsecretKey: Uint8Array,\n\t): Promise<Uint8Array> {\n\t\tconst kem = await getKemInstance();\n\t\treturn kem.decap(ciphertext, secretKey);\n\t},\n};\n"]}

package/dist/chunk-RDWCGZ2A.js

@@ -0,0 +1,87 @@
+import { log } from './chunk-72MNYFR6.js';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import * as grpc2 from '@grpc/grpc-js';
+import * as protoLoader from '@grpc/proto-loader';
+import * as fs2 from 'fs';
+
+var __filename$1 = fileURLToPath(import.meta.url);
+var __dirname$1 = path.dirname(__filename$1);
+var PROD_PATHS = [
+  path.resolve(__dirname$1, "./protocol/liop_core.proto"),
+  // Flat dist/ (tsup)
+  path.resolve(__dirname$1, "../protocol/liop_core.proto")
+  // dist/rpc/ (tsc)
+];
+var DEV_PROTO_PATH = path.resolve(
+  __dirname$1,
+  "../../../../protocol/proto/liop_core.proto"
+);
+var PROTO_PATH = PROD_PATHS.find((p) => fs2.existsSync(p)) || DEV_PROTO_PATH;
+if (!fs2.existsSync(PROTO_PATH)) {
+  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
+}
+var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
+  keepCase: true,
+  longs: String,
+  enums: String,
+  defaults: true,
+  oneofs: true
+});
+var liopProto = grpc2.loadPackageDefinition(packageDefinition);
+var liopV1 = liopProto.liop.v1;
+var isProduction = () => process.env.NODE_ENV === "production";
+function createServerCredentials(tls) {
+  if (!tls?.certChain || !tls?.privateKey) {
+    log.warn(
+      "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
+    );
+    return grpc2.ServerCredentials.createInsecure();
+  }
+  try {
+    const rootCert = tls.rootCert ? fs2.readFileSync(tls.rootCert) : null;
+    const certChain = fs2.readFileSync(tls.certChain);
+    const privateKey = fs2.readFileSync(tls.privateKey);
+    return grpc2.ServerCredentials.createSsl(rootCert, [
+      { cert_chain: certChain, private_key: privateKey }
+    ]);
+  } catch (error) {
+    if (isProduction()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Server certificate loading failed in production mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc2.ServerCredentials.createInsecure();
+  }
+}
+function createChannelCredentials(tls) {
+  if (!tls?.rootCert) {
+    log.warn(
+      "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
+    );
+    return grpc2.credentials.createInsecure();
+  }
+  try {
+    const rootCert = fs2.readFileSync(tls.rootCert);
+    const certChain = tls.certChain ? fs2.readFileSync(tls.certChain) : void 0;
+    const privateKey = tls.privateKey ? fs2.readFileSync(tls.privateKey) : void 0;
+    return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
+  } catch (error) {
+    if (isProduction()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Channel certificate loading failed in production mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc2.credentials.createInsecure();
+  }
+}
+
+export { createChannelCredentials, createServerCredentials, liopV1 };
+//# sourceMappingURL=chunk-RDWCGZ2A.js.map
+//# sourceMappingURL=chunk-RDWCGZ2A.js.map

package/dist/chunk-RDWCGZ2A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/proto.ts","../src/rpc/tls.ts"],"names":["__filename","__dirname","fs","grpc"],"mappings":";;;;;;;AAKA,IAAMA,YAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,WAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,YAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,WAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,WAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,WAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,GAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,4BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK;ACbrC,IAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAA,KAAa,YAAA;AAM7C,SAAS,wBACf,GAAA,EACyB;AACzB,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH;AAAA,KACD;AACA,IAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,OAAY,KAAA,CAAA,iBAAA,CAAkB,UAAU,QAAA,EAAU;AAAA,MACjD,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,UAAA;AAAW,KACjD,CAAA;AAAA,EACF,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,cAAa,EAAG;AACnB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,qIAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH;AAAA,KACD;AACA,IAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,KAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,cAAa,EAAG;AACnB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,sIAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,EACxC;AACD","file":"chunk-RDWCGZ2A.js","sourcesContent":["import path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n","/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n}\n\nconst isProduction = () => process.env.NODE_ENV === \"production\";\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production, refuses to fall back to insecure if TLS loading fails.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tlog.warn(\n\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\treturn grpc.ServerCredentials.createSsl(rootCert, [\n\t\t\t{ cert_chain: certChain, private_key: privateKey },\n\t\t]);\n\t} catch (error) {\n\t\tif (isProduction()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production, refuses to fall back to insecure if TLS loading fails.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\tif (!tls?.rootCert) {\n\t\tlog.warn(\n\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isProduction()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n"]}

package/dist/chunk-RWRRBYG4.js

@@ -1,2 +1,3 @@
+
 //# sourceMappingURL=chunk-RWRRBYG4.js.map
 //# sourceMappingURL=chunk-RWRRBYG4.js.map

package/dist/client.d.ts

@@ -1,6 +1,6 @@
 import './verifier-COnid_dg.js';
 import './mesh.js';
-export { a as LiopClient } from './index-Brfvxmdt.js';
-import './types-DzEXgi4s.js';
+export { a as LiopClient } from './index-qM8ZH8sC.js';
+import './types-sKeUxuky.js';
 import 'zod';
 import 'jose';

package/dist/client.js

@@ -1,2 +1,10 @@
-export{b as LiopClient}from'./chunk-T3L6OCM3.js';import'./chunk-PWCXZWSE.js';import'./chunk-ANFXJGMP.js';import'./chunk-DBXGYHKY.js';import'./chunk-V5MKJT6S.js';import'./chunk-DQ6UW6L7.js';import'./chunk-S6RJHZV2.js';import'./chunk-4C666HHU.js';//# sourceMappingURL=client.js.map
+export { LiopClient } from './chunk-E5QBDD5E.js';
+import './chunk-32ADSAJS.js';
+import './chunk-OUUTDSOW.js';
+import './chunk-QLCOEP5J.js';
+import './chunk-RDWCGZ2A.js';
+import './chunk-NJRSFFD7.js';
+import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,7 +1,7 @@
 import { MeshNode } from './mesh.js';
-import { L as LiopServer } from './index-BcuTJtQX.js';
+import { L as LiopServer } from './index-BlGc0iym.js';
 import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { M as McpRequest, A as AuthInfo, b as McpResponse } from './types-DzEXgi4s.js';
+import { M as McpRequest, A as AuthInfo, b as McpResponse } from './types-sKeUxuky.js';
 import 'zod';
 import 'jose';
 

package/dist/gateway.js

@@ -1,2 +1,11 @@
-export{b as LiopHybridGateway}from'./chunk-GI2LSJYZ.js';import'./chunk-I46YEWND.js';import'./chunk-PWCXZWSE.js';import'./chunk-ANFXJGMP.js';import'./chunk-DBXGYHKY.js';import'./chunk-SB5XJXKV.js';import'./chunk-V5MKJT6S.js';import'./chunk-S6RJHZV2.js';import'./chunk-4C666HHU.js';//# sourceMappingURL=gateway.js.map
+export { LiopHybridGateway } from './chunk-PHTWUTY7.js';
+import './chunk-HB5DXX3Q.js';
+import './chunk-32ADSAJS.js';
+import './chunk-OUUTDSOW.js';
+import './chunk-QLCOEP5J.js';
+import './chunk-IJHTRIZC.js';
+import './chunk-RDWCGZ2A.js';
+import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/{index-BcuTJtQX.d.ts → index-BlGc0iym.d.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { MeshNode } from './mesh.js';
-import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, c as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-DzEXgi4s.js';
+import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, c as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-sKeUxuky.js';
 
 /**
  * LIOP OAuth 2.1 Hybrid Auth — Configuration Types
@@ -278,6 +278,10 @@ interface LiopServerOptions {
      * Must match SCREAMING_SNAKE_CASE: /^[A-Z][A-Z0-9_]*$/ (e.g., "BANK", "VAULT", "HFT_ORACLE").
      */
     tokenSlug?: string;
+    /**
+     * Path to a shared JSON file for persistent Query Budget tracking across multiple server instances.
+     */
+    budgetStorePath?: string;
 }
 interface AggregationPolicy {
     /** Maximum number of object-type array elements allowed (default: 10) */
@@ -324,6 +328,10 @@ interface LogicExecutionPolicy {
      * Domain-specific sensitive keys that fall under the "sensitive" query budget tier.
      */
     sensitiveKeys?: string[];
+    /**
+     * Path to a shared JSON file for persistent Query Budget tracking across multiple server instances.
+     */
+    budgetStorePath?: string;
 }
 declare class LiopServer {
     private serverInfo;
@@ -497,6 +505,19 @@ declare class LiopServer {
     private loadRevocationList;
     revokeToken(token: string): void;
     revokeTokenHash(hash: string): void;
+    /**
+     * Resets the query budget for a specific client identity.
+     * If toolName is provided, only that tool's budget is cleared.
+     * Otherwise, all tool budgets for the client are reset.
+     *
+     * Operates on both in-memory and persistent (disk) budget stores.
+     * Uses file-level locking for safe concurrent access.
+     */
+    resetFieldBudget(clientId: string, toolName?: string): void;
+    private getPersistentBudget;
+    private savePersistentBudget;
+    private executeWithBudgetLock;
+    private applyInMemoryBudget;
 }
 
 export { AUTH_DEFAULTS as A, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuthRole as c, type LiopAuthConfig as d, type LogicExecutionPolicy as e, type OutputSanitizerConfig as f, PII_PRESETS as g, type PiiRule as h, PiiScanner as i, sanitizeOutput as s };

package/dist/{index-Brfvxmdt.d.ts → index-qM8ZH8sC.d.ts}

@@ -1,6 +1,6 @@
 import { L as LiopVerifier } from './verifier-COnid_dg.js';
 import { MeshNodeConfig } from './mesh.js';
-import { C as CallToolRequest, a as CallToolResult } from './types-DzEXgi4s.js';
+import { C as CallToolRequest, a as CallToolResult } from './types-sKeUxuky.js';
 
 /**
  * LIOP TLS Configuration

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOptions } from './bridge.js';
-import { L as LiopTlsOptions } from './index-Brfvxmdt.js';
-export { a as LiopClient } from './index-Brfvxmdt.js';
+import { L as LiopTlsOptions } from './index-qM8ZH8sC.js';
+export { a as LiopClient } from './index-qM8ZH8sC.js';
 export { LiopHybridGateway } from './gateway.js';
 export { LiopManifest, MeshNode, MeshNodeConfig } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-BcuTJtQX.js';
-import { A as AuthInfo } from './types-DzEXgi4s.js';
-export { C as CallToolRequest, a as CallToolResult, G as GetPromptRequest, c as GetPromptResult, J as JwtValidator, M as McpRequest, b as McpResponse, P as Prompt, d as PromptSchema, R as Resource, e as ResourceSchema, S as ServerInfo, T as Tool, f as ToolSchema } from './types-DzEXgi4s.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-BlGc0iym.js';
+import { A as AuthInfo } from './types-sKeUxuky.js';
+export { C as CallToolRequest, a as CallToolResult, G as GetPromptRequest, c as GetPromptResult, J as JwtValidator, M as McpRequest, b as McpResponse, P as Prompt, d as PromptSchema, R as Resource, e as ResourceSchema, S as ServerInfo, T as Tool, f as ToolSchema } from './types-sKeUxuky.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
 import '@modelcontextprotocol/sdk/server/mcp.js';

package/dist/index.js

@@ -1,4 +1,50 @@
-export{c as WasiSandbox,b as getDefaultEnvironment}from'./chunk-RYYRR4N5.js';export{b as LiopClient,a as LiopRpcClient}from'./chunk-T3L6OCM3.js';export{c as PromptSchema,b as ResourceSchema,a as ToolSchema}from'./chunk-TYVG6TXQ.js';export{b as LiopMcpBridge,a as LiopStreamBridge}from'./chunk-7L5ODML2.js';export{b as LiopHybridGateway,a as buildProtectedResourceMetadata}from'./chunk-GI2LSJYZ.js';export{b as AUTH_DEFAULTS,c as JwtValidator,a as LiopRpcServer,j as LiopServer,e as NerScanner,g as PII_PATTERNS,h as PII_PRESETS,i as PiiScanner,d as createOAuthServer,f as sanitizeOutput}from'./chunk-KQ5BDO2M.js';import'./chunk-2MGFSIXN.js';export{b as HeuristicTokenEstimator,e as LiopOTelBridge,a as RealTokenEstimator,f as TokenTelemetryEngine,d as createSyncTokenEstimator,c as createTokenEstimator}from'./chunk-I46YEWND.js';import'./chunk-PWCXZWSE.js';import'./chunk-ANFXJGMP.js';import'./chunk-DBXGYHKY.js';export{b as LIOP_SCOPES,a as authorizeRequest}from'./chunk-SB5XJXKV.js';import'./chunk-V5MKJT6S.js';export{a as MeshNode}from'./chunk-DQ6UW6L7.js';import'./chunk-S6RJHZV2.js';import'./chunk-4C666HHU.js';var h=(e=>(e.CapabilityViolation="CapabilityViolation",e.SandboxEscape="SandboxEscape",e.PiiLeak="PiiLeak",e.InvalidIntent="InvalidIntent",e.Throttled="Throttled",e.ZkVerificationFailed="ZkVerificationFailed",e.MeshUnavailable="MeshUnavailable",e.ConnectionFailed="ConnectionFailed",e))(h||{}),n=class extends Error{code;constructor(o,t){super(t),this.name="LiopError",this.code=o;}};var x={claude:{xmlStandard:true,jsonSchemaPreferred:false},openai:{xmlStandard:false,jsonSchemaPreferred:true},gemini:{xmlStandard:false,jsonSchemaPreferred:true}};function W(i){let o=x[i],t=`[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]
+export { WasiSandbox, getDefaultEnvironment } from './chunk-J3WPBMJ5.js';
+export { LiopClient, LiopRpcClient } from './chunk-E5QBDD5E.js';
+export { PromptSchema, ResourceSchema, ToolSchema } from './chunk-MCXMS5ZI.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-IMPCCZ2Y.js';
+export { LiopHybridGateway, buildProtectedResourceMetadata } from './chunk-PHTWUTY7.js';
+export { AUTH_DEFAULTS, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, createOAuthServer, sanitizeOutput } from './chunk-EEYEVHO2.js';
+import './chunk-F5YNYL5L.js';
+export { HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-HB5DXX3Q.js';
+import './chunk-32ADSAJS.js';
+import './chunk-OUUTDSOW.js';
+import './chunk-QLCOEP5J.js';
+export { LIOP_SCOPES, authorizeRequest } from './chunk-IJHTRIZC.js';
+import './chunk-RDWCGZ2A.js';
+export { MeshNode } from './chunk-NJRSFFD7.js';
+import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
+
+// src/errors.ts
+var ErrorCode = /* @__PURE__ */ ((ErrorCode2) => {
+  ErrorCode2["CapabilityViolation"] = "CapabilityViolation";
+  ErrorCode2["SandboxEscape"] = "SandboxEscape";
+  ErrorCode2["PiiLeak"] = "PiiLeak";
+  ErrorCode2["InvalidIntent"] = "InvalidIntent";
+  ErrorCode2["Throttled"] = "Throttled";
+  ErrorCode2["ZkVerificationFailed"] = "ZkVerificationFailed";
+  ErrorCode2["MeshUnavailable"] = "MeshUnavailable";
+  ErrorCode2["ConnectionFailed"] = "ConnectionFailed";
+  return ErrorCode2;
+})(ErrorCode || {});
+var LiopError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "LiopError";
+    this.code = code;
+  }
+};
+
+// src/prompts/adapters.ts
+var PROVIDER_CONFIGS = {
+  claude: { xmlStandard: true, jsonSchemaPreferred: false },
+  openai: { xmlStandard: false, jsonSchemaPreferred: true },
+  gemini: { xmlStandard: false, jsonSchemaPreferred: true }
+};
+function generateSystemInstructions(provider) {
+  const config = PROVIDER_CONFIGS[provider];
+  let instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]
 You are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.
 Unlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.
 
@@ -23,7 +69,9 @@ To prevent database reconstruction and inference attacks, numeric query outputs
 - Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.
 - Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.
 - K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.
-`;return o.xmlStandard?t+=`
+`;
+  if (config.xmlStandard) {
+    instructions += `
 ### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)
 You must wrap your logic precisely within <liop_logic> tags.
 Example:
@@ -32,7 +80,9 @@ const records = await liop.readResource("liop://vault/patients");
 const filtered = records.filter(r => r.disease === "Hypertension");
 return { alert: "High risk demographic", targetCount: filtered.length };
 </liop_logic>
-`:o.jsonSchemaPreferred&&(t+=`
+`;
+  } else if (config.jsonSchemaPreferred) {
+    instructions += `
 ### PAYLOAD FORMATTING (JSON PARSING PREFERRED)
 You must provide your logic strictly within a JSON string key called \`"logic_blob"\` inside your tool call parameters.
 Example:
@@ -40,5 +90,11 @@ Example:
   "target": "liop://vault/patients",
   "logic_blob": "const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };"
 }
-`),t}export{h as ErrorCode,n as LiopError,W as generateSystemInstructions};//# sourceMappingURL=index.js.map
+`;
+  }
+  return instructions;
+}
+
+export { ErrorCode, LiopError, generateSystemInstructions };
+//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/prompts/adapters.ts"],"names":["ErrorCode","LiopError","code","message","PROVIDER_CONFIGS","generateSystemInstructions","provider","config","instructions"],"mappings":"4lCAAO,IAAKA,OACXA,CAAAA,CAAA,mBAAA,CAAsB,qBAAA,CACtBA,CAAAA,CAAA,cAAgB,eAAA,CAChBA,CAAAA,CAAA,OAAA,CAAU,SAAA,CACVA,EAAA,aAAA,CAAgB,eAAA,CAChBA,EAAA,SAAA,CAAY,WAAA,CACZA,EAAA,oBAAA,CAAuB,sBAAA,CACvBA,CAAAA,CAAA,eAAA,CAAkB,kBAClBA,CAAAA,CAAA,gBAAA,CAAmB,kBAAA,CARRA,CAAAA,CAAAA,EAAAA,CAAAA,EAAA,IAWCC,CAAAA,CAAN,cAAwB,KAAM,CACpB,KAEhB,WAAA,CAAYC,CAAAA,CAAiBC,EAAiB,CAC7C,KAAA,CAAMA,CAAO,CAAA,CACb,IAAA,CAAK,IAAA,CAAO,WAAA,CACZ,KAAK,IAAA,CAAOD,EACb,CACD,ECLA,IAAME,CAAAA,CAAqD,CAC1D,MAAA,CAAQ,CAAE,YAAa,IAAA,CAAM,mBAAA,CAAqB,KAAM,CAAA,CACxD,MAAA,CAAQ,CAAE,WAAA,CAAa,KAAA,CAAO,mBAAA,CAAqB,IAAK,EACxD,MAAA,CAAQ,CAAE,YAAa,KAAA,CAAO,mBAAA,CAAqB,IAAK,CACzD,CAAA,CAMO,SAASC,CAAAA,CAA2BC,EAA8B,CACxE,IAAMC,EAASH,CAAAA,CAAiBE,CAAQ,EAEpCE,CAAAA,CAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CA2BnB,OAAID,CAAAA,CAAO,WAAA,CACVC,CAAAA,EAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAUND,CAAAA,CAAO,sBACjBC,CAAAA,EAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA,CAAA,CAWVA,CACR","file":"index.js","sourcesContent":["export enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/prompts/adapters.ts"],"names":["ErrorCode"],"mappings":";;;;;;;;;;;;;;;;;;AAAO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;;;ACLA,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR","file":"index.js","sourcesContent":["export enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n"]}

package/dist/kyber-FCVPX6CE.js

@@ -0,0 +1,4 @@
+export { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=kyber-FCVPX6CE.js.map
+//# sourceMappingURL=kyber-FCVPX6CE.js.map

package/dist/{kyber-NONMBQNH.js.map → kyber-FCVPX6CE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"kyber-NONMBQNH.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"kyber-FCVPX6CE.js"}

package/dist/mesh.js

@@ -1,2 +1,6 @@
-import'./chunk-RWRRBYG4.js';export{a as MeshNode}from'./chunk-DQ6UW6L7.js';import'./chunk-S6RJHZV2.js';import'./chunk-4C666HHU.js';//# sourceMappingURL=mesh.js.map
+import './chunk-RWRRBYG4.js';
+export { MeshNode } from './chunk-NJRSFFD7.js';
+import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=mesh.js.map
 //# sourceMappingURL=mesh.js.map

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-BcuTJtQX.js';
+export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-BlGc0iym.js';
 import 'zod';
 import './mesh.js';
-import './types-DzEXgi4s.js';
+import './types-sKeUxuky.js';
 import 'jose';

package/dist/server.js

@@ -1,2 +1,9 @@
-export{j as LiopServer,e as NerScanner,g as PII_PATTERNS,h as PII_PRESETS,i as PiiScanner,f as sanitizeOutput}from'./chunk-KQ5BDO2M.js';import'./chunk-2MGFSIXN.js';import'./chunk-SB5XJXKV.js';import'./chunk-V5MKJT6S.js';import'./chunk-DQ6UW6L7.js';import'./chunk-S6RJHZV2.js';import'./chunk-4C666HHU.js';//# sourceMappingURL=server.js.map
+export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, sanitizeOutput } from './chunk-EEYEVHO2.js';
+import './chunk-F5YNYL5L.js';
+import './chunk-IJHTRIZC.js';
+import './chunk-RDWCGZ2A.js';
+import './chunk-NJRSFFD7.js';
+import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map

package/dist/{types-DzEXgi4s.d.ts → types-sKeUxuky.d.ts}

@@ -87,32 +87,14 @@ declare const ToolSchema: z.ZodObject<{
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    inputSchema: Record<string, unknown>;
-    description?: string | undefined;
-}, {
-    name: string;
-    inputSchema: Record<string, unknown>;
-    description?: string | undefined;
-}>;
+}, z.core.$strip>;
 type Tool = z.infer<typeof ToolSchema>;
 declare const ResourceSchema: z.ZodObject<{
     uri: z.ZodString;
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     mimeType: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    uri: string;
-    description?: string | undefined;
-    mimeType?: string | undefined;
-}, {
-    name: string;
-    uri: string;
-    description?: string | undefined;
-    mimeType?: string | undefined;
-}>;
+}, z.core.$strip>;
 type Resource = z.infer<typeof ResourceSchema>;
 declare const PromptSchema: z.ZodObject<{
     name: z.ZodString;
@@ -121,32 +103,8 @@ declare const PromptSchema: z.ZodObject<{
         name: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         required: z.ZodOptional<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        name: string;
-        description?: string | undefined;
-        required?: boolean | undefined;
-    }, {
-        name: string;
-        description?: string | undefined;
-        required?: boolean | undefined;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    description?: string | undefined;
-    arguments?: {
-        name: string;
-        description?: string | undefined;
-        required?: boolean | undefined;
-    }[] | undefined;
-}, {
-    name: string;
-    description?: string | undefined;
-    arguments?: {
-        name: string;
-        description?: string | undefined;
-        required?: boolean | undefined;
-    }[] | undefined;
-}>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
 type Prompt = z.infer<typeof PromptSchema>;
 interface CallToolRequest {
     name: string;

package/dist/types.d.ts

@@ -1,3 +1,3 @@
 import 'zod';
-export { A as AuthInfo, C as CallToolRequest, a as CallToolResult, G as GetPromptRequest, c as GetPromptResult, M as McpRequest, b as McpResponse, P as Prompt, d as PromptSchema, R as Resource, e as ResourceSchema, S as ServerInfo, T as Tool, f as ToolSchema } from './types-DzEXgi4s.js';
+export { A as AuthInfo, C as CallToolRequest, a as CallToolResult, G as GetPromptRequest, c as GetPromptResult, M as McpRequest, b as McpResponse, P as Prompt, d as PromptSchema, R as Resource, e as ResourceSchema, S as ServerInfo, T as Tool, f as ToolSchema } from './types-sKeUxuky.js';
 import 'jose';

package/dist/types.js

@@ -1,2 +1,5 @@
-export{c as PromptSchema,b as ResourceSchema,a as ToolSchema}from'./chunk-TYVG6TXQ.js';import'./chunk-2MGFSIXN.js';import'./chunk-4C666HHU.js';//# sourceMappingURL=types.js.map
+export { PromptSchema, ResourceSchema, ToolSchema } from './chunk-MCXMS5ZI.js';
+import './chunk-F5YNYL5L.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=types.js.map
 //# sourceMappingURL=types.js.map

package/dist/verifier-GCZDNZK7.js

@@ -0,0 +1,6 @@
+export { LiopVerifier } from './chunk-32ADSAJS.js';
+import './chunk-OUUTDSOW.js';
+import './chunk-72MNYFR6.js';
+import './chunk-PZ5AY32C.js';
+//# sourceMappingURL=verifier-GCZDNZK7.js.map
+//# sourceMappingURL=verifier-GCZDNZK7.js.map

package/dist/{verifier-XU2DB56Z.js.map → verifier-GCZDNZK7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-XU2DB56Z.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-GCZDNZK7.js"}