@nekzus/liop 2.1.0-alpha.13 → 2.1.0-alpha.15

package/dist/chunk-WSW6YJNY.js

@@ -0,0 +1,168 @@
+import { log } from './chunk-72MNYFR6.js';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import * as grpc2 from '@grpc/grpc-js';
+import * as protoLoader from '@grpc/proto-loader';
+import * as fs2 from 'fs';
+
+// src/rpc/channel-options.ts
+var GRPC_CHANNEL_OPTIONS = {
+  "grpc.keepalive_time_ms": 3e4,
+  "grpc.keepalive_timeout_ms": 1e4,
+  "grpc.keepalive_permit_without_calls": 1,
+  "grpc.max_send_message_length": -1,
+  "grpc.max_receive_message_length": -1,
+  "grpc.enable_retries": 1
+};
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = path.dirname(__filename2);
+var PROD_PATHS = [
+  path.resolve(__dirname2, "./protocol/liop_core.proto"),
+  // Flat dist/ (tsup)
+  path.resolve(__dirname2, "../protocol/liop_core.proto")
+  // dist/rpc/ (tsc)
+];
+var DEV_PROTO_PATH = path.resolve(
+  __dirname2,
+  "../../../../protocol/proto/liop_core.proto"
+);
+var PROTO_PATH = PROD_PATHS.find((p) => fs2.existsSync(p)) || DEV_PROTO_PATH;
+if (!fs2.existsSync(PROTO_PATH)) {
+  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
+}
+var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
+  keepCase: true,
+  longs: String,
+  enums: String,
+  defaults: true,
+  oneofs: true
+});
+var liopProto = grpc2.loadPackageDefinition(packageDefinition);
+var liopV1 = liopProto.liop.v1;
+var isTlsEnforced = () => process.env.NODE_ENV === "production" || process.env.LIOP_ENFORCE_TLS === "true";
+function createServerCredentials(tls) {
+  if (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {
+    throw new Error(
+      "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
+    );
+  }
+  if (tls?.certManager) {
+    try {
+      const certChain = tls.certManager.getCertChain();
+      const privateKey = tls.certManager.getPrivateKey();
+      const rootCert = tls.certManager.getRootCert();
+      if (tls.mutualTls && !rootCert) {
+        throw new Error(
+          "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded."
+        );
+      }
+      return grpc2.ServerCredentials.createSsl(
+        rootCert,
+        [{ cert_chain: certChain, private_key: privateKey }],
+        Boolean(tls.mutualTls)
+      );
+    } catch (error) {
+      if (isTlsEnforced()) {
+        throw new Error(
+          `[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`
+        );
+      }
+      log.warn(
+        `[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`
+      );
+      return grpc2.ServerCredentials.createInsecure();
+    }
+  }
+  if (!tls?.certChain || !tls?.privateKey) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true."
+      );
+    }
+    log.warn(
+      "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
+    );
+    return grpc2.ServerCredentials.createInsecure();
+  }
+  try {
+    const rootCert = tls.rootCert ? fs2.readFileSync(tls.rootCert) : null;
+    const certChain = fs2.readFileSync(tls.certChain);
+    const privateKey = fs2.readFileSync(tls.privateKey);
+    if (tls.mutualTls && !rootCert) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
+      );
+    }
+    return grpc2.ServerCredentials.createSsl(
+      rootCert,
+      [{ cert_chain: certChain, private_key: privateKey }],
+      Boolean(tls.mutualTls)
+    );
+  } catch (error) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc2.ServerCredentials.createInsecure();
+  }
+}
+function createChannelCredentials(tls) {
+  if (tls?.certManager) {
+    try {
+      const rootCert = tls.certManager.getRootCert();
+      if (!rootCert) {
+        throw new Error(
+          "[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager."
+        );
+      }
+      const certChain = tls.certManager.getCertChain();
+      const privateKey = tls.certManager.getPrivateKey();
+      return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
+    } catch (error) {
+      if (isTlsEnforced()) {
+        throw new Error(
+          `[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`
+        );
+      }
+      log.warn(
+        `[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`
+      );
+      return grpc2.credentials.createInsecure();
+    }
+  }
+  if (!tls?.rootCert) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true."
+      );
+    }
+    log.warn(
+      "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
+    );
+    return grpc2.credentials.createInsecure();
+  }
+  try {
+    const rootCert = fs2.readFileSync(tls.rootCert);
+    const certChain = tls.certChain ? fs2.readFileSync(tls.certChain) : void 0;
+    const privateKey = tls.privateKey ? fs2.readFileSync(tls.privateKey) : void 0;
+    return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
+  } catch (error) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc2.credentials.createInsecure();
+  }
+}
+
+export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials, liopV1 };
+//# sourceMappingURL=chunk-WSW6YJNY.js.map
+//# sourceMappingURL=chunk-WSW6YJNY.js.map

package/dist/chunk-WSW6YJNY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/channel-options.ts","../src/rpc/proto.ts","../src/rpc/tls.ts"],"names":["__filename","__dirname","fs","grpc"],"mappings":";;;;;;;;AAOO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,GAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,4BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK;ACRrC,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAO3B,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,KAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH;AAAA,KACD;AACA,IAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,KAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,KAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH;AAAA,KACD;AACA,IAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,KAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,EACxC;AACD","file":"chunk-WSW6YJNY.js","sourcesContent":["/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","import path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n","/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n"]}

package/dist/client.d.ts

@@ -1,6 +1,7 @@
 import './verifier-COnid_dg.js';
 import './mesh.js';
-export { a as LiopClient } from './index-qM8ZH8sC.js';
-import './types-sKeUxuky.js';
+export { c as LiopClient } from './index-cMV0_yD9.js';
+import './types-lJIxBlWF.js';
+import 'node:events';
 import 'zod';
 import 'jose';

package/dist/client.js

@@ -1,9 +1,10 @@
-export { LiopClient } from './chunk-E5QBDD5E.js';
+export { LiopClient } from './chunk-CRZBVFDV.js';
 import './chunk-32ADSAJS.js';
 import './chunk-OUUTDSOW.js';
 import './chunk-QLCOEP5J.js';
-import './chunk-RDWCGZ2A.js';
-import './chunk-NJRSFFD7.js';
+import './chunk-WSW6YJNY.js';
+import './chunk-PYKRQAER.js';
+import './chunk-74CISO2I.js';
 import './chunk-72MNYFR6.js';
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,112 +1,7 @@
-import { MeshNode } from './mesh.js';
-import { L as LiopServer } from './index-BlGc0iym.js';
-import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { M as McpRequest, A as AuthInfo, b as McpResponse } from './types-sKeUxuky.js';
+import './mesh.js';
+import './index-BW95kAL4.js';
+export { L as LiopHybridGateway } from './hybrid-CF__0YnC.js';
 import 'zod';
+import './types-lJIxBlWF.js';
 import 'jose';
-
-/**
- * LIOP MCP Router
- *
- * Core logic for routing MCP requests to local or remote LIOP providers.
- * Decoupled from transport (HTTP/Stdio).
- *
- * All tool discovery and port resolution is DYNAMIC via the
- * /liop/manifest/1.0.0 protocol stream over Kademlia DHT.
- */
-declare class LiopMcpRouter {
-    private liopServer;
-    private meshNode;
-    private defaultRpcPort;
-    /** Cached manifests from remote peers. Key = PeerID */
-    private manifestCache;
-    /** Guards against concurrent discovery storms */
-    private currentDiscovery;
-    /** Verifier for Tier-0 integrity checks */
-    verifier: LiopVerifier;
-    /** Callback when new remote tools are discovered */
-    onToolsChanged?: () => void;
-    /** Circuit-breaker state for peers that repeatedly fail manifest queries. */
-    private manifestFailureState;
-    private static readonly MANIFEST_FAILURE_BASE_COOLDOWN_MS;
-    private static readonly MANIFEST_FAILURE_MAX_COOLDOWN_MS;
-    private static readonly MANIFEST_SKIP_LOG_THROTTLE_MS;
-    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, defaultRpcPort?: number);
-    private shouldSkipManifestQuery;
-    private recordManifestQuerySuccess;
-    private recordManifestQueryFailure;
-    dispatch(request: McpRequest, authInfo?: AuthInfo | null): Promise<McpResponse | null>;
-    /**
-     * MCP clients often send notifications/initialized then immediately tools/list.
-     * Start manifest discovery without blocking the notification handler.
-     */
-    private kickDiscoveryAfterInitialized;
-    /**
-     * Discovers and caches manifests from all remote LIOP providers in the mesh.
-     * Uses Kademlia DHT to find "liop:manifest" providers, then opens
-     * /liop/manifest/1.0.0 protocol streams to retrieve their full metadata.
-     */
-    refreshManifestCache(silent?: boolean): Promise<void>;
-    /**
-     * Returns the current manifest cache size for external telemetry.
-     * Used by the adaptive polling system to detect topology stabilization.
-     */
-    getCacheSize(): number;
-    /**
-     * Returns all remote tools discovered via the manifest protocol.
-     */
-    private getRemoteTools;
-    /**
-     * Returns all remote resources discovered via the manifest protocol.
-     */
-    private getRemoteResources;
-    /**
-     * Resolves the gRPC target (host:port) AND the peerId for a given tool name
-     * by searching the manifest cache. Supports exact names and suffixed names.
-     */
-    private resolveManifestTarget;
-    /**
-     * Redacts a PeerID for external-facing diagnostics.
-     * LIOP_DIAGNOSTIC_LEVEL controls verbosity:
-     *   - "redacted" (default): truncated to last 8 chars
-     *   - "full": complete PeerID (development only)
-     */
-    private redactPeerId;
-    private transcodeMcpToLiop;
-    private routeToRemoteProvider;
-    /** Cached M2M token for dynamic gateway-to-node routing */
-    private meshAgentToken?;
-    /**
-     * Dynamically acquires an M2M access token from the Nexus Authorization Server.
-     * If peerId is provided, checks if there are node-specific environment tokens
-     * before falling back to the global static token or Nexus acquisition.
-     */
-    private getOrAcquireMeshAgentToken;
-    private performTranscoding;
-    private encryptWithNonce;
-}
-
-/**
- * LIOP Hybrid Gateway
- * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.
- */
-declare class LiopHybridGateway {
-    private liopServer;
-    private meshNode;
-    private netServer;
-    private h2Server;
-    private h1Server;
-    private router;
-    private jwtValidator?;
-    private oauthProvider?;
-    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number);
-    private setupH2Routes;
-    private setupH1Routes;
-    private handleGrpcStream;
-    private handleMcpH2Stream;
-    listen(port: number, host?: string): Promise<number>;
-    stop(): Promise<void>;
-    getRouter(): LiopMcpRouter;
-}
-
-export { LiopHybridGateway };
+import './verifier-COnid_dg.js';

package/dist/gateway.js

@@ -1,10 +1,11 @@
-export { LiopHybridGateway } from './chunk-PHTWUTY7.js';
-import './chunk-HB5DXX3Q.js';
+export { LiopHybridGateway } from './chunk-636UOVSO.js';
+import './chunk-KF4DCCU3.js';
 import './chunk-32ADSAJS.js';
 import './chunk-OUUTDSOW.js';
 import './chunk-QLCOEP5J.js';
-import './chunk-IJHTRIZC.js';
-import './chunk-RDWCGZ2A.js';
+import './chunk-OIMJZ64E.js';
+import './chunk-WSW6YJNY.js';
+import './chunk-PYKRQAER.js';
 import './chunk-72MNYFR6.js';
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/hybrid-CF__0YnC.d.ts

@@ -0,0 +1,170 @@
+import { MeshNode } from './mesh.js';
+import { L as LiopServer } from './index-BW95kAL4.js';
+import { L as LiopVerifier } from './verifier-COnid_dg.js';
+import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse } from './types-lJIxBlWF.js';
+
+/**
+ * LIOP Sliding-Window Rate Limiter
+ *
+ * High-performance, zero-dependency in-memory rate limiter designed
+ * to protect the LIOP Hybrid Gateway and Mesh Nodes against Denial of Service (DoS),
+ * worker pool exhaustion, and brute-force attacks.
+ *
+ * Conforms to OWASP API Security Top 10 (API4:2023 - Unrestricted Resource Consumption).
+ */
+interface RateLimiterOptions {
+    /** Window duration in milliseconds (default: 60,000ms = 1 minute) */
+    windowMs?: number;
+    /** Maximum number of allowed requests per window (default: 120) */
+    maxRequests?: number;
+}
+interface RateLimitStatus {
+    allowed: boolean;
+    remaining: number;
+    limit: number;
+    resetMs: number;
+}
+declare class InMemoryRateLimiter {
+    private readonly windowMs;
+    private readonly maxRequests;
+    private readonly records;
+    private cleanupTimer?;
+    constructor(options?: RateLimiterOptions);
+    /**
+     * Evaluates whether a request from the given key (IP, token, or clientId) is permitted.
+     *
+     * @param key Identifier for the client (e.g., remote IP or OAuth client ID)
+     * @returns Status containing allowed boolean, remaining quota, and time until reset
+     */
+    check(key: string): RateLimitStatus;
+    /**
+     * Explicitly resets the rate limit bucket for a given key.
+     */
+    reset(key: string): void;
+    /**
+     * Cleans up expired rate-limiting buckets to prevent memory leaks.
+     */
+    cleanup(): void;
+    /**
+     * Destroys internal timers and clears records.
+     */
+    close(): void;
+}
+
+/**
+ * LIOP MCP Router
+ *
+ * Core logic for routing MCP requests to local or remote LIOP providers.
+ * Decoupled from transport (HTTP/Stdio).
+ *
+ * All tool discovery and port resolution is DYNAMIC via the
+ * /liop/manifest/1.0.0 protocol stream over Kademlia DHT.
+ */
+declare class LiopMcpRouter {
+    private liopServer;
+    private meshNode;
+    private defaultRpcPort;
+    /** Cached manifests from remote peers. Key = PeerID */
+    private manifestCache;
+    /** Guards against concurrent discovery storms */
+    private currentDiscovery;
+    /** Verifier for Tier-0 integrity checks */
+    verifier: LiopVerifier;
+    /** Callback when new remote tools are discovered */
+    onToolsChanged?: () => void;
+    /** Circuit-breaker state for peers that repeatedly fail manifest queries. */
+    private manifestFailureState;
+    private static readonly MANIFEST_FAILURE_BASE_COOLDOWN_MS;
+    private static readonly MANIFEST_FAILURE_MAX_COOLDOWN_MS;
+    private static readonly MANIFEST_SKIP_LOG_THROTTLE_MS;
+    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, defaultRpcPort?: number);
+    getManifestCacheSize(): number;
+    private shouldSkipManifestQuery;
+    private recordManifestQuerySuccess;
+    private recordManifestQueryFailure;
+    /**
+     * Detects the protocol era of an incoming request.
+     * Modern requests carry '_meta' with protocol version "2026-07-28" or use modern RPCs.
+     * Legacy requests use 'initialize' handshake or lack '_meta' envelopes.
+     */
+    detectEra(request: McpRequest): McpEra;
+    dispatch(request: McpRequest, authInfo?: AuthInfo | null): Promise<McpResponse | null>;
+    /**
+     * MCP clients often send notifications/initialized then immediately tools/list.
+     * Start manifest discovery without blocking the notification handler.
+     */
+    private kickDiscoveryAfterInitialized;
+    /**
+     * Discovers and caches manifests from all remote LIOP providers in the mesh.
+     * Uses Kademlia DHT to find "liop:manifest" providers, then opens
+     * /liop/manifest/1.0.0 protocol streams to retrieve their full metadata.
+     */
+    refreshManifestCache(silent?: boolean): Promise<void>;
+    /**
+     * Returns the current manifest cache size for external telemetry.
+     * Used by the adaptive polling system to detect topology stabilization.
+     */
+    getCacheSize(): number;
+    /**
+     * Returns all remote tools discovered via the manifest protocol.
+     */
+    private getRemoteTools;
+    /**
+     * Returns all remote resources discovered via the manifest protocol.
+     */
+    private getRemoteResources;
+    /**
+     * Resolves the gRPC target (host:port) AND the peerId for a given tool name
+     * by searching the manifest cache. Supports exact names and suffixed names.
+     */
+    private resolveManifestTarget;
+    /**
+     * Redacts a PeerID for external-facing diagnostics.
+     * LIOP_DIAGNOSTIC_LEVEL controls verbosity:
+     *   - "redacted" (default): truncated to last 8 chars
+     *   - "full": complete PeerID (development only)
+     */
+    private redactPeerId;
+    private transcodeMcpToLiop;
+    private routeToRemoteProvider;
+    /** Cached M2M token for dynamic gateway-to-node routing */
+    private meshAgentToken?;
+    /**
+     * Dynamically acquires an M2M access token from the Nexus Authorization Server.
+     * If peerId is provided, checks if there are node-specific environment tokens
+     * before falling back to the global static token or Nexus acquisition.
+     */
+    private getOrAcquireMeshAgentToken;
+    private performTranscoding;
+    private encryptWithNonce;
+}
+
+/**
+ * LIOP Hybrid Gateway
+ * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.
+ */
+declare class LiopHybridGateway {
+    private liopServer;
+    private meshNode;
+    private netServer;
+    private h2Server;
+    private h1Server;
+    private router;
+    private jwtValidator?;
+    private oauthProvider?;
+    private rateLimiter;
+    private isDraining;
+    private activeRequests;
+    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number, rateLimiterOptions?: RateLimiterOptions);
+    private setupH2Routes;
+    private setupH1Routes;
+    private handleGrpcStream;
+    private handleMcpH2Stream;
+    listen(port: number, host?: string): Promise<number>;
+    isDrained(): boolean;
+    drain(timeoutMs?: number): Promise<void>;
+    stop(): Promise<void>;
+    getRouter(): LiopMcpRouter;
+}
+
+export { InMemoryRateLimiter as I, LiopHybridGateway as L, type RateLimitStatus as R, LiopMcpRouter as a, type RateLimiterOptions as b };

package/dist/{index-BlGc0iym.d.ts → index-BW95kAL4.d.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { MeshNode } from './mesh.js';
-import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, c as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-sKeUxuky.js';
+import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, d as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-lJIxBlWF.js';
 
 /**
  * LIOP OAuth 2.1 Hybrid Auth — Configuration Types
@@ -100,6 +100,60 @@ declare const AUTH_DEFAULTS: {
     readonly signingAlgorithm: "EdDSA";
 };
 
+/**
+ * LIOP Immutable Audit Logger (Phase Beta-3)
+ * SOC 2 Type II & HIPAA compliant audit trail with cryptographic Hash-Chain.
+ * Guarantees tamper-evidence and non-repudiation for all Logic-on-Origin executions.
+ */
+type AuditStatus = "SUCCESS" | "BLOCKED_EGRESS" | "ERROR" | "POLICY_VIOLATION";
+interface AuditEntry {
+    id: string;
+    timestamp: string;
+    traceId: string;
+    agentDid: string;
+    peerId: string;
+    toolName: string;
+    datasetHash: string;
+    fuelConsumed: number;
+    outputHash: string;
+    zkReceiptSig: string;
+    status: AuditStatus;
+    prevEntryHash: string;
+    entryHash: string;
+}
+interface AuditRecordParams {
+    timestamp?: string;
+    traceId?: string;
+    agentDid: string;
+    peerId: string;
+    toolName: string;
+    datasetHash?: string;
+    fuelConsumed: number;
+    outputHash?: string;
+    zkReceiptSig?: string;
+    status: AuditStatus;
+}
+declare const GENESIS_HASH: string;
+declare function computeEntryHash(entryWithoutHash: Omit<AuditEntry, "entryHash">): string;
+declare class AuditLogger {
+    private entries;
+    private lastEntryHash;
+    private filePath?;
+    constructor(filePath?: string);
+    recordExecution(params: AuditRecordParams): AuditEntry;
+    getEntries(): readonly AuditEntry[];
+    getEntryCount(): number;
+    verifyIntegrity(): {
+        valid: boolean;
+        totalEntries: number;
+        brokenIndex?: number;
+        reason?: string;
+    };
+    exportJsonl(): string;
+    private loadFromFile;
+}
+declare const globalAuditLogger: AuditLogger;
+
 /** Single named entity detected by the NER scanner. */
 interface NerEntity {
     type: "person" | "place" | "organization";
@@ -278,6 +332,10 @@ interface LiopServerOptions {
      * Must match SCREAMING_SNAKE_CASE: /^[A-Z][A-Z0-9_]*$/ (e.g., "BANK", "VAULT", "HFT_ORACLE").
      */
     tokenSlug?: string;
+    /**
+     * SOC 2 Type II / HIPAA immutable audit logger instance.
+     */
+    auditLogger?: AuditLogger;
     /**
      * Path to a shared JSON file for persistent Query Budget tracking across multiple server instances.
      */
@@ -363,6 +421,9 @@ declare class LiopServer {
     private sessions;
     private revokedTokenHashes;
     private lastRevocationLoadTime;
+    private pqcKeyPair;
+    readonly auditLogger: AuditLogger;
+    getDatasetHash(): string;
     private static readonly LIOP_COMPACT_REGEX;
     private extractLogic;
     private parseUnknownJson;
@@ -520,4 +581,4 @@ declare class LiopServer {
     private applyInMemoryBudget;
 }
 
-export { AUTH_DEFAULTS as A, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuthRole as c, type LiopAuthConfig as d, type LogicExecutionPolicy as e, type OutputSanitizerConfig as f, PII_PRESETS as g, type PiiRule as h, PiiScanner as i, sanitizeOutput as s };
+export { AUTH_DEFAULTS as A, GENESIS_HASH as G, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuditEntry as c, AuditLogger as d, type AuditRecordParams as e, type AuditStatus as f, type AuthRole as g, type LiopAuthConfig as h, type LogicExecutionPolicy as i, type OutputSanitizerConfig as j, PII_PRESETS as k, type PiiRule as l, PiiScanner as m, computeEntryHash as n, globalAuditLogger as o, sanitizeOutput as s };