@nekzus/liop 2.1.0 → 2.3.0

package/dist/index.d.ts

@@ -1,17 +1,19 @@
 export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOptions } from './bridge.js';
-import { L as LiopTlsOptions } from './index-Brfvxmdt.js';
-export { a as LiopClient } from './index-Brfvxmdt.js';
-export { LiopHybridGateway } from './gateway.js';
+import { L as LiopTlsOptions } from './index-cMV0_yD9.js';
+export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient } from './index-cMV0_yD9.js';
+import * as http from 'node:http';
+export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-CF__0YnC.js';
 export { LiopManifest, MeshNode, MeshNodeConfig } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-DO97j6hP.js';
-import { A as AuthInfo } from './types-DzEXgi4s.js';
-export { C as CallToolRequest, a as CallToolResult, G as GetPromptRequest, c as GetPromptResult, J as JwtValidator, M as McpRequest, b as McpResponse, P as Prompt, d as PromptSchema, R as Resource, e as ResourceSchema, S as ServerInfo, T as Tool, f as ToolSchema } from './types-DzEXgi4s.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuditEntry, d as AuditLogger, e as AuditRecordParams, f as AuditStatus, g as AuthRole, G as GENESIS_HASH, h as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, i as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, j as OutputSanitizerConfig, P as PII_PATTERNS, k as PII_PRESETS, l as PiiRule, m as PiiScanner, T as ToolHandler, n as computeEntryHash, o as globalAuditLogger, s as sanitizeOutput } from './index-BW95kAL4.js';
+import { A as AuthInfo } from './types-lJIxBlWF.js';
+export { e as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, G as GetPromptRequest, d as GetPromptResult, I as InputRequest, f as InputRequiredResult, g as InputResponse, J as JwtValidator, h as MCP_LEGACY_SUPPORT_ENABLED, i as MCP_PROTOCOL_VERSION, j as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, k as McpRequestMeta, c as McpResponse, P as Prompt, l as PromptSchema, R as Resource, m as ResourceSchema, S as ServerInfo, T as Tool, n as ToolSchema } from './types-lJIxBlWF.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
 import '@modelcontextprotocol/sdk/server/mcp.js';
 import 'zod';
 import './verifier-COnid_dg.js';
+import 'node:events';
 
 /**
  * TokenEstimator — Pluggable strategy for counting tokens in text content.
@@ -26,7 +28,7 @@ interface TokenEstimator {
     readonly name: string;
 }
 /**
- * Exact BPE tokenizer using o200k_base encoding.
+ * Exact BPE tokenizer using inlined o200k_base encoding.
  *
  * o200k_base is the standard encoding for all modern OpenAI models
  * (GPT-4o, GPT-4.1, o1, o3, o4) and provides a reasonable baseline
@@ -34,7 +36,7 @@ interface TokenEstimator {
  *
  * - Synchronous: safe for hot-path usage without async overhead
  * - Merge cache reduced to 10K entries for long-running server processes
- * - Zero runtime dependencies beyond gpt-tokenizer itself
+ * - Inlined at build-time: zero external runtime dependencies in node_modules
  */
 declare class RealTokenEstimator implements TokenEstimator {
     readonly name = "o200k_base";
@@ -46,24 +48,19 @@ declare class RealTokenEstimator implements TokenEstimator {
  * Fallback heuristic estimator: ~4 characters per token.
  *
  * Industry-standard approximation (±10% for English/code content).
- * Used only when gpt-tokenizer fails to load in constrained environments.
+ * Used only when tokenizer fails in constrained environments.
  */
 declare class HeuristicTokenEstimator implements TokenEstimator {
     readonly name = "heuristic (chars/4)";
     countTokens(text: string): number;
 }
 /**
- * Factory: creates a RealTokenEstimator with gpt-tokenizer,
- * falling back to HeuristicTokenEstimator if the import fails.
- *
- * Uses dynamic import to avoid blocking SDK initialization and to
- * gracefully degrade in environments where gpt-tokenizer is unavailable.
+ * Factory: creates a RealTokenEstimator with inlined o200k_base,
+ * falling back to HeuristicTokenEstimator if an unexpected error occurs.
  */
 declare function createTokenEstimator(): Promise<TokenEstimator>;
 /**
- * Synchronous factory: creates a HeuristicTokenEstimator immediately.
- * Used when the async factory cannot be awaited (e.g., constructor contexts).
- * The engine should upgrade to the real estimator via setEstimator() later.
+ * Synchronous factory: creates a RealTokenEstimator immediately.
  */
 declare function createSyncTokenEstimator(): TokenEstimator;
 
@@ -199,6 +196,162 @@ declare class LiopError extends Error {
     constructor(code: ErrorCode, message: string);
 }
 
+/**
+ * LIOP gRPC-Web Protocol Adapter (HTTP/1.1 Fallback)
+ *
+ * Implements standard gRPC-Web framing per the official gRPC-Web specification:
+ * https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-WEB.md
+ *
+ * Allows web browsers, corporate Layer 7 HTTP/1.1 proxies, and enterprise WAFs
+ * to invoke LIOP nodes over HTTP/1.1 without requiring HTTP/2 streaming or h2c.
+ *
+ * Frame Format:
+ * - 1 byte: Frame Flag (0x00 = Data Frame, 0x80 = Trailers Frame)
+ * - 4 bytes: 32-bit Big-Endian Unsigned Integer (payload length in bytes)
+ * - N bytes: Message or Trailer payload
+ */
+
+declare const GRPC_WEB_CONSTANTS: {
+    readonly FLAG_DATA: 0;
+    readonly FLAG_TRAILERS: 128;
+    readonly HEADER_LENGTH: 5;
+    readonly CONTENT_TYPE_PREFIX: "application/grpc-web";
+    readonly STATUS_OK: 0;
+    readonly STATUS_CANCELLED: 1;
+    readonly STATUS_UNKNOWN: 2;
+    readonly STATUS_INVALID_ARGUMENT: 3;
+    readonly STATUS_DEADLINE_EXCEEDED: 4;
+    readonly STATUS_NOT_FOUND: 5;
+    readonly STATUS_PERMISSION_DENIED: 7;
+    readonly STATUS_UNAUTHENTICATED: 16;
+    readonly STATUS_INTERNAL: 13;
+};
+interface GrpcWebFrame {
+    isTrailer: boolean;
+    payload: Buffer;
+}
+/**
+ * Checks if an incoming HTTP request is a gRPC-Web request.
+ */
+declare function isGrpcWebRequest(contentType?: string): boolean;
+/**
+ * Encodes a binary payload into a standard 5-byte framed gRPC-Web Data Frame.
+ */
+declare function encodeDataFrame(payload: Buffer | Uint8Array): Buffer;
+/**
+ * Encodes gRPC status and optional message into a 5-byte framed gRPC-Web Trailer Frame.
+ */
+declare function encodeTrailerFrame(status?: number, message?: string, customTrailers?: Record<string, string>): Buffer;
+/**
+ * Parses raw gRPC-Web byte streams into an array of frames.
+ */
+declare function decodeFrames(buffer: Buffer): GrpcWebFrame[];
+/**
+ * Dispatches an HTTP/1.1 gRPC-Web request to an underlying protocol handler
+ * and serializes data and trailer frames back to the client.
+ */
+declare function dispatchGrpcWebRequest(req: http.IncomingMessage, res: http.ServerResponse, handler: (path: string, payload: Buffer) => Promise<{
+    status: number;
+    message?: string;
+    data?: Buffer;
+}>): Promise<void>;
+
+/**
+ * LIOP Prometheus Metrics Registry (Phase Beta-3)
+ * Lightweight, zero-dependency, high-performance metrics collector
+ * complying with Prometheus and OpenMetrics exposition format.
+ */
+type MetricLabels = Record<string, string | number>;
+interface MetricDefinition {
+    name: string;
+    help: string;
+    type: "counter" | "gauge" | "histogram";
+    buckets?: number[];
+}
+declare class Counter {
+    readonly name: string;
+    readonly help: string;
+    private values;
+    constructor(name: string, help: string);
+    inc(labels?: MetricLabels, value?: number): void;
+    get(labels?: MetricLabels): number;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class Gauge {
+    readonly name: string;
+    readonly help: string;
+    private values;
+    constructor(name: string, help: string);
+    set(labelsOrValue: MetricLabels | number, maybeValue?: number): void;
+    inc(labels?: MetricLabels, value?: number): void;
+    dec(labels?: MetricLabels, value?: number): void;
+    get(labels?: MetricLabels): number;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class Histogram {
+    readonly name: string;
+    readonly help: string;
+    readonly buckets: number[];
+    private observations;
+    constructor(name: string, help: string, buckets?: number[]);
+    observe(labelsOrValue: MetricLabels | number, maybeValue?: number): void;
+    reset(): void;
+    toPrometheus(): string[];
+}
+declare class MetricsRegistry {
+    private counters;
+    private gauges;
+    private histograms;
+    counter(name: string, help: string): Counter;
+    gauge(name: string, help: string): Gauge;
+    histogram(name: string, help: string, buckets?: number[]): Histogram;
+    collectProcessMetrics(): void;
+    exportPrometheusText(): string;
+    resetAll(): void;
+}
+declare const protocolMetrics: MetricsRegistry;
+declare const toolCallsTotal: Counter;
+declare const fuelConsumed: Histogram;
+declare const meshPeersConnected: Gauge;
+declare const manifestCacheSize: Gauge;
+declare const egressBlocksTotal: Counter;
+declare const zkVerificationDurationMs: Histogram;
+
+/**
+ * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)
+ * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.
+ * Spec: https://www.w3.org/TR/trace-context/
+ */
+interface SpanContext {
+    traceId: string;
+    spanId: string;
+    sampled: boolean;
+}
+interface LiopSpan {
+    readonly name: string;
+    readonly context: SpanContext;
+    readonly startTime: number;
+    endTime?: number;
+    attributes: Record<string, string | number | boolean>;
+    status: "OK" | "ERROR";
+    error?: string;
+    setAttribute(key: string, value: string | number | boolean): LiopSpan;
+    recordException(error: Error | string): LiopSpan;
+    end(): void;
+}
+declare class LiopTracer {
+    static generateTraceId(): string;
+    static generateSpanId(): string;
+    static formatTraceparent(traceId: string, spanId: string, sampled?: boolean): string;
+    static parseTraceparent(header?: string | null): SpanContext | null;
+    static injectTraceparent(carrier: Record<string, string | string[] | undefined>, context: SpanContext): void;
+    static extractTraceparent(carrier: Record<string, string | string[] | undefined>): SpanContext | null;
+    startSpan(name: string, parent?: SpanContext | null, attributes?: Record<string, string | number | boolean>): LiopSpan;
+}
+declare const defaultTracer: LiopTracer;
+
 /**
  * LIOP Cross-AI Prompt Adapters (Fase 92)
  *
@@ -216,6 +369,15 @@ interface PromptConfig {
  */
 declare function generateSystemInstructions(provider: AIProvider): string;
 
+/**
+ * LIOP Production-Grade gRPC Channel Options
+ *
+ * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,
+ * and gateway proxy channels per NIST SP 800-207 continuous verification.
+ * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.
+ */
+declare const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>>;
+
 /**
  * TypeScript interfaces reflecting liop_core.proto (LIOP v1)
  * Optimized for logic-on-origin and high-performance serialization.
@@ -252,6 +414,7 @@ interface LogicResponse {
 declare class LiopRpcClient {
     private client;
     private token?;
+    readonly address: string;
     constructor(address: string, tls?: LiopTlsOptions, token?: string);
     /**
      * Negotiates intent with the remote host.
@@ -266,6 +429,92 @@ declare class LiopRpcClient {
     close(): void;
 }
 
+/**
+ * LIOP Post-Quantum Digital Signature Wrapper
+ * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant
+ * manifest attestation, node revocation receipts, and cryptographic integrity.
+ *
+ * Characteristics:
+ * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)
+ * - Public Key Length: 1952 bytes
+ * - Secret Key Length: 4032 bytes
+ * - Signature Length: 3309 bytes
+ * - Implementation: Pure TypeScript/JS via @noble/post-quantum
+ */
+declare const DILITHIUM65_CONSTANTS: {
+    readonly PUBLIC_KEY_BYTES: 1952;
+    readonly SECRET_KEY_BYTES: 4032;
+    readonly SIGNATURE_BYTES: 3309;
+    readonly DEFAULT_CONTEXT: Uint8Array<ArrayBuffer>;
+};
+declare const Dilithium65Wrapper: {
+    /** Constants */
+    PUBLIC_KEY_BYTES: 1952;
+    SECRET_KEY_BYTES: 4032;
+    SIGNATURE_BYTES: 3309;
+    /**
+     * Generates a new ML-DSA-65 (FIPS 204) key pair.
+     * Optionally accepts a 32-byte seed for deterministic key generation.
+     */
+    generateKeyPair(seed?: Uint8Array): {
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    };
+    /**
+     * Validates and imports a raw ML-DSA-65 public key.
+     */
+    importPublicKey(buffer: Uint8Array): Uint8Array;
+    /**
+     * Signs a message using the post-quantum secret key.
+     * Supports optional domain separation context (up to 255 bytes).
+     */
+    sign(message: Uint8Array | string, secretKey: Uint8Array, context?: Uint8Array): Uint8Array;
+    /**
+     * Verifies an ML-DSA-65 post-quantum digital signature.
+     */
+    verify(signature: Uint8Array, message: Uint8Array | string, publicKey: Uint8Array, context?: Uint8Array): boolean;
+    /**
+     * Signs a structured manifest (LiopManifest) using canonical JSON serialization.
+     * Returns base64-encoded signature and public key for transport over gRPC/MCP.
+     */
+    signManifest(manifest: Record<string, unknown>, secretKey: Uint8Array, publicKey: Uint8Array): {
+        signature: string;
+        publicKey: string;
+    };
+    /**
+     * Verifies the post-quantum signature of a structured manifest.
+     */
+    verifyManifest(manifest: Record<string, unknown>, signatureBase64: string, publicKeyBase64: string): boolean;
+};
+
+declare const Kyber768Wrapper: {
+    /**
+     * Extracts and validates the 1184-byte Public Key from the Rust LIOP Data Node
+     * @param buffer Raw buffer sent via gRPC IntentResponse
+     */
+    importPublicKey(buffer: Uint8Array): Uint8Array;
+    /**
+     * Encapsulates a shared secret using the server's public key.
+     * Returns the 1088-byte ciphertext to be sent back, and the 32-byte shared AES secret.
+     */
+    encapsulateAsymmetric(publicKey: Uint8Array): Promise<{
+        ciphertext: Uint8Array;
+        sharedSecret: Uint8Array;
+    }>;
+    /**
+     * Generates a Kyber768 KeyPair for the server to accept intents.
+     */
+    generateKeyPair(): Promise<{
+        publicKey: Uint8Array;
+        secretKey: Uint8Array;
+    }>;
+    /**
+     * Decapsulates the shared secret using the server's secret key.
+     * Zero-fills the shared secret buffer after extraction for side-channel protection.
+     */
+    decapsulateSymmetric(ciphertext: Uint8Array, secretKey: Uint8Array): Promise<Uint8Array>;
+};
+
 declare class LiopRpcServer {
     private server;
     constructor();
@@ -274,6 +523,7 @@ declare class LiopRpcServer {
         executeLogic: (call: grpc.ServerWritableStream<LogicRequest, LogicResponse>) => void;
     }): void;
     listen(port?: number, tls?: LiopTlsOptions): Promise<number>;
+    gracefulShutdown(timeoutMs?: number): Promise<void>;
     stop(): Promise<void>;
 }
 
@@ -282,6 +532,11 @@ declare class LiopRpcServer {
  * preventing exposure of sensitive credentials and shell function injection.
  */
 declare function getDefaultEnvironment(): Record<string, string>;
+/**
+ * Calculates deterministic execution fuel units based on AST instruction complexity.
+ * Guarantees identical fuel consumption for the same logic across different hardware.
+ */
+declare function calculateAstInstructionFuel(code: string): number;
 interface SandboxConfig {
     allowEnv?: boolean;
     allowedDirectories?: Record<string, string>;
@@ -428,4 +683,4 @@ declare function authorizeRequest(method: string, auth: AuthInfo | null, additio
 declare const LIOP_SCOPES: readonly ["liop:tools:list", "liop:tools:call", "liop:resources:read", "liop:schema:read", "liop:mesh:query"];
 type LiopScope = (typeof LIOP_SCOPES)[number];
 
-export { type AIProvider, AuthInfo, ErrorCode, HeuristicTokenEstimator, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type PromptConfig, RealTokenEstimator, type SandboxConfig, type TokenEstimator, type TokenOperationMetric, type TokenSessionReport, TokenTelemetryEngine, type ToolTokenBreakdown, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, generateSystemInstructions, getDefaultEnvironment };
+export { type AIProvider, AuthInfo, Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, ErrorCode, GRPC_CHANNEL_OPTIONS, GRPC_WEB_CONSTANTS, Gauge, type GrpcWebFrame, HeuristicTokenEstimator, Histogram, Kyber768Wrapper, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type LiopSpan, LiopTracer, type MetricDefinition, type MetricLabels, MetricsRegistry, type PromptConfig, RealTokenEstimator, type SandboxConfig, type SpanContext, type TokenEstimator, type TokenOperationMetric, type TokenSessionReport, TokenTelemetryEngine, type ToolTokenBreakdown, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, calculateAstInstructionFuel, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, decodeFrames, defaultTracer, dispatchGrpcWebRequest, egressBlocksTotal, encodeDataFrame, encodeTrailerFrame, fuelConsumed, generateSystemInstructions, getDefaultEnvironment, isGrpcWebRequest, manifestCacheSize, meshPeersConnected, protocolMetrics, toolCallsTotal, zkVerificationDurationMs };