@nekzus/liop 2.1.0 → 2.3.0

package/dist/chunk-CRZBVFDV.js

@@ -0,0 +1,616 @@
+import { LiopVerifier } from './chunk-32ADSAJS.js';
+import { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
+import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS } from './chunk-WSW6YJNY.js';
+import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-PYKRQAER.js';
+import { MeshNode } from './chunk-74CISO2I.js';
+import { log } from './chunk-72MNYFR6.js';
+import * as grpc from '@grpc/grpc-js';
+import { createDecipheriv, randomBytes, createCipheriv } from 'crypto';
+
+var LiopRpcClient = class {
+  // biome-ignore lint/suspicious/noExplicitAny: internal gRPC client type
+  client;
+  token;
+  address;
+  constructor(address, tls, token) {
+    const credentials = createChannelCredentials(tls);
+    this.client = new liopV1.LogicMesh(
+      address,
+      credentials,
+      GRPC_CHANNEL_OPTIONS
+    );
+    this.token = token;
+    this.address = address;
+  }
+  /**
+   * Negotiates intent with the remote host.
+   * Returns the ephemeral Kyber public key for payload encryption.
+   */
+  async negotiateIntent(request) {
+    return new Promise((resolve, reject) => {
+      const metadata = new grpc.Metadata();
+      if (this.token) {
+        metadata.add("authorization", `Bearer ${this.token}`);
+      }
+      this.client.NegotiateIntent(
+        request,
+        metadata,
+        (error, response) => {
+          if (error) {
+            reject(error);
+          } else {
+            resolve(response);
+          }
+        }
+      );
+    });
+  }
+  /**
+   * Pushes the encrypted Logic-on-Origin payload to the origin.
+   * Returns a stream of semantic responses and ZK proofs.
+   */
+  executeLogic(request) {
+    const metadata = new grpc.Metadata();
+    if (this.token) {
+      metadata.add("authorization", `Bearer ${this.token}`);
+    }
+    return this.client.ExecuteLogic(request, metadata);
+  }
+  close() {
+    this.client.close();
+  }
+};
+var AesGcmWrapper = {
+  /**
+   * Encrypts a raw WASM payload using the shared secret negotiated via Kyber768.
+   *
+   * @param payload Raw incoming WASM byte array or string.
+   * @param sharedSecret A perfectly derived 32-byte (256-bit) shared secret array
+   * @returns The encrypted buffer to push to the GRPc stream, along with the 12-byte initialization vector natively generated.
+   */
+  encryptPayload(payload, sharedSecret) {
+    if (sharedSecret.length !== 32) {
+      throw new Error("Symmetric Key must be exactly 32 bytes (256 bits).");
+    }
+    const nonce = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", sharedSecret, nonce);
+    const encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const finalCiphertext = Buffer.concat([encrypted, authTag]);
+    return {
+      ciphertext: finalCiphertext,
+      nonce
+    };
+  },
+  /**
+   * Decrypts a remote Zero-Knowledge receipt using AES-256-GCM.
+   */
+  decryptPayload(ciphertextBuffer, nonce, sharedSecret) {
+    if (ciphertextBuffer.length < 16) {
+      throw new Error(
+        "Invalid GCM Ciphertext; missing authentication tag length"
+      );
+    }
+    const encryptedData = ciphertextBuffer.subarray(0, -16);
+    const authTag = ciphertextBuffer.subarray(-16);
+    const decipher = createDecipheriv("aes-256-gcm", sharedSecret, nonce);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([decipher.update(encryptedData), decipher.final()]);
+  }
+};
+
+// src/client/index.ts
+var LiopClient = class {
+  meshNode = null;
+  rpcClients = /* @__PURE__ */ new Map();
+  manifests = /* @__PURE__ */ new Map();
+  tlsOptions;
+  serverInfo;
+  verifier = new LiopVerifier();
+  oauthToken;
+  /** Protocol negotiation era */
+  era = "modern";
+  /** Negotiated protocol version */
+  protocolVersion = MCP_PROTOCOL_VERSION;
+  constructor(tls) {
+    this.tlsOptions = tls;
+  }
+  /**
+   * Requests an M2M access token from the Nexus Authorization Server using Client Credentials.
+   */
+  async acquireM2MToken(authOpts) {
+    const baseUrl = authOpts.nexusUrl.endsWith("/oidc") ? authOpts.nexusUrl : `${authOpts.nexusUrl}/oidc`;
+    const tokenUrl = `${baseUrl}/token`;
+    log.info(`[LiopClient] Requesting M2M Token from Nexus AS: ${tokenUrl}`);
+    const params = new URLSearchParams({
+      grant_type: "client_credentials",
+      scope: authOpts.scope || "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query",
+      resource: authOpts.audience,
+      client_id: authOpts.clientId,
+      client_secret: authOpts.clientSecret
+    });
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: params.toString()
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(
+        `OAuth token request failed with status ${response.status}: ${text}`
+      );
+    }
+    const data = await response.json();
+    if (!data.access_token) {
+      throw new Error("OAuth token response did not contain an access_token.");
+    }
+    log.info("[LiopClient] M2M Token acquired successfully.");
+    return data.access_token;
+  }
+  /**
+   * Discovers and connects to the target server or mesh capability.
+   * If address is omitted, it sets up the MeshNode to act purely dynamically.
+   */
+  async connect(address, options) {
+    const clientId = options?.auth?.clientId || process.env.LIOP_OAUTH_CLIENT_ID || process.env.LIOP_CLIENT_ID;
+    const clientSecret = options?.auth?.clientSecret || process.env.LIOP_OAUTH_CLIENT_SECRET || process.env.LIOP_CLIENT_SECRET;
+    const nexusUrl = options?.auth?.nexusUrl || process.env.LIOP_NEXUS_URL || "http://localhost:3000";
+    const audience = options?.auth?.audience || process.env.LIOP_OAUTH_AUDIENCE || "urn:liop:mesh:api";
+    const scope = options?.auth?.scope || process.env.LIOP_OAUTH_SCOPE || "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query";
+    this.oauthToken = options?.auth?.token || process.env.LIOP_OAUTH_TOKEN || process.env.LIOP_TOKEN;
+    if (clientId && clientSecret) {
+      try {
+        this.oauthToken = await this.acquireM2MToken({
+          clientId,
+          clientSecret,
+          nexusUrl,
+          audience,
+          scope
+        });
+      } catch (err) {
+        log.error(
+          `[LiopClient] Failed to acquire OAuth M2M Token: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    this.meshNode = new MeshNode(options?.meshConfig);
+    await this.meshNode.start();
+    log.info(
+      `[LiopClient] Mesh Node synchronized. PeerID: ${this.meshNode.getPeerId()}`
+    );
+    if (address) {
+      this.rpcClients.set(
+        "static",
+        new LiopRpcClient(address, this.tlsOptions, this.oauthToken)
+      );
+      this.serverInfo = { name: `LiopServer (${address})`, version: "1.0.0" };
+      log.info(`[LiopClient] Static gRPC configured for: ${address}`);
+    } else {
+      this.serverInfo = { name: "LiopServer (Mesh Alpha)", version: "1.0.0" };
+    }
+  }
+  /**
+   * Selects the optimal IP from an array of multiaddrs.
+   * Prioritizes routable non-loopback IPv4 addresses (e.g. Docker bridge, LAN, WAN)
+   * over loopback (127.0.0.1) to prevent inter-container connection failures.
+   */
+  selectOptimalIp(addrs) {
+    for (const maddr of addrs) {
+      const parts = maddr.split("/");
+      const ipIdx = parts.indexOf("ip4");
+      if (ipIdx !== -1 && ipIdx + 1 < parts.length) {
+        const ip = parts[ipIdx + 1];
+        if (ip !== "127.0.0.1" && !ip.startsWith("127.") && ip !== "0.0.0.0" && ip !== "localhost") {
+          return ip;
+        }
+      }
+    }
+    for (const maddr of addrs) {
+      const parts = maddr.split("/");
+      const ipIdx = parts.indexOf("ip4");
+      if (ipIdx !== -1 && ipIdx + 1 < parts.length) {
+        return parts[ipIdx + 1];
+      }
+    }
+    return null;
+  }
+  /**
+   * Dynamically queries Kademlia DHT to find the optimal PeerID providing the Capability
+   * and returns the physical gRPC target (host:port) resolved from the provider's manifest.
+   */
+  async resolveCapability(toolName) {
+    if (!this.meshNode)
+      throw new Error(
+        "Client must be connected to Mesh to resolve capabilities."
+      );
+    log.info(`[LiopClient] Querying Mesh DHT for Provider: ${toolName}...`);
+    const providers = await this.meshNode.findProviders(toolName);
+    if (providers.length === 0) {
+      throw new Error(
+        `Kademlia DHT found zero providers for capability: ${toolName}`
+      );
+    }
+    const providerId = providers[0];
+    log.info(`[LiopClient] Identified Alpha Provider PeerID: ${providerId}`);
+    let grpcPort = 50051;
+    const manifest = await this.meshNode.queryManifest(providerId);
+    if (manifest) {
+      grpcPort = manifest.grpcPort;
+      this.manifests.set(providerId, manifest);
+      log.info(
+        `[LiopClient] Manifest resolved: gRPC port ${grpcPort}. Cached manifest for PeerID ${providerId}`
+      );
+    }
+    const addrs = await this.meshNode.resolvePeer(providerId);
+    const optimalIp = this.selectOptimalIp(addrs);
+    if (optimalIp) {
+      const grpcHost = `${optimalIp}:${grpcPort}`;
+      log.info(
+        `[LiopClient] Translated Multiaddr to optimal gRPC Target: ${grpcHost}`
+      );
+      return grpcHost;
+    }
+    return `127.0.0.1:${grpcPort}`;
+  }
+  /**
+   * Probes a remote MCP endpoint using 'server/discover' to negotiate protocol era.
+   * Falls back to legacy initialize handshake if server/discover fails.
+   */
+  async probeServerDiscover(mcpUrl) {
+    try {
+      const headers = {
+        "Content-Type": "application/json",
+        "Mcp-Method": "server/discover"
+      };
+      if (this.oauthToken) {
+        headers.Authorization = `Bearer ${this.oauthToken}`;
+      }
+      const res = await fetch(mcpUrl, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "server/discover",
+          params: {}
+        })
+      });
+      if (res.ok) {
+        const json = await res.json();
+        const supported = json.result?.supportedVersions || [];
+        if (supported.includes(MCP_PROTOCOL_VERSION)) {
+          this.era = "modern";
+          this.protocolVersion = MCP_PROTOCOL_VERSION;
+          return {
+            era: "modern",
+            protocolVersion: MCP_PROTOCOL_VERSION,
+            supportedVersions: supported
+          };
+        }
+      }
+    } catch (_err) {
+    }
+    if (MCP_LEGACY_SUPPORT_ENABLED) {
+      this.era = "legacy";
+      this.protocolVersion = MCP_PROTOCOL_VERSION_LEGACY;
+      return {
+        era: "legacy",
+        protocolVersion: MCP_PROTOCOL_VERSION_LEGACY,
+        supportedVersions: [MCP_PROTOCOL_VERSION_LEGACY]
+      };
+    }
+    throw new Error(
+      "Server does not support MCP 2026-07-28 and legacy support is disabled."
+    );
+  }
+  /**
+   * Discovers remote capabilities via the LIOP Manifest Protocol.
+   * Utilizes a memory cache to avoid redundant network dials against live peers.
+   */
+  async discoverTools(forceRefresh = false) {
+    if (!this.meshNode) {
+      throw new Error("Client must be connected before discovering tools.");
+    }
+    log.info(
+      `[LiopClient] Discovery started (forceRefresh: ${forceRefresh})...`
+    );
+    const providerIds = await this.meshNode.discoverManifestProviders();
+    const tools = [];
+    const seenNames = /* @__PURE__ */ new Set();
+    for (const peerId of providerIds) {
+      try {
+        let manifest = !forceRefresh ? this.manifests.get(peerId) : void 0;
+        if (!manifest) {
+          log.info(`[LiopClient] Querying manifest from: ${peerId}`);
+          manifest = await this.meshNode.queryManifest(peerId);
+          if (manifest) {
+            this.manifests.set(peerId, manifest);
+          }
+        } else {
+          log.info(`[LiopClient] Using cached manifest for: ${peerId}`);
+        }
+        if (manifest) {
+          for (const tool of manifest.tools) {
+            if (!seenNames.has(tool.name)) {
+              tools.push({ name: tool.name, description: tool.description });
+              seenNames.add(tool.name);
+            }
+          }
+        }
+      } catch (err) {
+        log.info(
+          `[LiopClient] Error querying manifest from ${peerId}:`,
+          err instanceof Error ? err.message : String(err)
+        );
+      }
+    }
+    log.info(
+      `[LiopClient] Discovery finished. Found ${tools.length} unique tools.`
+    );
+    return tools;
+  }
+  /**
+   * Invokes a tool.
+   */
+  async callTool(request, _wasmPayload) {
+    if (!this.meshNode) {
+      throw new Error("Client must be connected before calling tools.");
+    }
+    const toolName = request.name;
+    log.info(`[LiopClient] Resolving Tool: ${toolName}`);
+    let rpcClient = this.rpcClients.get("static");
+    let targetClientKey = toolName;
+    if (!rpcClient) {
+      if (this.rpcClients.has(toolName)) {
+        rpcClient = this.rpcClients.get(toolName);
+        targetClientKey = toolName;
+      }
+    }
+    if (!rpcClient) {
+      let resolvedHost = null;
+      for (const [peerId, manifest] of this.manifests.entries()) {
+        if (manifest.tools.some((t) => t.name === toolName)) {
+          if (this.rpcClients.has(peerId)) {
+            rpcClient = this.rpcClients.get(peerId);
+            targetClientKey = peerId;
+            break;
+          }
+          const addrs = await this.meshNode.resolvePeer(peerId);
+          const optimalIp = this.selectOptimalIp(addrs);
+          if (optimalIp) {
+            resolvedHost = `${optimalIp}:${manifest.grpcPort}`;
+            log.info(
+              `[LiopClient] Fast-path: Resolved ${toolName} from manifest cache to optimal target ${resolvedHost}`
+            );
+            targetClientKey = peerId;
+            rpcClient = this.getOrCreateRpcClient(peerId, resolvedHost);
+            break;
+          }
+        }
+      }
+      if (!rpcClient) {
+        const dynamicAddress = await this.resolveCapability(toolName);
+        targetClientKey = toolName;
+        rpcClient = this.getOrCreateRpcClient(toolName, dynamicAddress);
+      }
+    } else {
+      targetClientKey = "static";
+      log.info(
+        `[LiopClient] Using existing static gRPC connection for ${toolName}.`
+      );
+    }
+    log.info(`[LiopClient] Negotiating intent for ${toolName}...`);
+    const agentDid = this.meshNode ? `did:liop:${this.meshNode.getPeerId()}` : "did:liop:ephemeral";
+    const intentPayload = Buffer.from(`${toolName}:${Date.now()}`);
+    const proofOfIntent = this.meshNode ? await this.meshNode.sign(intentPayload) : intentPayload;
+    const intentResponse = await rpcClient.negotiateIntent({
+      agent_did: agentDid,
+      capability_hash: toolName,
+      proof_of_intent: proofOfIntent
+    });
+    if (!intentResponse.accepted) {
+      throw new Error(`Intent denied by host: ${intentResponse.error_message}`);
+    }
+    const publicKey = intentResponse.kyber_public_key || intentResponse.kyberPublicKey;
+    const sessionToken = intentResponse.session_token || intentResponse.sessionToken;
+    if (!publicKey) {
+      log.info(
+        "[LiopClient] Critical Error: Kyber Public Key not found in IntentResponse.",
+        intentResponse
+      );
+      throw new Error(
+        "Handshake failed: Remote host did not provide a valid Kyber Public Key."
+      );
+    }
+    log.info(
+      `[LiopClient] Encapsulating Post-Quantum Shared Secret for ${request.name}...`
+    );
+    const { ciphertext: kyberCiphertext, sharedSecret } = await Kyber768Wrapper.encapsulateAsymmetric(publicKey);
+    log.info(`[LiopClient] Sealing WASM Payload and Inputs...`);
+    const _safePayload = _wasmPayload || Buffer.from("");
+    const { ciphertext: encryptedWasm, nonce: aesNonce } = AesGcmWrapper.encryptPayload(_safePayload, sharedSecret);
+    const encryptedInputs = {};
+    const crypto = await import('crypto');
+    for (const [key, value] of Object.entries(request.arguments || {})) {
+      const inputNonce = crypto.randomBytes(12);
+      const cipher = crypto.createCipheriv(
+        "aes-256-gcm",
+        sharedSecret,
+        inputNonce
+      );
+      const encrypted = Buffer.concat([
+        cipher.update(JSON.stringify(value)),
+        cipher.final()
+      ]);
+      const authTag = cipher.getAuthTag();
+      encryptedInputs[key] = Buffer.concat([inputNonce, encrypted, authTag]);
+    }
+    const logicRequest = {
+      session_token: sessionToken,
+      wasm_binary: encryptedWasm,
+      inputs: encryptedInputs,
+      pqc_ciphertext: kyberCiphertext,
+      aes_nonce: aesNonce
+    };
+    return new Promise((resolve, reject) => {
+      const stream = rpcClient.executeLogic(logicRequest);
+      if (!stream) {
+        reject(new Error("RPC Client unavailable or failed to create stream."));
+        return;
+      }
+      let resultFulfilled = false;
+      let hasReceivedData = false;
+      stream.on("data", async (response) => {
+        if (resultFulfilled) return;
+        hasReceivedData = true;
+        log.info("[LiopClient] Logic Executed. Verification in progress...");
+        try {
+          if (!response.is_error) {
+            const isValid = await this.verifier.verifyZkReceipt(
+              _safePayload,
+              Buffer.from(response.cryptographic_proof).toString("hex"),
+              Buffer.from(response.zk_receipt),
+              Buffer.from(sharedSecret),
+              response.semantic_evidence
+            );
+            if (!isValid) {
+              reject(
+                new Error(
+                  "PROTOCOL INTEGRITY VIOLATION: ZK-Receipt verification failed."
+                )
+              );
+              return;
+            }
+          }
+          resultFulfilled = true;
+          resolve({
+            content: [
+              {
+                type: "text",
+                text: response.semantic_evidence
+              }
+            ],
+            isError: response.is_error
+          });
+        } catch (err) {
+          reject(err);
+        }
+      });
+      stream.on("error", (err) => {
+        this.rpcClients.delete(targetClientKey);
+        this.rpcClients.delete(toolName);
+        if (resultFulfilled) return;
+        log.error("[LiopClient] Stream Error:", err);
+        reject(err);
+      });
+      stream.on("end", () => {
+        if (!hasReceivedData && !resultFulfilled) {
+          reject(new Error("Logic-on-Origin stream closed without results."));
+        }
+      });
+    });
+  }
+  getOrCreateRpcClient(peerId, address) {
+    let client = this.rpcClients.get(peerId);
+    if (!client) {
+      let nodeToken = this.oauthToken;
+      let manifest = this.manifests.get(peerId);
+      let realPeerId = peerId;
+      if (!manifest) {
+        log.info(
+          `[LiopClient] PeerID "${peerId}" not found in manifest cache as PeerID. Searching tools in cached manifests...`
+        );
+        for (const [pId, m] of this.manifests.entries()) {
+          if (m.tools.some((t) => t.name === peerId)) {
+            manifest = m;
+            realPeerId = pId;
+            log.info(
+              `[LiopClient] Resolved tool "${peerId}" to provider PeerID "${pId.slice(-8)}" from manifest cache.`
+            );
+            break;
+          }
+        }
+      }
+      const providerName = manifest?.serverInfo?.name?.toLowerCase() || "";
+      let envToken;
+      const slug = manifest?.tokenSlug;
+      if (slug) {
+        envToken = process.env[`LIOP_TOKEN_${slug}`] || process.env[`LIOP_OAUTH_TOKEN_${slug}`];
+        log.info(
+          `[LiopClient] Resolved via tokenSlug "${slug}" (LIOP_TOKEN_${slug}) -> found: ${!!envToken}`
+        );
+      } else {
+        log.info(
+          `[LiopClient] No tokenSlug available for peer ${realPeerId.slice(-8)}. Available cache keys: ${Array.from(
+            this.manifests.keys()
+          ).map((k) => k.slice(-8)).join(", ")}`
+        );
+      }
+      if (!envToken && realPeerId) {
+        const shortId = realPeerId.slice(-8).toUpperCase();
+        envToken = process.env[`LIOP_TOKEN_${shortId}`] || process.env[`LIOP_OAUTH_TOKEN_${shortId}`];
+      }
+      if (!envToken && providerName) {
+        const cleanName = providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        envToken = process.env[`LIOP_TOKEN_${cleanName}`] || process.env[`LIOP_OAUTH_TOKEN_${cleanName}`];
+      }
+      if (envToken) {
+        log.info(
+          `[LiopClient] Resolved node-specific token for peer ${realPeerId.slice(-8)} (${providerName || "unknown"})`
+        );
+        nodeToken = envToken;
+      }
+      client = new LiopRpcClient(address, this.tlsOptions, nodeToken);
+      this.rpcClients.set(peerId, client);
+    }
+    return client;
+  }
+  /**
+   * Reads a specific resource by URI.
+   * In LIOP, resources can be static definitions or dynamic streams.
+   */
+  async readResource(uri) {
+    if (!this.meshNode) {
+      throw new Error("Client must be connected before reading resources.");
+    }
+    log.info(`[LiopClient] Querying Mesh for Resource: ${uri}...`);
+    const providers = await this.meshNode.findProviders(uri);
+    if (providers.length === 0) {
+      throw new Error(`No mesh providers found for resource: ${uri}`);
+    }
+    const manifest = await this.meshNode.queryManifest(providers[0]);
+    if (!manifest) {
+      throw new Error("Target peer did not return a valid LIOP Manifest.");
+    }
+    const resourceDef = manifest.resources?.find((r) => r.uri === uri);
+    if (!resourceDef) {
+      throw new Error(`Resource ${uri} not listed in remote manifest.`);
+    }
+    return {
+      contents: [
+        {
+          uri,
+          mimeType: resourceDef.mimeType || "application/json",
+          text: JSON.stringify(resourceDef, null, 2)
+        }
+      ]
+    };
+  }
+  getServerInfo() {
+    return this.serverInfo;
+  }
+  /**
+   * Destroys the active Mesh Node resources.
+   */
+  async close() {
+    if (this.meshNode) {
+      await this.meshNode.stop();
+    }
+  }
+};
+
+export { LiopClient, LiopRpcClient };
+//# sourceMappingURL=chunk-CRZBVFDV.js.map
+//# sourceMappingURL=chunk-CRZBVFDV.js.map