@nekzus/liop 2.2.0 → 2.3.0

package/dist/hybrid-CF__0YnC.d.ts

@@ -0,0 +1,170 @@
+import { MeshNode } from './mesh.js';
+import { L as LiopServer } from './index-BW95kAL4.js';
+import { L as LiopVerifier } from './verifier-COnid_dg.js';
+import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse } from './types-lJIxBlWF.js';
+
+/**
+ * LIOP Sliding-Window Rate Limiter
+ *
+ * High-performance, zero-dependency in-memory rate limiter designed
+ * to protect the LIOP Hybrid Gateway and Mesh Nodes against Denial of Service (DoS),
+ * worker pool exhaustion, and brute-force attacks.
+ *
+ * Conforms to OWASP API Security Top 10 (API4:2023 - Unrestricted Resource Consumption).
+ */
+interface RateLimiterOptions {
+    /** Window duration in milliseconds (default: 60,000ms = 1 minute) */
+    windowMs?: number;
+    /** Maximum number of allowed requests per window (default: 120) */
+    maxRequests?: number;
+}
+interface RateLimitStatus {
+    allowed: boolean;
+    remaining: number;
+    limit: number;
+    resetMs: number;
+}
+declare class InMemoryRateLimiter {
+    private readonly windowMs;
+    private readonly maxRequests;
+    private readonly records;
+    private cleanupTimer?;
+    constructor(options?: RateLimiterOptions);
+    /**
+     * Evaluates whether a request from the given key (IP, token, or clientId) is permitted.
+     *
+     * @param key Identifier for the client (e.g., remote IP or OAuth client ID)
+     * @returns Status containing allowed boolean, remaining quota, and time until reset
+     */
+    check(key: string): RateLimitStatus;
+    /**
+     * Explicitly resets the rate limit bucket for a given key.
+     */
+    reset(key: string): void;
+    /**
+     * Cleans up expired rate-limiting buckets to prevent memory leaks.
+     */
+    cleanup(): void;
+    /**
+     * Destroys internal timers and clears records.
+     */
+    close(): void;
+}
+
+/**
+ * LIOP MCP Router
+ *
+ * Core logic for routing MCP requests to local or remote LIOP providers.
+ * Decoupled from transport (HTTP/Stdio).
+ *
+ * All tool discovery and port resolution is DYNAMIC via the
+ * /liop/manifest/1.0.0 protocol stream over Kademlia DHT.
+ */
+declare class LiopMcpRouter {
+    private liopServer;
+    private meshNode;
+    private defaultRpcPort;
+    /** Cached manifests from remote peers. Key = PeerID */
+    private manifestCache;
+    /** Guards against concurrent discovery storms */
+    private currentDiscovery;
+    /** Verifier for Tier-0 integrity checks */
+    verifier: LiopVerifier;
+    /** Callback when new remote tools are discovered */
+    onToolsChanged?: () => void;
+    /** Circuit-breaker state for peers that repeatedly fail manifest queries. */
+    private manifestFailureState;
+    private static readonly MANIFEST_FAILURE_BASE_COOLDOWN_MS;
+    private static readonly MANIFEST_FAILURE_MAX_COOLDOWN_MS;
+    private static readonly MANIFEST_SKIP_LOG_THROTTLE_MS;
+    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, defaultRpcPort?: number);
+    getManifestCacheSize(): number;
+    private shouldSkipManifestQuery;
+    private recordManifestQuerySuccess;
+    private recordManifestQueryFailure;
+    /**
+     * Detects the protocol era of an incoming request.
+     * Modern requests carry '_meta' with protocol version "2026-07-28" or use modern RPCs.
+     * Legacy requests use 'initialize' handshake or lack '_meta' envelopes.
+     */
+    detectEra(request: McpRequest): McpEra;
+    dispatch(request: McpRequest, authInfo?: AuthInfo | null): Promise<McpResponse | null>;
+    /**
+     * MCP clients often send notifications/initialized then immediately tools/list.
+     * Start manifest discovery without blocking the notification handler.
+     */
+    private kickDiscoveryAfterInitialized;
+    /**
+     * Discovers and caches manifests from all remote LIOP providers in the mesh.
+     * Uses Kademlia DHT to find "liop:manifest" providers, then opens
+     * /liop/manifest/1.0.0 protocol streams to retrieve their full metadata.
+     */
+    refreshManifestCache(silent?: boolean): Promise<void>;
+    /**
+     * Returns the current manifest cache size for external telemetry.
+     * Used by the adaptive polling system to detect topology stabilization.
+     */
+    getCacheSize(): number;
+    /**
+     * Returns all remote tools discovered via the manifest protocol.
+     */
+    private getRemoteTools;
+    /**
+     * Returns all remote resources discovered via the manifest protocol.
+     */
+    private getRemoteResources;
+    /**
+     * Resolves the gRPC target (host:port) AND the peerId for a given tool name
+     * by searching the manifest cache. Supports exact names and suffixed names.
+     */
+    private resolveManifestTarget;
+    /**
+     * Redacts a PeerID for external-facing diagnostics.
+     * LIOP_DIAGNOSTIC_LEVEL controls verbosity:
+     *   - "redacted" (default): truncated to last 8 chars
+     *   - "full": complete PeerID (development only)
+     */
+    private redactPeerId;
+    private transcodeMcpToLiop;
+    private routeToRemoteProvider;
+    /** Cached M2M token for dynamic gateway-to-node routing */
+    private meshAgentToken?;
+    /**
+     * Dynamically acquires an M2M access token from the Nexus Authorization Server.
+     * If peerId is provided, checks if there are node-specific environment tokens
+     * before falling back to the global static token or Nexus acquisition.
+     */
+    private getOrAcquireMeshAgentToken;
+    private performTranscoding;
+    private encryptWithNonce;
+}
+
+/**
+ * LIOP Hybrid Gateway
+ * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.
+ */
+declare class LiopHybridGateway {
+    private liopServer;
+    private meshNode;
+    private netServer;
+    private h2Server;
+    private h1Server;
+    private router;
+    private jwtValidator?;
+    private oauthProvider?;
+    private rateLimiter;
+    private isDraining;
+    private activeRequests;
+    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number, rateLimiterOptions?: RateLimiterOptions);
+    private setupH2Routes;
+    private setupH1Routes;
+    private handleGrpcStream;
+    private handleMcpH2Stream;
+    listen(port: number, host?: string): Promise<number>;
+    isDrained(): boolean;
+    drain(timeoutMs?: number): Promise<void>;
+    stop(): Promise<void>;
+    getRouter(): LiopMcpRouter;
+}
+
+export { InMemoryRateLimiter as I, LiopHybridGateway as L, type RateLimitStatus as R, LiopMcpRouter as a, type RateLimiterOptions as b };

package/dist/{index-BlGc0iym.d.ts → index-BW95kAL4.d.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { MeshNode } from './mesh.js';
-import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, c as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-sKeUxuky.js';
+import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, d as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-lJIxBlWF.js';
 
 /**
  * LIOP OAuth 2.1 Hybrid Auth — Configuration Types
@@ -100,6 +100,60 @@ declare const AUTH_DEFAULTS: {
     readonly signingAlgorithm: "EdDSA";
 };
 
+/**
+ * LIOP Immutable Audit Logger (Phase Beta-3)
+ * SOC 2 Type II & HIPAA compliant audit trail with cryptographic Hash-Chain.
+ * Guarantees tamper-evidence and non-repudiation for all Logic-on-Origin executions.
+ */
+type AuditStatus = "SUCCESS" | "BLOCKED_EGRESS" | "ERROR" | "POLICY_VIOLATION";
+interface AuditEntry {
+    id: string;
+    timestamp: string;
+    traceId: string;
+    agentDid: string;
+    peerId: string;
+    toolName: string;
+    datasetHash: string;
+    fuelConsumed: number;
+    outputHash: string;
+    zkReceiptSig: string;
+    status: AuditStatus;
+    prevEntryHash: string;
+    entryHash: string;
+}
+interface AuditRecordParams {
+    timestamp?: string;
+    traceId?: string;
+    agentDid: string;
+    peerId: string;
+    toolName: string;
+    datasetHash?: string;
+    fuelConsumed: number;
+    outputHash?: string;
+    zkReceiptSig?: string;
+    status: AuditStatus;
+}
+declare const GENESIS_HASH: string;
+declare function computeEntryHash(entryWithoutHash: Omit<AuditEntry, "entryHash">): string;
+declare class AuditLogger {
+    private entries;
+    private lastEntryHash;
+    private filePath?;
+    constructor(filePath?: string);
+    recordExecution(params: AuditRecordParams): AuditEntry;
+    getEntries(): readonly AuditEntry[];
+    getEntryCount(): number;
+    verifyIntegrity(): {
+        valid: boolean;
+        totalEntries: number;
+        brokenIndex?: number;
+        reason?: string;
+    };
+    exportJsonl(): string;
+    private loadFromFile;
+}
+declare const globalAuditLogger: AuditLogger;
+
 /** Single named entity detected by the NER scanner. */
 interface NerEntity {
     type: "person" | "place" | "organization";
@@ -278,6 +332,10 @@ interface LiopServerOptions {
      * Must match SCREAMING_SNAKE_CASE: /^[A-Z][A-Z0-9_]*$/ (e.g., "BANK", "VAULT", "HFT_ORACLE").
      */
     tokenSlug?: string;
+    /**
+     * SOC 2 Type II / HIPAA immutable audit logger instance.
+     */
+    auditLogger?: AuditLogger;
     /**
      * Path to a shared JSON file for persistent Query Budget tracking across multiple server instances.
      */
@@ -363,6 +421,9 @@ declare class LiopServer {
     private sessions;
     private revokedTokenHashes;
     private lastRevocationLoadTime;
+    private pqcKeyPair;
+    readonly auditLogger: AuditLogger;
+    getDatasetHash(): string;
     private static readonly LIOP_COMPACT_REGEX;
     private extractLogic;
     private parseUnknownJson;
@@ -520,4 +581,4 @@ declare class LiopServer {
     private applyInMemoryBudget;
 }
 
-export { AUTH_DEFAULTS as A, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuthRole as c, type LiopAuthConfig as d, type LogicExecutionPolicy as e, type OutputSanitizerConfig as f, PII_PRESETS as g, type PiiRule as h, PiiScanner as i, sanitizeOutput as s };
+export { AUTH_DEFAULTS as A, GENESIS_HASH as G, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuditEntry as c, AuditLogger as d, type AuditRecordParams as e, type AuditStatus as f, type AuthRole as g, type LiopAuthConfig as h, type LogicExecutionPolicy as i, type OutputSanitizerConfig as j, PII_PRESETS as k, type PiiRule as l, PiiScanner as m, computeEntryHash as n, globalAuditLogger as o, sanitizeOutput as s };

package/dist/index-cMV0_yD9.d.ts

@@ -0,0 +1,200 @@
+import { L as LiopVerifier } from './verifier-COnid_dg.js';
+import { MeshNodeConfig } from './mesh.js';
+import { EventEmitter } from 'node:events';
+import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-lJIxBlWF.js';
+
+/**
+ * LIOP Certificate Manager (CertManager)
+ * Provides automated certificate monitoring, X.509 validity inspection,
+ * and hot-reloading for mutual TLS (mTLS) without node restarts.
+ *
+ * Compliance:
+ * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS
+ * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification
+ */
+
+interface CertManagerOptions {
+    /** Path to the root CA certificate (PEM format) */
+    rootCertPath?: string;
+    /** Path to the server/client certificate chain (PEM format) */
+    certChainPath: string;
+    /** Path to the private key (PEM format) */
+    privateKeyPath: string;
+    /** Expiration warning threshold in days (default: 30) */
+    warningDays?: number;
+    /** Enable file watching for automatic hot-reloading (default: true) */
+    watchFiles?: boolean;
+    /** Debounce delay in ms for hot reloading (default: 150) */
+    debounceMs?: number;
+}
+interface CertInfo {
+    subject: string;
+    issuer: string;
+    validFrom: string;
+    validTo: string;
+    fingerprint256: string;
+    daysRemaining: number;
+    isExpired: boolean;
+    isExpiringSoon: boolean;
+}
+declare class CertManager extends EventEmitter {
+    private readonly options;
+    private rootCertBuffer;
+    private certChainBuffer;
+    private privateKeyBuffer;
+    private watchers;
+    private reloadDebounceTimer;
+    private readonly warningDays;
+    private readonly debounceMs;
+    constructor(options: CertManagerOptions);
+    /**
+     * Synchronously loads or reloads certificates from filesystem into memory.
+     */
+    loadCertificates(): void;
+    /**
+     * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.
+     */
+    inspectCertificate(): CertInfo;
+    /**
+     * Sets up non-blocking filesystem watchers to detect certificate renewals
+     * and trigger hot-reloading without process restarts.
+     */
+    private setupWatchers;
+    /**
+     * Debounces reload events to ensure files have finished writing.
+     */
+    private scheduleReload;
+    /**
+     * Manually triggers a reload of certificates and emits the 'reload' event.
+     */
+    reload(): CertInfo;
+    getRootCert(): Buffer | null;
+    getCertChain(): Buffer;
+    getPrivateKey(): Buffer;
+    /**
+     * Stops all active file watchers and releases resources.
+     */
+    dispose(): void;
+}
+
+/**
+ * LIOP TLS Configuration
+ *
+ * Provides conditional TLS credential factories for gRPC connections.
+ * When TLS options are provided, connections are secured with mutual TLS.
+ * Otherwise, falls back to insecure credentials (alpha/development mode).
+ *
+ * Production Hardening (Phase 128):
+ * - When NODE_ENV=production and TLS is configured but certificate loading
+ *   fails, the system throws a fatal error instead of silently degrading
+ *   to insecure credentials. This prevents MITM/eavesdropping attacks
+ *   caused by misconfigured certificate paths going unnoticed.
+ * - Reference: gRPC-node official docs — "Using insecure credentials in
+ *   production poses significant security risks including eavesdropping,
+ *   MITM attacks, and lack of authentication."
+ */
+
+interface LiopTlsOptions {
+    /** Path to the root CA certificate (PEM format) */
+    rootCert?: string;
+    /** Path to the server/client certificate (PEM format) */
+    certChain?: string;
+    /** Path to the private key (PEM format) */
+    privateKey?: string;
+    /** Require mutual TLS (mTLS): verify client certificate against root CA */
+    mutualTls?: boolean;
+    /** Optional CertManager instance for automated certificate management and hot reloading */
+    certManager?: CertManager;
+}
+
+/**
+ * LIOP Client
+ * High-level orchestration for discovery and execution in the Logic-Injection-on-Origin mesh.
+ */
+declare class LiopClient {
+    private meshNode;
+    private rpcClients;
+    private manifests;
+    private tlsOptions?;
+    private serverInfo?;
+    verifier: LiopVerifier;
+    private oauthToken?;
+    /** Protocol negotiation era */
+    era: McpEra;
+    /** Negotiated protocol version */
+    protocolVersion: string;
+    constructor(tls?: LiopTlsOptions);
+    /**
+     * Requests an M2M access token from the Nexus Authorization Server using Client Credentials.
+     */
+    private acquireM2MToken;
+    /**
+     * Discovers and connects to the target server or mesh capability.
+     * If address is omitted, it sets up the MeshNode to act purely dynamically.
+     */
+    connect(address?: string, options?: {
+        meshConfig?: MeshNodeConfig;
+        auth?: {
+            clientId?: string;
+            clientSecret?: string;
+            nexusUrl?: string;
+            audience?: string;
+            scope?: string;
+            token?: string;
+        };
+    }): Promise<void>;
+    /**
+     * Selects the optimal IP from an array of multiaddrs.
+     * Prioritizes routable non-loopback IPv4 addresses (e.g. Docker bridge, LAN, WAN)
+     * over loopback (127.0.0.1) to prevent inter-container connection failures.
+     */
+    private selectOptimalIp;
+    /**
+     * Dynamically queries Kademlia DHT to find the optimal PeerID providing the Capability
+     * and returns the physical gRPC target (host:port) resolved from the provider's manifest.
+     */
+    resolveCapability(toolName: string): Promise<string>;
+    /**
+     * Probes a remote MCP endpoint using 'server/discover' to negotiate protocol era.
+     * Falls back to legacy initialize handshake if server/discover fails.
+     */
+    probeServerDiscover(mcpUrl: string): Promise<{
+        era: McpEra;
+        protocolVersion: string;
+        supportedVersions: string[];
+    }>;
+    /**
+     * Discovers remote capabilities via the LIOP Manifest Protocol.
+     * Utilizes a memory cache to avoid redundant network dials against live peers.
+     */
+    discoverTools(forceRefresh?: boolean): Promise<{
+        name: string;
+        description?: string;
+    }[]>;
+    /**
+     * Invokes a tool.
+     */
+    callTool(request: CallToolRequest, _wasmPayload?: Buffer): Promise<CallToolResult>;
+    private getOrCreateRpcClient;
+    /**
+     * Reads a specific resource by URI.
+     * In LIOP, resources can be static definitions or dynamic streams.
+     */
+    readResource(uri: string): Promise<{
+        contents: Array<{
+            uri: string;
+            mimeType?: string;
+            text: string;
+        }>;
+    }>;
+    getServerInfo(): {
+        name: string;
+        version: string;
+    } | undefined;
+    /**
+     * Destroys the active Mesh Node resources.
+     */
+    close(): Promise<void>;
+}
+
+export { type CertInfo as C, type LiopTlsOptions as L, CertManager as a, type CertManagerOptions as b, LiopClient as c };