@nekzus/liop 2.4.0-alpha.25 → 2.4.0-alpha.26

package/dist/chunk-3664H3CV.js

@@ -1,136 +0,0 @@
-import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
-
-// src/rpc/crypto/dilithium.ts
-var DILITHIUM65_CONSTANTS = {
-  PUBLIC_KEY_BYTES: 1952,
-  SECRET_KEY_BYTES: 4032,
-  SIGNATURE_BYTES: 3309,
-  DEFAULT_CONTEXT: new TextEncoder().encode("LIOP-FIPS204-ML-DSA-65")
-};
-function normalizeMessage(message) {
-  if (typeof message === "string") {
-    return new TextEncoder().encode(message);
-  }
-  return message;
-}
-function canonicalizeJson(obj) {
-  if (obj === null || typeof obj !== "object") {
-    return JSON.stringify(obj);
-  }
-  if (Array.isArray(obj)) {
-    return `[${obj.map(canonicalizeJson).join(",")}]`;
-  }
-  const record = obj;
-  const sortedKeys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
-  const entries = sortedKeys.map(
-    (key) => `${JSON.stringify(key)}:${canonicalizeJson(record[key])}`
-  );
-  return `{${entries.join(",")}}`;
-}
-var Dilithium65Wrapper = {
-  /** Constants */
-  PUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,
-  SECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,
-  SIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,
-  /**
-   * Generates a new ML-DSA-65 (FIPS 204) key pair.
-   * Optionally accepts a 32-byte seed for deterministic key generation.
-   */
-  generateKeyPair(seed) {
-    if (seed && seed.length !== 32) {
-      throw new Error(
-        `ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`
-      );
-    }
-    const keys = ml_dsa65.keygen(seed);
-    return {
-      publicKey: keys.publicKey,
-      secretKey: keys.secretKey
-    };
-  },
-  /**
-   * Derives the ML-DSA-65 public key from a given secret key.
-   */
-  getPublicKey(secretKey) {
-    if (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {
-      throw new Error(
-        `ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`
-      );
-    }
-    return ml_dsa65.getPublicKey(secretKey);
-  },
-  /**
-   * Validates and imports a raw ML-DSA-65 public key.
-   */
-  importPublicKey(buffer) {
-    if (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {
-      throw new Error(
-        `ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`
-      );
-    }
-    return buffer;
-  },
-  /**
-   * Signs a message using the post-quantum secret key.
-   * Supports optional domain separation context (up to 255 bytes).
-   */
-  sign(message, secretKey, context) {
-    if (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {
-      throw new Error(
-        `ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`
-      );
-    }
-    const msgBytes = normalizeMessage(message);
-    const ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;
-    return ml_dsa65.sign(msgBytes, secretKey, { context: ctx });
-  },
-  /**
-   * Verifies an ML-DSA-65 post-quantum digital signature.
-   */
-  verify(signature, message, publicKey, context) {
-    if (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {
-      return false;
-    }
-    if (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {
-      return false;
-    }
-    try {
-      const msgBytes = normalizeMessage(message);
-      const ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;
-      return ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });
-    } catch {
-      return false;
-    }
-  },
-  /**
-   * Signs a structured manifest (LiopManifest) using canonical JSON serialization.
-   * Returns base64-encoded signature and public key for transport over gRPC/MCP.
-   */
-  signManifest(manifest, secretKey, publicKey) {
-    const { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;
-    const canonicalStr = canonicalizeJson(unsigned);
-    const sig = this.sign(canonicalStr, secretKey);
-    return {
-      signature: Buffer.from(sig).toString("base64"),
-      publicKey: Buffer.from(publicKey).toString("base64")
-    };
-  },
-  /**
-   * Verifies the post-quantum signature of a structured manifest.
-   */
-  verifyManifest(manifest, signatureBase64, publicKeyBase64) {
-    try {
-      const sig = Buffer.from(signatureBase64, "base64");
-      const pub = Buffer.from(publicKeyBase64, "base64");
-      const { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;
-      const canonicalStr = canonicalizeJson(unsigned);
-      return this.verify(sig, canonicalStr, pub);
-    } catch {
-      return false;
-    }
-  }
-};
-
-export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper };
-//# sourceMappingURL=chunk-3664H3CV.js.map
-//# sourceMappingURL=chunk-3664H3CV.js.map

package/dist/chunk-3QH44NKZ.js

@@ -1,115 +0,0 @@
-import { log } from './chunk-K3DGJLUY.js';
-
-// src/runtime/token-manager.ts
-var TokenManager = class _TokenManager {
-  cachedToken = null;
-  expiresAt = 0;
-  // Epoch ms
-  pendingPromise = null;
-  tokenEndpoint;
-  clientId;
-  clientSecret;
-  audience;
-  scope;
-  staticToken;
-  // Preemptive refresh threshold: 30 seconds before expiration
-  static REFRESH_BUFFER_MS = 3e4;
-  constructor(options) {
-    this.tokenEndpoint = options.tokenEndpoint;
-    this.clientId = options.clientId;
-    this.clientSecret = options.clientSecret;
-    this.audience = options.audience ?? "urn:liop:mesh:api";
-    this.scope = Array.isArray(options.scopes) ? options.scopes.join(" ") : options.scopes ?? "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query";
-    this.staticToken = options.staticToken;
-  }
-  /**
-   * Returns a valid OAuth 2.1 access token.
-   * Automatically performs preemptive refresh if the token is close to expiry.
-   */
-  async getToken() {
-    if (this.staticToken) {
-      return this.staticToken;
-    }
-    const now = Date.now();
-    if (this.cachedToken && now < this.expiresAt - _TokenManager.REFRESH_BUFFER_MS) {
-      return this.cachedToken;
-    }
-    if (this.pendingPromise) {
-      return this.pendingPromise;
-    }
-    this.pendingPromise = (async () => {
-      try {
-        const token = await this.fetchNewToken();
-        this.cachedToken = token;
-        return token;
-      } finally {
-        this.pendingPromise = null;
-      }
-    })();
-    return this.pendingPromise;
-  }
-  /**
-   * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.
-   */
-  invalidate() {
-    this.cachedToken = null;
-    this.expiresAt = 0;
-    if (this.clientId && this.clientSecret) {
-      this.staticToken = void 0;
-    }
-    log.info("[TokenManager] Cached OAuth access token invalidated.");
-  }
-  /**
-   * Returns true if the token is absent or has passed the refresh threshold.
-   */
-  isExpired() {
-    if (this.staticToken) return false;
-    return !this.cachedToken || Date.now() >= this.expiresAt - _TokenManager.REFRESH_BUFFER_MS;
-  }
-  getExpiresAt() {
-    return this.expiresAt;
-  }
-  async fetchNewToken() {
-    log.info(
-      `[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`
-    );
-    const params = new URLSearchParams({
-      grant_type: "client_credentials",
-      client_id: this.clientId,
-      client_secret: this.clientSecret,
-      resource: this.audience,
-      scope: this.scope
-    });
-    const response = await fetch(this.tokenEndpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        Accept: "application/json"
-      },
-      body: params.toString(),
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(
-        `OAuth token request failed [HTTP ${response.status}]: ${errorText}`
-      );
-    }
-    const data = await response.json();
-    if (!data.access_token) {
-      throw new Error(
-        "OAuth token response did not contain an 'access_token' field."
-      );
-    }
-    const expiresInSec = typeof data.expires_in === "number" ? data.expires_in : 3600;
-    this.expiresAt = Date.now() + expiresInSec * 1e3;
-    log.info(
-      `[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`
-    );
-    return data.access_token;
-  }
-};
-
-export { TokenManager };
-//# sourceMappingURL=chunk-3QH44NKZ.js.map
-//# sourceMappingURL=chunk-3QH44NKZ.js.map