@nekzus/liop 2.4.0-alpha.3 → 2.4.0-alpha.30

package/dist/{hybrid-CF__0YnC.d.ts → hybrid-BZpCiUaV.d.ts}

@@ -1,7 +1,7 @@
-import { MeshNode } from './mesh.js';
-import { L as LiopServer } from './index-BW95kAL4.js';
-import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse } from './types-lJIxBlWF.js';
+import { a as MeshNode } from './node-Djzm6UYd.js';
+import { L as LiopServer } from './index-ByzjpRCk.js';
+import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-29zv9X1V.js';
+import { L as LiopVerifier } from './verifier-DqZ9MQ9l.js';
 
 /**
  * LIOP Sliding-Window Rate Limiter
@@ -153,9 +153,10 @@ declare class LiopHybridGateway {
     private jwtValidator?;
     private oauthProvider?;
     private rateLimiter;
+    private readonly interceptorOptions?;
     private isDraining;
     private activeRequests;
-    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number, rateLimiterOptions?: RateLimiterOptions);
+    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number, rateLimiterOptions?: RateLimiterOptions, interceptorOptions?: GatewayInterceptorOptions);
     private setupH2Routes;
     private setupH1Routes;
     private handleGrpcStream;

package/dist/{index-cMV0_yD9.d.ts → index-BYDtRGue.d.ts}

@@ -1,17 +1,9 @@
-import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { MeshNodeConfig } from './mesh.js';
+import { L as LiopVerifier } from './verifier-DqZ9MQ9l.js';
+import { M as MeshNodeConfig } from './node-Djzm6UYd.js';
+import * as grpc from '@grpc/grpc-js';
 import { EventEmitter } from 'node:events';
-import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-lJIxBlWF.js';
-
-/**
- * LIOP Certificate Manager (CertManager)
- * Provides automated certificate monitoring, X.509 validity inspection,
- * and hot-reloading for mutual TLS (mTLS) without node restarts.
- *
- * Compliance:
- * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS
- * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification
- */
+import { Z as ZkPolicy } from './zk-DzYNWBgo.js';
+import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-29zv9X1V.js';
 
 interface CertManagerOptions {
     /** Path to the root CA certificate (PEM format) */
@@ -77,23 +69,6 @@ declare class CertManager extends EventEmitter {
     dispose(): void;
 }
 
-/**
- * LIOP TLS Configuration
- *
- * Provides conditional TLS credential factories for gRPC connections.
- * When TLS options are provided, connections are secured with mutual TLS.
- * Otherwise, falls back to insecure credentials (alpha/development mode).
- *
- * Production Hardening (Phase 128):
- * - When NODE_ENV=production and TLS is configured but certificate loading
- *   fails, the system throws a fatal error instead of silently degrading
- *   to insecure credentials. This prevents MITM/eavesdropping attacks
- *   caused by misconfigured certificate paths going unnoticed.
- * - Reference: gRPC-node official docs — "Using insecure credentials in
- *   production poses significant security risks including eavesdropping,
- *   MITM attacks, and lack of authentication."
- */
-
 interface LiopTlsOptions {
     /** Path to the root CA certificate (PEM format) */
     rootCert?: string;
@@ -105,7 +80,28 @@ interface LiopTlsOptions {
     mutualTls?: boolean;
     /** Optional CertManager instance for automated certificate management and hot reloading */
     certManager?: CertManager;
+    /**
+     * Explicitly permit unencrypted (insecure) credentials for local development,
+     * Docker testbeds, or tooling harnesses without emitting console warnings.
+     * Ignored if isTlsEnforced() is true (production/enforced mode always throws).
+     */
+    insecure?: boolean;
+    /**
+     * Explicitly suppress the fallback warning when insecure credentials are created.
+     */
+    suppressWarning?: boolean;
 }
+/**
+ * Creates gRPC server credentials from TLS options.
+ * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.
+ * When mutualTls=true, enforces client certificate authentication against root CA.
+ */
+declare function createServerCredentials(tls?: LiopTlsOptions): grpc.ServerCredentials;
+/**
+ * Creates gRPC channel credentials from TLS options.
+ * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.
+ */
+declare function createChannelCredentials(tls?: LiopTlsOptions): grpc.ChannelCredentials;
 
 /**
  * LIOP Client
@@ -119,15 +115,12 @@ declare class LiopClient {
     private serverInfo?;
     verifier: LiopVerifier;
     private oauthToken?;
+    private tokenManager?;
     /** Protocol negotiation era */
     era: McpEra;
     /** Negotiated protocol version */
     protocolVersion: string;
     constructor(tls?: LiopTlsOptions);
-    /**
-     * Requests an M2M access token from the Nexus Authorization Server using Client Credentials.
-     */
-    private acquireM2MToken;
     /**
      * Discovers and connects to the target server or mesh capability.
      * If address is omitted, it sets up the MeshNode to act purely dynamically.
@@ -174,7 +167,10 @@ declare class LiopClient {
     /**
      * Invokes a tool.
      */
-    callTool(request: CallToolRequest, _wasmPayload?: Buffer): Promise<CallToolResult>;
+    callTool(request: CallToolRequest, _wasmPayload?: Buffer, options?: {
+        zkPolicy?: ZkPolicy;
+        circuitName?: string;
+    }): Promise<CallToolResult>;
     private getOrCreateRpcClient;
     /**
      * Reads a specific resource by URI.
@@ -187,6 +183,19 @@ declare class LiopClient {
             text: string;
         }>;
     }>;
+    /**
+     * Returns the local PeerId string if the mesh node is active, null otherwise.
+     * PeerIds are public identifiers by libp2p protocol design (Ed25519 public key hash).
+     */
+    get peerId(): string | null;
+    /**
+     * Returns true if the mesh node is initialized and running.
+     */
+    get isMeshActive(): boolean;
+    /**
+     * Returns the number of active P2P connections, or 0 if the mesh is inactive.
+     */
+    get connectionCount(): number;
     getServerInfo(): {
         name: string;
         version: string;
@@ -197,4 +206,4 @@ declare class LiopClient {
     close(): Promise<void>;
 }
 
-export { type CertInfo as C, type LiopTlsOptions as L, CertManager as a, type CertManagerOptions as b, LiopClient as c };
+export { type CertInfo as C, type LiopTlsOptions as L, CertManager as a, type CertManagerOptions as b, LiopClient as c, createChannelCredentials as d, createServerCredentials as e };

package/dist/{index-BW95kAL4.d.ts → index-ByzjpRCk.d.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { MeshNode } from './mesh.js';
-import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, d as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-lJIxBlWF.js';
+import { M as MeshNodeConfig, a as MeshNode } from './node-Djzm6UYd.js';
+import { d as AuditLogger, J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, e as GetPromptRequest, f as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-29zv9X1V.js';
 
 /**
  * LIOP OAuth 2.1 Hybrid Auth — Configuration Types
@@ -100,60 +100,6 @@ declare const AUTH_DEFAULTS: {
     readonly signingAlgorithm: "EdDSA";
 };
 
-/**
- * LIOP Immutable Audit Logger (Phase Beta-3)
- * SOC 2 Type II & HIPAA compliant audit trail with cryptographic Hash-Chain.
- * Guarantees tamper-evidence and non-repudiation for all Logic-on-Origin executions.
- */
-type AuditStatus = "SUCCESS" | "BLOCKED_EGRESS" | "ERROR" | "POLICY_VIOLATION";
-interface AuditEntry {
-    id: string;
-    timestamp: string;
-    traceId: string;
-    agentDid: string;
-    peerId: string;
-    toolName: string;
-    datasetHash: string;
-    fuelConsumed: number;
-    outputHash: string;
-    zkReceiptSig: string;
-    status: AuditStatus;
-    prevEntryHash: string;
-    entryHash: string;
-}
-interface AuditRecordParams {
-    timestamp?: string;
-    traceId?: string;
-    agentDid: string;
-    peerId: string;
-    toolName: string;
-    datasetHash?: string;
-    fuelConsumed: number;
-    outputHash?: string;
-    zkReceiptSig?: string;
-    status: AuditStatus;
-}
-declare const GENESIS_HASH: string;
-declare function computeEntryHash(entryWithoutHash: Omit<AuditEntry, "entryHash">): string;
-declare class AuditLogger {
-    private entries;
-    private lastEntryHash;
-    private filePath?;
-    constructor(filePath?: string);
-    recordExecution(params: AuditRecordParams): AuditEntry;
-    getEntries(): readonly AuditEntry[];
-    getEntryCount(): number;
-    verifyIntegrity(): {
-        valid: boolean;
-        totalEntries: number;
-        brokenIndex?: number;
-        reason?: string;
-    };
-    exportJsonl(): string;
-    private loadFromFile;
-}
-declare const globalAuditLogger: AuditLogger;
-
 /** Single named entity detected by the NER scanner. */
 interface NerEntity {
     type: "person" | "place" | "organization";
@@ -211,11 +157,6 @@ interface OutputSanitizerConfig {
  */
 declare function sanitizeOutput(output: unknown, config?: OutputSanitizerConfig): unknown;
 
-/**
- * LIOP Professional PII Engine (The Shield V2 - Tier-1 Military Edition)
- * Implements high-fidelity detection based on NIST and OWASP standards.
- * Features Multi-Layer Verification (Regex + Algorithmic Validators).
- */
 type PiiRuleDefinition = {
     name: string;
     pattern: string | RegExp;
@@ -340,6 +281,10 @@ interface LiopServerOptions {
      * Path to a shared JSON file for persistent Query Budget tracking across multiple server instances.
      */
     budgetStorePath?: string;
+    /** Expected guest image identifier hash for sovereign enclaves (Hex) */
+    guestImageId?: string;
+    /** Static verification key mappings for fast-path analytical circuits */
+    zkVkeys?: Record<string, unknown>;
 }
 interface AggregationPolicy {
     /** Maximum number of object-type array elements allowed (default: 10) */
@@ -390,6 +335,29 @@ interface LogicExecutionPolicy {
      * Path to a shared JSON file for persistent Query Budget tracking across multiple server instances.
      */
     budgetStorePath?: string;
+    /**
+     * Zero-Knowledge proof mode required for this tool capability.
+     * - "none": standard HMAC-SHA256 session commitment
+     * - "optimistic": Groth16 v2 receipt generated if prover available, otherwise fallback
+     * - "required": strictly enforces Groth16 v2 proof generation; rejects if unavailable
+     */
+    zkMode?: "none" | "optimistic" | "required";
+    /**
+     * Optional custom guest image identifier hash for this capability.
+     */
+    guestImageId?: string;
+    /**
+     * Name of the designated R1CS circuit (e.g. "sum", "count", "average", "filter").
+     */
+    circuitName?: string;
+    /**
+     * Static verification key JSON structure for this capability.
+     */
+    vkey?: Record<string, unknown>;
+    /**
+     * Whether to co-sign the Groth16 receipt with an ML-DSA-65 post-quantum digital signature (FIPS 204).
+     */
+    pqcSign?: boolean;
 }
 declare class LiopServer {
     private serverInfo;
@@ -416,6 +384,7 @@ declare class LiopServer {
     private meshNode;
     private rpcServer;
     private boundPort;
+    private enclavePqcKeypair?;
     jwtValidator?: JwtValidator;
     oauthProvider?: any;
     private sessions;
@@ -458,11 +427,7 @@ declare class LiopServer {
      */
     connect(options?: {
         port?: number;
-        meshConfig?: {
-            listenAddresses?: string[];
-            bootstrapNodes?: string[];
-            identityPath?: string;
-        };
+        meshConfig?: MeshNodeConfig;
     }): Promise<void>;
     /**
      * Register a new Tool
@@ -541,6 +506,10 @@ declare class LiopServer {
      * Injects data into the secure sandbox context for Logic-on-Origin tools.
      */
     setSandboxData(records: Record<string, unknown>[]): void;
+    /**
+     * Returns the read-only sandbox records registered in the enclave.
+     */
+    getSandboxData(): readonly Record<string, unknown>[];
     getBoundPort(): number | null;
     /**
      * Connects to the libp2p Kademlia DHT and announces capabilities.
@@ -548,11 +517,7 @@ declare class LiopServer {
      */
     connectToMesh(options?: {
         port?: number;
-        meshConfig?: {
-            listenAddresses?: string[];
-            bootstrapNodes?: string[];
-            identityPath?: string;
-        };
+        meshConfig?: MeshNodeConfig;
     }): Promise<void>;
     /**
      * Internal worker execution with Egress Filtering logic.
@@ -581,4 +546,4 @@ declare class LiopServer {
     private applyInMemoryBudget;
 }
 
-export { AUTH_DEFAULTS as A, GENESIS_HASH as G, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuditEntry as c, AuditLogger as d, type AuditRecordParams as e, type AuditStatus as f, type AuthRole as g, type LiopAuthConfig as h, type LogicExecutionPolicy as i, type OutputSanitizerConfig as j, PII_PRESETS as k, type PiiRule as l, PiiScanner as m, computeEntryHash as n, globalAuditLogger as o, sanitizeOutput as s };
+export { AUTH_DEFAULTS as A, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuthRole as c, type LiopAuthConfig as d, type LogicExecutionPolicy as e, type OutputSanitizerConfig as f, PII_PRESETS as g, type PiiRule as h, PiiScanner as i, sanitizeOutput as s };