@nekzus/liop 2.4.0-alpha.3 → 2.4.0-alpha.30

package/dist/index.d.ts

@@ -1,20 +1,48 @@
 export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOptions } from './bridge.js';
-import { L as LiopTlsOptions } from './index-cMV0_yD9.js';
-export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient } from './index-cMV0_yD9.js';
+import { L as LiopTlsOptions } from './index-BYDtRGue.js';
+export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient, d as createChannelCredentials, e as createServerCredentials } from './index-BYDtRGue.js';
+import { ProofWithSignals, VerificationKey } from 'micro-zk-proofs';
+export { ProofWithSignals, VerificationKey } from 'micro-zk-proofs';
+export { L as LiopVerifier, T as TeePolicy, a as TeeVerificationOptions, b as TeeVerificationResult, V as VerifyZkOptions } from './verifier-DqZ9MQ9l.js';
 import * as http from 'node:http';
-export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-CF__0YnC.js';
-export { LiopManifest, MeshNode, MeshNodeConfig } from './mesh.js';
+export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-BZpCiUaV.js';
+import { A as AuthInfo } from './types-29zv9X1V.js';
+export { g as AuditEntry, h as AuditInterceptor, d as AuditLogger, i as AuditRecordParams, j as AuditStatus, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, l as GENESIS_HASH, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, J as JwtValidator, L as LiopLogger, r as LogEvent, s as LogInterceptor, t as LogLevel, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema, E as computeEntryHash, F as executeGatewayInterceptor, H as globalAuditLogger, K as log } from './types-29zv9X1V.js';
+export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-Djzm6UYd.js';
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuditEntry, d as AuditLogger, e as AuditRecordParams, f as AuditStatus, g as AuthRole, G as GENESIS_HASH, h as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, i as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, j as OutputSanitizerConfig, P as PII_PATTERNS, k as PII_PRESETS, l as PiiRule, m as PiiScanner, T as ToolHandler, n as computeEntryHash, o as globalAuditLogger, s as sanitizeOutput } from './index-BW95kAL4.js';
-import { A as AuthInfo } from './types-lJIxBlWF.js';
-export { e as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, G as GetPromptRequest, d as GetPromptResult, I as InputRequest, f as InputRequiredResult, g as InputResponse, J as JwtValidator, h as MCP_LEGACY_SUPPORT_ENABLED, i as MCP_PROTOCOL_VERSION, j as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, k as McpRequestMeta, c as McpResponse, P as Prompt, l as PromptSchema, R as Resource, m as ResourceSchema, S as ServerInfo, T as Tool, n as ToolSchema } from './types-lJIxBlWF.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-ByzjpRCk.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
+export { D as DecodedReceipt, P as ProofType, R as RECEIPT_VERSION_V1, a as RECEIPT_VERSION_V2, b as ZK_JOURNAL_V2_SIZE, c as ZkJournalV2, Z as ZkPolicy, d as ZkReceipt, e as ZkVerificationError, f as ZkVerifier, g as decodeJournalV2, h as encodeJournalV2, r as receiptCodec } from './zk-DzYNWBgo.js';
 import '@modelcontextprotocol/sdk/server/mcp.js';
 import 'zod';
-import './verifier-COnid_dg.js';
 import 'node:events';
 
+declare const VERIFICATION_LATENCY_BUDGET_MS = 250;
+
+/**
+ * Verifies a Groth16 Zero-Knowledge proof against a verification key.
+ * Traps curve validation errors gracefully to ensure safe verification.
+ */
+declare function verifyGroth16Proof(vkey: VerificationKey, proofWithSignals: ProofWithSignals): boolean;
+/**
+ * Serializes a VerificationKey into a Buffer.
+ */
+declare function serializeVKey(vkey: VerificationKey): Buffer;
+/**
+ * Deserializes a Buffer into a typed VerificationKey.
+ */
+declare function deserializeVKey(buf: Buffer): VerificationKey;
+/**
+ * Serializes a ProofWithSignals into a Buffer.
+ */
+declare function serializeGrothProof(proofWithSignals: ProofWithSignals): Buffer;
+/**
+ * Deserializes a Buffer into a typed ProofWithSignals.
+ */
+declare function deserializeGrothProof(buf: Buffer): ProofWithSignals;
+
 /**
  * TokenEstimator — Pluggable strategy for counting tokens in text content.
  *
@@ -36,7 +64,7 @@ interface TokenEstimator {
  *
  * - Synchronous: safe for hot-path usage without async overhead
  * - Merge cache reduced to 10K entries for long-running server processes
- * - Inlined at build-time: zero external runtime dependencies in node_modules
+ * - External dependency: resolved from gpt-tokenizer in node_modules at runtime
  */
 declare class RealTokenEstimator implements TokenEstimator {
     readonly name = "o200k_base";
@@ -113,6 +141,7 @@ interface TokenOperationMetric {
     readonly toolName?: string;
     readonly peerId?: string;
     readonly durationMs?: number;
+    readonly originDatasetTokens?: number;
 }
 /** Session-level aggregate report */
 interface TokenSessionReport {
@@ -313,17 +342,25 @@ declare class MetricsRegistry {
 }
 declare const protocolMetrics: MetricsRegistry;
 declare const toolCallsTotal: Counter;
+declare const toolCallErrorsTotal: Counter;
 declare const fuelConsumed: Histogram;
 declare const meshPeersConnected: Gauge;
 declare const manifestCacheSize: Gauge;
 declare const egressBlocksTotal: Counter;
 declare const zkVerificationDurationMs: Histogram;
+declare const zkVerificationsTotal: Counter;
+declare const zkProofsByTypeTotal: Counter;
+declare const zkProvingDurationMs: Histogram;
+declare const zkVkeyCacheSize: Gauge;
+declare const tokensInputTotal: Counter;
+declare const tokensOutputTotal: Counter;
+declare const tokensSavedTotal: Counter;
+declare const operationDurationMs: Histogram;
+declare const pqcHandshakeDurationMs: Histogram;
+declare const pqcHandshakesTotal: Counter;
+declare const wireEgressBytesTotal: Counter;
+declare const wireSavedBytesTotal: Counter;
 
-/**
- * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)
- * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.
- * Spec: https://www.w3.org/TR/trace-context/
- */
 interface SpanContext {
     traceId: string;
     spanId: string;
@@ -382,6 +419,16 @@ declare const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>>;
  * TypeScript interfaces reflecting liop_core.proto (LIOP v1)
  * Optimized for logic-on-origin and high-performance serialization.
  */
+declare enum ProofMode {
+    PROOF_MODE_LEGACY_HMAC = 0,
+    PROOF_MODE_ZK_OPTIMISTIC = 1,
+    PROOF_MODE_ZK_BLOCKING = 2
+}
+declare enum ProofType {
+    PROOF_TYPE_HMAC_LEGACY = 0,
+    PROOF_TYPE_GROTH16 = 2,
+    PROOF_TYPE_GROTH16_PQC_HYBRID = 3
+}
 interface IntentRequest {
     agent_did: string;
     capability_hash: string;
@@ -399,14 +446,18 @@ interface LogicRequest {
     inputs: Record<string, Uint8Array>;
     pqc_ciphertext: Uint8Array;
     aes_nonce: Uint8Array;
+    requested_proof_mode?: ProofMode;
 }
 interface LogicResponse {
     semantic_evidence: string;
     cryptographic_proof: Uint8Array;
     zk_receipt: Uint8Array;
     is_error: boolean;
+    proof_type?: ProofType;
+    guest_image_id?: Uint8Array;
 }
 
+type TokenProvider = string | (() => Promise<string | undefined> | string | undefined);
 /**
  * LIOP gRPC Client Implementation
  * Provides a high-level interface for secure intent negotiation and logic execution.
@@ -414,8 +465,11 @@ interface LogicResponse {
 declare class LiopRpcClient {
     private client;
     private token?;
+    private lastResolvedToken?;
     readonly address: string;
-    constructor(address: string, tls?: LiopTlsOptions, token?: string);
+    constructor(address: string, tls?: LiopTlsOptions, token?: TokenProvider);
+    setToken(token?: TokenProvider): void;
+    private resolveToken;
     /**
      * Negotiates intent with the remote host.
      * Returns the ephemeral Kyber public key for payload encryption.
@@ -430,17 +484,28 @@ declare class LiopRpcClient {
 }
 
 /**
- * LIOP Post-Quantum Digital Signature Wrapper
- * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant
- * manifest attestation, node revocation receipts, and cryptographic integrity.
- *
- * Characteristics:
- * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)
- * - Public Key Length: 1952 bytes
- * - Secret Key Length: 4032 bytes
- * - Signature Length: 3309 bytes
- * - Implementation: Pure TypeScript/JS via @noble/post-quantum
+ * LIOP Symmetric Payload Encryption Wrapper
+ * Uses AES-256-GCM to secure WASM Code transport over Zero-Trust networks.
+ * Fully compatible with the `aes-gcm` Rust crate used by Wasmtime.
  */
+declare const AesGcmWrapper: {
+    /**
+     * Encrypts a raw WASM payload using the shared secret negotiated via Kyber768.
+     *
+     * @param payload Raw incoming WASM byte array or string.
+     * @param sharedSecret A perfectly derived 32-byte (256-bit) shared secret array
+     * @returns The encrypted buffer to push to the GRPc stream, along with the 12-byte initialization vector natively generated.
+     */
+    encryptPayload(payload: Uint8Array | Buffer, sharedSecret: Uint8Array): {
+        ciphertext: Buffer;
+        nonce: Buffer;
+    };
+    /**
+     * Decrypts a remote Zero-Knowledge receipt using AES-256-GCM.
+     */
+    decryptPayload(ciphertextBuffer: Buffer, nonce: Buffer, sharedSecret: Uint8Array): Buffer;
+};
+
 declare const DILITHIUM65_CONSTANTS: {
     readonly PUBLIC_KEY_BYTES: 1952;
     readonly SECRET_KEY_BYTES: 4032;
@@ -460,6 +525,10 @@ declare const Dilithium65Wrapper: {
         publicKey: Uint8Array;
         secretKey: Uint8Array;
     };
+    /**
+     * Derives the ML-DSA-65 public key from a given secret key.
+     */
+    getPublicKey(secretKey: Uint8Array): Uint8Array;
     /**
      * Validates and imports a raw ML-DSA-65 public key.
      */
@@ -527,6 +596,132 @@ declare class LiopRpcServer {
     stop(): Promise<void>;
 }
 
+type TransportProvider = "http-gateway" | "p2p-grpc" | "local";
+interface ToolDefinition {
+    name: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+}
+interface ToolRoute {
+    name: string;
+    provider: TransportProvider;
+    endpoint: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+    latencyMs: number;
+    failCount: number;
+    lastSuccess: number;
+    authRequired?: boolean;
+}
+declare class RoutingTable {
+    private routes;
+    private static readonly MAX_FAILURES;
+    /**
+     * Registers or updates a collection of tools exposed via an HTTP Gateway.
+     */
+    registerGatewayTools(tools: ToolDefinition[], mcpEndpoint: string, authRequired?: boolean): void;
+    /**
+     * Registers tools discovered directly over the P2P Mesh (gRPC).
+     */
+    registerMeshTools(tools: ToolDefinition[], grpcTarget: string, authRequired?: boolean): void;
+    /**
+     * Registers an in-process local tool (e.g. LiopMeshStatus).
+     */
+    registerLocalTool(tool: ToolDefinition): void;
+    /**
+     * Resolves the optimal route for a specific tool.
+     */
+    resolve(toolName: string): ToolRoute | undefined;
+    /**
+     * Records a successful invocation on a route, resetting failures and updating latency.
+     */
+    recordSuccess(toolName: string, latencyMs: number): void;
+    /**
+     * Records a failed invocation on a route.
+     */
+    recordFailure(toolName: string): void;
+    /**
+     * Lists all registered tools in sorted format for tools/list.
+     */
+    getAllToolDefinitions(): ToolDefinition[];
+    getRoute(toolName: string): ToolRoute | undefined;
+    size(): number;
+    clear(): void;
+}
+
+interface TokenManagerOptions {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret: string;
+    audience?: string;
+    scopes?: string | string[];
+    staticToken?: string;
+}
+declare class TokenManager {
+    private cachedToken;
+    private expiresAt;
+    private pendingPromise;
+    private readonly tokenEndpoint;
+    private readonly clientId;
+    private readonly clientSecret;
+    private readonly audience;
+    private readonly scope;
+    private staticToken?;
+    private static readonly REFRESH_BUFFER_MS;
+    constructor(options: TokenManagerOptions);
+    /**
+     * Returns a valid OAuth 2.1 access token.
+     * Automatically performs preemptive refresh if the token is close to expiry.
+     */
+    getToken(): Promise<string>;
+    /**
+     * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.
+     */
+    invalidate(): void;
+    /**
+     * Returns true if the token is absent or has passed the refresh threshold.
+     */
+    isExpired(): boolean;
+    getExpiresAt(): number;
+    private fetchNewToken;
+}
+
+interface GatewayTopologyInfo {
+    baseUrl: string;
+    mcpEndpoint: string;
+    healthEndpoint: string;
+    tokenEndpoint: string;
+    issuer: string;
+    audience: string;
+    scopes: string[];
+    tools: string[];
+    tier: number;
+}
+interface MeshTopologyInfo {
+    bootstrapNodes: string[];
+    identityPath?: string;
+}
+interface TopologyProbeResult {
+    mode: "gateway" | "mesh" | "hybrid";
+    gateway?: GatewayTopologyInfo;
+    mesh?: MeshTopologyInfo;
+}
+interface TopologyProbeOptions {
+    blgUrl?: string;
+    nexusUrl?: string;
+    clientId?: string;
+    clientSecret?: string;
+    audience?: string;
+    staticToken?: string;
+    bootstrapNodes?: string[];
+    identityPath?: string;
+    autoProbeLocal?: boolean;
+}
+/**
+ * Probes the runtime environment and determines the optimal architecture mode.
+ */
+declare function probeTopology(options?: TopologyProbeOptions): Promise<TopologyProbeResult>;
+
 /**
  * Returns a filtered environment object containing only safe system variables,
  * preventing exposure of sensitive credentials and shell function injection.
@@ -574,21 +769,6 @@ declare class WasiSandbox {
     teardown(): Promise<void>;
 }
 
-/**
- * LIOP Embedded OAuth 2.1 Authorization Server
- *
- * Implements a lightweight, high-performance OAuth 2.1 / OIDC Authorization Server
- * for the Nexus node using `panva/node-oidc-provider`.
- *
- * Security Hardening:
- * - M2M (Machine-to-Machine) Client Credentials Grant ONLY (Zero human interaction interface).
- * - Algorithmic whitelist: EdDSA (Ed25519) for token signing.
- * - JWT Access Tokens: Allows stateless, cryptographically-secure validation on data nodes (NIST SP 800-207).
- * - Interaction Lockout: Throws exception on any interactive flow attempt to prevent hijack attacks (OWASP).
- *
- * Standards: OAuth 2.1, RFC 6749, RFC 7519, NIST SP 800-63B
- */
-
 interface OAuthServerClientConfig {
     client_id: string;
     client_secret: string;
@@ -610,15 +790,6 @@ interface OAuthServerResult {
  */
 declare function createOAuthServer(config: OAuthServerConfig): OAuthServerResult;
 
-/**
- * LIOP Protected Resource Metadata — RFC 9728
- *
- * Builds the JSON document served at /.well-known/oauth-protected-resource.
- * This enables MCP clients to discover the authorization server and
- * required scopes for accessing LIOP tools and resources.
- *
- * Standards: RFC 9728, MCP Spec 2025-11-25
- */
 /**
  * RFC 9728 Protected Resource Metadata response.
  *
@@ -683,4 +854,4 @@ declare function authorizeRequest(method: string, auth: AuthInfo | null, additio
 declare const LIOP_SCOPES: readonly ["liop:tools:list", "liop:tools:call", "liop:resources:read", "liop:schema:read", "liop:mesh:query"];
 type LiopScope = (typeof LIOP_SCOPES)[number];
 
-export { type AIProvider, AuthInfo, Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, ErrorCode, GRPC_CHANNEL_OPTIONS, GRPC_WEB_CONSTANTS, Gauge, type GrpcWebFrame, HeuristicTokenEstimator, Histogram, Kyber768Wrapper, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type LiopSpan, LiopTracer, type MetricDefinition, type MetricLabels, MetricsRegistry, type PromptConfig, RealTokenEstimator, type SandboxConfig, type SpanContext, type TokenEstimator, type TokenOperationMetric, type TokenSessionReport, TokenTelemetryEngine, type ToolTokenBreakdown, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, calculateAstInstructionFuel, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, decodeFrames, defaultTracer, dispatchGrpcWebRequest, egressBlocksTotal, encodeDataFrame, encodeTrailerFrame, fuelConsumed, generateSystemInstructions, getDefaultEnvironment, isGrpcWebRequest, manifestCacheSize, meshPeersConnected, protocolMetrics, toolCallsTotal, zkVerificationDurationMs };
+export { type AIProvider, AesGcmWrapper, AuthInfo, Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, ErrorCode, GRPC_CHANNEL_OPTIONS, GRPC_WEB_CONSTANTS, type GatewayTopologyInfo, Gauge, type GrpcWebFrame, HeuristicTokenEstimator, Histogram, Kyber768Wrapper, LIOP_SCOPES, LiopError, LiopOTelBridge, LiopRpcClient, LiopRpcServer, type LiopScope, type LiopSpan, LiopTlsOptions, LiopTracer, type MeshTopologyInfo, type MetricDefinition, type MetricLabels, MetricsRegistry, type PromptConfig, RealTokenEstimator, RoutingTable, type SandboxConfig, type SpanContext, type TokenEstimator, TokenManager, type TokenManagerOptions, type TokenOperationMetric, type TokenProvider, type TokenSessionReport, TokenTelemetryEngine, type ToolDefinition, type ToolRoute, type ToolTokenBreakdown, type TopologyProbeOptions, type TopologyProbeResult, type TransportProvider, VERIFICATION_LATENCY_BUDGET_MS, WasiSandbox, authorizeRequest, buildProtectedResourceMetadata, calculateAstInstructionFuel, createOAuthServer, createSyncTokenEstimator, createTokenEstimator, decodeFrames, defaultTracer, deserializeGrothProof, deserializeVKey, dispatchGrpcWebRequest, egressBlocksTotal, encodeDataFrame, encodeTrailerFrame, fuelConsumed, generateSystemInstructions, getDefaultEnvironment, isGrpcWebRequest, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, probeTopology, protocolMetrics, serializeGrothProof, serializeVKey, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, verifyGroth16Proof, wireEgressBytesTotal, wireSavedBytesTotal, zkProofsByTypeTotal, zkProvingDurationMs, zkVerificationDurationMs, zkVerificationsTotal, zkVkeyCacheSize };