@nekzus/liop 2.4.0-alpha.7 → 2.4.0-alpha.8

package/dist/chunk-VH4K4U45.js

@@ -0,0 +1,180 @@
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
+
+// src/rpc/crypto/dilithium.ts
+var DILITHIUM65_CONSTANTS = {
+  PUBLIC_KEY_BYTES: 1952,
+  SECRET_KEY_BYTES: 4032,
+  SIGNATURE_BYTES: 3309,
+  DEFAULT_CONTEXT: new TextEncoder().encode("LIOP-FIPS204-ML-DSA-65")
+};
+function normalizeMessage(message) {
+  if (typeof message === "string") {
+    return new TextEncoder().encode(message);
+  }
+  return message;
+}
+function canonicalizeJson(obj) {
+  if (obj === null || typeof obj !== "object") {
+    return JSON.stringify(obj);
+  }
+  if (Array.isArray(obj)) {
+    return `[${obj.map(canonicalizeJson).join(",")}]`;
+  }
+  const sortedKeys = Object.keys(obj).sort();
+  const entries = sortedKeys.map(
+    (key) => `${JSON.stringify(key)}:${canonicalizeJson(obj[key])}`
+  );
+  return `{${entries.join(",")}}`;
+}
+var Dilithium65Wrapper = {
+  /** Constants */
+  PUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,
+  SECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,
+  SIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,
+  /**
+   * Generates a new ML-DSA-65 (FIPS 204) key pair.
+   * Optionally accepts a 32-byte seed for deterministic key generation.
+   */
+  generateKeyPair(seed) {
+    if (seed && seed.length !== 32) {
+      throw new Error(
+        `ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`
+      );
+    }
+    const keys = ml_dsa65.keygen(seed);
+    return {
+      publicKey: keys.publicKey,
+      secretKey: keys.secretKey
+    };
+  },
+  /**
+   * Validates and imports a raw ML-DSA-65 public key.
+   */
+  importPublicKey(buffer) {
+    if (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {
+      throw new Error(
+        `ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`
+      );
+    }
+    return buffer;
+  },
+  /**
+   * Signs a message using the post-quantum secret key.
+   * Supports optional domain separation context (up to 255 bytes).
+   */
+  sign(message, secretKey, context) {
+    if (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {
+      throw new Error(
+        `ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`
+      );
+    }
+    const msgBytes = normalizeMessage(message);
+    const ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;
+    return ml_dsa65.sign(msgBytes, secretKey, { context: ctx });
+  },
+  /**
+   * Verifies an ML-DSA-65 post-quantum digital signature.
+   */
+  verify(signature, message, publicKey, context) {
+    if (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {
+      return false;
+    }
+    if (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {
+      return false;
+    }
+    try {
+      const msgBytes = normalizeMessage(message);
+      const ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;
+      return ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });
+    } catch {
+      return false;
+    }
+  },
+  /**
+   * Signs a structured manifest (LiopManifest) using canonical JSON serialization.
+   * Returns base64-encoded signature and public key for transport over gRPC/MCP.
+   */
+  signManifest(manifest, secretKey, publicKey) {
+    const { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;
+    const canonicalStr = canonicalizeJson(unsigned);
+    const sig = this.sign(canonicalStr, secretKey);
+    return {
+      signature: Buffer.from(sig).toString("base64"),
+      publicKey: Buffer.from(publicKey).toString("base64")
+    };
+  },
+  /**
+   * Verifies the post-quantum signature of a structured manifest.
+   */
+  verifyManifest(manifest, signatureBase64, publicKeyBase64) {
+    try {
+      const sig = Buffer.from(signatureBase64, "base64");
+      const pub = Buffer.from(publicKeyBase64, "base64");
+      const { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;
+      const canonicalStr = canonicalizeJson(unsigned);
+      return this.verify(sig, canonicalStr, pub);
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/security/rbac.ts
+var SCOPE_MAP = {
+  // Protocol lifecycle — unauthenticated (MCP spec compliance)
+  initialize: [],
+  "notifications/initialized": [],
+  "notifications/cancelled": [],
+  ping: [],
+  "server/discover": [],
+  "subscriptions/listen": [],
+  // Tool operations — require explicit authorization
+  "tools/list": ["liop:tools:list"],
+  "tools/call": ["liop:tools:call"],
+  // Resource operations — read-level access
+  "resources/list": ["liop:resources:read"],
+  "resources/read": ["liop:resources:read"],
+  "resources/templates/list": ["liop:resources:read"],
+  // Prompt/schema operations — schema-level access
+  "prompts/list": ["liop:schema:read"],
+  "prompts/get": ["liop:schema:read"]
+};
+function authorizeRequest(method, auth, additionalScopes) {
+  const methodScopes = SCOPE_MAP[method];
+  if (methodScopes !== void 0 && methodScopes.length === 0) {
+    return { allowed: true };
+  }
+  if (!auth) {
+    return {
+      allowed: false,
+      reason: `Authentication required for method: ${method}`
+    };
+  }
+  const needed = [...methodScopes ?? [], ...additionalScopes ?? []];
+  if (needed.length === 0) {
+    return {
+      allowed: false,
+      reason: `Unknown method: ${method}. Access denied (fail-closed).`
+    };
+  }
+  const clientScopes = new Set(auth.scopes);
+  const missing = needed.filter((s) => !clientScopes.has(s));
+  if (missing.length > 0) {
+    return {
+      allowed: false,
+      reason: `Insufficient scopes for ${method}. Missing: ${missing.join(", ")}`
+    };
+  }
+  return { allowed: true };
+}
+var LIOP_SCOPES = [
+  "liop:tools:list",
+  "liop:tools:call",
+  "liop:resources:read",
+  "liop:schema:read",
+  "liop:mesh:query"
+];
+
+export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest };
+//# sourceMappingURL=chunk-VH4K4U45.js.map
+//# sourceMappingURL=chunk-VH4K4U45.js.map

package/dist/chunk-VH4K4U45.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/crypto/dilithium.ts","../src/security/rbac.ts"],"names":[],"mappings":";;;AAkBO,IAAM,qBAAA,GAAwB;AAAA,EACpC,gBAAA,EAAkB,IAAA;AAAA,EAClB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB,IAAA;AAAA,EACjB,eAAA,EAAiB,IAAI,WAAA,EAAY,CAAE,OAAO,wBAAwB;AACnE;AAKA,SAAS,iBAAiB,OAAA,EAA0C;AACnE,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAChC,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,OAAA;AACR;AAMA,SAAS,iBAAiB,GAAA,EAAsB;AAC/C,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC5C,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,IAAI,GAAA,CAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,GAA8B,EAAE,IAAA,EAAK;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,GAAA;AAAA,IAC1B,CAAC,GAAA,KACA,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAkB,GAAA,CAAgC,GAAG,CAAC,CAAC,CAAA;AAAA,GACnF;AACA,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEO,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEjC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,iBAAiB,qBAAA,CAAsB,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvC,gBAAgB,IAAA,EAGd;AACD,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,mDAAA,EAAsD,KAAK,MAAM,CAAA,CAAA;AAAA,OAClE;AAAA,IACD;AACA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA;AACjC,IAAA,OAAO;AAAA,MACN,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KACjB;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAC7D,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,OAAO,MAAM,CAAA,CAAA;AAAA,OACjH;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CACC,OAAA,EACA,SAAA,EACA,OAAA,EACa;AACb,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,UAAU,MAAM,CAAA,CAAA;AAAA,OACpH;AAAA,IACD;AACA,IAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,IAAA,OAAO,SAAS,IAAA,CAAK,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,EAC3D,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,CACC,SAAA,EACA,OAAA,EACA,SAAA,EACA,OAAA,EACU;AACV,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,eAAA,EAAiB;AAC/D,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,MAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,MAAA,OAAO,QAAA,CAAS,OAAO,SAAA,EAAW,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CACC,QAAA,EACA,SAAA,EACA,SAAA,EAC2C;AAC3C,IAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,IAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAS,CAAA;AAC7C,IAAA,OAAO;AAAA,MACN,WAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,MAC7C,WAAW,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,QAAQ;AAAA,KACpD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,QAAA,EACA,eAAA,EACA,eAAA,EACU;AACV,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,MAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,MAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK,YAAA,EAAc,GAAG,CAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AACD;;;ACvJA,IAAM,SAAA,GAAyD;AAAA;AAAA,EAE9D,YAAY,EAAC;AAAA,EACb,6BAA6B,EAAC;AAAA,EAC9B,2BAA2B,EAAC;AAAA,EAC5B,MAAM,EAAC;AAAA,EACP,mBAAmB,EAAC;AAAA,EACpB,wBAAwB,EAAC;AAAA;AAAA,EAGzB,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA,EAChC,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA;AAAA,EAGhC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,0BAAA,EAA4B,CAAC,qBAAqB,CAAA;AAAA;AAAA,EAGlD,cAAA,EAAgB,CAAC,kBAAkB,CAAA;AAAA,EACnC,aAAA,EAAe,CAAC,kBAAkB;AACnC,CAAA;AAuBO,SAAS,gBAAA,CACf,MAAA,EACA,IAAA,EACA,gBAAA,EACsB;AACtB,EAAA,MAAM,YAAA,GAAe,UAAU,MAAM,CAAA;AAGrC,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AAC5D,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACxB;AAGA,EAAA,IAAI,CAAC,IAAA,EAAM;AACV,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,uCAAuC,MAAM,CAAA;AAAA,KACtD;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GAAS,CAAC,GAAI,YAAA,IAAgB,EAAC,EAAI,GAAI,gBAAA,IAAoB,EAAG,CAAA;AAGpE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACxB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,mBAAmB,MAAM,CAAA,8BAAA;AAAA,KAClC;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,GAAA,CAAI,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACvB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,QAAQ,CAAA,wBAAA,EAA2B,MAAM,cAAc,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC1E;AAAA,EACD;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACxB;AAMO,IAAM,WAAA,GAAc;AAAA,EAC1B,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACD","file":"chunk-VH4K4U45.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Post-Quantum Digital Signature Wrapper\n * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant\n * manifest attestation, node revocation receipts, and cryptographic integrity.\n *\n * Characteristics:\n * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)\n * - Public Key Length: 1952 bytes\n * - Secret Key Length: 4032 bytes\n * - Signature Length: 3309 bytes\n * - Implementation: Pure TypeScript/JS via @noble/post-quantum\n */\n\nimport { ml_dsa65 } from \"@noble/post-quantum/ml-dsa.js\";\n\nexport const DILITHIUM65_CONSTANTS = {\n\tPUBLIC_KEY_BYTES: 1952,\n\tSECRET_KEY_BYTES: 4032,\n\tSIGNATURE_BYTES: 3309,\n\tDEFAULT_CONTEXT: new TextEncoder().encode(\"LIOP-FIPS204-ML-DSA-65\"),\n} as const;\n\n/**\n * Deterministically normalizes a message into a Uint8Array.\n */\nfunction normalizeMessage(message: Uint8Array | string): Uint8Array {\n\tif (typeof message === \"string\") {\n\t\treturn new TextEncoder().encode(message);\n\t}\n\treturn message;\n}\n\n/**\n * Deterministic canonical JSON serializer to ensure stable cryptographic hashing\n * regardless of key ordering in JavaScript objects.\n */\nfunction canonicalizeJson(obj: unknown): string {\n\tif (obj === null || typeof obj !== \"object\") {\n\t\treturn JSON.stringify(obj);\n\t}\n\tif (Array.isArray(obj)) {\n\t\treturn `[${obj.map(canonicalizeJson).join(\",\")}]`;\n\t}\n\tconst sortedKeys = Object.keys(obj as Record<string, unknown>).sort();\n\tconst entries = sortedKeys.map(\n\t\t(key) =>\n\t\t\t`${JSON.stringify(key)}:${canonicalizeJson((obj as Record<string, unknown>)[key])}`,\n\t);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nexport const Dilithium65Wrapper = {\n\t/** Constants */\n\tPUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,\n\tSECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,\n\tSIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,\n\n\t/**\n\t * Generates a new ML-DSA-65 (FIPS 204) key pair.\n\t * Optionally accepts a 32-byte seed for deterministic key generation.\n\t */\n\tgenerateKeyPair(seed?: Uint8Array): {\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t} {\n\t\tif (seed && seed.length !== 32) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`,\n\t\t\t);\n\t\t}\n\t\tconst keys = ml_dsa65.keygen(seed);\n\t\treturn {\n\t\t\tpublicKey: keys.publicKey,\n\t\t\tsecretKey: keys.secretKey,\n\t\t};\n\t},\n\n\t/**\n\t * Validates and imports a raw ML-DSA-65 public key.\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Signs a message using the post-quantum secret key.\n\t * Supports optional domain separation context (up to 255 bytes).\n\t */\n\tsign(\n\t\tmessage: Uint8Array | string,\n\t\tsecretKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): Uint8Array {\n\t\tif (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`,\n\t\t\t);\n\t\t}\n\t\tconst msgBytes = normalizeMessage(message);\n\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\treturn ml_dsa65.sign(msgBytes, secretKey, { context: ctx });\n\t},\n\n\t/**\n\t * Verifies an ML-DSA-65 post-quantum digital signature.\n\t */\n\tverify(\n\t\tsignature: Uint8Array,\n\t\tmessage: Uint8Array | string,\n\t\tpublicKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): boolean {\n\t\tif (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\tif (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\ttry {\n\t\t\tconst msgBytes = normalizeMessage(message);\n\t\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\t\treturn ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n\n\t/**\n\t * Signs a structured manifest (LiopManifest) using canonical JSON serialization.\n\t * Returns base64-encoded signature and public key for transport over gRPC/MCP.\n\t */\n\tsignManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsecretKey: Uint8Array,\n\t\tpublicKey: Uint8Array,\n\t): { signature: string; publicKey: string } {\n\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\tconst sig = this.sign(canonicalStr, secretKey);\n\t\treturn {\n\t\t\tsignature: Buffer.from(sig).toString(\"base64\"),\n\t\t\tpublicKey: Buffer.from(publicKey).toString(\"base64\"),\n\t\t};\n\t},\n\n\t/**\n\t * Verifies the post-quantum signature of a structured manifest.\n\t */\n\tverifyManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsignatureBase64: string,\n\t\tpublicKeyBase64: string,\n\t): boolean {\n\t\ttry {\n\t\t\tconst sig = Buffer.from(signatureBase64, \"base64\");\n\t\t\tconst pub = Buffer.from(publicKeyBase64, \"base64\");\n\t\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\t\treturn this.verify(sig, canonicalStr, pub);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP RBAC Engine — Scope-Based Authorization\n *\n * Maps MCP JSON-RPC methods to required LIOP OAuth scopes.\n * Enforces least-privilege access at the router level before\n * any tool execution or resource read occurs.\n *\n * Standards: NIST SP 800-207 §4.3 (least privilege), OWASP LLM06 (Excessive Agency),\n *            OWASP API-A01 (Broken Access Control)\n */\n\nimport type { AuthInfo } from \"./jwt-validator.js\";\n\n/**\n * Maps MCP JSON-RPC methods to the LIOP scopes required to invoke them.\n * Empty array = no authentication required (public endpoints).\n */\nconst SCOPE_MAP: Readonly<Record<string, readonly string[]>> = {\n\t// Protocol lifecycle — unauthenticated (MCP spec compliance)\n\tinitialize: [],\n\t\"notifications/initialized\": [],\n\t\"notifications/cancelled\": [],\n\tping: [],\n\t\"server/discover\": [],\n\t\"subscriptions/listen\": [],\n\n\t// Tool operations — require explicit authorization\n\t\"tools/list\": [\"liop:tools:list\"],\n\t\"tools/call\": [\"liop:tools:call\"],\n\n\t// Resource operations — read-level access\n\t\"resources/list\": [\"liop:resources:read\"],\n\t\"resources/read\": [\"liop:resources:read\"],\n\t\"resources/templates/list\": [\"liop:resources:read\"],\n\n\t// Prompt/schema operations — schema-level access\n\t\"prompts/list\": [\"liop:schema:read\"],\n\t\"prompts/get\": [\"liop:schema:read\"],\n};\n\n/**\n * Authorization result with optional denial reason for audit logging.\n */\nexport interface AuthorizationResult {\n\tallowed: boolean;\n\treason?: string;\n}\n\n/**\n * Evaluates whether a request is authorized based on JWT scopes.\n *\n * Decision logic:\n * 1. Methods with no required scopes (initialize, ping) → always allowed.\n * 2. Methods with required scopes but no auth → denied.\n * 3. Methods with required scopes → all scopes must be present in the JWT.\n * 4. Unknown methods with no auth → denied (fail-closed per NIST SP 800-207).\n *\n * @param method - MCP JSON-RPC method name (e.g., \"tools/call\")\n * @param auth - Validated JWT context, or null if unauthenticated\n * @param additionalScopes - Extra scopes required by specific node configuration\n */\nexport function authorizeRequest(\n\tmethod: string,\n\tauth: AuthInfo | null,\n\tadditionalScopes?: readonly string[],\n): AuthorizationResult {\n\tconst methodScopes = SCOPE_MAP[method];\n\n\t// Methods explicitly marked as public (empty scope array) pass freely\n\tif (methodScopes !== undefined && methodScopes.length === 0) {\n\t\treturn { allowed: true };\n\t}\n\n\t// If no auth context and method requires scopes → deny\n\tif (!auth) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Authentication required for method: ${method}`,\n\t\t};\n\t}\n\n\t// Merge method-level scopes with node-level additional scopes\n\tconst needed = [...(methodScopes ?? []), ...(additionalScopes ?? [])];\n\n\t// If no scopes needed (unknown method, no additional) → fail-closed\n\tif (needed.length === 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Unknown method: ${method}. Access denied (fail-closed).`,\n\t\t};\n\t}\n\n\t// Verify all required scopes are present in the JWT\n\tconst clientScopes = new Set(auth.scopes);\n\tconst missing = needed.filter((s) => !clientScopes.has(s));\n\n\tif (missing.length > 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Insufficient scopes for ${method}. Missing: ${missing.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * All LIOP OAuth scopes supported by the protocol.\n * Used for PRM metadata and client registration.\n */\nexport const LIOP_SCOPES = [\n\t\"liop:tools:list\",\n\t\"liop:tools:call\",\n\t\"liop:resources:read\",\n\t\"liop:schema:read\",\n\t\"liop:mesh:query\",\n] as const;\n\nexport type LiopScope = (typeof LIOP_SCOPES)[number];\n"]}

package/dist/{chunk-JIJPZFR2.js → chunk-Y62GORQF.js}

@@ -47,5 +47,5 @@ function sanitizeOutput(output, config) {
 }
 
 export { sanitizeOutput };
-//# sourceMappingURL=chunk-JIJPZFR2.js.map
-//# sourceMappingURL=chunk-JIJPZFR2.js.map
+//# sourceMappingURL=chunk-Y62GORQF.js.map
+//# sourceMappingURL=chunk-Y62GORQF.js.map

package/dist/chunk-Y62GORQF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/output-sanitizer.ts"],"names":[],"mappings":";AAkBA,IAAM,cAAA,GAAkD;AAAA,EACvD,gBAAA,EAAkB,CAAA;AAAA,EAClB,gBAAA,EAAkB;AACnB,CAAA;AASO,SAAS,cAAA,CACf,QACA,MAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,MAAA,EAAO;AAC9C,EAAA,MAAM,IAAA,uBAAW,OAAA,EAAgB;AAEjC,EAAA,SAAS,KAAK,IAAA,EAAwB;AACrC,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACxC,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,QAAA,OAAO,IAAA;AAAA,MACR;AAEA,MAAA,IAAI,KAAA,GAAQ,IAAA;AAGZ,MAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,KAAA,GAAQ,CAAA,EAAG;AACzC,QAAA,KAAA,GAAQ,CAAA;AAAA,MACT;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,gBAAA;AAC5B,MAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA,GAAI,MAAA;AAErC,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,SAAS,SAAA,EAAW;AAC1D,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE7B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAc,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACR;AACA,MAAA,IAAA,CAAK,IAAI,IAAc,CAAA;AAEvB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,QAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MACrC;AAEA,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,QAC/B;AAAA,OACD,EAAG;AACF,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,MAAM,CAAA;AACnB","file":"chunk-Y62GORQF.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Egress Shield Output Sanitizer (NIST SP 800-226 and OWASP DLP 2025 compliant)\n * Recursively sanitizes execution outputs by rounding floating-point numbers\n * and clamping negative values to zero floor where appropriate.\n *\n * Implements absolute immutability, returning a fresh copy of the data.\n */\n\nexport interface OutputSanitizerConfig {\n\t/** Maximum decimal places for floating-point values (default: 4) */\n\tmaxDecimalPlaces?: number;\n\t/** Clamp negative values to zero floor (default: true) */\n\tclampNonNegative?: boolean;\n}\n\nconst DEFAULT_CONFIG: Required<OutputSanitizerConfig> = {\n\tmaxDecimalPlaces: 4,\n\tclampNonNegative: true,\n};\n\n/**\n * Recursively walks a JSON-like tree, rounding floats and clamping negative values.\n *\n * @param output - The raw or DP-modified output object/value to sanitize\n * @param config - Sanitization parameters (rounding depth, negative clamping)\n * @returns A sanitized deep copy of the output\n */\nexport function sanitizeOutput(\n\toutput: unknown,\n\tconfig?: OutputSanitizerConfig,\n): unknown {\n\tconst merged = { ...DEFAULT_CONFIG, ...config };\n\tconst seen = new WeakSet<object>();\n\n\tfunction walk(node: unknown): unknown {\n\t\tif (node === null || node === undefined) {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"number\") {\n\t\t\tif (!Number.isFinite(node)) {\n\t\t\t\treturn node;\n\t\t\t}\n\n\t\t\tlet value = node;\n\n\t\t\t// 1. Clamp negative values to 0 if configured\n\t\t\tif (merged.clampNonNegative && value < 0) {\n\t\t\t\tvalue = 0;\n\t\t\t}\n\n\t\t\t// 2. Round to maximum decimal places\n\t\t\tconst factor = 10 ** merged.maxDecimalPlaces;\n\t\t\tvalue = Math.round(value * factor) / factor;\n\n\t\t\treturn value;\n\t\t}\n\n\t\tif (typeof node === \"string\" || typeof node === \"boolean\") {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"object\") {\n\t\t\t// Circular reference protection\n\t\t\tif (seen.has(node as object)) {\n\t\t\t\treturn node;\n\t\t\t}\n\t\t\tseen.add(node as object);\n\n\t\t\tif (Array.isArray(node)) {\n\t\t\t\treturn node.map((item) => walk(item));\n\t\t\t}\n\n\t\t\tconst result: Record<string, unknown> = {};\n\t\t\tfor (const [key, val] of Object.entries(\n\t\t\t\tnode as Record<string, unknown>,\n\t\t\t)) {\n\t\t\t\tresult[key] = walk(val);\n\t\t\t}\n\t\t\treturn result;\n\t\t}\n\n\t\treturn node;\n\t}\n\n\treturn walk(output);\n}\n"]}

package/dist/chunk-ZP3VVXOI.js

@@ -0,0 +1,66 @@
+import { Buffer } from 'buffer';
+import { mkdir, writeFile, readFile } from 'fs/promises';
+import { dirname } from 'path';
+import { generateKey } from '@libp2p/pnet';
+
+// src/mesh/swarm-key.ts
+var SWARM_KEY_BYTE_LENGTH = 95;
+function createSwarmKey() {
+  const psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);
+  generateKey(psk);
+  return psk;
+}
+function serializeSwarmKey(psk) {
+  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
+    throw new Error(
+      `Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
+    );
+  }
+  return Buffer.from(psk).toString("base64");
+}
+function deserializeSwarmKey(base64Str) {
+  const trimmed = base64Str.trim();
+  const buf = Buffer.from(trimmed, "base64");
+  if (buf.length !== SWARM_KEY_BYTE_LENGTH) {
+    throw new Error(
+      `Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`
+    );
+  }
+  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+}
+function parseSwarmKey(rawText) {
+  const trimmed = rawText.trim();
+  if (trimmed.startsWith("/key/swarm/psk/")) {
+    const normalized = trimmed.replace(/\r\n/g, "\n").trimEnd();
+    const bytes = new TextEncoder().encode(normalized);
+    if (bytes.length === SWARM_KEY_BYTE_LENGTH) {
+      return bytes;
+    }
+  }
+  return deserializeSwarmKey(trimmed);
+}
+async function saveSwarmKey(psk, filePath) {
+  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
+    throw new Error(
+      `Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
+    );
+  }
+  await mkdir(dirname(filePath), { recursive: true });
+  await writeFile(filePath, psk);
+}
+async function loadSwarmKey(filePath) {
+  const fileBuffer = await readFile(filePath);
+  if (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {
+    return new Uint8Array(
+      fileBuffer.buffer,
+      fileBuffer.byteOffset,
+      fileBuffer.byteLength
+    );
+  }
+  const text = fileBuffer.toString("utf-8");
+  return parseSwarmKey(text);
+}
+
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey };
+//# sourceMappingURL=chunk-ZP3VVXOI.js.map
+//# sourceMappingURL=chunk-ZP3VVXOI.js.map

package/dist/chunk-ZP3VVXOI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mesh/swarm-key.ts"],"names":[],"mappings":";;;;;;AAQO,IAAM,qBAAA,GAAwB;AAM9B,SAAS,cAAA,GAA6B;AAC5C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,qBAAqB,CAAA;AAChD,EAAA,WAAA,CAAY,GAAG,CAAA;AACf,EAAA,OAAO,GAAA;AACR;AAKO,SAAS,kBAAkB,GAAA,EAAyB;AAC1D,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,mCAAA,EAAsC,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KACrF;AAAA,EACD;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC1C;AAKO,SAAS,oBAAoB,SAAA,EAA+B;AAClE,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AACzC,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,yCAAA,EAA4C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC3F;AAAA,EACD;AACA,EAAA,OAAO,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,GAAA,CAAI,UAAA,EAAY,IAAI,UAAU,CAAA;AACjE;AAMO,SAAS,cAAc,OAAA,EAA6B;AAC1D,EAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAK;AAE7B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,iBAAiB,CAAA,EAAG;AAC1C,IAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,OAAA,EAAS,IAAI,EAAE,OAAA,EAAQ;AAC1D,IAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AACjD,IAAA,IAAI,KAAA,CAAM,WAAW,qBAAA,EAAuB;AAC3C,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAEA,EAAA,OAAO,oBAAoB,OAAO,CAAA;AACnC;AAKA,eAAsB,YAAA,CACrB,KACA,QAAA,EACgB;AAChB,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,wCAAA,EAA2C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC1F;AAAA,EACD;AACA,EAAA,MAAM,MAAM,OAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,EAAA,MAAM,SAAA,CAAU,UAAU,GAAG,CAAA;AAC9B;AAMA,eAAsB,aAAa,QAAA,EAAuC;AACzE,EAAA,MAAM,UAAA,GAAa,MAAM,QAAA,CAAS,QAAQ,CAAA;AAC1C,EAAA,IAAI,UAAA,CAAW,WAAW,qBAAA,EAAuB;AAChD,IAAA,OAAO,IAAI,UAAA;AAAA,MACV,UAAA,CAAW,MAAA;AAAA,MACX,UAAA,CAAW,UAAA;AAAA,MACX,UAAA,CAAW;AAAA,KACZ;AAAA,EACD;AACA,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA;AACxC,EAAA,OAAO,cAAc,IAAI,CAAA;AAC1B","file":"chunk-ZP3VVXOI.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Buffer } from \"node:buffer\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { generateKey } from \"@libp2p/pnet\";\n\nexport const SWARM_KEY_BYTE_LENGTH = 95;\n\n/**\n * Creates a freshly generated 95-byte Pre-Shared Key (PSK) for libp2p Private Networks (pnet).\n * Follows the canonical format `/key/swarm/psk/1.0.0/\\n/base16/\\n<hex>\\n`.\n */\nexport function createSwarmKey(): Uint8Array {\n\tconst psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);\n\tgenerateKey(psk);\n\treturn psk;\n}\n\n/**\n * Serializes a 95-byte PSK into a Base64 string for safe environment variable passing or JSON config.\n */\nexport function serializeSwarmKey(psk: Uint8Array): string {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\treturn Buffer.from(psk).toString(\"base64\");\n}\n\n/**\n * Deserializes a Base64-encoded string into a 95-byte PSK Uint8Array.\n */\nexport function deserializeSwarmKey(base64Str: string): Uint8Array {\n\tconst trimmed = base64Str.trim();\n\tconst buf = Buffer.from(trimmed, \"base64\");\n\tif (buf.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`,\n\t\t);\n\t}\n\treturn new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);\n}\n\n/**\n * Parses raw text format PSK or Base64 string into a 95-byte PSK Uint8Array.\n * Allows loading either the canonical multiline text (`/key/swarm/psk/1.0.0/...`) or Base64.\n */\nexport function parseSwarmKey(rawText: string): Uint8Array {\n\tconst trimmed = rawText.trim();\n\t// Check if this is canonical raw text format\n\tif (trimmed.startsWith(\"/key/swarm/psk/\")) {\n\t\tconst normalized = trimmed.replace(/\\r\\n/g, \"\\n\").trimEnd();\n\t\tconst bytes = new TextEncoder().encode(normalized);\n\t\tif (bytes.length === SWARM_KEY_BYTE_LENGTH) {\n\t\t\treturn bytes;\n\t\t}\n\t}\n\t// Fallback to Base64 deserialization\n\treturn deserializeSwarmKey(trimmed);\n}\n\n/**\n * Saves a 95-byte Swarm Key to a file on disk (written as canonical text).\n */\nexport async function saveSwarmKey(\n\tpsk: Uint8Array,\n\tfilePath: string,\n): Promise<void> {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\tawait mkdir(dirname(filePath), { recursive: true });\n\tawait writeFile(filePath, psk);\n}\n\n/**\n * Loads a 95-byte Swarm Key from a file on disk.\n * Supports both raw binary/canonical format and Base64-encoded text.\n */\nexport async function loadSwarmKey(filePath: string): Promise<Uint8Array> {\n\tconst fileBuffer = await readFile(filePath);\n\tif (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {\n\t\treturn new Uint8Array(\n\t\t\tfileBuffer.buffer,\n\t\t\tfileBuffer.byteOffset,\n\t\t\tfileBuffer.byteLength,\n\t\t);\n\t}\n\tconst text = fileBuffer.toString(\"utf-8\");\n\treturn parseSwarmKey(text);\n}\n"]}

package/dist/client.d.ts

@@ -1,6 +1,6 @@
 import './verifier-COnid_dg.js';
-import './mesh.js';
-export { c as LiopClient } from './index-cMV0_yD9.js';
+import './node-B0b2vUFS.js';
+export { c as LiopClient } from './index-CX43dvMs.js';
 import './types-lJIxBlWF.js';
 import 'node:events';
 import 'zod';

package/dist/client.js

@@ -1,10 +1,13 @@
-export { LiopClient } from './chunk-CRZBVFDV.js';
-import './chunk-32ADSAJS.js';
-import './chunk-OUUTDSOW.js';
-import './chunk-QLCOEP5J.js';
-import './chunk-WSW6YJNY.js';
-import './chunk-PYKRQAER.js';
-import './chunk-74CISO2I.js';
-import './chunk-72MNYFR6.js';
+export { LiopClient } from './chunk-T7R5HUFD.js';
+import './chunk-ESRXG36Y.js';
+import './chunk-DZ2FQGJD.js';
+import './chunk-PEN3KFLF.js';
+import './chunk-IK7CGWAZ.js';
+import './chunk-7PITYWOV.js';
+import './chunk-TKRX6CFI.js';
+import './chunk-PAICJCKJ.js';
+import './chunk-EG46XMJT.js';
+import './chunk-7RXOIDXP.js';
+import './chunk-HA6YZ42O.js';
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,6 +1,6 @@
-import './mesh.js';
-import './index-BW95kAL4.js';
-export { L as LiopHybridGateway } from './hybrid-CF__0YnC.js';
+import './node-B0b2vUFS.js';
+import './index-DoW2gzBZ.js';
+export { L as LiopHybridGateway } from './hybrid-CrKB50nh.js';
 import 'zod';
 import './types-lJIxBlWF.js';
 import 'jose';

package/dist/gateway.js

@@ -1,11 +1,13 @@
-export { LiopHybridGateway } from './chunk-T5IUZF47.js';
-import './chunk-547TYL27.js';
-import './chunk-32ADSAJS.js';
-import './chunk-OUUTDSOW.js';
-import './chunk-QLCOEP5J.js';
-import './chunk-U5BZ66VX.js';
-import './chunk-WSW6YJNY.js';
-import './chunk-PYKRQAER.js';
-import './chunk-72MNYFR6.js';
+export { LiopHybridGateway } from './chunk-3L2O2XKG.js';
+import './chunk-L6J72C5X.js';
+import './chunk-DZ2FQGJD.js';
+import './chunk-PEN3KFLF.js';
+import './chunk-IK7CGWAZ.js';
+import './chunk-7PITYWOV.js';
+import './chunk-VH4K4U45.js';
+import './chunk-TKRX6CFI.js';
+import './chunk-PAICJCKJ.js';
+import './chunk-EG46XMJT.js';
+import './chunk-HA6YZ42O.js';
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/{hybrid-CF__0YnC.d.ts → hybrid-CrKB50nh.d.ts}

@@ -1,5 +1,5 @@
-import { MeshNode } from './mesh.js';
-import { L as LiopServer } from './index-BW95kAL4.js';
+import { a as MeshNode } from './node-B0b2vUFS.js';
+import { L as LiopServer } from './index-DoW2gzBZ.js';
 import { L as LiopVerifier } from './verifier-COnid_dg.js';
 import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse } from './types-lJIxBlWF.js';
 

package/dist/{index-cMV0_yD9.d.ts → index-CX43dvMs.d.ts}

@@ -1,18 +1,8 @@
 import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { MeshNodeConfig } from './mesh.js';
+import { M as MeshNodeConfig } from './node-B0b2vUFS.js';
 import { EventEmitter } from 'node:events';
 import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-lJIxBlWF.js';
 
-/**
- * LIOP Certificate Manager (CertManager)
- * Provides automated certificate monitoring, X.509 validity inspection,
- * and hot-reloading for mutual TLS (mTLS) without node restarts.
- *
- * Compliance:
- * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS
- * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification
- */
-
 interface CertManagerOptions {
     /** Path to the root CA certificate (PEM format) */
     rootCertPath?: string;
@@ -77,23 +67,6 @@ declare class CertManager extends EventEmitter {
     dispose(): void;
 }
 
-/**
- * LIOP TLS Configuration
- *
- * Provides conditional TLS credential factories for gRPC connections.
- * When TLS options are provided, connections are secured with mutual TLS.
- * Otherwise, falls back to insecure credentials (alpha/development mode).
- *
- * Production Hardening (Phase 128):
- * - When NODE_ENV=production and TLS is configured but certificate loading
- *   fails, the system throws a fatal error instead of silently degrading
- *   to insecure credentials. This prevents MITM/eavesdropping attacks
- *   caused by misconfigured certificate paths going unnoticed.
- * - Reference: gRPC-node official docs — "Using insecure credentials in
- *   production poses significant security risks including eavesdropping,
- *   MITM attacks, and lack of authentication."
- */
-
 interface LiopTlsOptions {
     /** Path to the root CA certificate (PEM format) */
     rootCert?: string;
@@ -119,15 +92,12 @@ declare class LiopClient {
     private serverInfo?;
     verifier: LiopVerifier;
     private oauthToken?;
+    private tokenManager?;
     /** Protocol negotiation era */
     era: McpEra;
     /** Negotiated protocol version */
     protocolVersion: string;
     constructor(tls?: LiopTlsOptions);
-    /**
-     * Requests an M2M access token from the Nexus Authorization Server using Client Credentials.
-     */
-    private acquireM2MToken;
     /**
      * Discovers and connects to the target server or mesh capability.
      * If address is omitted, it sets up the MeshNode to act purely dynamically.

package/dist/{index-BW95kAL4.d.ts → index-DoW2gzBZ.d.ts}

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { MeshNode } from './mesh.js';
+import { M as MeshNodeConfig, a as MeshNode } from './node-B0b2vUFS.js';
 import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, d as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-lJIxBlWF.js';
 
 /**
@@ -100,11 +100,6 @@ declare const AUTH_DEFAULTS: {
     readonly signingAlgorithm: "EdDSA";
 };
 
-/**
- * LIOP Immutable Audit Logger (Phase Beta-3)
- * SOC 2 Type II & HIPAA compliant audit trail with cryptographic Hash-Chain.
- * Guarantees tamper-evidence and non-repudiation for all Logic-on-Origin executions.
- */
 type AuditStatus = "SUCCESS" | "BLOCKED_EGRESS" | "ERROR" | "POLICY_VIOLATION";
 interface AuditEntry {
     id: string;
@@ -211,11 +206,6 @@ interface OutputSanitizerConfig {
  */
 declare function sanitizeOutput(output: unknown, config?: OutputSanitizerConfig): unknown;
 
-/**
- * LIOP Professional PII Engine (The Shield V2 - Tier-1 Military Edition)
- * Implements high-fidelity detection based on NIST and OWASP standards.
- * Features Multi-Layer Verification (Regex + Algorithmic Validators).
- */
 type PiiRuleDefinition = {
     name: string;
     pattern: string | RegExp;
@@ -458,11 +448,7 @@ declare class LiopServer {
      */
     connect(options?: {
         port?: number;
-        meshConfig?: {
-            listenAddresses?: string[];
-            bootstrapNodes?: string[];
-            identityPath?: string;
-        };
+        meshConfig?: MeshNodeConfig;
     }): Promise<void>;
     /**
      * Register a new Tool
@@ -548,11 +534,7 @@ declare class LiopServer {
      */
     connectToMesh(options?: {
         port?: number;
-        meshConfig?: {
-            listenAddresses?: string[];
-            bootstrapNodes?: string[];
-            identityPath?: string;
-        };
+        meshConfig?: MeshNodeConfig;
     }): Promise<void>;
     /**
      * Internal worker execution with Egress Filtering logic.