@nekzus/liop 2.5.0-beta.1 → 2.5.0-beta.2

package/dist/chunk-WSW6YJNY.js

@@ -1,168 +0,0 @@
-import { log } from './chunk-72MNYFR6.js';
-import path from 'path';
-import { fileURLToPath } from 'url';
-import * as grpc2 from '@grpc/grpc-js';
-import * as protoLoader from '@grpc/proto-loader';
-import * as fs2 from 'fs';
-
-// src/rpc/channel-options.ts
-var GRPC_CHANNEL_OPTIONS = {
-  "grpc.keepalive_time_ms": 3e4,
-  "grpc.keepalive_timeout_ms": 1e4,
-  "grpc.keepalive_permit_without_calls": 1,
-  "grpc.max_send_message_length": -1,
-  "grpc.max_receive_message_length": -1,
-  "grpc.enable_retries": 1
-};
-var __filename2 = fileURLToPath(import.meta.url);
-var __dirname2 = path.dirname(__filename2);
-var PROD_PATHS = [
-  path.resolve(__dirname2, "./protocol/liop_core.proto"),
-  // Flat dist/ (tsup)
-  path.resolve(__dirname2, "../protocol/liop_core.proto")
-  // dist/rpc/ (tsc)
-];
-var DEV_PROTO_PATH = path.resolve(
-  __dirname2,
-  "../../../../protocol/proto/liop_core.proto"
-);
-var PROTO_PATH = PROD_PATHS.find((p) => fs2.existsSync(p)) || DEV_PROTO_PATH;
-if (!fs2.existsSync(PROTO_PATH)) {
-  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
-}
-var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
-  keepCase: true,
-  longs: String,
-  enums: String,
-  defaults: true,
-  oneofs: true
-});
-var liopProto = grpc2.loadPackageDefinition(packageDefinition);
-var liopV1 = liopProto.liop.v1;
-var isTlsEnforced = () => process.env.NODE_ENV === "production" || process.env.LIOP_ENFORCE_TLS === "true";
-function createServerCredentials(tls) {
-  if (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {
-    throw new Error(
-      "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
-    );
-  }
-  if (tls?.certManager) {
-    try {
-      const certChain = tls.certManager.getCertChain();
-      const privateKey = tls.certManager.getPrivateKey();
-      const rootCert = tls.certManager.getRootCert();
-      if (tls.mutualTls && !rootCert) {
-        throw new Error(
-          "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded."
-        );
-      }
-      return grpc2.ServerCredentials.createSsl(
-        rootCert,
-        [{ cert_chain: certChain, private_key: privateKey }],
-        Boolean(tls.mutualTls)
-      );
-    } catch (error) {
-      if (isTlsEnforced()) {
-        throw new Error(
-          `[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`
-        );
-      }
-      log.warn(
-        `[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`
-      );
-      return grpc2.ServerCredentials.createInsecure();
-    }
-  }
-  if (!tls?.certChain || !tls?.privateKey) {
-    if (isTlsEnforced()) {
-      throw new Error(
-        "[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true."
-      );
-    }
-    log.warn(
-      "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
-    );
-    return grpc2.ServerCredentials.createInsecure();
-  }
-  try {
-    const rootCert = tls.rootCert ? fs2.readFileSync(tls.rootCert) : null;
-    const certChain = fs2.readFileSync(tls.certChain);
-    const privateKey = fs2.readFileSync(tls.privateKey);
-    if (tls.mutualTls && !rootCert) {
-      throw new Error(
-        "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
-      );
-    }
-    return grpc2.ServerCredentials.createSsl(
-      rootCert,
-      [{ cert_chain: certChain, private_key: privateKey }],
-      Boolean(tls.mutualTls)
-    );
-  } catch (error) {
-    if (isTlsEnforced()) {
-      throw new Error(
-        `[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
-      );
-    }
-    log.warn(
-      `[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`
-    );
-    return grpc2.ServerCredentials.createInsecure();
-  }
-}
-function createChannelCredentials(tls) {
-  if (tls?.certManager) {
-    try {
-      const rootCert = tls.certManager.getRootCert();
-      if (!rootCert) {
-        throw new Error(
-          "[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager."
-        );
-      }
-      const certChain = tls.certManager.getCertChain();
-      const privateKey = tls.certManager.getPrivateKey();
-      return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
-    } catch (error) {
-      if (isTlsEnforced()) {
-        throw new Error(
-          `[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`
-        );
-      }
-      log.warn(
-        `[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`
-      );
-      return grpc2.credentials.createInsecure();
-    }
-  }
-  if (!tls?.rootCert) {
-    if (isTlsEnforced()) {
-      throw new Error(
-        "[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true."
-      );
-    }
-    log.warn(
-      "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
-    );
-    return grpc2.credentials.createInsecure();
-  }
-  try {
-    const rootCert = fs2.readFileSync(tls.rootCert);
-    const certChain = tls.certChain ? fs2.readFileSync(tls.certChain) : void 0;
-    const privateKey = tls.privateKey ? fs2.readFileSync(tls.privateKey) : void 0;
-    return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
-  } catch (error) {
-    if (isTlsEnforced()) {
-      throw new Error(
-        `[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
-      );
-    }
-    log.warn(
-      `[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`
-    );
-    return grpc2.credentials.createInsecure();
-  }
-}
-
-export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials, liopV1 };
-//# sourceMappingURL=chunk-WSW6YJNY.js.map
-//# sourceMappingURL=chunk-WSW6YJNY.js.map

package/dist/chunk-WSW6YJNY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rpc/channel-options.ts","../src/rpc/proto.ts","../src/rpc/tls.ts"],"names":["__filename","__dirname","fs","grpc"],"mappings":";;;;;;;;AAOO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,GAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,4BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK;ACRrC,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAO3B,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,KAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH;AAAA,KACD;AACA,IAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,KAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,KAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH;AAAA,KACD;AACA,IAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,KAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,EACxC;AACD","file":"chunk-WSW6YJNY.js","sourcesContent":["/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","import path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n","/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n"]}

package/dist/kyber-3ULIJSE3.js

@@ -1,3 +0,0 @@
-export { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
-//# sourceMappingURL=kyber-3ULIJSE3.js.map
-//# sourceMappingURL=kyber-3ULIJSE3.js.map

package/dist/types-lJIxBlWF.d.ts

@@ -1,256 +0,0 @@
-import { z } from 'zod';
-import * as jose from 'jose';
-
-/**
- * LIOP JWT Validator — Token Verification Engine
- *
- * Validates JWT Access Tokens using the `jose` library.
- * Supports two modes:
- *   - Local JWKS (Nexus role): Keys in memory, zero network latency.
- *   - Remote JWKS (Node role): Fetched from Nexus /oidc/jwks with 10min cache.
- *
- * Standards: NIST SP 800-207 (continuous verification), OWASP API-A01
- * Source: panva/jose DeepWiki — createRemoteJWKSet, jwtVerify
- */
-
-/**
- * Authorization context extracted from a validated JWT.
- * Compatible with MCP TypeScript SDK AuthInfo interface.
- */
-interface AuthInfo {
-    /** Raw JWT string. */
-    token: string;
-    /** Subject claim (client_id for M2M flows). */
-    clientId: string;
-    /** Space-delimited scopes parsed into an array. */
-    scopes: string[];
-    /** Token expiration timestamp (Unix seconds). */
-    expiresAt?: number;
-}
-/**
- * JWT Validator with dual-mode JWKS resolution.
- *
- * - Nexus role: `new JwtValidator(issuer, audience, localJwks)` (createLocalJWKSet)
- * - Node role: `new JwtValidator(issuer, audience, new URL(jwksUri))` (createRemoteJWKSet)
- */
-declare class JwtValidator {
-    private readonly jwksResolver;
-    private readonly issuer;
-    private readonly audience;
-    constructor(issuer: string, audience: string, jwksSource: URL | jose.JSONWebKeySet);
-    /**
-     * Validates a JWT access token and extracts authorization context.
-     *
-     * Checks performed (jose.jwtVerify):
-     * - Cryptographic signature verification (EdDSA or ES256)
-     * - Issuer claim matches configured issuer
-     * - Audience claim matches configured audience
-     * - Token is not expired (with clock tolerance for mesh skew)
-     * - Required claims (sub, scope) are present
-     *
-     * @throws JOSEError if validation fails (expired, wrong issuer, bad signature, etc.)
-     */
-    validate(token: string): Promise<AuthInfo>;
-    /**
-     * Builds a complete set of issuer URL aliases for the LIOP demo topology.
-     *
-     * The LIOP mesh runs on Docker Desktop with the following network layout:
-     *   Container hostnames: "nexus", "liop-nexus" (internal port 3000)
-     *   Host-published ports: 13000 (HTTP/MCP), 13001 (libp2p TCP)
-     *   Loopback addresses: 127.0.0.1, localhost
-     *
-     * The Nexus OAuth server may set its issuer to any of these depending on
-     * how it was configured, and nodes may resolve it via LIOP_NEXUS_URL
-     * which varies by context. This method generates all equivalent aliases
-     * so that jose.jwtVerify accepts the token regardless of which alias
-     * was used as `iss` in the JWT.
-     *
-     * Security note: This does NOT weaken validation — the cryptographic
-     * signature is still verified against the same JWKS keys. Only the
-     * string comparison of the `iss` claim is relaxed across known aliases.
-     */
-    private buildIssuerAliases;
-    /**
-     * Returns the configured issuer URL for PRM (RFC 9728) metadata.
-     */
-    getIssuer(): string;
-    /**
-     * Returns the configured audience for PRM metadata.
-     */
-    getAudience(): string;
-}
-
-/**
- * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.
- * Remove this file when MCP v1 (2025-11-25) reaches EOL.
- *
- * SUNSET INSTRUCTION: Delete this file, then grep for "@mcp-legacy" in the
- * codebase to find and remove all remaining legacy seams.
- */
-/**
- * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.
- * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.
- */
-declare const MCP_LEGACY_SUPPORT_ENABLED = true;
-/**
- * @mcp-legacy Legacy protocol version constant.
- */
-declare const MCP_PROTOCOL_VERSION_LEGACY: "2025-11-25";
-
-/**
- * Protocol Version Identifiers
- */
-declare const MCP_PROTOCOL_VERSION: "2026-07-28";
-
-/**
- * Protocol Era Classification
- */
-type McpEra = "legacy" | "modern";
-/**
- * Caching Hints for MCP 2026-07-28 Spec
- */
-interface CacheableResult {
-    ttlMs?: number;
-    cacheScope?: "public" | "private";
-}
-/**
- * Multi-Round-Trip Requests (MRTR) Specification Types
- */
-interface InputRequest {
-    id: string;
-    message: string;
-    schema?: Record<string, unknown>;
-}
-interface InputResponse {
-    id: string;
-    value: unknown;
-}
-interface InputRequiredResult {
-    resultType: "input_required";
-    inputRequests: InputRequest[];
-    requestState?: string;
-}
-/**
- * Modern Envelope Metadata (_meta)
- */
-interface McpRequestMeta {
-    "io.modelcontextprotocol/protocolVersion"?: string;
-    "io.modelcontextprotocol/clientInfo"?: {
-        name: string;
-        version: string;
-    };
-    "io.modelcontextprotocol/clientCapabilities"?: Record<string, unknown>;
-    [key: string]: unknown;
-}
-/**
- * Base Protocol Types representing parity with Model Context Protocol
- */
-declare const ToolSchema: z.ZodObject<{
-    name: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-}, z.core.$strip>;
-type Tool = z.infer<typeof ToolSchema>;
-declare const ResourceSchema: z.ZodObject<{
-    uri: z.ZodString;
-    name: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    mimeType: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-type Resource = z.infer<typeof ResourceSchema>;
-declare const PromptSchema: z.ZodObject<{
-    name: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    arguments: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        description: z.ZodOptional<z.ZodString>;
-        required: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$strip>>>;
-}, z.core.$strip>;
-type Prompt = z.infer<typeof PromptSchema>;
-interface CallToolRequest {
-    name: string;
-    arguments?: Record<string, unknown>;
-}
-interface CallToolResult {
-    content: Array<{
-        type: "text" | "image" | "resource";
-        text?: string;
-        data?: string;
-        mimeType?: string;
-        resource?: {
-            uri: string;
-            text?: string;
-            blob?: string;
-        };
-    }>;
-    isError?: boolean;
-}
-interface GetPromptRequest {
-    name: string;
-    arguments?: Record<string, string>;
-}
-interface GetPromptResult {
-    description?: string;
-    messages: Array<{
-        role: "user" | "assistant";
-        content: {
-            type: "text";
-            text: string;
-        } | {
-            type: "image";
-            data: string;
-            mimeType: string;
-        } | {
-            type: "resource";
-            resource: {
-                uri: string;
-                text?: string;
-                blob?: string;
-            };
-        };
-    }>;
-}
-interface ServerInfo {
-    name: string;
-    version: string;
-    capabilities?: {
-        prompts?: {
-            listChanged?: boolean;
-        };
-        resources?: {
-            subscribe?: boolean;
-            listChanged?: boolean;
-        };
-        tools?: {
-            listChanged?: boolean;
-        };
-        /** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */
-        logging?: Record<string, unknown>;
-    };
-}
-interface DiscoverResult {
-    resultType: "complete";
-    supportedVersions: string[];
-    capabilities: ServerInfo["capabilities"];
-    serverInfo: ServerInfo;
-    instructions?: string;
-}
-interface McpRequest {
-    method: string;
-    params?: unknown;
-    id?: string | number | null;
-    jsonrpc?: "2.0";
-}
-interface McpResponse {
-    jsonrpc: "2.0";
-    id?: string | number | null;
-    result?: unknown;
-    error?: {
-        code: number;
-        message: string;
-        data?: unknown;
-    };
-}
-
-export { type AuthInfo as A, type CallToolRequest as C, type DiscoverResult as D, type GetPromptRequest as G, type InputRequest as I, JwtValidator as J, type McpEra as M, type Prompt as P, type Resource as R, type ServerInfo as S, type Tool as T, type CallToolResult as a, type McpRequest as b, type McpResponse as c, type GetPromptResult as d, type CacheableResult as e, type InputRequiredResult as f, type InputResponse as g, MCP_LEGACY_SUPPORT_ENABLED as h, MCP_PROTOCOL_VERSION as i, MCP_PROTOCOL_VERSION_LEGACY as j, type McpRequestMeta as k, PromptSchema as l, ResourceSchema as m, ToolSchema as n };

package/dist/verifier-3FAKCFNN.js

@@ -1,5 +0,0 @@
-export { LiopVerifier } from './chunk-32ADSAJS.js';
-import './chunk-OUUTDSOW.js';
-import './chunk-72MNYFR6.js';
-//# sourceMappingURL=verifier-3FAKCFNN.js.map
-//# sourceMappingURL=verifier-3FAKCFNN.js.map