@nekzus/liop 2.5.0-beta.1 → 2.5.0-beta.3

package/dist/index.js

@@ -1,140 +1,4 @@
-export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-SONUORBT.js';
-export { LiopClient, LiopRpcClient } from './chunk-CRZBVFDV.js';
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-GA3Q2S7O.js';
-export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, isGrpcWebRequest } from './chunk-T5IUZF47.js';
-export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-WCCGE4QR.js';
-export { sanitizeOutput } from './chunk-JIJPZFR2.js';
-export { HeuristicTokenEstimator, LiopMcpRouter, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-547TYL27.js';
-import './chunk-32ADSAJS.js';
-import './chunk-OUUTDSOW.js';
-export { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
-export { Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, Gauge, Histogram, LIOP_SCOPES, MetricsRegistry, authorizeRequest, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, protocolMetrics, toolCallsTotal, zkVerificationDurationMs } from './chunk-U5BZ66VX.js';
-export { GRPC_CHANNEL_OPTIONS } from './chunk-WSW6YJNY.js';
-export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-PYKRQAER.js';
-export { MeshNode } from './chunk-74CISO2I.js';
-import { log } from './chunk-72MNYFR6.js';
-import * as crypto from 'crypto';
-import { EventEmitter } from 'events';
-import * as fs from 'fs';
-
-// src/errors.ts
-var ErrorCode = /* @__PURE__ */ ((ErrorCode2) => {
-  ErrorCode2["CapabilityViolation"] = "CapabilityViolation";
-  ErrorCode2["SandboxEscape"] = "SandboxEscape";
-  ErrorCode2["PiiLeak"] = "PiiLeak";
-  ErrorCode2["InvalidIntent"] = "InvalidIntent";
-  ErrorCode2["Throttled"] = "Throttled";
-  ErrorCode2["ZkVerificationFailed"] = "ZkVerificationFailed";
-  ErrorCode2["MeshUnavailable"] = "MeshUnavailable";
-  ErrorCode2["ConnectionFailed"] = "ConnectionFailed";
-  return ErrorCode2;
-})(ErrorCode || {});
-var LiopError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "LiopError";
-    this.code = code;
-  }
-};
-var TRACEPARENT_REGEX = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
-var LiopTracer = class _LiopTracer {
-  static generateTraceId() {
-    let id;
-    do {
-      id = crypto.randomBytes(16).toString("hex");
-    } while (id === "0".repeat(32));
-    return id;
-  }
-  static generateSpanId() {
-    let id;
-    do {
-      id = crypto.randomBytes(8).toString("hex");
-    } while (id === "0".repeat(16));
-    return id;
-  }
-  static formatTraceparent(traceId, spanId, sampled = true) {
-    const flags = sampled ? "01" : "00";
-    return `00-${traceId}-${spanId}-${flags}`;
-  }
-  static parseTraceparent(header) {
-    if (!header || typeof header !== "string") {
-      return null;
-    }
-    const trimmed = header.trim();
-    const match = TRACEPARENT_REGEX.exec(trimmed);
-    if (!match) {
-      return null;
-    }
-    const [, version, traceId, spanId, flags] = match;
-    if (version === "00") {
-      if (traceId === "0".repeat(32) || spanId === "0".repeat(16)) {
-        return null;
-      }
-    }
-    const sampled = (Number.parseInt(flags, 16) & 1) === 1;
-    return {
-      traceId,
-      spanId,
-      sampled
-    };
-  }
-  static injectTraceparent(carrier, context) {
-    carrier.traceparent = _LiopTracer.formatTraceparent(
-      context.traceId,
-      context.spanId,
-      context.sampled
-    );
-  }
-  static extractTraceparent(carrier) {
-    const val = carrier.traceparent || carrier.Traceparent;
-    if (Array.isArray(val)) {
-      return _LiopTracer.parseTraceparent(val[0]);
-    }
-    return _LiopTracer.parseTraceparent(val);
-  }
-  startSpan(name, parent, attributes = {}) {
-    const traceId = parent?.traceId || _LiopTracer.generateTraceId();
-    const spanId = _LiopTracer.generateSpanId();
-    const sampled = parent ? parent.sampled : true;
-    const context = {
-      traceId,
-      spanId,
-      sampled
-    };
-    const span = {
-      name,
-      context,
-      startTime: Date.now(),
-      attributes: { ...attributes },
-      status: "OK",
-      setAttribute(key, value) {
-        this.attributes[key] = value;
-        return this;
-      },
-      recordException(err) {
-        this.status = "ERROR";
-        this.error = typeof err === "string" ? err : err.message;
-        return this;
-      },
-      end() {
-        this.endTime = Date.now();
-      }
-    };
-    return span;
-  }
-};
-var defaultTracer = new LiopTracer();
-
-// src/prompts/adapters.ts
-var PROVIDER_CONFIGS = {
-  claude: { xmlStandard: true, jsonSchemaPreferred: false },
-  openai: { xmlStandard: false, jsonSchemaPreferred: true },
-  gemini: { xmlStandard: false, jsonSchemaPreferred: true }
-};
-function generateSystemInstructions(provider) {
-  const config = PROVIDER_CONFIGS[provider];
-  let instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]
+export{d as WasiSandbox,c as calculateAstInstructionFuel,b as getDefaultEnvironment}from'./chunk-CTTTLCGL.js';export{a as VERIFICATION_LATENCY_BUDGET_MS,f as deserializeGrothProof,d as deserializeVKey,e as serializeGrothProof,c as serializeVKey,b as verifyGroth16Proof}from'./chunk-FDJMH4CB.js';export{b as AesGcmWrapper,c as LiopClient,a as LiopRpcClient}from'./chunk-WP5ER7RH.js';export{b as LiopMcpBridge,a as LiopStreamBridge}from'./chunk-P6IJ3VBD.js';export{a as GRPC_WEB_CONSTANTS,i as InMemoryRateLimiter,j as LiopHybridGateway,g as buildProtectedResourceMetadata,e as decodeFrames,f as dispatchGrpcWebRequest,c as encodeDataFrame,d as encodeTrailerFrame,h as executeGatewayInterceptor,b as isGrpcWebRequest}from'./chunk-LEXMMIQI.js';export{a as RoutingTable,b as probeTopology}from'./chunk-2XHSALII.js';export{a as TokenManager}from'./chunk-N35BC62H.js';export{f as AUTH_DEFAULTS,d as AuditLogger,b as GENESIS_HASH,g as JwtValidator,a as LiopRpcServer,m as LiopServer,i as NerScanner,j as PII_PATTERNS,k as PII_PRESETS,l as PiiScanner,c as computeEntryHash,h as createOAuthServer,e as globalAuditLogger}from'./chunk-YD2AF2M6.js';export{a as sanitizeOutput}from'./chunk-MQ5SU26J.js';export{a as LiopMcpRouter}from'./chunk-LM26HOJ6.js';export{a as LiopVerifier}from'./chunk-6KFKO6ZX.js';import'./chunk-TKLRW52V.js';export{a as Kyber768Wrapper}from'./chunk-Y675R34Z.js';export{b as LIOP_SCOPES,a as authorizeRequest}from'./chunk-XLVEDKM6.js';export{a as DILITHIUM65_CONSTANTS,b as Dilithium65Wrapper}from'./chunk-2ZYX736J.js';export{j as GRPC_CHANNEL_OPTIONS,b as HeuristicTokenEstimator,e as LiopOTelBridge,a as RealTokenEstimator,f as TokenTelemetryEngine,i as createChannelCredentials,h as createServerCredentials,d as createSyncTokenEstimator,c as createTokenEstimator}from'./chunk-ECRS6N33.js';export{a as Counter,b as Gauge,c as Histogram,d as MetricsRegistry,k as egressBlocksTotal,h as fuelConsumed,j as manifestCacheSize,i as meshPeersConnected,t as operationDurationMs,u as pqcHandshakeDurationMs,v as pqcHandshakesTotal,e as protocolMetrics,q as tokensInputTotal,r as tokensOutputTotal,s as tokensSavedTotal,g as toolCallErrorsTotal,f as toolCallsTotal,w as wireEgressBytesTotal,x as wireSavedBytesTotal,n as zkProofsByTypeTotal,o as zkProvingDurationMs,l as zkVerificationDurationMs,m as zkVerificationsTotal,p as zkVkeyCacheSize}from'./chunk-ZZMSFCJP.js';export{a as MCP_LEGACY_SUPPORT_ENABLED,h as MCP_PROTOCOL_VERSION,b as MCP_PROTOCOL_VERSION_LEGACY,k as PromptSchema,j as ResourceSchema,i as ToolSchema}from'./chunk-GWVSCZUS.js';export{a as ProofType,b as RECEIPT_VERSION_V1,c as RECEIPT_VERSION_V2,d as ZK_JOURNAL_V2_SIZE,e as ZkVerificationError,i as ZkVerifier,g as decodeJournalV2,f as encodeJournalV2,h as receiptCodec}from'./chunk-6VK2XALI.js';export{a as SWARM_KEY_BYTE_LENGTH,b as createSwarmKey,d as deserializeSwarmKey,g as loadSwarmKey,e as parseSwarmKey,f as saveSwarmKey,c as serializeSwarmKey}from'./chunk-YLCNV764.js';export{a as MeshNode}from'./chunk-V35CXJQN.js';import {b}from'./chunk-3WRKTVOF.js';export{a as LiopLogger,b as log}from'./chunk-3WRKTVOF.js';import {a}from'./chunk-AYDF3IFZ.js';import*as h from'crypto';import {EventEmitter}from'events';import*as i from'fs';var A=(o=>(o.CapabilityViolation="CapabilityViolation",o.SandboxEscape="SandboxEscape",o.PiiLeak="PiiLeak",o.InvalidIntent="InvalidIntent",o.Throttled="Throttled",o.ZkVerificationFailed="ZkVerificationFailed",o.MeshUnavailable="MeshUnavailable",o.ConnectionFailed="ConnectionFailed",o))(A||{}),y=class extends Error{static{a(this,"LiopError");}code;constructor(t,e){super(e),this.name="LiopError",this.code=t;}};var D=/^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/,g=class n{static{a(this,"LiopTracer");}static generateTraceId(){let t;do t=h.randomBytes(16).toString("hex");while(t==="0".repeat(32));return t}static generateSpanId(){let t;do t=h.randomBytes(8).toString("hex");while(t==="0".repeat(16));return t}static formatTraceparent(t,e,r=true){return `00-${t}-${e}-${r?"01":"00"}`}static parseTraceparent(t){if(!t||typeof t!="string")return null;let e=t.trim(),r=D.exec(e);if(!r)return null;let[,a,c,l,m]=r;if(a==="00"&&(c==="0".repeat(32)||l==="0".repeat(16)))return null;let o=(Number.parseInt(m,16)&1)===1;return {traceId:c,spanId:l,sampled:o}}static injectTraceparent(t,e){t.traceparent=n.formatTraceparent(e.traceId,e.spanId,e.sampled);}static extractTraceparent(t){let e=t.traceparent||t.Traceparent;return Array.isArray(e)?n.parseTraceparent(e[0]):n.parseTraceparent(e)}startSpan(t,e,r={}){let a=e?.traceId||n.generateTraceId(),c=n.generateSpanId(),l=e?e.sampled:true;return {name:t,context:{traceId:a,spanId:c,sampled:l},startTime:Date.now(),attributes:{...r},status:"OK",setAttribute(d,T){return this.attributes[d]=T,this},recordException(d){return this.status="ERROR",this.error=typeof d=="string"?d:d.message,this},end(){this.endTime=Date.now();}}}},Mt=new g;var k={claude:{xmlStandard:true,jsonSchemaPreferred:false},openai:{xmlStandard:false,jsonSchemaPreferred:true},gemini:{xmlStandard:false,jsonSchemaPreferred:true}};function Bt(n){let t=k[n],e=`[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]
 You are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.
 Unlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.
 
@@ -159,9 +23,7 @@ To prevent database reconstruction and inference attacks, numeric query outputs
 - Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.
 - Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.
 - K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.
-`;
-  if (config.xmlStandard) {
-    instructions += `
+`;return t.xmlStandard?e+=`
 ### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)
 You must wrap your logic precisely within <liop_logic> tags.
 Example:
@@ -170,9 +32,7 @@ const records = await liop.readResource("liop://vault/patients");
 const filtered = records.filter(r => r.disease === "Hypertension");
 return { alert: "High risk demographic", targetCount: filtered.length };
 </liop_logic>
-`;
-  } else if (config.jsonSchemaPreferred) {
-    instructions += `
+`:t.jsonSchemaPreferred&&(e+=`
 ### PAYLOAD FORMATTING (JSON PARSING PREFERRED)
 You must provide your logic strictly within a JSON string key called \`"logic_blob"\` inside your tool call parameters.
 Example:
@@ -180,173 +40,5 @@ Example:
   "target": "liop://vault/patients",
   "logic_blob": "const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };"
 }
-`;
-  }
-  return instructions;
-}
-var CertManager = class extends EventEmitter {
-  constructor(options) {
-    super();
-    this.options = options;
-    this.warningDays = options.warningDays ?? 30;
-    this.debounceMs = options.debounceMs ?? 150;
-    this.loadCertificates();
-    if (options.watchFiles !== false) {
-      this.setupWatchers();
-    }
-  }
-  options;
-  rootCertBuffer = null;
-  certChainBuffer = null;
-  privateKeyBuffer = null;
-  watchers = [];
-  reloadDebounceTimer = null;
-  warningDays;
-  debounceMs;
-  /**
-   * Synchronously loads or reloads certificates from filesystem into memory.
-   */
-  loadCertificates() {
-    try {
-      if (this.options.rootCertPath && fs.existsSync(this.options.rootCertPath)) {
-        this.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);
-      }
-      if (!fs.existsSync(this.options.certChainPath)) {
-        throw new Error(
-          `Certificate chain file not found: ${this.options.certChainPath}`
-        );
-      }
-      if (!fs.existsSync(this.options.privateKeyPath)) {
-        throw new Error(
-          `Private key file not found: ${this.options.privateKeyPath}`
-        );
-      }
-      this.certChainBuffer = fs.readFileSync(this.options.certChainPath);
-      this.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);
-      log.info("[CertManager] Certificates loaded successfully.");
-    } catch (error) {
-      log.error(`[CertManager] Failed to load certificates: ${error}`);
-      throw error;
-    }
-  }
-  /**
-   * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.
-   */
-  inspectCertificate() {
-    if (!this.certChainBuffer) {
-      throw new Error("[CertManager] No certificate loaded to inspect.");
-    }
-    const x509 = new crypto.X509Certificate(this.certChainBuffer);
-    const validToDate = new Date(x509.validTo);
-    const now = /* @__PURE__ */ new Date();
-    const msRemaining = validToDate.getTime() - now.getTime();
-    const daysRemaining = Math.max(
-      0,
-      Math.floor(msRemaining / (1e3 * 60 * 60 * 24))
-    );
-    const isExpired = msRemaining <= 0;
-    const isExpiringSoon = daysRemaining <= this.warningDays;
-    return {
-      subject: x509.subject,
-      issuer: x509.issuer,
-      validFrom: x509.validFrom,
-      validTo: x509.validTo,
-      fingerprint256: x509.fingerprint256,
-      daysRemaining,
-      isExpired,
-      isExpiringSoon
-    };
-  }
-  /**
-   * Sets up non-blocking filesystem watchers to detect certificate renewals
-   * and trigger hot-reloading without process restarts.
-   */
-  setupWatchers() {
-    const filesToWatch = [
-      this.options.certChainPath,
-      this.options.privateKeyPath,
-      this.options.rootCertPath
-    ].filter((p) => Boolean(p && fs.existsSync(p)));
-    for (const filePath of filesToWatch) {
-      try {
-        const watcher = fs.watch(filePath, () => {
-          this.scheduleReload();
-        });
-        this.watchers.push(watcher);
-      } catch (err) {
-        log.warn(
-          `[CertManager] Could not watch ${filePath} for hot reloading: ${err}`
-        );
-      }
-    }
-  }
-  /**
-   * Debounces reload events to ensure files have finished writing.
-   */
-  scheduleReload() {
-    if (this.reloadDebounceTimer) {
-      clearTimeout(this.reloadDebounceTimer);
-    }
-    this.reloadDebounceTimer = setTimeout(() => {
-      try {
-        this.loadCertificates();
-        const certInfo = this.inspectCertificate();
-        log.info(
-          `[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`
-        );
-        this.emit("reload", certInfo);
-      } catch (error) {
-        log.error(`[CertManager] Hot reload failed: ${error}`);
-        this.emit("error", error);
-      }
-    }, this.debounceMs);
-  }
-  /**
-   * Manually triggers a reload of certificates and emits the 'reload' event.
-   */
-  reload() {
-    this.loadCertificates();
-    const certInfo = this.inspectCertificate();
-    log.info(
-      `[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`
-    );
-    this.emit("reload", certInfo);
-    return certInfo;
-  }
-  getRootCert() {
-    return this.rootCertBuffer;
-  }
-  getCertChain() {
-    if (!this.certChainBuffer) {
-      throw new Error("[CertManager] Certificate chain not loaded.");
-    }
-    return this.certChainBuffer;
-  }
-  getPrivateKey() {
-    if (!this.privateKeyBuffer) {
-      throw new Error("[CertManager] Private key not loaded.");
-    }
-    return this.privateKeyBuffer;
-  }
-  /**
-   * Stops all active file watchers and releases resources.
-   */
-  dispose() {
-    if (this.reloadDebounceTimer) {
-      clearTimeout(this.reloadDebounceTimer);
-      this.reloadDebounceTimer = null;
-    }
-    for (const watcher of this.watchers) {
-      try {
-        watcher.close();
-      } catch {
-      }
-    }
-    this.watchers = [];
-    this.removeAllListeners();
-  }
-};
-
-export { CertManager, ErrorCode, LiopError, LiopTracer, defaultTracer, generateSystemInstructions };
-//# sourceMappingURL=index.js.map
+`),e}a(Bt,"generateSystemInstructions");var x=class extends EventEmitter{constructor(e){super();this.options=e;this.warningDays=e.warningDays??30,this.debounceMs=e.debounceMs??150,this.loadCertificates(),e.watchFiles!==false&&this.setupWatchers();}options;static{a(this,"CertManager");}rootCertBuffer=null;certChainBuffer=null;privateKeyBuffer=null;watchers=[];reloadDebounceTimer=null;warningDays;debounceMs;loadCertificates(){try{if(this.options.rootCertPath&&i.existsSync(this.options.rootCertPath)&&(this.rootCertBuffer=i.readFileSync(this.options.rootCertPath)),!i.existsSync(this.options.certChainPath))throw new Error(`Certificate chain file not found: ${this.options.certChainPath}`);if(!i.existsSync(this.options.privateKeyPath))throw new Error(`Private key file not found: ${this.options.privateKeyPath}`);this.certChainBuffer=i.readFileSync(this.options.certChainPath),this.privateKeyBuffer=i.readFileSync(this.options.privateKeyPath),b.info("[CertManager] Certificates loaded successfully.");}catch(e){throw b.error(`[CertManager] Failed to load certificates: ${e}`),e}}inspectCertificate(){if(!this.certChainBuffer)throw new Error("[CertManager] No certificate loaded to inspect.");let e=new h.X509Certificate(this.certChainBuffer),r=new Date(e.validTo),a=new Date,c=r.getTime()-a.getTime(),l=Math.max(0,Math.floor(c/(1e3*60*60*24))),m=c<=0,o=l<=this.warningDays;return {subject:e.subject,issuer:e.issuer,validFrom:e.validFrom,validTo:e.validTo,fingerprint256:e.fingerprint256,daysRemaining:l,isExpired:m,isExpiringSoon:o}}setupWatchers(){let e=[this.options.certChainPath,this.options.privateKeyPath,this.options.rootCertPath].filter(r=>!!(r&&i.existsSync(r)));for(let r of e)try{let a=i.watch(r,()=>{this.scheduleReload();});this.watchers.push(a);}catch(a){b.warn(`[CertManager] Could not watch ${r} for hot reloading: ${a}`);}}scheduleReload(){this.reloadDebounceTimer&&clearTimeout(this.reloadDebounceTimer),this.reloadDebounceTimer=setTimeout(()=>{try{this.loadCertificates();let e=this.inspectCertificate();b.info(`[CertManager] Hot reload complete. Certificate expires in ${e.daysRemaining} days.`),this.emit("reload",e);}catch(e){b.error(`[CertManager] Hot reload failed: ${e}`),this.emit("error",e);}},this.debounceMs);}reload(){this.loadCertificates();let e=this.inspectCertificate();return b.info(`[CertManager] Hot reload complete. Certificate expires in ${e.daysRemaining} days.`),this.emit("reload",e),e}getRootCert(){return this.rootCertBuffer}getCertChain(){if(!this.certChainBuffer)throw new Error("[CertManager] Certificate chain not loaded.");return this.certChainBuffer}getPrivateKey(){if(!this.privateKeyBuffer)throw new Error("[CertManager] Private key not loaded.");return this.privateKeyBuffer}dispose(){this.reloadDebounceTimer&&(clearTimeout(this.reloadDebounceTimer),this.reloadDebounceTimer=null);for(let e of this.watchers)try{e.close();}catch{}this.watchers=[],this.removeAllListeners();}};export{x as CertManager,A as ErrorCode,y as LiopError,g as LiopTracer,Mt as defaultTracer,Bt as generateSystemInstructions};//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/kyber-PULV7PQX.js

@@ -0,0 +1,2 @@
+export{a as Kyber768Wrapper}from'./chunk-Y675R34Z.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=kyber-PULV7PQX.js.map
+//# sourceMappingURL=kyber-PULV7PQX.js.map

package/dist/mesh.d.ts

@@ -1,148 +1,32 @@
+export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-Djzm6UYd.js';
+
+declare const SWARM_KEY_BYTE_LENGTH = 95;
+/**
+ * Creates a freshly generated 95-byte Pre-Shared Key (PSK) for libp2p Private Networks (pnet).
+ * Follows the canonical format `/key/swarm/psk/1.0.0/\n/base16/\n<hex>\n`.
+ */
+declare function createSwarmKey(): Uint8Array;
+/**
+ * Serializes a 95-byte PSK into a Base64 string for safe environment variable passing or JSON config.
+ */
+declare function serializeSwarmKey(psk: Uint8Array): string;
+/**
+ * Deserializes a Base64-encoded string into a 95-byte PSK Uint8Array.
+ */
+declare function deserializeSwarmKey(base64Str: string): Uint8Array;
+/**
+ * Parses raw text format PSK or Base64 string into a 95-byte PSK Uint8Array.
+ * Allows loading either the canonical multiline text (`/key/swarm/psk/1.0.0/...`) or Base64.
+ */
+declare function parseSwarmKey(rawText: string): Uint8Array;
 /**
- * Manifest describing a node's capabilities in the LIOP Mesh.
- * Exchanged via the /liop/manifest/1.0.0 protocol stream.
+ * Saves a 95-byte Swarm Key to a file on disk (written as canonical text).
  */
-interface LiopManifest {
-    peerId: string;
-    grpcPort: number;
-    tools: Array<{
-        name: string;
-        description?: string;
-        inputSchema?: Record<string, unknown>;
-    }>;
-    resources: Array<{
-        name: string;
-        uri: string;
-        description?: string;
-        mimeType?: string;
-        text?: string;
-    }>;
-    serverInfo: {
-        name: string;
-        version: string;
-    };
-    taxonomy?: {
-        domain: string;
-        clearanceTier: number;
-        executionTypes: string[];
-    };
-    authRequired?: boolean;
-    /** Canonical slug for deterministic token resolution. Agents resolve LIOP_TOKEN_<tokenSlug>. Must match /^[A-Z][A-Z0-9_]*$/. */
-    tokenSlug?: string;
-    /** ML-DSA-65 (FIPS 204) Post-Quantum Digital Signature for Manifest Attestation (Base64) */
-    pqcSignature?: string;
-    /** ML-DSA-65 (FIPS 204) Post-Quantum Public Key (Base64) */
-    pqcPublicKey?: string;
-}
-interface MeshNodeConfig {
-    listenAddresses?: string[];
-    bootstrapNodes?: string[];
-    identityPath?: string;
-    enableWAN?: boolean;
-    dhtStoragePath?: string;
-    /** Optional function to translate multiaddrs (e.g. for Docker NAT traversal). Return null to drop an address. */
-    addressMapper?: (addr: string) => string | null;
-    /** Enable AutoNAT reachability detection (default: true) */
-    enableAutoNAT?: boolean;
-    /** Enable Circuit Relay v2 transport & server for NAT traversal (default: true) */
-    enableRelay?: boolean;
-    /** Enable DCUtR decentralized hole punching (default: true) */
-    enableDcutr?: boolean;
-    /** Enable mDNS peer discovery for local networks (default: false in WAN, true in LAN) */
-    enableMdns?: boolean;
-}
+declare function saveSwarmKey(psk: Uint8Array, filePath: string): Promise<void>;
 /**
- * P2P Mesh Node backed by libp2p + Kademlia DHT.
- *
- * Provides capability advertisement via CID-based content routing
- * and decentralized peer discovery.
+ * Loads a 95-byte Swarm Key from a file on disk.
+ * Supports both raw binary/canonical format and Base64-encoded text.
  */
-declare class MeshNode {
-    private node;
-    private config;
-    private manifestDialFailureState;
-    private static readonly MANIFEST_DIAL_BASE_COOLDOWN_MS;
-    private static readonly MANIFEST_DIAL_MAX_COOLDOWN_MS;
-    private static readonly MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS;
-    /**
-     * Buffer of capability hashes that have been announced.
-     * Used to re-announce capabilities when new peers connect
-     * (critical for small / isolated clusters where the initial
-     * provide() finds zero peers in the routing table).
-     */
-    private announcedCapabilities;
-    /** Guards against concurrent re-announcement storms. */
-    private reannouncing;
-    /** Callback that returns the local node's manifest on request. */
-    private manifestProvider;
-    /** Flag to ensure the manifest protocol is only registered once. */
-    private manifestProtocolRegistered;
-    /** Local Ed25519 Private Key for protocol signatures */
-    private localPrivateKey;
-    constructor(config?: MeshNodeConfig);
-    private shouldSkipManifestDial;
-    private recordManifestDialFailure;
-    private clearManifestDialFailure;
-    /**
-     * Loads a persistent identity from disk or generates a new Ed25519 keypair.
-     * Uses privateKeyToProtobuf/privateKeyFromProtobuf (libp2p v3.x official API).
-     */
-    private loadOrCreateIdentity;
-    /**
-     * Persists the private key to disk using protobuf serialization (libp2p v3.x).
-     */
-    private saveIdentity;
-    /**
-     * Creates a CID v1 (raw codec 0x55) from a SHA-256 hash of the capability string.
-     * Required by @libp2p/kad-dht v16+ for provide/findProviders.
-     */
-    private capabilityToCID;
-    /**
-     * Re-announces all buffered capabilities after a new peer connects.
-     * Uses a small delay to allow the DHT protocol handshake to complete.
-     */
-    private reannounceAll;
-    start(): Promise<void>;
-    stop(): Promise<void>;
-    private loadRoutingTable;
-    private saveRoutingTable;
-    /**
-     * Internal logic to register protocol handlers against the libp2p node.
-     * Can be called multiple times; handles idempotent registration.
-     */
-    private applyHandlers;
-    /**
-     * Registers a callback as the manifest provider.
-     * Will be applied immediately if the node is already initialized.
-     */
-    registerManifestHandler(provider: () => LiopManifest): void;
-    /**
-     * Queries a remote peer's manifest by opening a /liop/manifest/1.0.0 stream.
-     * Returns null if the peer doesn't support the protocol or is unreachable.
-     */
-    queryManifest(peerIdStr: string): Promise<LiopManifest | null>;
-    /**
-     * Discovers all peers in the DHT that have announced "liop:manifest".
-     * Returns their PeerIDs for subsequent manifest queries.
-     */
-    discoverManifestProviders(): Promise<string[]>;
-    /**
-     * Announces this node as a manifest provider in the DHT.
-     * Should be called after tools/resources have been registered.
-     */
-    announceManifest(): Promise<void>;
-    /**
-     * Returns the current size of the routing table for diagnostic purposes.
-     */
-    getRoutingTableSize(): number;
-    getPeerId(): string;
-    sign(data: Uint8Array): Promise<Uint8Array>;
-    getMultiaddrs(): string[];
-    announceCapability(hash: string): Promise<void>;
-    findProviders(hash: string): Promise<string[]>;
-    resolvePeer(peerIdStr: string): Promise<string[]>;
-    isStarted(): boolean;
-    getPeers(): string[];
-}
+declare function loadSwarmKey(filePath: string): Promise<Uint8Array>;
 
-export { type LiopManifest, MeshNode, type MeshNodeConfig };
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey };

package/dist/mesh.js

@@ -1,5 +1,2 @@
-import './chunk-RWRRBYG4.js';
-export { MeshNode } from './chunk-74CISO2I.js';
-import './chunk-72MNYFR6.js';
-//# sourceMappingURL=mesh.js.map
+import'./chunk-FTF6AMF6.js';export{a as SWARM_KEY_BYTE_LENGTH,b as createSwarmKey,d as deserializeSwarmKey,g as loadSwarmKey,e as parseSwarmKey,f as saveSwarmKey,c as serializeSwarmKey}from'./chunk-YLCNV764.js';export{a as MeshNode}from'./chunk-V35CXJQN.js';import'./chunk-3WRKTVOF.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=mesh.js.map
 //# sourceMappingURL=mesh.js.map