@nekzus/liop 2.5.0-beta.1 → 2.5.0-beta.3

package/dist/node-Djzm6UYd.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Manifest describing a node's capabilities in the LIOP Mesh.
+ * Exchanged via the /liop/manifest/1.0.0 protocol stream.
+ */
+interface LiopManifest {
+    peerId: string;
+    grpcPort: number;
+    tools: Array<{
+        name: string;
+        description?: string;
+        inputSchema?: Record<string, unknown>;
+        zkMode?: "none" | "optimistic" | "required";
+        guestImageId?: string;
+        circuitName?: string;
+        vkey?: Record<string, unknown>;
+    }>;
+    resources: Array<{
+        name: string;
+        uri: string;
+        description?: string;
+        mimeType?: string;
+        text?: string;
+    }>;
+    serverInfo: {
+        name: string;
+        version: string;
+    };
+    taxonomy?: {
+        domain: string;
+        clearanceTier: number;
+        executionTypes: string[];
+    };
+    authRequired?: boolean;
+    /** Canonical slug for deterministic token resolution. Agents resolve LIOP_TOKEN_<tokenSlug>. Must match /^[A-Z][A-Z0-9_]*$/. */
+    tokenSlug?: string;
+    /** Expected guest image identifier hash for sovereign enclaves (Hex) */
+    guestImageId?: string;
+    /** Static verification key mappings for fast-path analytical circuits */
+    vkeys?: Record<string, unknown>;
+    /** ML-DSA-65 (FIPS 204) Post-Quantum Digital Signature for Manifest Attestation (Base64) */
+    pqcSignature?: string;
+    /** ML-DSA-65 (FIPS 204) Post-Quantum Public Key (Base64) */
+    pqcPublicKey?: string;
+}
+interface MeshNodeConfig {
+    listenAddresses?: string[];
+    bootstrapNodes?: string[];
+    identityPath?: string;
+    enableWAN?: boolean;
+    dhtStoragePath?: string;
+    /** Optional function to translate multiaddrs (e.g. for Docker NAT traversal). Return null to drop an address. */
+    addressMapper?: (addr: string) => string | null;
+    /** Enable AutoNAT reachability detection (default: true) */
+    enableAutoNAT?: boolean;
+    /** Enable Circuit Relay v2 transport & server for NAT traversal (default: true) */
+    enableRelay?: boolean;
+    /** Enable DCUtR decentralized hole punching (default: true) */
+    enableDcutr?: boolean;
+    /** Enable mDNS peer discovery for local networks (default: false in WAN, true in LAN) */
+    enableMdns?: boolean;
+    /**
+     * Pre-Shared Key for libp2p Private Network isolation (Tier 1 Enclave Hardening).
+     * When provided, the node will reject ALL connections from peers that do not
+     * possess the identical 95-byte PSK at the transport framing layer,
+     * BEFORE the Noise XX handshake is attempted.
+     * @see https://github.com/libp2p/specs/blob/master/pnet/Private-Networks-PSK-V1.md
+     */
+    swarmKey?: Uint8Array;
+}
+/**
+ * P2P Mesh Node backed by libp2p + Kademlia DHT.
+ *
+ * Provides capability advertisement via CID-based content routing
+ * and decentralized peer discovery.
+ */
+declare class MeshNode {
+    private node;
+    private config;
+    private manifestDialFailureState;
+    private static readonly MANIFEST_DIAL_BASE_COOLDOWN_MS;
+    private static readonly MANIFEST_DIAL_MAX_COOLDOWN_MS;
+    private static readonly MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS;
+    /**
+     * Buffer of capability hashes that have been announced.
+     * Used to re-announce capabilities when new peers connect
+     * (critical for small / isolated clusters where the initial
+     * provide() finds zero peers in the routing table).
+     */
+    private announcedCapabilities;
+    /** Guards against concurrent re-announcement storms. */
+    private reannouncing;
+    /** Callback that returns the local node's manifest on request. */
+    private manifestProvider;
+    /** Flag to ensure the manifest protocol is only registered once. */
+    private manifestProtocolRegistered;
+    /** Local Ed25519 Private Key for protocol signatures */
+    private localPrivateKey;
+    constructor(config?: MeshNodeConfig);
+    private shouldSkipManifestDial;
+    private recordManifestDialFailure;
+    private clearManifestDialFailure;
+    /**
+     * Loads a persistent identity from disk or generates a new Ed25519 keypair.
+     * Uses privateKeyToProtobuf/privateKeyFromProtobuf (libp2p v3.x official API).
+     */
+    private loadOrCreateIdentity;
+    /**
+     * Persists the private key to disk using protobuf serialization (libp2p v3.x).
+     */
+    private saveIdentity;
+    /**
+     * Creates a CID v1 (raw codec 0x55) from a SHA-256 hash of the capability string.
+     * Required by @libp2p/kad-dht v16+ for provide/findProviders.
+     */
+    private capabilityToCID;
+    /**
+     * Re-announces all buffered capabilities after a new peer connects.
+     * Uses a small delay to allow the DHT protocol handshake to complete.
+     */
+    private reannounceAll;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private loadRoutingTable;
+    private saveRoutingTable;
+    /**
+     * Internal logic to register protocol handlers against the libp2p node.
+     * Can be called multiple times; handles idempotent registration.
+     */
+    private applyHandlers;
+    /**
+     * Registers a callback as the manifest provider.
+     * Will be applied immediately if the node is already initialized.
+     */
+    registerManifestHandler(provider: () => LiopManifest): void;
+    /**
+     * Queries a remote peer's manifest by opening a /liop/manifest/1.0.0 stream.
+     * Returns null if the peer doesn't support the protocol or is unreachable.
+     */
+    queryManifest(peerIdStr: string): Promise<LiopManifest | null>;
+    /**
+     * Discovers all peers in the DHT that have announced "liop:manifest".
+     * Returns their PeerIDs for subsequent manifest queries.
+     */
+    discoverManifestProviders(): Promise<string[]>;
+    /**
+     * Announces this node as a manifest provider in the DHT.
+     * Should be called after tools/resources have been registered.
+     */
+    announceManifest(): Promise<void>;
+    /**
+     * Returns the current size of the routing table for diagnostic purposes.
+     */
+    getRoutingTableSize(): number;
+    getPeerId(): string;
+    sign(data: Uint8Array): Promise<Uint8Array>;
+    getMultiaddrs(): string[];
+    announceCapability(hash: string): Promise<void>;
+    findProviders(hash: string): Promise<string[]>;
+    resolvePeer(peerIdStr: string): Promise<string[]>;
+    isStarted(): boolean;
+    getPeers(): string[];
+    /**
+     * Returns true if this MeshNode was booted inside an isolated libp2p private network (pnet PSK).
+     */
+    isPrivateNetwork(): boolean;
+    /**
+     * Returns the configured 95-byte Swarm Key, or undefined if running in a public/consortium mesh.
+     */
+    getSwarmKey(): Uint8Array | undefined;
+}
+
+export { type LiopManifest as L, type MeshNodeConfig as M, MeshNode as a };

package/dist/protocol/liop_core.proto

@@ -1,3 +1,6 @@
+// Copyright 2026 Nekzus Solutions and contributors
+// SPDX-License-Identifier: Apache-2.0
+
 syntax = "proto3";
 package liop.v1;
 
@@ -11,6 +14,19 @@ service LogicMesh {
   rpc ExecuteLogic (LogicRequest) returns (stream LogicResponse);
 }
 
+// Verification and proving policy requested by the caller
+enum ProofMode {
+  PROOF_MODE_LEGACY_HMAC = 0;
+  PROOF_MODE_ZK_OPTIMISTIC = 1;
+  PROOF_MODE_ZK_BLOCKING = 2;
+}
+
+// Cryptographic proof format attached to computation receipts
+enum ProofType {
+  PROOF_TYPE_HMAC_LEGACY = 0;
+  PROOF_TYPE_GROTH16 = 2;
+}
+
 // Request to negotiate an intent to execute a WASM capability
 message IntentRequest {
   string agent_did = 1;         // Decentralized Identifier (DID) e.g., spiffe:// or Noise PeerID
@@ -28,17 +44,20 @@ message IntentResponse {
 
 // Request to push a WASM module down to the origin for execution
 message LogicRequest {
-  string session_token = 1;      // Token acquired from NegotiateIntent
-  bytes wasm_binary = 2;         // AES-GCM Encrypted .wasm Logic-on-Origin filter code
-  map<string, bytes> inputs = 3; // AES-GCM Encrypted input parameters
-  bytes pqc_ciphertext = 4;      // Kyber (ML-KEM-768) Ciphertext encapsulating the AES shared secret
-  bytes aes_nonce = 5;           // 12-byte nonce for AES-GCM
+  string session_token = 1;             // Token acquired from NegotiateIntent
+  bytes wasm_binary = 2;                // AES-GCM Encrypted .wasm Logic-on-Origin filter code
+  map<string, bytes> inputs = 3;        // AES-GCM Encrypted input parameters
+  bytes pqc_ciphertext = 4;             // Kyber (ML-KEM-768) Ciphertext encapsulating the AES shared secret
+  bytes aes_nonce = 5;                  // 12-byte nonce for AES-GCM
+  ProofMode requested_proof_mode = 6;   // Proving policy requested by caller
 }
 
 // Streamed Response back to the LLM agent containing reduced, semantically rich semantic responses
 message LogicResponse {
   string semantic_evidence = 1;  // Condensed semantic result for the LLM
   bytes cryptographic_proof = 2; // Integrity signature (SHA256)
-  bytes zk_receipt = 3;          // Zero-Knowledge Proof Receipt (e.g. risc0 zkVM) for Computational Integrity
+  bytes zk_receipt = 3;          // Zero-Knowledge Proof Receipt for Computational Integrity
   bool is_error = 4;             // Execution status
+  ProofType proof_type = 5;      // Format of the zero-knowledge computational proof
+  bytes guest_image_id = 6;      // Guest image identifier (32 bytes SHA-256)
 }

package/dist/server.d.ts

@@ -1,5 +1,6 @@
-export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, i as LogicExecutionPolicy, N as NerScanner, j as OutputSanitizerConfig, P as PII_PATTERNS, k as PII_PRESETS, l as PiiRule, m as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-BW95kAL4.js';
+export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-ByzjpRCk.js';
 import 'zod';
-import './mesh.js';
-import './types-lJIxBlWF.js';
+import './node-Djzm6UYd.js';
+import './types-29zv9X1V.js';
+import './zk-DzYNWBgo.js';
 import 'jose';

package/dist/server.js

@@ -1,8 +1,2 @@
-export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner } from './chunk-WCCGE4QR.js';
-export { sanitizeOutput } from './chunk-JIJPZFR2.js';
-import './chunk-U5BZ66VX.js';
-import './chunk-WSW6YJNY.js';
-import './chunk-74CISO2I.js';
-import './chunk-72MNYFR6.js';
-//# sourceMappingURL=server.js.map
+export{m as LiopServer,i as NerScanner,j as PII_PATTERNS,k as PII_PRESETS,l as PiiScanner}from'./chunk-YD2AF2M6.js';export{a as sanitizeOutput}from'./chunk-MQ5SU26J.js';import'./chunk-XLVEDKM6.js';import'./chunk-2ZYX736J.js';import'./chunk-ECRS6N33.js';import'./chunk-ZZMSFCJP.js';import'./chunk-6VK2XALI.js';import'./chunk-V35CXJQN.js';import'./chunk-3WRKTVOF.js';import'./chunk-AYDF3IFZ.js';//# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map