@nekzus/liop 2.5.0 → 2.6.1

package/dist/mesh.d.ts

@@ -1,148 +1,32 @@
+export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-B0b2vUFS.js';
+
+declare const SWARM_KEY_BYTE_LENGTH = 95;
+/**
+ * Creates a freshly generated 95-byte Pre-Shared Key (PSK) for libp2p Private Networks (pnet).
+ * Follows the canonical format `/key/swarm/psk/1.0.0/\n/base16/\n<hex>\n`.
+ */
+declare function createSwarmKey(): Uint8Array;
+/**
+ * Serializes a 95-byte PSK into a Base64 string for safe environment variable passing or JSON config.
+ */
+declare function serializeSwarmKey(psk: Uint8Array): string;
+/**
+ * Deserializes a Base64-encoded string into a 95-byte PSK Uint8Array.
+ */
+declare function deserializeSwarmKey(base64Str: string): Uint8Array;
+/**
+ * Parses raw text format PSK or Base64 string into a 95-byte PSK Uint8Array.
+ * Allows loading either the canonical multiline text (`/key/swarm/psk/1.0.0/...`) or Base64.
+ */
+declare function parseSwarmKey(rawText: string): Uint8Array;
 /**
- * Manifest describing a node's capabilities in the LIOP Mesh.
- * Exchanged via the /liop/manifest/1.0.0 protocol stream.
+ * Saves a 95-byte Swarm Key to a file on disk (written as canonical text).
  */
-interface LiopManifest {
-    peerId: string;
-    grpcPort: number;
-    tools: Array<{
-        name: string;
-        description?: string;
-        inputSchema?: Record<string, unknown>;
-    }>;
-    resources: Array<{
-        name: string;
-        uri: string;
-        description?: string;
-        mimeType?: string;
-        text?: string;
-    }>;
-    serverInfo: {
-        name: string;
-        version: string;
-    };
-    taxonomy?: {
-        domain: string;
-        clearanceTier: number;
-        executionTypes: string[];
-    };
-    authRequired?: boolean;
-    /** Canonical slug for deterministic token resolution. Agents resolve LIOP_TOKEN_<tokenSlug>. Must match /^[A-Z][A-Z0-9_]*$/. */
-    tokenSlug?: string;
-    /** ML-DSA-65 (FIPS 204) Post-Quantum Digital Signature for Manifest Attestation (Base64) */
-    pqcSignature?: string;
-    /** ML-DSA-65 (FIPS 204) Post-Quantum Public Key (Base64) */
-    pqcPublicKey?: string;
-}
-interface MeshNodeConfig {
-    listenAddresses?: string[];
-    bootstrapNodes?: string[];
-    identityPath?: string;
-    enableWAN?: boolean;
-    dhtStoragePath?: string;
-    /** Optional function to translate multiaddrs (e.g. for Docker NAT traversal). Return null to drop an address. */
-    addressMapper?: (addr: string) => string | null;
-    /** Enable AutoNAT reachability detection (default: true) */
-    enableAutoNAT?: boolean;
-    /** Enable Circuit Relay v2 transport & server for NAT traversal (default: true) */
-    enableRelay?: boolean;
-    /** Enable DCUtR decentralized hole punching (default: true) */
-    enableDcutr?: boolean;
-    /** Enable mDNS peer discovery for local networks (default: false in WAN, true in LAN) */
-    enableMdns?: boolean;
-}
+declare function saveSwarmKey(psk: Uint8Array, filePath: string): Promise<void>;
 /**
- * P2P Mesh Node backed by libp2p + Kademlia DHT.
- *
- * Provides capability advertisement via CID-based content routing
- * and decentralized peer discovery.
+ * Loads a 95-byte Swarm Key from a file on disk.
+ * Supports both raw binary/canonical format and Base64-encoded text.
  */
-declare class MeshNode {
-    private node;
-    private config;
-    private manifestDialFailureState;
-    private static readonly MANIFEST_DIAL_BASE_COOLDOWN_MS;
-    private static readonly MANIFEST_DIAL_MAX_COOLDOWN_MS;
-    private static readonly MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS;
-    /**
-     * Buffer of capability hashes that have been announced.
-     * Used to re-announce capabilities when new peers connect
-     * (critical for small / isolated clusters where the initial
-     * provide() finds zero peers in the routing table).
-     */
-    private announcedCapabilities;
-    /** Guards against concurrent re-announcement storms. */
-    private reannouncing;
-    /** Callback that returns the local node's manifest on request. */
-    private manifestProvider;
-    /** Flag to ensure the manifest protocol is only registered once. */
-    private manifestProtocolRegistered;
-    /** Local Ed25519 Private Key for protocol signatures */
-    private localPrivateKey;
-    constructor(config?: MeshNodeConfig);
-    private shouldSkipManifestDial;
-    private recordManifestDialFailure;
-    private clearManifestDialFailure;
-    /**
-     * Loads a persistent identity from disk or generates a new Ed25519 keypair.
-     * Uses privateKeyToProtobuf/privateKeyFromProtobuf (libp2p v3.x official API).
-     */
-    private loadOrCreateIdentity;
-    /**
-     * Persists the private key to disk using protobuf serialization (libp2p v3.x).
-     */
-    private saveIdentity;
-    /**
-     * Creates a CID v1 (raw codec 0x55) from a SHA-256 hash of the capability string.
-     * Required by @libp2p/kad-dht v16+ for provide/findProviders.
-     */
-    private capabilityToCID;
-    /**
-     * Re-announces all buffered capabilities after a new peer connects.
-     * Uses a small delay to allow the DHT protocol handshake to complete.
-     */
-    private reannounceAll;
-    start(): Promise<void>;
-    stop(): Promise<void>;
-    private loadRoutingTable;
-    private saveRoutingTable;
-    /**
-     * Internal logic to register protocol handlers against the libp2p node.
-     * Can be called multiple times; handles idempotent registration.
-     */
-    private applyHandlers;
-    /**
-     * Registers a callback as the manifest provider.
-     * Will be applied immediately if the node is already initialized.
-     */
-    registerManifestHandler(provider: () => LiopManifest): void;
-    /**
-     * Queries a remote peer's manifest by opening a /liop/manifest/1.0.0 stream.
-     * Returns null if the peer doesn't support the protocol or is unreachable.
-     */
-    queryManifest(peerIdStr: string): Promise<LiopManifest | null>;
-    /**
-     * Discovers all peers in the DHT that have announced "liop:manifest".
-     * Returns their PeerIDs for subsequent manifest queries.
-     */
-    discoverManifestProviders(): Promise<string[]>;
-    /**
-     * Announces this node as a manifest provider in the DHT.
-     * Should be called after tools/resources have been registered.
-     */
-    announceManifest(): Promise<void>;
-    /**
-     * Returns the current size of the routing table for diagnostic purposes.
-     */
-    getRoutingTableSize(): number;
-    getPeerId(): string;
-    sign(data: Uint8Array): Promise<Uint8Array>;
-    getMultiaddrs(): string[];
-    announceCapability(hash: string): Promise<void>;
-    findProviders(hash: string): Promise<string[]>;
-    resolvePeer(peerIdStr: string): Promise<string[]>;
-    isStarted(): boolean;
-    getPeers(): string[];
-}
+declare function loadSwarmKey(filePath: string): Promise<Uint8Array>;
 
-export { type LiopManifest, MeshNode, type MeshNodeConfig };
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey };

package/dist/mesh.js

@@ -1,5 +1,6 @@
-import './chunk-RWRRBYG4.js';
-export { MeshNode } from './chunk-74CISO2I.js';
-import './chunk-72MNYFR6.js';
+import './chunk-FTF6AMF6.js';
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
+export { MeshNode } from './chunk-XRDN232O.js';
+import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=mesh.js.map
 //# sourceMappingURL=mesh.js.map

package/dist/node-B0b2vUFS.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Manifest describing a node's capabilities in the LIOP Mesh.
+ * Exchanged via the /liop/manifest/1.0.0 protocol stream.
+ */
+interface LiopManifest {
+    peerId: string;
+    grpcPort: number;
+    tools: Array<{
+        name: string;
+        description?: string;
+        inputSchema?: Record<string, unknown>;
+    }>;
+    resources: Array<{
+        name: string;
+        uri: string;
+        description?: string;
+        mimeType?: string;
+        text?: string;
+    }>;
+    serverInfo: {
+        name: string;
+        version: string;
+    };
+    taxonomy?: {
+        domain: string;
+        clearanceTier: number;
+        executionTypes: string[];
+    };
+    authRequired?: boolean;
+    /** Canonical slug for deterministic token resolution. Agents resolve LIOP_TOKEN_<tokenSlug>. Must match /^[A-Z][A-Z0-9_]*$/. */
+    tokenSlug?: string;
+    /** ML-DSA-65 (FIPS 204) Post-Quantum Digital Signature for Manifest Attestation (Base64) */
+    pqcSignature?: string;
+    /** ML-DSA-65 (FIPS 204) Post-Quantum Public Key (Base64) */
+    pqcPublicKey?: string;
+}
+interface MeshNodeConfig {
+    listenAddresses?: string[];
+    bootstrapNodes?: string[];
+    identityPath?: string;
+    enableWAN?: boolean;
+    dhtStoragePath?: string;
+    /** Optional function to translate multiaddrs (e.g. for Docker NAT traversal). Return null to drop an address. */
+    addressMapper?: (addr: string) => string | null;
+    /** Enable AutoNAT reachability detection (default: true) */
+    enableAutoNAT?: boolean;
+    /** Enable Circuit Relay v2 transport & server for NAT traversal (default: true) */
+    enableRelay?: boolean;
+    /** Enable DCUtR decentralized hole punching (default: true) */
+    enableDcutr?: boolean;
+    /** Enable mDNS peer discovery for local networks (default: false in WAN, true in LAN) */
+    enableMdns?: boolean;
+    /**
+     * Pre-Shared Key for libp2p Private Network isolation (Tier 1 Enclave Hardening).
+     * When provided, the node will reject ALL connections from peers that do not
+     * possess the identical 95-byte PSK at the transport framing layer,
+     * BEFORE the Noise XX handshake is attempted.
+     * @see https://github.com/libp2p/specs/blob/master/pnet/Private-Networks-PSK-V1.md
+     */
+    swarmKey?: Uint8Array;
+}
+/**
+ * P2P Mesh Node backed by libp2p + Kademlia DHT.
+ *
+ * Provides capability advertisement via CID-based content routing
+ * and decentralized peer discovery.
+ */
+declare class MeshNode {
+    private node;
+    private config;
+    private manifestDialFailureState;
+    private static readonly MANIFEST_DIAL_BASE_COOLDOWN_MS;
+    private static readonly MANIFEST_DIAL_MAX_COOLDOWN_MS;
+    private static readonly MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS;
+    /**
+     * Buffer of capability hashes that have been announced.
+     * Used to re-announce capabilities when new peers connect
+     * (critical for small / isolated clusters where the initial
+     * provide() finds zero peers in the routing table).
+     */
+    private announcedCapabilities;
+    /** Guards against concurrent re-announcement storms. */
+    private reannouncing;
+    /** Callback that returns the local node's manifest on request. */
+    private manifestProvider;
+    /** Flag to ensure the manifest protocol is only registered once. */
+    private manifestProtocolRegistered;
+    /** Local Ed25519 Private Key for protocol signatures */
+    private localPrivateKey;
+    constructor(config?: MeshNodeConfig);
+    private shouldSkipManifestDial;
+    private recordManifestDialFailure;
+    private clearManifestDialFailure;
+    /**
+     * Loads a persistent identity from disk or generates a new Ed25519 keypair.
+     * Uses privateKeyToProtobuf/privateKeyFromProtobuf (libp2p v3.x official API).
+     */
+    private loadOrCreateIdentity;
+    /**
+     * Persists the private key to disk using protobuf serialization (libp2p v3.x).
+     */
+    private saveIdentity;
+    /**
+     * Creates a CID v1 (raw codec 0x55) from a SHA-256 hash of the capability string.
+     * Required by @libp2p/kad-dht v16+ for provide/findProviders.
+     */
+    private capabilityToCID;
+    /**
+     * Re-announces all buffered capabilities after a new peer connects.
+     * Uses a small delay to allow the DHT protocol handshake to complete.
+     */
+    private reannounceAll;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private loadRoutingTable;
+    private saveRoutingTable;
+    /**
+     * Internal logic to register protocol handlers against the libp2p node.
+     * Can be called multiple times; handles idempotent registration.
+     */
+    private applyHandlers;
+    /**
+     * Registers a callback as the manifest provider.
+     * Will be applied immediately if the node is already initialized.
+     */
+    registerManifestHandler(provider: () => LiopManifest): void;
+    /**
+     * Queries a remote peer's manifest by opening a /liop/manifest/1.0.0 stream.
+     * Returns null if the peer doesn't support the protocol or is unreachable.
+     */
+    queryManifest(peerIdStr: string): Promise<LiopManifest | null>;
+    /**
+     * Discovers all peers in the DHT that have announced "liop:manifest".
+     * Returns their PeerIDs for subsequent manifest queries.
+     */
+    discoverManifestProviders(): Promise<string[]>;
+    /**
+     * Announces this node as a manifest provider in the DHT.
+     * Should be called after tools/resources have been registered.
+     */
+    announceManifest(): Promise<void>;
+    /**
+     * Returns the current size of the routing table for diagnostic purposes.
+     */
+    getRoutingTableSize(): number;
+    getPeerId(): string;
+    sign(data: Uint8Array): Promise<Uint8Array>;
+    getMultiaddrs(): string[];
+    announceCapability(hash: string): Promise<void>;
+    findProviders(hash: string): Promise<string[]>;
+    resolvePeer(peerIdStr: string): Promise<string[]>;
+    isStarted(): boolean;
+    getPeers(): string[];
+    /**
+     * Returns true if this MeshNode was booted inside an isolated libp2p private network (pnet PSK).
+     */
+    isPrivateNetwork(): boolean;
+    /**
+     * Returns the configured 95-byte Swarm Key, or undefined if running in a public/consortium mesh.
+     */
+    getSwarmKey(): Uint8Array | undefined;
+}
+
+export { type LiopManifest as L, type MeshNodeConfig as M, MeshNode as a };

package/dist/protocol/liop_core.proto

@@ -1,3 +1,6 @@
+// Copyright 2026 Nekzus Solutions and contributors
+// SPDX-License-Identifier: Apache-2.0
+
 syntax = "proto3";
 package liop.v1;
 

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, i as LogicExecutionPolicy, N as NerScanner, j as OutputSanitizerConfig, P as PII_PATTERNS, k as PII_PRESETS, l as PiiRule, m as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-BW95kAL4.js';
+export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-CdW8j8Bn.js';
 import 'zod';
-import './mesh.js';
-import './types-lJIxBlWF.js';
+import './node-B0b2vUFS.js';
+import './types-CzRSOlOo.js';
 import 'jose';

package/dist/server.js

@@ -1,8 +1,9 @@
-export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner } from './chunk-WCCGE4QR.js';
-export { sanitizeOutput } from './chunk-JIJPZFR2.js';
-import './chunk-U5BZ66VX.js';
-import './chunk-WSW6YJNY.js';
-import './chunk-74CISO2I.js';
-import './chunk-72MNYFR6.js';
+export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner } from './chunk-5SWHE62F.js';
+export { sanitizeOutput } from './chunk-Y62GORQF.js';
+import './chunk-WPTOJYN5.js';
+import './chunk-UJFWPRDM.js';
+import './chunk-PAICJCKJ.js';
+import './chunk-XRDN232O.js';
+import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map