@nekzus/liop 1.0.0-alpha.1

package/dist/chunk-EG46XMJT.js

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+
+// src/types.ts
+
+// src/gateway/mcp-compat.ts
+var MCP_LEGACY_SUPPORT_ENABLED = true;
+var MCP_PROTOCOL_VERSION_LEGACY = "2025-11-25";
+function buildLegacyInitializeResponse(serverInfo, id) {
+  return {
+    jsonrpc: "2.0",
+    id: id ?? null,
+    result: {
+      protocolVersion: MCP_PROTOCOL_VERSION_LEGACY,
+      capabilities: {
+        tools: { listChanged: true },
+        resources: { listChanged: true },
+        prompts: { listChanged: true }
+      },
+      serverInfo
+    }
+  };
+}
+function isLegacyRequest(request) {
+  if (request.method === "initialize" || request.method === "notifications/initialized") {
+    return true;
+  }
+  const params = request.params;
+  const meta = params?._meta;
+  const version = meta?.["io.modelcontextprotocol/protocolVersion"];
+  if (!version || version === MCP_PROTOCOL_VERSION_LEGACY) {
+    return true;
+  }
+  return false;
+}
+function adaptResponseForLegacyClient(response) {
+  if (!response.result || typeof response.result !== "object") {
+    return response;
+  }
+  const rawResult = { ...response.result };
+  delete rawResult.resultType;
+  delete rawResult.ttlMs;
+  delete rawResult.cacheScope;
+  return {
+    ...response,
+    result: rawResult
+  };
+}
+
+// src/types.ts
+var MCP_PROTOCOL_VERSION = "2026-07-28";
+var ToolSchema = z.object({
+  name: z.string(),
+  description: z.string().optional(),
+  inputSchema: z.record(z.string(), z.unknown())
+  // Represents a JSON Schema
+});
+var ResourceSchema = z.object({
+  uri: z.string(),
+  name: z.string(),
+  description: z.string().optional(),
+  mimeType: z.string().optional()
+});
+var PromptSchema = z.object({
+  name: z.string(),
+  description: z.string().optional(),
+  arguments: z.array(
+    z.object({
+      name: z.string(),
+      description: z.string().optional(),
+      required: z.boolean().optional()
+    })
+  ).optional()
+});
+
+export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema, adaptResponseForLegacyClient, buildLegacyInitializeResponse, isLegacyRequest };
+//# sourceMappingURL=chunk-EG46XMJT.js.map
+//# sourceMappingURL=chunk-EG46XMJT.js.map

package/dist/chunk-EG46XMJT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/gateway/mcp-compat.ts","../src/types.ts"],"names":[],"mappings":";;;;;AAiBO,IAAM,0BAAA,GAA6B;AAKnC,IAAM,2BAAA,GAA8B;AAKpC,SAAS,6BAAA,CACf,YACA,EAAA,EACc;AACd,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,IAAI,EAAA,IAAM,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,MACP,eAAA,EAAiB,2BAAA;AAAA,MACjB,YAAA,EAAc;AAAA,QACb,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC3B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC/B,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA;AAAK,OAC9B;AAAA,MACA;AAAA;AACD,GACD;AACD;AAOO,SAAS,gBAAgB,OAAA,EAA8B;AAC7D,EAAA,IACC,OAAA,CAAQ,MAAA,KAAW,YAAA,IACnB,OAAA,CAAQ,WAAW,2BAAA,EAClB;AACD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,EAAA,MAAM,OAAO,MAAA,EAAQ,KAAA;AACrB,EAAA,MAAM,OAAA,GAAU,OAAO,yCAAyC,CAAA;AAEhE,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,2BAAA,EAA6B;AACxD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAA;AACR;AAMO,SAAS,6BACf,QAAA,EACc;AACd,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,IAAU,OAAO,QAAA,CAAS,WAAW,QAAA,EAAU;AAC5D,IAAA,OAAO,QAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAA,GAAY,EAAE,GAAI,QAAA,CAAS,MAAA,EAAmC;AAGpE,EAAA,OAAO,SAAA,CAAU,UAAA;AACjB,EAAA,OAAO,SAAA,CAAU,KAAA;AACjB,EAAA,OAAO,SAAA,CAAU,UAAA;AAEjB,EAAA,OAAO;AAAA,IACN,GAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT;AACD;;;ACpFO,IAAM,oBAAA,GAAuB;AAyD7B,IAAM,UAAA,GAAa,EAAE,MAAA,CAAO;AAAA,EAClC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,CAAA,CAAE,SAAS;AAAA;AAC9C,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,EAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EACpC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAW,CAAA,CACT,KAAA;AAAA,IACA,EAAE,MAAA,CAAO;AAAA,MACR,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,MACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAC/B;AAAA,IAED,QAAA;AACH,CAAC","file":"chunk-EG46XMJT.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { McpRequest, McpResponse, ServerInfo } from \"../types.js\";\n\n/**\n * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.\n * Remove this file when MCP v1 (2025-11-25) reaches EOL.\n *\n * SUNSET INSTRUCTION: Delete this file, then grep for \"@mcp-legacy\" in the\n * codebase to find and remove all remaining legacy seams.\n */\n\n/**\n * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.\n * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.\n */\nexport const MCP_LEGACY_SUPPORT_ENABLED = true;\n\n/**\n * @mcp-legacy Legacy protocol version constant.\n */\nexport const MCP_PROTOCOL_VERSION_LEGACY = \"2025-11-25\" as const;\n\n/**\n * @mcp-legacy Build the legacy initialize handshake response.\n */\nexport function buildLegacyInitializeResponse(\n\tserverInfo: ServerInfo,\n\tid?: string | number | null,\n): McpResponse {\n\treturn {\n\t\tjsonrpc: \"2.0\",\n\t\tid: id ?? null,\n\t\tresult: {\n\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\tcapabilities: {\n\t\t\t\ttools: { listChanged: true },\n\t\t\t\tresources: { listChanged: true },\n\t\t\t\tprompts: { listChanged: true },\n\t\t\t},\n\t\t\tserverInfo,\n\t\t},\n\t};\n}\n\n/**\n * @mcp-legacy Detect if a request is strictly from a 2025-era legacy client.\n * Legacy requests either invoke 'initialize', 'notifications/initialized',\n * or lack modern '_meta' protocol envelopes.\n */\nexport function isLegacyRequest(request: McpRequest): boolean {\n\tif (\n\t\trequest.method === \"initialize\" ||\n\t\trequest.method === \"notifications/initialized\"\n\t) {\n\t\treturn true;\n\t}\n\n\tconst params = request.params as Record<string, unknown> | undefined;\n\tconst meta = params?._meta as Record<string, unknown> | undefined;\n\tconst version = meta?.[\"io.modelcontextprotocol/protocolVersion\"];\n\n\tif (!version || version === MCP_PROTOCOL_VERSION_LEGACY) {\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * @mcp-legacy Wrap and strip modern-era fields (resultType, ttlMs, cacheScope, etc.)\n * from a response to ensure 100% wire-compatibility with strict 2025 MCP clients.\n */\nexport function adaptResponseForLegacyClient(\n\tresponse: McpResponse,\n): McpResponse {\n\tif (!response.result || typeof response.result !== \"object\") {\n\t\treturn response;\n\t}\n\n\tconst rawResult = { ...(response.result as Record<string, unknown>) };\n\n\t// Strip modern-only envelope tags\n\tdelete rawResult.resultType;\n\tdelete rawResult.ttlMs;\n\tdelete rawResult.cacheScope;\n\n\treturn {\n\t\t...response,\n\t\tresult: rawResult,\n\t};\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from \"zod\";\n\n/**\n * Protocol Version Identifiers\n */\nexport const MCP_PROTOCOL_VERSION = \"2026-07-28\" as const;\n\nexport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"./gateway/mcp-compat.js\";\n\n/**\n * Protocol Era Classification\n */\nexport type McpEra = \"legacy\" | \"modern\";\n\n/**\n * Caching Hints for MCP 2026-07-28 Spec\n */\nexport interface CacheableResult {\n\tttlMs?: number;\n\tcacheScope?: \"public\" | \"private\";\n}\n\n/**\n * Multi-Round-Trip Requests (MRTR) Specification Types\n */\nexport interface InputRequest {\n\tid: string;\n\tmessage: string;\n\tschema?: Record<string, unknown>;\n}\n\nexport interface InputResponse {\n\tid: string;\n\tvalue: unknown;\n}\n\nexport interface InputRequiredResult {\n\tresultType: \"input_required\";\n\tinputRequests: InputRequest[];\n\trequestState?: string;\n}\n\n/**\n * Modern Envelope Metadata (_meta)\n */\nexport interface McpRequestMeta {\n\t\"io.modelcontextprotocol/protocolVersion\"?: string;\n\t\"io.modelcontextprotocol/clientInfo\"?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\t\"io.modelcontextprotocol/clientCapabilities\"?: Record<string, unknown>;\n\t[key: string]: unknown;\n}\n\n/**\n * Base Protocol Types representing parity with Model Context Protocol\n */\n\nexport const ToolSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tinputSchema: z.record(z.string(), z.unknown()), // Represents a JSON Schema\n});\n\nexport type Tool = z.infer<typeof ToolSchema>;\n\nexport const ResourceSchema = z.object({\n\turi: z.string(),\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tmimeType: z.string().optional(),\n});\n\nexport type Resource = z.infer<typeof ResourceSchema>;\n\nexport const PromptSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\targuments: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tdescription: z.string().optional(),\n\t\t\t\trequired: z.boolean().optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\nexport type Prompt = z.infer<typeof PromptSchema>;\n\nexport interface CallToolRequest {\n\tname: string;\n\targuments?: Record<string, unknown>;\n}\n\nexport interface CallToolResult {\n\tcontent: Array<{\n\t\ttype: \"text\" | \"image\" | \"resource\";\n\t\ttext?: string;\n\t\tdata?: string;\n\t\tmimeType?: string;\n\t\tresource?: {\n\t\t\turi: string;\n\t\t\ttext?: string;\n\t\t\tblob?: string;\n\t\t};\n\t}>;\n\tisError?: boolean;\n}\n\nexport interface GetPromptRequest {\n\tname: string;\n\targuments?: Record<string, string>;\n}\n\nexport interface GetPromptResult {\n\tdescription?: string;\n\tmessages: Array<{\n\t\trole: \"user\" | \"assistant\";\n\t\tcontent:\n\t\t\t| { type: \"text\"; text: string }\n\t\t\t| { type: \"image\"; data: string; mimeType: string }\n\t\t\t| {\n\t\t\t\t\ttype: \"resource\";\n\t\t\t\t\tresource: { uri: string; text?: string; blob?: string };\n\t\t\t  };\n\t}>;\n}\n\nexport interface ServerInfo {\n\tname: string;\n\tversion: string;\n\tcapabilities?: {\n\t\tprompts?: { listChanged?: boolean };\n\t\tresources?: { subscribe?: boolean; listChanged?: boolean };\n\t\ttools?: { listChanged?: boolean };\n\t\t/** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */\n\t\tlogging?: Record<string, unknown>;\n\t};\n}\n\nexport interface DiscoverResult {\n\tresultType: \"complete\";\n\tsupportedVersions: string[];\n\tcapabilities: ServerInfo[\"capabilities\"];\n\tserverInfo: ServerInfo;\n\tinstructions?: string;\n}\n\nexport interface McpRequest {\n\tmethod: string;\n\tparams?: unknown;\n\tid?: string | number | null;\n\tjsonrpc?: \"2.0\";\n}\n\nexport interface McpResponse {\n\tjsonrpc: \"2.0\";\n\tid?: string | number | null;\n\tresult?: unknown;\n\terror?: {\n\t\tcode: number;\n\t\tmessage: string;\n\t\tdata?: unknown;\n\t};\n}\n\n/**\n * Re-export AuthInfo from the security module for convenience.\n * Compatible with MCP TypeScript SDK AuthInfo interface shape.\n */\nexport type { AuthInfo } from \"./security/jwt-validator.js\";\n"]}

package/dist/chunk-ESRXG36Y.js

@@ -0,0 +1,115 @@
+import { log } from './chunk-HA6YZ42O.js';
+
+// src/runtime/token-manager.ts
+var TokenManager = class _TokenManager {
+  cachedToken = null;
+  expiresAt = 0;
+  // Epoch ms
+  pendingPromise = null;
+  tokenEndpoint;
+  clientId;
+  clientSecret;
+  audience;
+  scope;
+  staticToken;
+  // Preemptive refresh threshold: 30 seconds before expiration
+  static REFRESH_BUFFER_MS = 3e4;
+  constructor(options) {
+    this.tokenEndpoint = options.tokenEndpoint;
+    this.clientId = options.clientId;
+    this.clientSecret = options.clientSecret;
+    this.audience = options.audience ?? "urn:liop:mesh:api";
+    this.scope = Array.isArray(options.scopes) ? options.scopes.join(" ") : options.scopes ?? "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query";
+    this.staticToken = options.staticToken;
+  }
+  /**
+   * Returns a valid OAuth 2.1 access token.
+   * Automatically performs preemptive refresh if the token is close to expiry.
+   */
+  async getToken() {
+    if (this.staticToken) {
+      return this.staticToken;
+    }
+    const now = Date.now();
+    if (this.cachedToken && now < this.expiresAt - _TokenManager.REFRESH_BUFFER_MS) {
+      return this.cachedToken;
+    }
+    if (this.pendingPromise) {
+      return this.pendingPromise;
+    }
+    this.pendingPromise = (async () => {
+      try {
+        const token = await this.fetchNewToken();
+        this.cachedToken = token;
+        return token;
+      } finally {
+        this.pendingPromise = null;
+      }
+    })();
+    return this.pendingPromise;
+  }
+  /**
+   * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.
+   */
+  invalidate() {
+    this.cachedToken = null;
+    this.expiresAt = 0;
+    if (this.clientId && this.clientSecret) {
+      this.staticToken = void 0;
+    }
+    log.info("[TokenManager] Cached OAuth access token invalidated.");
+  }
+  /**
+   * Returns true if the token is absent or has passed the refresh threshold.
+   */
+  isExpired() {
+    if (this.staticToken) return false;
+    return !this.cachedToken || Date.now() >= this.expiresAt - _TokenManager.REFRESH_BUFFER_MS;
+  }
+  getExpiresAt() {
+    return this.expiresAt;
+  }
+  async fetchNewToken() {
+    log.info(
+      `[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`
+    );
+    const params = new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: this.clientId,
+      client_secret: this.clientSecret,
+      resource: this.audience,
+      scope: this.scope
+    });
+    const response = await fetch(this.tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: params.toString(),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(
+        `OAuth token request failed [HTTP ${response.status}]: ${errorText}`
+      );
+    }
+    const data = await response.json();
+    if (!data.access_token) {
+      throw new Error(
+        "OAuth token response did not contain an 'access_token' field."
+      );
+    }
+    const expiresInSec = typeof data.expires_in === "number" ? data.expires_in : 3600;
+    this.expiresAt = Date.now() + expiresInSec * 1e3;
+    log.info(
+      `[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`
+    );
+    return data.access_token;
+  }
+};
+
+export { TokenManager };
+//# sourceMappingURL=chunk-ESRXG36Y.js.map
+//# sourceMappingURL=chunk-ESRXG36Y.js.map

package/dist/chunk-ESRXG36Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime/token-manager.ts"],"names":[],"mappings":";;;AAwBO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,WAAA,GAA6B,IAAA;AAAA,EAC7B,SAAA,GAAY,CAAA;AAAA;AAAA,EACZ,cAAA,GAAyC,IAAA;AAAA,EAEhC,aAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACT,WAAA;AAAA;AAAA,EAGR,OAAwB,iBAAA,GAAoB,GAAA;AAAA,EAE5C,YAAY,OAAA,EAA8B;AACzC,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACpC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,GACtC,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GACtB,OAAA,CAAQ,MAAA,IACV,sFAAA;AACF,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,QAAA,GAA4B;AACxC,IAAA,IAAI,KAAK,WAAA,EAAa;AACrB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IACC,KAAK,WAAA,IACL,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,cAAa,iBAAA,EACnC;AACD,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACxB,MAAA,OAAO,IAAA,CAAK,cAAA;AAAA,IACb;AAEA,IAAA,IAAA,CAAK,kBAAkB,YAAY;AAClC,MAAA,IAAI;AACH,QAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AACvC,QAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,QAAA,OAAO,KAAA;AAAA,MACR,CAAA,SAAE;AACD,QAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,MACvB;AAAA,IACD,CAAA,GAAG;AAEH,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,UAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,YAAA,EAAc;AACvC,MAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAAA,IACpB;AACA,IAAA,GAAA,CAAI,KAAK,uDAAuD,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKO,SAAA,GAAqB;AAC3B,IAAA,IAAI,IAAA,CAAK,aAAa,OAAO,KAAA;AAC7B,IAAA,OACC,CAAC,KAAK,WAAA,IACN,IAAA,CAAK,KAAI,IAAK,IAAA,CAAK,YAAY,aAAA,CAAa,iBAAA;AAAA,EAE9C;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACb;AAAA,EAEA,MAAc,aAAA,GAAiC;AAC9C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yCAAA,EAA4C,IAAA,CAAK,aAAa,CAAA,aAAA,EAAgB,KAAK,QAAQ,CAAA,IAAA;AAAA,KAC5F;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAClC,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,IAAA,CAAK,QAAA;AAAA,MAChB,eAAe,IAAA,CAAK,YAAA;AAAA,MACpB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,OAAO,IAAA,CAAK;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACR,cAAA,EAAgB,mCAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACT;AAAA,MACA,IAAA,EAAM,OAAO,QAAA,EAAS;AAAA,MACtB,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AACjB,MAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,IAAA,EAAK;AACtC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,iCAAA,EAAoC,QAAA,CAAS,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAMlC,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,eACL,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,IAAA;AACzD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,YAAA,GAAe,GAAA;AAE7C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iEAAiE,YAAY,CAAA,EAAA;AAAA,KAC9E;AAEA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACb;AACD","file":"chunk-ESRXG36Y.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Token Manager — Adaptive OAuth 2.1 M2M Token Lifecycle\n *\n * Implements resilient token caching with preemptive refresh (30s safety buffer),\n * concurrency de-duplication (single in-flight HTTP request), and on-demand\n * invalidation for 401 Unauthorized handling.\n *\n * Standards: RFC 6749, RFC 8707 (Resource Indicators), RFC 9068 (JWT Profile)\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface TokenManagerOptions {\n\ttokenEndpoint: string;\n\tclientId: string;\n\tclientSecret: string;\n\taudience?: string;\n\tscopes?: string | string[];\n\tstaticToken?: string;\n}\n\nexport class TokenManager {\n\tprivate cachedToken: string | null = null;\n\tprivate expiresAt = 0; // Epoch ms\n\tprivate pendingPromise: Promise<string> | null = null;\n\n\tprivate readonly tokenEndpoint: string;\n\tprivate readonly clientId: string;\n\tprivate readonly clientSecret: string;\n\tprivate readonly audience: string;\n\tprivate readonly scope: string;\n\tprivate staticToken?: string;\n\n\t// Preemptive refresh threshold: 30 seconds before expiration\n\tprivate static readonly REFRESH_BUFFER_MS = 30_000;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.tokenEndpoint = options.tokenEndpoint;\n\t\tthis.clientId = options.clientId;\n\t\tthis.clientSecret = options.clientSecret;\n\t\tthis.audience = options.audience ?? \"urn:liop:mesh:api\";\n\t\tthis.scope = Array.isArray(options.scopes)\n\t\t\t? options.scopes.join(\" \")\n\t\t\t: (options.scopes ??\n\t\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\");\n\t\tthis.staticToken = options.staticToken;\n\t}\n\n\t/**\n\t * Returns a valid OAuth 2.1 access token.\n\t * Automatically performs preemptive refresh if the token is close to expiry.\n\t */\n\tpublic async getToken(): Promise<string> {\n\t\tif (this.staticToken) {\n\t\t\treturn this.staticToken;\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tif (\n\t\t\tthis.cachedToken &&\n\t\t\tnow < this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t) {\n\t\t\treturn this.cachedToken;\n\t\t}\n\n\t\tif (this.pendingPromise) {\n\t\t\treturn this.pendingPromise;\n\t\t}\n\n\t\tthis.pendingPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tconst token = await this.fetchNewToken();\n\t\t\t\tthis.cachedToken = token;\n\t\t\t\treturn token;\n\t\t\t} finally {\n\t\t\t\tthis.pendingPromise = null;\n\t\t\t}\n\t\t})();\n\n\t\treturn this.pendingPromise;\n\t}\n\n\t/**\n\t * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.\n\t */\n\tpublic invalidate(): void {\n\t\tthis.cachedToken = null;\n\t\tthis.expiresAt = 0;\n\t\tif (this.clientId && this.clientSecret) {\n\t\t\tthis.staticToken = undefined;\n\t\t}\n\t\tlog.info(\"[TokenManager] Cached OAuth access token invalidated.\");\n\t}\n\n\t/**\n\t * Returns true if the token is absent or has passed the refresh threshold.\n\t */\n\tpublic isExpired(): boolean {\n\t\tif (this.staticToken) return false;\n\t\treturn (\n\t\t\t!this.cachedToken ||\n\t\t\tDate.now() >= this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t);\n\t}\n\n\tpublic getExpiresAt(): number {\n\t\treturn this.expiresAt;\n\t}\n\n\tprivate async fetchNewToken(): Promise<string> {\n\t\tlog.info(\n\t\t\t`[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`,\n\t\t);\n\n\t\tconst params = new URLSearchParams({\n\t\t\tgrant_type: \"client_credentials\",\n\t\t\tclient_id: this.clientId,\n\t\t\tclient_secret: this.clientSecret,\n\t\t\tresource: this.audience,\n\t\t\tscope: this.scope,\n\t\t});\n\n\t\tconst response = await fetch(this.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\tAccept: \"application/json\",\n\t\t\t},\n\t\t\tbody: params.toString(),\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst errorText = await response.text();\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth token request failed [HTTP ${response.status}]: ${errorText}`,\n\t\t\t);\n\t\t}\n\n\t\tconst data = (await response.json()) as {\n\t\t\taccess_token?: string;\n\t\t\texpires_in?: number;\n\t\t\ttoken_type?: string;\n\t\t};\n\n\t\tif (!data.access_token) {\n\t\t\tthrow new Error(\n\t\t\t\t\"OAuth token response did not contain an 'access_token' field.\",\n\t\t\t);\n\t\t}\n\n\t\tconst expiresInSec =\n\t\t\ttypeof data.expires_in === \"number\" ? data.expires_in : 3600;\n\t\tthis.expiresAt = Date.now() + expiresInSec * 1000;\n\n\t\tlog.info(\n\t\t\t`[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`,\n\t\t);\n\n\t\treturn data.access_token;\n\t}\n}\n"]}

package/dist/chunk-FTF6AMF6.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-FTF6AMF6.js.map
+//# sourceMappingURL=chunk-FTF6AMF6.js.map

package/dist/chunk-FTF6AMF6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-FTF6AMF6.js"}

package/dist/chunk-HA6YZ42O.js

@@ -0,0 +1,64 @@
+// src/utils/logger.ts
+var LiopLogger = class _LiopLogger {
+  static instance;
+  level = "info";
+  constructor() {
+    this.setLevelFromEnv();
+  }
+  static getInstance() {
+    if (!_LiopLogger.instance) {
+      _LiopLogger.instance = new _LiopLogger();
+    }
+    return _LiopLogger.instance;
+  }
+  setLevelFromEnv() {
+    const envLevel = process.env.LIOP_LOG_LEVEL?.toLowerCase();
+    if (envLevel === "silent" || envLevel === "error" || envLevel === "warn" || envLevel === "info" || envLevel === "debug") {
+      this.level = envLevel;
+    } else {
+      this.level = "info";
+    }
+  }
+  setLevel(level) {
+    this.level = level;
+  }
+  shouldLog(targetLevel) {
+    const levels = {
+      silent: 0,
+      error: 1,
+      warn: 2,
+      info: 3,
+      debug: 4
+    };
+    return levels[this.level] >= levels[targetLevel];
+  }
+  formatMessage(level, message) {
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    return `[${ts}] [${level}] ${message}`;
+  }
+  error(message, ...args) {
+    if (this.shouldLog("error")) {
+      console.error(this.formatMessage("ERROR", message), ...args);
+    }
+  }
+  warn(message, ...args) {
+    if (this.shouldLog("warn")) {
+      console.error(this.formatMessage("WARN", message), ...args);
+    }
+  }
+  info(message, ...args) {
+    if (this.shouldLog("info")) {
+      console.error(this.formatMessage("INFO", message), ...args);
+    }
+  }
+  debug(message, ...args) {
+    if (this.shouldLog("debug")) {
+      console.error(this.formatMessage("DEBUG", message), ...args);
+    }
+  }
+};
+var log = LiopLogger.getInstance();
+
+export { log };
+//# sourceMappingURL=chunk-HA6YZ42O.js.map
+//# sourceMappingURL=chunk-HA6YZ42O.js.map

package/dist/chunk-HA6YZ42O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/logger.ts"],"names":[],"mappings":";AAUO,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAe,QAAA;AAAA,EACP,KAAA,GAAkB,MAAA;AAAA,EAElB,WAAA,GAAc;AACrB,IAAA,IAAA,CAAK,eAAA,EAAgB;AAAA,EACtB;AAAA,EAEA,OAAc,WAAA,GAA0B;AACvC,IAAA,IAAI,CAAC,YAAW,QAAA,EAAU;AACzB,MAAA,WAAA,CAAW,QAAA,GAAW,IAAI,WAAA,EAAW;AAAA,IACtC;AACA,IAAA,OAAO,WAAA,CAAW,QAAA;AAAA,EACnB;AAAA,EAEQ,eAAA,GAAkB;AACzB,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,cAAA,EAAgB,WAAA,EAAY;AACzD,IAAA,IACC,QAAA,KAAa,YACb,QAAA,KAAa,OAAA,IACb,aAAa,MAAA,IACb,QAAA,KAAa,MAAA,IACb,QAAA,KAAa,OAAA,EACZ;AACD,MAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AAAA,IACd,CAAA,MAAO;AAEN,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,IACd;AAAA,EACD;AAAA,EAEO,SAAS,KAAA,EAAiB;AAChC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACd;AAAA,EAEQ,UAAU,WAAA,EAAgC;AACjD,IAAA,MAAM,MAAA,GAAmC;AAAA,MACxC,MAAA,EAAQ,CAAA;AAAA,MACR,KAAA,EAAO,CAAA;AAAA,MACP,IAAA,EAAM,CAAA;AAAA,MACN,IAAA,EAAM,CAAA;AAAA,MACN,KAAA,EAAO;AAAA,KACR;AACA,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,IAAK,OAAO,WAAW,CAAA;AAAA,EAChD;AAAA,EAEQ,aAAA,CAAc,OAAe,OAAA,EAAyB;AAC7D,IAAA,MAAM,EAAA,GAAA,iBAAK,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAClC,IAAA,OAAO,CAAA,CAAA,EAAI,EAAE,CAAA,GAAA,EAAM,KAAK,KAAK,OAAO,CAAA,CAAA;AAAA,EACrC;AAAA,EAEO,KAAA,CAAM,YAAoB,IAAA,EAAiB;AACjD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAC5B,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,SAAS,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,IAC5D;AAAA,EACD;AAAA,EAEO,IAAA,CAAK,YAAoB,IAAA,EAAiB;AAChD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,IAC3D;AAAA,EACD;AAAA,EAEO,IAAA,CAAK,YAAoB,IAAA,EAAiB;AAChD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,IAC3D;AAAA,EACD;AAAA,EAEO,KAAA,CAAM,YAAoB,IAAA,EAAiB;AACjD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAC5B,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,SAAS,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,IAC5D;AAAA,EACD;AACD,CAAA;AAEO,IAAM,GAAA,GAAM,WAAW,WAAA","file":"chunk-HA6YZ42O.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport type LogLevel = \"silent\" | \"error\" | \"warn\" | \"info\" | \"debug\";\n\n/**\n * LiopLogger - Structured Logging Abstraction\n * Configurable via `process.env.LIOP_LOG_LEVEL`.\n * Emits strictly to stderr to comply with MCP stdio protocols.\n */\nexport class LiopLogger {\n\tprivate static instance: LiopLogger;\n\tprivate level: LogLevel = \"info\";\n\n\tprivate constructor() {\n\t\tthis.setLevelFromEnv();\n\t}\n\n\tpublic static getInstance(): LiopLogger {\n\t\tif (!LiopLogger.instance) {\n\t\t\tLiopLogger.instance = new LiopLogger();\n\t\t}\n\t\treturn LiopLogger.instance;\n\t}\n\n\tprivate setLevelFromEnv() {\n\t\tconst envLevel = process.env.LIOP_LOG_LEVEL?.toLowerCase();\n\t\tif (\n\t\t\tenvLevel === \"silent\" ||\n\t\t\tenvLevel === \"error\" ||\n\t\t\tenvLevel === \"warn\" ||\n\t\t\tenvLevel === \"info\" ||\n\t\t\tenvLevel === \"debug\"\n\t\t) {\n\t\t\tthis.level = envLevel as LogLevel;\n\t\t} else {\n\t\t\t// Default level: info\n\t\t\tthis.level = \"info\";\n\t\t}\n\t}\n\n\tpublic setLevel(level: LogLevel) {\n\t\tthis.level = level;\n\t}\n\n\tprivate shouldLog(targetLevel: LogLevel): boolean {\n\t\tconst levels: Record<LogLevel, number> = {\n\t\t\tsilent: 0,\n\t\t\terror: 1,\n\t\t\twarn: 2,\n\t\t\tinfo: 3,\n\t\t\tdebug: 4,\n\t\t};\n\t\treturn levels[this.level] >= levels[targetLevel];\n\t}\n\n\tprivate formatMessage(level: string, message: string): string {\n\t\tconst ts = new Date().toISOString();\n\t\treturn `[${ts}] [${level}] ${message}`;\n\t}\n\n\tpublic error(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"error\")) {\n\t\t\tconsole.error(this.formatMessage(\"ERROR\", message), ...args);\n\t\t}\n\t}\n\n\tpublic warn(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"warn\")) {\n\t\t\tconsole.error(this.formatMessage(\"WARN\", message), ...args);\n\t\t}\n\t}\n\n\tpublic info(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"info\")) {\n\t\t\tconsole.error(this.formatMessage(\"INFO\", message), ...args);\n\t\t}\n\t}\n\n\tpublic debug(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"debug\")) {\n\t\t\tconsole.error(this.formatMessage(\"DEBUG\", message), ...args);\n\t\t}\n\t}\n}\n\nexport const log = LiopLogger.getInstance();\n"]}