@nekzus/liop 2.1.0-alpha.4 → 2.1.0-alpha.5

package/dist/chunk-Y73XGYY7.js

@@ -0,0 +1,1597 @@
+import { LiopVerifier } from './chunk-32ADSAJS.js';
+import { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
+import { authorizeRequest } from './chunk-IJHTRIZC.js';
+import { liopV1, createChannelCredentials } from './chunk-RDWCGZ2A.js';
+import { log } from './chunk-72MNYFR6.js';
+import { metrics } from '@opentelemetry/api';
+import * as crypto2 from 'crypto';
+import * as grpc from '@grpc/grpc-js';
+
+// src/economy/estimator.ts
+var RealTokenEstimator = class {
+  name = "o200k_base";
+  countFn;
+  constructor(countFn, setMergeCacheSizeFn) {
+    this.countFn = countFn;
+    if (setMergeCacheSizeFn) {
+      setMergeCacheSizeFn(1e4);
+    }
+  }
+  countTokens(text) {
+    if (text.length === 0) return 0;
+    return this.countFn(text);
+  }
+};
+var HeuristicTokenEstimator = class {
+  name = "heuristic (chars/4)";
+  countTokens(text) {
+    if (text.length === 0) return 0;
+    return Math.ceil(text.length / 4);
+  }
+};
+async function createTokenEstimator() {
+  try {
+    const mod = await import('gpt-tokenizer');
+    const estimator = new RealTokenEstimator(
+      mod.countTokens,
+      mod.setMergeCacheSize
+    );
+    log.debug("[LIOP-Economy] Token estimator initialized: o200k_base");
+    return estimator;
+  } catch {
+    log.info(
+      "[LIOP-Economy] gpt-tokenizer unavailable, falling back to heuristic estimator"
+    );
+    return new HeuristicTokenEstimator();
+  }
+}
+function createSyncTokenEstimator() {
+  return new HeuristicTokenEstimator();
+}
+var METER_NAME = "@nekzus/liop";
+var METER_VERSION = "1.2.0-alpha.9";
+var TOKEN_USAGE_BUCKETS = [
+  1,
+  4,
+  16,
+  64,
+  256,
+  1024,
+  4096,
+  16384,
+  65536,
+  262144,
+  1048576,
+  4194304,
+  16777216,
+  67108864
+];
+var DURATION_BUCKETS = [
+  0.01,
+  0.02,
+  0.04,
+  0.08,
+  0.16,
+  0.32,
+  0.64,
+  1.28,
+  2.56,
+  5.12,
+  10.24,
+  20.48,
+  40.96,
+  81.92
+];
+var LiopOTelBridge = class {
+  tokenUsage;
+  operationDuration;
+  active = false;
+  constructor() {
+    try {
+      const meter = metrics.getMeter(METER_NAME, METER_VERSION);
+      this.tokenUsage = meter.createHistogram("gen_ai.client.token.usage", {
+        description: "Number of tokens used in LIOP Logic-on-Origin operations",
+        unit: "{token}",
+        advice: { explicitBucketBoundaries: TOKEN_USAGE_BUCKETS }
+      });
+      this.operationDuration = meter.createHistogram(
+        "gen_ai.client.operation.duration",
+        {
+          description: "Duration of LIOP operations",
+          unit: "s",
+          advice: { explicitBucketBoundaries: DURATION_BUCKETS }
+        }
+      );
+      this.active = true;
+      log.debug("[LIOP-OTel] gen_ai.* metrics bridge initialized");
+    } catch (err) {
+      log.debug(
+        `[LIOP-OTel] Bridge disabled: ${err instanceof Error ? err.message : String(err)}`
+      );
+      const noopHistogram = {
+        record: () => {
+        }
+      };
+      this.tokenUsage = noopHistogram;
+      this.operationDuration = noopHistogram;
+    }
+  }
+  /**
+   * Record token usage with gen_ai.* standard attributes.
+   *
+   * @param tokens - Number of tokens consumed
+   * @param tokenType - "input" or "output" (gen_ai.token.type)
+   * @param operationName - gen_ai.operation.name (e.g., "execute_tool", "chat")
+   * @param toolName - Optional LIOP-specific tool name for attribution
+   */
+  recordTokens(tokens, tokenType, operationName, toolName) {
+    this.tokenUsage.record(tokens, {
+      "gen_ai.system": "liop",
+      "gen_ai.operation.name": operationName,
+      "gen_ai.token.type": tokenType,
+      "gen_ai.request.model": "liop-mesh",
+      ...toolName ? { "liop.tool.name": toolName } : {}
+    });
+  }
+  /**
+   * Record operation duration with gen_ai.* standard attributes.
+   *
+   * @param durationMs - Duration in milliseconds (converted to seconds for OTel)
+   * @param operationName - gen_ai.operation.name
+   * @param error - Optional error type string if the operation failed
+   */
+  recordDuration(durationMs, operationName, error) {
+    this.operationDuration.record(durationMs / 1e3, {
+      "gen_ai.system": "liop",
+      "gen_ai.operation.name": operationName,
+      ...error ? { "error.type": error } : {}
+    });
+  }
+  /** Whether the OTel bridge is actively connected to a MeterProvider */
+  isActive() {
+    return this.active;
+  }
+};
+
+// src/economy/telemetry.ts
+var OTEL_OPERATION_MAP = {
+  tools_list: "chat",
+  tool_call: "execute_tool",
+  resource_read: "chat",
+  resource_list: "chat",
+  prompt_get: "chat",
+  prompt_list: "chat",
+  diagnostic: "chat"
+};
+var TokenTelemetryEngine = class _TokenTelemetryEngine {
+  static instance = null;
+  operations = [];
+  sessionId;
+  startedAt;
+  estimator;
+  otelBridge;
+  constructor() {
+    this.sessionId = crypto.randomUUID();
+    this.startedAt = Date.now();
+    this.estimator = createSyncTokenEstimator();
+    this.otelBridge = new LiopOTelBridge();
+    this.initRealEstimator();
+  }
+  /** Async upgrade from heuristic to real BPE tokenizer */
+  initRealEstimator() {
+    createTokenEstimator().then((real) => {
+      this.estimator = real;
+    }).catch(() => {
+    });
+  }
+  static getInstance() {
+    if (!_TokenTelemetryEngine.instance) {
+      _TokenTelemetryEngine.instance = new _TokenTelemetryEngine();
+    }
+    return _TokenTelemetryEngine.instance;
+  }
+  /**
+   * Count tokens in a string using the active estimator.
+   * Delegates to o200k_base BPE tokenizer (or heuristic fallback).
+   */
+  countTokens(content) {
+    try {
+      return this.estimator.countTokens(content);
+    } catch {
+      return Math.ceil(content.length / 4);
+    }
+  }
+  /**
+   * Record a single MCP operation's token footprint.
+   * Emits both internal metrics and OTel gen_ai.* histograms.
+   */
+  record(metric) {
+    const fullMetric = {
+      ...metric,
+      timestamp: Date.now()
+    };
+    this.operations.push(fullMetric);
+    try {
+      const otelOp = OTEL_OPERATION_MAP[metric.type] || "chat";
+      if (metric.estimatedInputTokens > 0) {
+        this.otelBridge.recordTokens(
+          metric.estimatedInputTokens,
+          "input",
+          otelOp,
+          metric.toolName
+        );
+      }
+      if (metric.estimatedOutputTokens > 0) {
+        this.otelBridge.recordTokens(
+          metric.estimatedOutputTokens,
+          "output",
+          otelOp,
+          metric.toolName
+        );
+      }
+      if (metric.durationMs !== void 0) {
+        this.otelBridge.recordDuration(metric.durationMs, otelOp);
+      }
+    } catch {
+    }
+  }
+  /**
+   * @deprecated Use countTokens() instead. Kept for backward compatibility.
+   */
+  estimateTokens(content) {
+    return this.countTokens(content);
+  }
+  /** Generate the full session report */
+  getReport() {
+    return {
+      sessionId: this.sessionId,
+      operations: [...this.operations],
+      totalInputTokens: this.operations.reduce(
+        (sum, op) => sum + op.estimatedInputTokens,
+        0
+      ),
+      totalOutputTokens: this.operations.reduce(
+        (sum, op) => sum + op.estimatedOutputTokens,
+        0
+      ),
+      estimatorName: this.estimator.name,
+      sessionUptimeMs: Date.now() - this.startedAt
+    };
+  }
+  /** Get per-tool token breakdown for diagnostic display */
+  getPerToolReport() {
+    const breakdown = /* @__PURE__ */ new Map();
+    for (const op of this.operations) {
+      const key = op.toolName || op.method;
+      const existing = breakdown.get(key) || {
+        input: 0,
+        output: 0,
+        calls: 0,
+        avgDurationMs: 0
+      };
+      const totalDuration = existing.avgDurationMs * existing.calls + (op.durationMs || 0);
+      const newCalls = existing.calls + 1;
+      breakdown.set(key, {
+        input: existing.input + op.estimatedInputTokens,
+        output: existing.output + op.estimatedOutputTokens,
+        calls: newCalls,
+        avgDurationMs: newCalls > 0 ? totalDuration / newCalls : 0
+      });
+    }
+    return breakdown;
+  }
+  /**
+   * Format a rich, human-readable summary block for LiopMeshStatus diagnostic.
+   * Returns empty string when no operations have been recorded.
+   */
+  formatStatusBlock() {
+    const report = this.getReport();
+    if (report.operations.length === 0) return "";
+    const uptimeStr = this.formatUptime(report.sessionUptimeMs);
+    const totalCombined = report.totalInputTokens + report.totalOutputTokens;
+    const byType = /* @__PURE__ */ new Map();
+    for (const op of report.operations) {
+      const key = op.type;
+      const existing = byType.get(key) || {
+        count: 0,
+        input: 0,
+        output: 0
+      };
+      byType.set(key, {
+        count: existing.count + 1,
+        input: existing.input + op.estimatedInputTokens,
+        output: existing.output + op.estimatedOutputTokens
+      });
+    }
+    const typeEntries = Array.from(byType.entries());
+    const typeLines = typeEntries.map(([type, data], idx) => {
+      const prefix = idx === typeEntries.length - 1 ? "\u2502  \u2514\u2500" : "\u2502  \u251C\u2500";
+      const outputPart = data.output > 0 ? ` / ${data.output.toLocaleString()} out` : "";
+      return `${prefix} ${type} \xD7${data.count} \u2192 ${data.input.toLocaleString()} in${outputPart}`;
+    });
+    const toolReport = this.getPerToolReport();
+    const toolEntries = Array.from(toolReport.entries()).filter(
+      ([key]) => key !== "tools/list" && key !== "LiopMeshStatus"
+    );
+    const toolLines = [];
+    if (toolEntries.length > 0) {
+      toolLines.push("\u251C\u2500 By Tool:");
+      toolEntries.forEach(([name, data], idx) => {
+        const prefix = idx === toolEntries.length - 1 ? "\u2502  \u2514\u2500" : "\u2502  \u251C\u2500";
+        const outputPart = data.output > 0 ? ` / ${data.output.toLocaleString()} out` : "";
+        const durationPart = data.avgDurationMs > 0 ? ` ~${Math.round(data.avgDurationMs)}ms` : "";
+        toolLines.push(
+          `${prefix} ${name}: ${data.input.toLocaleString()} in${outputPart} (\xD7${data.calls})${durationPart}`
+        );
+      });
+    }
+    const timedOps = report.operations.filter(
+      (op) => op.durationMs !== void 0
+    );
+    const avgLatency = timedOps.length > 0 ? Math.round(
+      timedOps.reduce((sum, op) => sum + (op.durationMs || 0), 0) / timedOps.length
+    ) : 0;
+    const otelStatus = this.otelBridge.isActive() ? "gen_ai.client.token.usage \u2192 active" : "disabled";
+    const lines = [
+      "\nToken Economy:",
+      `\u251C\u2500 Session: ${report.sessionId.slice(0, 8)} (${uptimeStr})`,
+      `\u251C\u2500 Estimator: ${report.estimatorName}`,
+      `\u251C\u2500 Operations: ${report.operations.length}`,
+      ...typeLines,
+      `\u251C\u2500 Total: ${report.totalInputTokens.toLocaleString()} in / ${report.totalOutputTokens.toLocaleString()} out (${totalCombined.toLocaleString()} combined)`,
+      ...toolLines,
+      ...avgLatency > 0 ? [`\u251C\u2500 Avg Latency: ${avgLatency}ms`] : [],
+      `\u2514\u2500 OTel: ${otelStatus}`
+    ];
+    return lines.join("\n");
+  }
+  /** Format milliseconds into human-readable uptime string */
+  formatUptime(ms) {
+    const seconds = Math.floor(ms / 1e3);
+    if (seconds < 60) return `${seconds}s`;
+    const minutes = Math.floor(seconds / 60);
+    const remainingSeconds = seconds % 60;
+    if (minutes < 60) return `${minutes}m ${remainingSeconds}s`;
+    const hours = Math.floor(minutes / 60);
+    const remainingMinutes = minutes % 60;
+    return `${hours}h ${remainingMinutes}m`;
+  }
+  /** Reset all recorded metrics (used in tests) */
+  reset() {
+    this.operations = [];
+  }
+  /** Destroy the singleton (used in tests to guarantee isolation) */
+  static destroy() {
+    _TokenTelemetryEngine.instance = null;
+  }
+};
+
+// src/utils/mcpCompact.ts
+function mcpCompactToolDescriptions() {
+  const v = process.env.LIOP_MCP_COMPACT_TOOL_DESCRIPTIONS?.toLowerCase().trim();
+  if (v === "0" || v === "false" || v === "no") return false;
+  return true;
+}
+function stripVerboseLiopToolDescription(description) {
+  let d = description;
+  const markers = [
+    "\n\n[LIOP-PROTO-V1:",
+    "\r\n\r\n[LIOP-PROTO-V1:",
+    "\n[LIOP-PROTO-V1:"
+    // rare
+  ];
+  for (const m of markers) {
+    const i = d.indexOf(m);
+    if (i !== -1) {
+      d = d.slice(0, i);
+      break;
+    }
+  }
+  return d.trimEnd();
+}
+
+// src/gateway/router.ts
+var MANIFEST_CACHE_TTL_S = 300;
+var MANIFEST_DISCOVERY_RETRIES = 5;
+var LiopMcpRouter = class _LiopMcpRouter {
+  constructor(liopServer, meshNode = null, defaultRpcPort = 50051) {
+    this.liopServer = liopServer;
+    this.meshNode = meshNode;
+    this.defaultRpcPort = defaultRpcPort;
+    if (this.meshNode) {
+      this.meshNode.registerManifestHandler(() => {
+        const remoteTools = this.liopServer.listTools().map((t) => ({
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema
+        }));
+        const resources = this.liopServer.listResources().map((r) => ({
+          name: r.name,
+          uri: r.uri,
+          description: r.description,
+          mimeType: r.mimeType
+        }));
+        const serverConfig = this.liopServer.config;
+        return {
+          peerId: this.meshNode?.getPeerId() || "unknown",
+          grpcPort: this.defaultRpcPort,
+          tools: [...remoteTools],
+          resources,
+          serverInfo: this.liopServer.getServerInfo(),
+          authRequired: this.liopServer.jwtValidator !== void 0,
+          tokenSlug: serverConfig?.tokenSlug,
+          taxonomy: serverConfig?.taxonomy ? {
+            domain: serverConfig.taxonomy.domain || "Unknown Domain",
+            clearanceTier: serverConfig.taxonomy.clearanceTier ?? 0,
+            executionTypes: serverConfig.taxonomy.executionTypes || []
+          } : void 0
+        };
+      });
+      this.meshNode.announceManifest().catch((err) => {
+        log.info(
+          `[LIOP-Router] Failed to announce manifest: ${err instanceof Error ? err.message : String(err)}`
+        );
+      });
+    }
+    if (process.env.LIOP_DIAGNOSTIC_LEVEL === "full") {
+      process.stderr.write(
+        "\u26A0\uFE0F [LIOP-Security] Diagnostic level set to FULL \u2014 PeerIDs and network topology are exposed. Do NOT use in production.\n"
+      );
+    }
+  }
+  /** Cached manifests from remote peers. Key = PeerID */
+  manifestCache = /* @__PURE__ */ new Map();
+  /** Guards against concurrent discovery storms */
+  currentDiscovery = null;
+  /** Verifier for Tier-0 integrity checks */
+  verifier = new LiopVerifier();
+  /** Callback when new remote tools are discovered */
+  onToolsChanged;
+  /** Circuit-breaker state for peers that repeatedly fail manifest queries. */
+  manifestFailureState = /* @__PURE__ */ new Map();
+  static MANIFEST_FAILURE_BASE_COOLDOWN_MS = 15e3;
+  static MANIFEST_FAILURE_MAX_COOLDOWN_MS = 5 * 6e4;
+  static MANIFEST_SKIP_LOG_THROTTLE_MS = 3e4;
+  shouldSkipManifestQuery(peerId) {
+    const state = this.manifestFailureState.get(peerId);
+    if (!state) return false;
+    const now = Date.now();
+    if (now >= state.cooldownUntil) return false;
+    if (now - state.lastSkipLogAt > _LiopMcpRouter.MANIFEST_SKIP_LOG_THROTTLE_MS) {
+      log.info(
+        `[LIOP-Router] Skipping manifest query for ${peerId} during cooldown (${Math.ceil((state.cooldownUntil - now) / 1e3)}s remaining)`
+      );
+      state.lastSkipLogAt = now;
+    }
+    return true;
+  }
+  recordManifestQuerySuccess(peerId) {
+    this.manifestFailureState.delete(peerId);
+  }
+  recordManifestQueryFailure(peerId) {
+    const now = Date.now();
+    const prev = this.manifestFailureState.get(peerId);
+    const failures = (prev?.failures || 0) + 1;
+    const backoff = Math.min(
+      _LiopMcpRouter.MANIFEST_FAILURE_BASE_COOLDOWN_MS * 2 ** Math.max(0, failures - 1),
+      _LiopMcpRouter.MANIFEST_FAILURE_MAX_COOLDOWN_MS
+    );
+    this.manifestFailureState.set(peerId, {
+      failures,
+      cooldownUntil: now + backoff,
+      lastSkipLogAt: 0
+    });
+  }
+  async dispatch(request, authInfo) {
+    const { method, params, id } = request;
+    log.info(`[LIOP-Router] Processing: ${method}`);
+    if (this.liopServer.jwtValidator) {
+      const authResult = authorizeRequest(method, authInfo ?? null);
+      if (!authResult.allowed) {
+        log.info(
+          `[LIOP-Router] RBAC Access Denied for method '${method}': ${authResult.reason}`
+        );
+        return {
+          jsonrpc: "2.0",
+          id,
+          error: {
+            code: -32099,
+            // Custom authentication/authorization failure code
+            message: authResult.reason || "Access Denied"
+          }
+        };
+      }
+    }
+    switch (method) {
+      case "initialize":
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            protocolVersion: "2025-11-25",
+            capabilities: {
+              tools: { listChanged: true },
+              resources: { listChanged: true },
+              prompts: { listChanged: true }
+            },
+            serverInfo: this.liopServer.getServerInfo()
+          }
+        };
+      case "notifications/initialized":
+        this.kickDiscoveryAfterInitialized().catch(() => {
+        });
+        return null;
+      case "notifications/cancelled":
+        return null;
+      // No-op for MCP spec compliance
+      case "ping":
+        return { jsonrpc: "2.0", id, result: {} };
+      case "tools/list": {
+        const localTools = this.liopServer.listTools();
+        const remoteTools = await this.getRemoteTools();
+        const listedLocals = mcpCompactToolDescriptions() ? localTools.map((t) => ({
+          ...t,
+          description: stripVerboseLiopToolDescription(t.description ?? "")
+        })) : localTools;
+        log.info(
+          `[LIOP-Router] tools/list: ${localTools.length} local, ${remoteTools.length} remote tools found`
+        );
+        const diagnosticTool = {
+          name: "LiopMeshStatus",
+          description: "LiopMeshStatus: Returns the current dynamic diagnostic status of the Zero-Trust Neural Mesh.",
+          inputSchema: {
+            type: "object",
+            properties: {},
+            additionalProperties: false
+          }
+        };
+        const allTools = [diagnosticTool, ...listedLocals, ...remoteTools];
+        const telemetry = TokenTelemetryEngine.getInstance();
+        const toolsPayload = JSON.stringify(allTools);
+        const toolsResponsePayload = JSON.stringify({ tools: allTools });
+        telemetry.record({
+          type: "tools_list",
+          method: "tools/list",
+          estimatedInputTokens: telemetry.countTokens(toolsPayload),
+          estimatedOutputTokens: telemetry.countTokens(toolsResponsePayload)
+        });
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            tools: allTools
+          }
+        };
+      }
+      case "tools/call":
+        return this.transcodeMcpToLiop(
+          id,
+          params,
+          authInfo?.token
+        );
+      case "resources/list": {
+        const localResources = this.liopServer.listResources();
+        const remoteResources = await this.getRemoteResources();
+        const allResources = [...localResources, ...remoteResources];
+        const rlTelemetry = TokenTelemetryEngine.getInstance();
+        const rlPayload = JSON.stringify(allResources);
+        rlTelemetry.record({
+          type: "resource_list",
+          method: "resources/list",
+          estimatedInputTokens: 0,
+          estimatedOutputTokens: rlTelemetry.countTokens(rlPayload)
+        });
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: { resources: allResources }
+        };
+      }
+      case "resources/read": {
+        const typedParams = params;
+        if (!typedParams?.uri)
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: { code: -32602, message: "Missing resource uri" }
+          };
+        try {
+          const rrStartTime = Date.now();
+          const result = await this.liopServer.readResource(typedParams.uri);
+          const rrTelemetry = TokenTelemetryEngine.getInstance();
+          const rrOutputPayload = JSON.stringify(result);
+          rrTelemetry.record({
+            type: "resource_read",
+            method: "resources/read",
+            toolName: typedParams.uri,
+            estimatedInputTokens: rrTelemetry.countTokens(typedParams.uri),
+            estimatedOutputTokens: rrTelemetry.countTokens(rrOutputPayload),
+            durationMs: Date.now() - rrStartTime
+          });
+          return { jsonrpc: "2.0", id, result };
+        } catch (err) {
+          const targetUri = typedParams.uri;
+          for (const { manifest } of this.manifestCache.values()) {
+            const remoteResource = manifest.resources.find(
+              (r) => r.uri === targetUri
+            );
+            if (remoteResource) {
+              log.info(
+                `[LIOP-Router] Resolved resource ${targetUri} from cache (Peer: ${manifest.peerId})`
+              );
+              return {
+                jsonrpc: "2.0",
+                id,
+                result: {
+                  contents: [
+                    {
+                      uri: remoteResource.uri,
+                      mimeType: remoteResource.mimeType || "text/plain",
+                      text: remoteResource.text || remoteResource.description || "No content provided"
+                    }
+                  ]
+                }
+              };
+            }
+          }
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: {
+              code: -32e3,
+              message: err instanceof Error ? err.message : String(err)
+            }
+          };
+        }
+      }
+      case "prompts/list": {
+        const promptsList = this.liopServer.listPrompts();
+        const plTelemetry = TokenTelemetryEngine.getInstance();
+        const plPayload = JSON.stringify(promptsList);
+        plTelemetry.record({
+          type: "prompt_list",
+          method: "prompts/list",
+          estimatedInputTokens: 0,
+          estimatedOutputTokens: plTelemetry.countTokens(plPayload)
+        });
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: { prompts: promptsList }
+        };
+      }
+      case "prompts/get": {
+        const typedParams = params;
+        if (!typedParams?.name)
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: { code: -32602, message: "Missing prompt name" }
+          };
+        try {
+          const pgStartTime = Date.now();
+          const result = await this.liopServer.getPrompt({
+            name: typedParams.name,
+            arguments: typedParams.arguments || {}
+          });
+          const pgTelemetry = TokenTelemetryEngine.getInstance();
+          const pgInputPayload = JSON.stringify({
+            name: typedParams.name,
+            arguments: typedParams.arguments
+          });
+          const pgOutputPayload = JSON.stringify(result);
+          pgTelemetry.record({
+            type: "prompt_get",
+            method: "prompts/get",
+            toolName: typedParams.name,
+            estimatedInputTokens: pgTelemetry.countTokens(pgInputPayload),
+            estimatedOutputTokens: pgTelemetry.countTokens(pgOutputPayload),
+            durationMs: Date.now() - pgStartTime
+          });
+          return { jsonrpc: "2.0", id, result };
+        } catch (err) {
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: {
+              code: -32e3,
+              message: err instanceof Error ? err.message : String(err)
+            }
+          };
+        }
+      }
+      default:
+        return {
+          jsonrpc: "2.0",
+          id,
+          error: { code: -32601, message: `Method not found: ${method}` }
+        };
+    }
+  }
+  /**
+   * MCP clients often send notifications/initialized then immediately tools/list.
+   * Start manifest discovery without blocking the notification handler.
+   */
+  kickDiscoveryAfterInitialized() {
+    return (async () => {
+      await new Promise((r) => setTimeout(r, 250));
+      await Promise.race([
+        this.refreshManifestCache(true),
+        new Promise((r) => setTimeout(r, 15e3))
+      ]).catch(() => {
+      });
+    })();
+  }
+  /**
+   * Discovers and caches manifests from all remote LIOP providers in the mesh.
+   * Uses Kademlia DHT to find "liop:manifest" providers, then opens
+   * /liop/manifest/1.0.0 protocol streams to retrieve their full metadata.
+   */
+  async refreshManifestCache(silent = false) {
+    if (!this.meshNode) return;
+    if (this.currentDiscovery) return this.currentDiscovery;
+    if (!silent && this.manifestCache.size > 0) {
+      const now = Date.now();
+      const allFresh = Array.from(this.manifestCache.values()).every(
+        ({ cachedAt }) => now - cachedAt < MANIFEST_CACHE_TTL_S * 1e3
+      );
+      if (allFresh) return;
+    }
+    this.currentDiscovery = (async () => {
+      try {
+        const prevCount = Array.from(this.manifestCache.values()).reduce(
+          (acc, { manifest }) => acc + manifest.tools.length,
+          0
+        );
+        if (this.manifestCache.size === 0) {
+          for (let i = 0; i < 3; i++) {
+            const connections = (
+              // biome-ignore lint/suspicious/noExplicitAny: access internal nodes for connection count
+              this.meshNode.node?.getConnections().length || 0
+            );
+            if (connections > 0) {
+              log.info(
+                `[LIOP-Router] P2P Connection established. Starting discovery...`
+              );
+              break;
+            }
+            log.info(
+              `[LIOP-Router] Waiting for P2P connections (attempt ${i + 1}/10)...`
+            );
+            await new Promise((r) => setTimeout(r, 1e3));
+          }
+        }
+        let providerIds = [];
+        const MAX_COLD_ATTEMPTS = this.manifestCache.size === 0 ? 5 : 1;
+        for (let coldAttempt = 0; coldAttempt < MAX_COLD_ATTEMPTS; coldAttempt++) {
+          for (let attempt = 0; attempt < MANIFEST_DISCOVERY_RETRIES; attempt++) {
+            providerIds = await this.meshNode?.discoverManifestProviders() || [];
+            const selfId2 = this.meshNode?.getPeerId();
+            const remoteIds = providerIds.filter((id) => id !== selfId2);
+            if (remoteIds.length > 0) break;
+            if (attempt < MANIFEST_DISCOVERY_RETRIES - 1) {
+              log.info(
+                `[LIOP-Router] DHT discovery attempt ${attempt + 1}/${MANIFEST_DISCOVERY_RETRIES}...`
+              );
+              await new Promise((r) => setTimeout(r, 1e3));
+            }
+          }
+          const activePeers = (
+            // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
+            this.meshNode.node?.getConnections().map(
+              (c) => c.remotePeer.toString()
+            ) || []
+          );
+          if (activePeers.length > 0) {
+            providerIds = Array.from(/* @__PURE__ */ new Set([...providerIds, ...activePeers]));
+          }
+          const selfIdEnd = this.meshNode?.getPeerId();
+          const remoteIdsEnd = providerIds.filter((id) => id !== selfIdEnd);
+          if (remoteIdsEnd.length > 0) break;
+          if (coldAttempt < MAX_COLD_ATTEMPTS - 1) {
+            log.info(
+              `[LIOP-Router] Initial discovery failed (0 providers). Retrying in 1s (${coldAttempt + 1}/${MAX_COLD_ATTEMPTS})...`
+            );
+            await new Promise((r) => setTimeout(r, 1e3));
+          }
+        }
+        if (providerIds.length === 0) {
+          log.info(
+            `[LIOP-Router] No manifest providers found after all attempts.`
+          );
+          return;
+        }
+        if (!silent) {
+          log.info(
+            `[LIOP-Router] Discovered ${providerIds.length} candidate manifest providers`
+          );
+        }
+        const connectedPeers = new Set(
+          // biome-ignore lint/suspicious/noExplicitAny: internal node access for fast peer ordering
+          (this.meshNode.node?.getConnections?.() || []).map(
+            (c) => c.remotePeer.toString()
+          )
+        );
+        providerIds = [...providerIds].sort((a, b) => {
+          const aConnected = connectedPeers.has(a) ? 1 : 0;
+          const bConnected = connectedPeers.has(b) ? 1 : 0;
+          return bConnected - aConnected;
+        });
+        let successCount = 0;
+        let errorCount = 0;
+        let cacheUpdated = false;
+        const selfId = this.meshNode?.getPeerId();
+        const eligiblePeers = providerIds.filter((peerId) => {
+          if (!this.meshNode) return false;
+          if (peerId === selfId) return false;
+          if (this.shouldSkipManifestQuery(peerId)) return false;
+          const cached = this.manifestCache.get(peerId);
+          if (cached && Date.now() - cached.cachedAt < MANIFEST_CACHE_TTL_S * 1e3) {
+            successCount++;
+            return false;
+          }
+          return true;
+        });
+        const queryResults = await Promise.allSettled(
+          eligiblePeers.map(async (peerId) => {
+            if (!this.meshNode) return null;
+            log.info(`[LIOP-Router] Querying manifest from: ${peerId}`);
+            return {
+              peerId,
+              manifest: await this.meshNode.queryManifest(peerId)
+            };
+          })
+        );
+        for (const result of queryResults) {
+          if (result.status === "fulfilled" && result.value?.manifest) {
+            const { peerId, manifest } = result.value;
+            this.manifestCache.set(peerId, {
+              manifest,
+              cachedAt: Date.now()
+            });
+            this.recordManifestQuerySuccess(peerId);
+            cacheUpdated = true;
+            successCount++;
+            log.info(
+              `[LIOP-Router] Manifest received from ${peerId} (${manifest.tools.length} tools)`
+            );
+          } else if (result.status === "fulfilled" && result.value) {
+            this.recordManifestQueryFailure(result.value.peerId);
+            errorCount++;
+            log.info(
+              `[LIOP-Router] Manifest query returned NULL for ${result.value.peerId}`
+            );
+          } else if (result.status === "rejected") {
+            errorCount++;
+            log.info(
+              `[LIOP-Router] Fatal error querying manifest:`,
+              result.reason instanceof Error ? result.reason.message : String(result.reason)
+            );
+          }
+        }
+        this._discoveryStats = {
+          candidates: providerIds.length,
+          success: successCount,
+          failures: errorCount,
+          lastDiscovery: Date.now()
+        };
+        if (cacheUpdated) {
+          const newCount = Array.from(this.manifestCache.values()).reduce(
+            (acc, { manifest }) => acc + manifest.tools.length,
+            0
+          );
+          if (newCount !== prevCount && this.onToolsChanged) {
+            process.stderr.write(
+              "[LIOP-Router] Mesh topology updated! Emitting notifications/tools/list_changed.\n"
+            );
+            this.onToolsChanged();
+          }
+        }
+      } finally {
+        this.currentDiscovery = null;
+      }
+    })();
+    return this.currentDiscovery;
+  }
+  /**
+   * Returns the current manifest cache size for external telemetry.
+   * Used by the adaptive polling system to detect topology stabilization.
+   */
+  getCacheSize() {
+    return this.manifestCache.size;
+  }
+  /**
+   * Returns all remote tools discovered via the manifest protocol.
+   */
+  async getRemoteTools() {
+    const EXPECTED_PROVIDERS = Number.parseInt(
+      process.env.LIOP_EXPECTED_PROVIDERS ?? "1",
+      10
+    );
+    if (this.manifestCache.size < EXPECTED_PROVIDERS && this.meshNode) {
+      const initialTimeoutMs = Number.parseInt(
+        process.env.LIOP_INITIAL_DISCOVERY_TIMEOUT_MS ?? "8000",
+        10
+      );
+      const boundedTimeoutMs = Number.isFinite(initialTimeoutMs) && initialTimeoutMs > 0 ? initialTimeoutMs : 12e3;
+      const deadline = Date.now() + boundedTimeoutMs;
+      let stableCount = 0;
+      let lastCacheSize = -1;
+      while (Date.now() < deadline) {
+        if (this.manifestCache.size >= EXPECTED_PROVIDERS) break;
+        await Promise.race([
+          this.refreshManifestCache(true),
+          new Promise((resolve) => setTimeout(resolve, 3e3))
+        ]).catch(() => {
+        });
+        if (this.manifestCache.size >= EXPECTED_PROVIDERS) break;
+        if (this.manifestCache.size === lastCacheSize) {
+          stableCount++;
+          if (stableCount >= 3 && this.manifestCache.size > 0) {
+            log.info(
+              `[LIOP-Router] Provider count stabilized at ${this.manifestCache.size}/${EXPECTED_PROVIDERS}. Proceeding with available mesh.`
+            );
+            break;
+          }
+        } else {
+          stableCount = 0;
+          lastCacheSize = this.manifestCache.size;
+        }
+        await new Promise((r) => setTimeout(r, 1e3));
+      }
+      if (this.manifestCache.size < EXPECTED_PROVIDERS) {
+        log.info(
+          `[LIOP-Router] \u26A0\uFE0F Mesh partially available: ${this.manifestCache.size}/${EXPECTED_PROVIDERS} providers. Some tools may be unavailable. Check Docker containers.`
+        );
+        this.refreshManifestCache(true).catch(() => {
+        });
+      }
+    }
+    const tools = [];
+    const seenNames = /* @__PURE__ */ new Set();
+    const localToolNames = new Set(
+      this.liopServer.listTools().map((t) => t.name)
+    );
+    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
+      for (const tool of manifest.tools) {
+        if (tool.name === "LiopMeshStatus") continue;
+        let finalName = tool.name;
+        if (seenNames.has(tool.name) || localToolNames.has(tool.name)) {
+          finalName = `${tool.name}_${peerId.slice(-4)}`;
+        }
+        seenNames.add(finalName);
+        const providerName = manifest.serverInfo?.name || "Unknown Provider";
+        const baseDesc = tool.description || `Remote tool from ${providerName}`;
+        const cleanTool = {
+          name: finalName,
+          description: mcpCompactToolDescriptions() ? stripVerboseLiopToolDescription(baseDesc) : baseDesc,
+          inputSchema: tool.inputSchema || {
+            type: "object",
+            properties: {}
+          }
+        };
+        if (typeof cleanTool.inputSchema === "object" && !cleanTool.inputSchema.type) {
+          cleanTool.inputSchema.type = "object";
+        }
+        if (typeof cleanTool.inputSchema === "object" && !cleanTool.inputSchema.properties) {
+          cleanTool.inputSchema.properties = {};
+        }
+        let blueprint = "";
+        if (manifest.taxonomy) {
+          blueprint = `
+[LIOP-DOMAIN: ${manifest.taxonomy.domain}]`;
+        }
+        const properties = cleanTool.inputSchema.properties || {};
+        let envelopeDoc = "";
+        if (!mcpCompactToolDescriptions() && properties.payload) {
+          envelopeDoc = `
+[REQUIRES: LIOP-PROTO-V1 ENVELOPE]`;
+        }
+        if (!mcpCompactToolDescriptions() && cleanTool.description.includes("STRICT SCHEMA ADHERENCE")) {
+          cleanTool.description = cleanTool.description.replace(
+            "STRICT SCHEMA ADHERENCE:",
+            "[INDUSTRIAL-REQUISITE] STRICT SCHEMA ADHERENCE (MANDATORY):"
+          );
+        }
+        const originStamp = mcpCompactToolDescriptions() ? `
+(Peer: ${peerId.slice(-8)})${blueprint}` : `
+(Origin: ${peerId.slice(-8)})${blueprint}${envelopeDoc}`;
+        cleanTool.description = `${cleanTool.description}${originStamp}`;
+        tools.push(cleanTool);
+      }
+    }
+    return tools;
+  }
+  /**
+   * Returns all remote resources discovered via the manifest protocol.
+   */
+  async getRemoteResources() {
+    if (!this.currentDiscovery) {
+      this.refreshManifestCache(true).catch(() => {
+      });
+    }
+    const resources = [];
+    const seenUris = new Set(this.liopServer.listResources().map((r) => r.uri));
+    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
+      for (const resource of manifest.resources) {
+        if (!seenUris.has(resource.uri)) {
+          const augmentedResource = { ...resource };
+          const providerName = manifest.serverInfo?.name || "Unknown Provider";
+          let blueprint = "";
+          if (manifest.taxonomy) {
+            blueprint = `
+
+[LIOP Zero-Trust Blueprint]
+Domain: ${manifest.taxonomy.domain}
+Clearance Tier: ${manifest.taxonomy.clearanceTier}`;
+            if (manifest.taxonomy.executionTypes && manifest.taxonomy.executionTypes.length > 0) {
+              blueprint += `
+Execution Types: ${manifest.taxonomy.executionTypes.join(", ")}`;
+            }
+          }
+          const originStamp = `
+
+[LIOP Zero-Trust Origin]
+Provider: ${providerName}
+Network ID: ${peerId}${blueprint}`;
+          if (augmentedResource.uri.startsWith("liop://schema/")) {
+            augmentedResource.name = `[SCHEMA] ${augmentedResource.name}`;
+            augmentedResource.description = `[CRITICAL SCHEMA] ${augmentedResource.description || "Data Dictionary for Zero-Shot Autonomy"}${originStamp}`;
+          } else {
+            augmentedResource.description = augmentedResource.description ? `${augmentedResource.description}${originStamp}` : originStamp.trim();
+          }
+          resources.push(augmentedResource);
+          seenUris.add(resource.uri);
+        }
+      }
+    }
+    return resources;
+  }
+  /**
+   * Resolves the gRPC target (host:port) AND the peerId for a given tool name
+   * by searching the manifest cache. Supports exact names and suffixed names.
+   */
+  resolveManifestTarget(toolName) {
+    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
+      const tool = manifest.tools.find((t) => t.name === toolName);
+      if (tool) {
+        return {
+          peerId,
+          originalToolName: toolName
+        };
+      }
+    }
+    const parts = toolName.split("_");
+    if (parts.length > 1) {
+      const suffix = parts.pop();
+      const baseName = parts.join("_");
+      for (const [peerId, { manifest }] of this.manifestCache.entries()) {
+        if (peerId.endsWith(suffix || "")) {
+          const tool = manifest.tools.find((t) => t.name === baseName);
+          if (tool) {
+            return {
+              peerId,
+              originalToolName: baseName
+            };
+          }
+        }
+      }
+    }
+    return null;
+  }
+  /**
+   * Redacts a PeerID for external-facing diagnostics.
+   * LIOP_DIAGNOSTIC_LEVEL controls verbosity:
+   *   - "redacted" (default): truncated to last 8 chars
+   *   - "full": complete PeerID (development only)
+   */
+  redactPeerId(peerId) {
+    const level = process.env.LIOP_DIAGNOSTIC_LEVEL || "redacted";
+    if (level === "full") return peerId;
+    return `***${peerId.slice(-8)}`;
+  }
+  async transcodeMcpToLiop(id, params, token) {
+    const toolName = params.name;
+    if (toolName === "LiopMeshStatus") {
+      this.refreshManifestCache(true).catch(() => {
+      });
+      const stats = this._discoveryStats || {
+        candidates: 0,
+        success: 0,
+        failures: 0
+      };
+      const providerCount = this.manifestCache.size;
+      const meshState = this.meshNode ? "Active" : "Offline";
+      const cachedTools = Array.from(this.manifestCache.values()).reduce(
+        (acc, { manifest }) => acc + manifest.tools.length,
+        0
+      );
+      const connections = this.meshNode ? (
+        // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
+        this.meshNode.node?.getConnections().length
+      ) : 0;
+      const bootstrapNodes = this.meshNode && // biome-ignore lint/suspicious/noExplicitAny: access internal config
+      this.meshNode.config?.bootstrapNodes ? (
+        // biome-ignore lint/suspicious/noExplicitAny: access internal config
+        this.meshNode.config.bootstrapNodes
+      ) : [];
+      const bootstrapCount = bootstrapNodes.length;
+      const diagLevel = process.env.LIOP_DIAGNOSTIC_LEVEL || "redacted";
+      const showBootstraps = diagLevel !== "minimal";
+      const bootstrapList = showBootstraps ? bootstrapNodes.map((addr) => {
+        const parts = addr.split("/");
+        const id2 = parts[parts.length - 1];
+        return `  \u2022 ${id2 ? id2.slice(-8) : "Unknown"} (bootstrap)`;
+      }).join("\n") : "";
+      const routingTableSize = this.meshNode ? (
+        // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
+        this.meshNode.getRoutingTableSize()
+      ) : 0;
+      const rawPeerId = this.meshNode?.getPeerId() || "Offline";
+      const localPeerId = rawPeerId === "Offline" ? rawPeerId : this.redactPeerId(rawPeerId);
+      const cachedToolList = Array.from(this.manifestCache.entries()).flatMap(
+        ([peerId, { manifest }]) => manifest.tools.map(
+          (t) => `  \u2022 ${t.name} (from origin: ${this.redactPeerId(peerId)})`
+        )
+      ).join("\n");
+      const statusText = [
+        `LIOP Mesh Status: ${meshState === "Active" ? "Active" : "Offline"}`,
+        `Local Agent Identity: ${localPeerId}`,
+        `Network: ${connections} Conns | ${routingTableSize} Mesh Nodes | ${bootstrapCount} Bootstraps`,
+        showBootstraps && bootstrapCount > 0 ? `
+Active Bootstraps:
+${bootstrapList}
+` : "",
+        `Discovery: ${stats.candidates} Candidates | ${stats.success} OK | ${stats.failures} FAIL`,
+        `Tooling: ${providerCount} Providers | ${cachedTools} Total Remote Tools`,
+        cachedTools > 0 ? `
+Discovered Remote Tools (Zero-Trust Origins):
+${cachedToolList}` : "\nNo remote tools discovered yet.",
+        // [Token Economy] Telemetry block (only appears when operations exist)
+        TokenTelemetryEngine.getInstance().formatStatusBlock()
+      ].filter((line) => line !== "").join("\n");
+      const diagTelemetry = TokenTelemetryEngine.getInstance();
+      diagTelemetry.record({
+        type: "diagnostic",
+        method: "tools/call",
+        toolName: "LiopMeshStatus",
+        estimatedInputTokens: 0,
+        estimatedOutputTokens: diagTelemetry.countTokens(statusText)
+      });
+      return {
+        jsonrpc: "2.0",
+        id,
+        result: {
+          content: [
+            {
+              type: "text",
+              text: statusText
+            }
+          ]
+        }
+      };
+    }
+    const isLocal = this.liopServer.listTools().some((t) => t.name === toolName);
+    if (!isLocal && this.meshNode) {
+      let target = this.resolveManifestTarget(toolName);
+      if (!target) {
+        await this.refreshManifestCache();
+        target = this.resolveManifestTarget(toolName);
+      }
+      if (target) {
+        log.info(
+          `[LIOP-Router] Resolved ${toolName} via manifest cache (Peer: ${target.peerId}, Original: ${target.originalToolName})`
+        );
+        const manifestEntry = this.manifestCache.get(target.peerId);
+        let effectiveToken = token;
+        if (manifestEntry?.manifest.authRequired) {
+          const resolvedToken = token || await this.getOrAcquireMeshAgentToken(target.peerId);
+          if (!resolvedToken) {
+            const providerName = manifestEntry.manifest.serverInfo?.name?.toLowerCase() || "unknown";
+            const slug = manifestEntry.manifest.tokenSlug;
+            const shortId = target.peerId.slice(-8).toUpperCase();
+            const primaryVar = slug ? `LIOP_TOKEN_${slug}` : `LIOP_TOKEN_${providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
+            return {
+              jsonrpc: "2.0",
+              id,
+              result: {
+                content: [
+                  {
+                    type: "text",
+                    text: `Authentication Required: The restricted node (${providerName}) requires an access token. Please define the ${primaryVar} or LIOP_TOKEN_${shortId} environment variable on your agent/client host.`
+                  }
+                ],
+                isError: true
+              }
+            };
+          }
+          effectiveToken = resolvedToken;
+        }
+        return this.routeToRemoteProvider(
+          id,
+          target.originalToolName,
+          target.peerId,
+          params,
+          effectiveToken
+        );
+      }
+      let providers = [];
+      for (let i = 0; i < 3; i++) {
+        providers = await this.meshNode.findProviders(toolName);
+        if (providers.length > 0) break;
+        if (i < 2) await new Promise((r) => setTimeout(r, 1e3));
+      }
+      if (providers.length > 0) {
+        return this.routeToRemoteProvider(
+          id,
+          toolName,
+          providers[0],
+          params,
+          token
+        );
+      }
+    }
+    if (isLocal) {
+      try {
+        const localStartTime = Date.now();
+        const result = await this.liopServer.callTool({
+          name: toolName,
+          arguments: params.arguments || {}
+        });
+        const localTelemetry = TokenTelemetryEngine.getInstance();
+        const localInputPayload = JSON.stringify(params.arguments || {});
+        const localOutputPayload = JSON.stringify(result);
+        localTelemetry.record({
+          type: "tool_call",
+          method: "tools/call",
+          toolName,
+          estimatedInputTokens: localTelemetry.countTokens(localInputPayload),
+          estimatedOutputTokens: localTelemetry.countTokens(localOutputPayload),
+          durationMs: Date.now() - localStartTime
+        });
+        return { jsonrpc: "2.0", id, result };
+      } catch (err) {
+        return {
+          jsonrpc: "2.0",
+          id,
+          error: {
+            code: -32e3,
+            message: err instanceof Error ? err.message : String(err)
+          }
+        };
+      }
+    }
+    return {
+      jsonrpc: "2.0",
+      id,
+      error: {
+        code: -32002,
+        message: `No provider found for tool: ${toolName}. Ensure the provider node is active and connected to the mesh.`
+      }
+    };
+  }
+  async routeToRemoteProvider(id, toolName, peerId, params, token) {
+    if (!this.meshNode)
+      return {
+        jsonrpc: "2.0",
+        id,
+        error: { code: -32603, message: "Mesh Node inactive" }
+      };
+    let manifestEntry = this.manifestCache.get(peerId);
+    let grpcPort = this.defaultRpcPort;
+    if (manifestEntry) {
+      grpcPort = manifestEntry.manifest.grpcPort;
+    } else {
+      const manifest = await this.meshNode.queryManifest(peerId);
+      if (manifest) {
+        grpcPort = manifest.grpcPort;
+        this.manifestCache.set(peerId, {
+          manifest,
+          cachedAt: Date.now()
+        });
+        manifestEntry = this.manifestCache.get(peerId);
+      }
+    }
+    const shouldRemapGrpcPorts = process.env.LIOP_USE_PUBLISHED_GRPC_PORTS === "1" || process.env.LIOP_DOCKER_MAP === "true" || process.env.LIOP_DEV_MODE === "true" || process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test";
+    if (shouldRemapGrpcPorts && manifestEntry) {
+      const providerName = manifestEntry.manifest.serverInfo?.name?.toLowerCase() || "";
+      if (providerName.includes("vault")) grpcPort = 13011;
+      else if (providerName.includes("bank")) grpcPort = 13021;
+      else if (providerName.includes("oracle")) grpcPort = 13031;
+    }
+    const addrs = await this.meshNode.resolvePeer(peerId);
+    let targetAddr = null;
+    const os = await import('os');
+    const localInterfaces = Object.values(os.networkInterfaces()).flat().filter((i) => i?.family === "IPv4").map((i) => i?.address);
+    for (const addr of addrs) {
+      const parts = addr.split("/");
+      const ipIdx = parts.indexOf("ip4");
+      if (ipIdx !== -1) {
+        const advertisedIp = parts[ipIdx + 1];
+        if (advertisedIp === "127.0.0.1" || localInterfaces.includes(advertisedIp)) {
+          targetAddr = `127.0.0.1:${grpcPort}`;
+          break;
+        }
+        if (!targetAddr) {
+          targetAddr = `${advertisedIp}:${grpcPort}`;
+        }
+      }
+    }
+    if (!targetAddr) {
+      targetAddr = `127.0.0.1:${grpcPort}`;
+    }
+    log.info(
+      `[LIOP-Router] Dynamic route: ${toolName} -> ${targetAddr} (PeerID: ${peerId})`
+    );
+    const remoteClient = new liopV1.LogicMesh(
+      targetAddr,
+      createChannelCredentials()
+    );
+    return this.performTranscoding(
+      id,
+      remoteClient,
+      toolName,
+      params,
+      peerId,
+      token
+    );
+  }
+  /** Cached M2M token for dynamic gateway-to-node routing */
+  meshAgentToken;
+  /**
+   * Dynamically acquires an M2M access token from the Nexus Authorization Server.
+   * If peerId is provided, checks if there are node-specific environment tokens
+   * before falling back to the global static token or Nexus acquisition.
+   */
+  async getOrAcquireMeshAgentToken(peerId) {
+    if (peerId) {
+      const manifestEntry = this.manifestCache.get(peerId);
+      const providerName = manifestEntry?.manifest.serverInfo?.name?.toLowerCase() || "";
+      let nodeToken;
+      const slug = manifestEntry?.manifest.tokenSlug;
+      if (slug) {
+        const envKey = `LIOP_TOKEN_${slug}`;
+        nodeToken = process.env[envKey] || process.env[`LIOP_OAUTH_TOKEN_${slug}`];
+        log.info(
+          `[LIOP-Router] Step0 tokenSlug=${slug} envKey=${envKey} found=${!!nodeToken} peer=${peerId.slice(-8)}`
+        );
+      } else {
+        log.info(
+          `[LIOP-Router] Step0 tokenSlug=MISSING (manifest has no tokenSlug) peer=${peerId.slice(-8)} provider=${providerName}`
+        );
+      }
+      if (!nodeToken) {
+        const shortId = peerId.slice(-8).toUpperCase();
+        nodeToken = process.env[`LIOP_TOKEN_${shortId}`] || process.env[`LIOP_OAUTH_TOKEN_${shortId}`];
+      }
+      if (!nodeToken && providerName) {
+        const cleanName = providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        nodeToken = process.env[`LIOP_TOKEN_${cleanName}`] || process.env[`LIOP_OAUTH_TOKEN_${cleanName}`];
+      }
+      if (nodeToken) {
+        log.info(
+          `[LIOP-Router] Resolved node-specific token for peer ${peerId.slice(-8)} (${providerName || "unknown"})`
+        );
+        return nodeToken;
+      }
+    }
+    if (this.meshAgentToken) return this.meshAgentToken;
+    const staticToken = process.env.LIOP_OAUTH_TOKEN || process.env.LIOP_TOKEN;
+    if (staticToken) {
+      this.meshAgentToken = staticToken;
+      return this.meshAgentToken;
+    }
+    const nexusUrl = process.env.LIOP_NEXUS_URL;
+    if (!nexusUrl) return void 0;
+    const clientId = process.env.LIOP_OAUTH_CLIENT_ID || process.env.LIOP_CLIENT_ID || "liop-mesh-agent";
+    const clientSecret = process.env.LIOP_OAUTH_CLIENT_SECRET || process.env.LIOP_CLIENT_SECRET || "dev-secret-change-me";
+    const audience = process.env.LIOP_OAUTH_AUDIENCE || process.env.LIOP_AUDIENCE || "urn:liop:mesh:api";
+    try {
+      const baseUrl = nexusUrl.endsWith("/oidc") ? nexusUrl : `${nexusUrl}/oidc`;
+      const tokenUrl = `${baseUrl}/token`;
+      log.info(
+        `[LIOP-Router] Proactively acquiring M2M token from Nexus: ${tokenUrl}`
+      );
+      const params = new URLSearchParams({
+        grant_type: "client_credentials",
+        scope: "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query",
+        resource: audience,
+        client_id: clientId,
+        client_secret: clientSecret
+      });
+      const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: params.toString()
+      });
+      if (!response.ok) {
+        const text = await response.text();
+        log.warn(
+          `[LIOP-Router] M2M Token acquisition failed: ${response.status} ${text}`
+        );
+        return void 0;
+      }
+      const data = await response.json();
+      if (data.access_token) {
+        this.meshAgentToken = data.access_token;
+        log.info(
+          "[LIOP-Router] M2M Token acquired successfully for router routing."
+        );
+        return this.meshAgentToken;
+      }
+    } catch (err) {
+      log.warn(
+        `[LIOP-Router] Failed to acquire M2M token: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    return void 0;
+  }
+  async performTranscoding(id, client, toolName, params, peerId, token) {
+    const capabilityHash = toolName;
+    const proofOfIntent = this.meshNode ? await this.meshNode.sign(Buffer.from(capabilityHash)) : Buffer.from([]);
+    const transcodingStartTime = Date.now();
+    let activeToken = token;
+    if (!activeToken) {
+      activeToken = await this.getOrAcquireMeshAgentToken(peerId);
+    }
+    if (peerId) {
+      const manifestEntry = this.manifestCache.get(peerId);
+      if (manifestEntry?.manifest.authRequired && !activeToken) {
+        const providerName = manifestEntry.manifest.serverInfo?.name?.toLowerCase() || "unknown";
+        const slug = manifestEntry.manifest.tokenSlug;
+        const shortId = peerId.slice(-8).toUpperCase();
+        const primaryVar = slug ? `LIOP_TOKEN_${slug}` : `LIOP_TOKEN_${providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            content: [
+              {
+                type: "text",
+                text: `Authentication Required: The restricted node (${providerName}) requires an access token. Please define the ${primaryVar} or LIOP_TOKEN_${shortId} environment variable on your agent/client host.`
+              }
+            ],
+            isError: true
+          }
+        };
+      }
+    }
+    return new Promise((resolve) => {
+      const metadata = new grpc.Metadata();
+      if (activeToken) {
+        metadata.add("authorization", `Bearer ${activeToken}`);
+      }
+      client.negotiateIntent(
+        {
+          agent_did: `did:liop:${this.meshNode?.getPeerId() || "mcp-proxy"}`,
+          capability_hash: capabilityHash,
+          proof_of_intent: proofOfIntent
+        },
+        metadata,
+        async (err, response) => {
+          if (err || !response.accepted) {
+            return resolve({
+              jsonrpc: "2.0",
+              id,
+              result: {
+                content: [
+                  {
+                    type: "text",
+                    text: `PQC Handshake Failed: ${err?.message || "Rejected"}`
+                  }
+                ],
+                isError: true
+              }
+            });
+          }
+          const { ciphertext, sharedSecret } = await Kyber768Wrapper.encapsulateAsymmetric(
+            response.kyber_public_key
+          );
+          const embeddedArgsJson = JSON.stringify(params.arguments || {});
+          const proxyLogic = `return { "__liop_proxy_tool": "${toolName}", "__liop_proxy_args": ${embeddedArgsJson} };`;
+          const nonce = crypto2.randomBytes(12);
+          const sealedLogic = this.encryptWithNonce(
+            Buffer.from(proxyLogic),
+            sharedSecret,
+            nonce
+          );
+          const metadataCall = new grpc.Metadata();
+          if (activeToken) {
+            metadataCall.add("authorization", `Bearer ${activeToken}`);
+          }
+          const call = client.executeLogic(
+            {
+              session_token: response.session_token,
+              wasm_binary: new Uint8Array(sealedLogic),
+              inputs: {},
+              pqc_ciphertext: ciphertext,
+              aes_nonce: nonce
+            },
+            metadataCall
+          );
+          let resultBody = "";
+          let lastResponse = null;
+          call.on("data", (grpcRes) => {
+            resultBody += grpcRes.semantic_evidence;
+            lastResponse = grpcRes;
+          });
+          call.on("end", async () => {
+            try {
+              if (lastResponse) {
+                if (!lastResponse.is_error) {
+                  const proofHex = Buffer.from(
+                    lastResponse.cryptographic_proof
+                  ).toString("hex");
+                  const isValid = await this.verifier.verifyZkReceipt(
+                    Buffer.from(proxyLogic),
+                    proofHex,
+                    Buffer.from(lastResponse.zk_receipt),
+                    Buffer.from(sharedSecret),
+                    resultBody
+                  );
+                  if (!isValid) {
+                    return resolve({
+                      jsonrpc: "2.0",
+                      id,
+                      result: {
+                        content: [
+                          {
+                            type: "text",
+                            text: "SECURITY ALERT: Remote response failed cryptographic integrity audit."
+                          }
+                        ],
+                        isError: true
+                      }
+                    });
+                  }
+                }
+              }
+              const parsedResult = JSON.parse(resultBody);
+              const remoteTelemetry = TokenTelemetryEngine.getInstance();
+              remoteTelemetry.record({
+                type: "tool_call",
+                method: "tools/call",
+                toolName,
+                peerId,
+                estimatedInputTokens: remoteTelemetry.countTokens(embeddedArgsJson),
+                estimatedOutputTokens: remoteTelemetry.countTokens(resultBody),
+                durationMs: Date.now() - transcodingStartTime
+              });
+              resolve({ jsonrpc: "2.0", id, result: parsedResult });
+            } catch (_e) {
+              resolve({
+                jsonrpc: "2.0",
+                id,
+                result: { content: [{ type: "text", text: resultBody }] }
+              });
+            }
+          });
+          call.on(
+            "error",
+            (e) => resolve({
+              jsonrpc: "2.0",
+              id,
+              result: {
+                content: [
+                  { type: "text", text: `LIOP gRPC Error: ${e.message}` }
+                ],
+                isError: true
+              }
+            })
+          );
+        }
+      );
+    });
+  }
+  encryptWithNonce(payload, key, nonce) {
+    const cipher = crypto2.createCipheriv("aes-256-gcm", key, nonce);
+    const encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);
+    return Buffer.concat([encrypted, cipher.getAuthTag()]);
+  }
+};
+
+export { HeuristicTokenEstimator, LiopMcpRouter, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator };
+//# sourceMappingURL=chunk-Y73XGYY7.js.map
+//# sourceMappingURL=chunk-Y73XGYY7.js.map