@nekzus/liop 2.4.0-alpha.10 → 2.4.0-alpha.12

package/dist/bin/agent.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { probeTopology, RoutingTable } from '../chunk-UCVP3XAL.js';
 import { TokenManager } from '../chunk-ESRXG36Y.js';
-import { LiopServer } from '../chunk-HD2N3IJX.js';
+import { LiopServer } from '../chunk-UWC7OY7K.js';
 import '../chunk-Y62GORQF.js';
-import { LiopMcpRouter } from '../chunk-L6J72C5X.js';
+import { LiopMcpRouter } from '../chunk-V2TP43CD.js';
 import '../chunk-DZ2FQGJD.js';
 import '../chunk-PEN3KFLF.js';
 import '../chunk-IK7CGWAZ.js';
 import '../chunk-7PITYWOV.js';
 import '../chunk-VH4K4U45.js';
-import '../chunk-TKRX6CFI.js';
+import '../chunk-3BJ5QQHK.js';
 import '../chunk-PAICJCKJ.js';
 import { isLegacyRequest } from '../chunk-EG46XMJT.js';
 import '../chunk-FTF6AMF6.js';

package/dist/bridge.js

@@ -1,4 +1,4 @@
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-BOISQ45Z.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-U2KYB6FN.js';
 import './chunk-EG46XMJT.js';
 import './chunk-HA6YZ42O.js';
 //# sourceMappingURL=bridge.js.map

package/dist/{chunk-TKRX6CFI.js → chunk-3BJ5QQHK.js}

@@ -1,45 +1,14 @@
 import { log } from './chunk-HA6YZ42O.js';
+import * as fs from 'fs';
+import * as grpc from '@grpc/grpc-js';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import * as grpc2 from '@grpc/grpc-js';
 import * as protoLoader from '@grpc/proto-loader';
-import * as fs2 from 'fs';
 
-// src/rpc/channel-options.ts
-var GRPC_CHANNEL_OPTIONS = {
-  "grpc.keepalive_time_ms": 3e4,
-  "grpc.keepalive_timeout_ms": 1e4,
-  "grpc.keepalive_permit_without_calls": 1,
-  "grpc.max_send_message_length": -1,
-  "grpc.max_receive_message_length": -1,
-  "grpc.enable_retries": 1
-};
-var __filename2 = fileURLToPath(import.meta.url);
-var __dirname2 = path.dirname(__filename2);
-var PROD_PATHS = [
-  path.resolve(__dirname2, "./protocol/liop_core.proto"),
-  // Flat dist/ (tsup)
-  path.resolve(__dirname2, "../protocol/liop_core.proto")
-  // dist/rpc/ (tsc)
-];
-var DEV_PROTO_PATH = path.resolve(
-  __dirname2,
-  "../../../../protocol/proto/liop_core.proto"
-);
-var PROTO_PATH = PROD_PATHS.find((p) => fs2.existsSync(p)) || DEV_PROTO_PATH;
-if (!fs2.existsSync(PROTO_PATH)) {
-  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
-}
-var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
-  keepCase: true,
-  longs: String,
-  enums: String,
-  defaults: true,
-  oneofs: true
-});
-var liopProto = grpc2.loadPackageDefinition(packageDefinition);
-var liopV1 = liopProto.liop.v1;
 var isTlsEnforced = () => process.env.NODE_ENV === "production" || process.env.LIOP_ENFORCE_TLS === "true";
+var isTlsWarningSuppressed = (tls) => tls?.insecure === true || tls?.suppressWarning === true || process.env.LIOP_SUPPRESS_TLS_WARNING === "true";
+var hasWarnedInsecureServer = false;
+var hasWarnedInsecureChannel = false;
 function createServerCredentials(tls) {
   if (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {
     throw new Error(
@@ -56,7 +25,7 @@ function createServerCredentials(tls) {
           "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded."
         );
       }
-      return grpc2.ServerCredentials.createSsl(
+      return grpc.ServerCredentials.createSsl(
         rootCert,
         [{ cert_chain: certChain, private_key: privateKey }],
         Boolean(tls.mutualTls)
@@ -70,7 +39,7 @@ function createServerCredentials(tls) {
       log.warn(
         `[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`
       );
-      return grpc2.ServerCredentials.createInsecure();
+      return grpc.ServerCredentials.createInsecure();
     }
   }
   if (!tls?.certChain || !tls?.privateKey) {
@@ -79,21 +48,24 @@ function createServerCredentials(tls) {
         "[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true."
       );
     }
-    log.warn(
-      "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
-    );
-    return grpc2.ServerCredentials.createInsecure();
+    if (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {
+      hasWarnedInsecureServer = true;
+      log.debug(
+        "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
+      );
+    }
+    return grpc.ServerCredentials.createInsecure();
   }
   try {
-    const rootCert = tls.rootCert ? fs2.readFileSync(tls.rootCert) : null;
-    const certChain = fs2.readFileSync(tls.certChain);
-    const privateKey = fs2.readFileSync(tls.privateKey);
+    const rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;
+    const certChain = fs.readFileSync(tls.certChain);
+    const privateKey = fs.readFileSync(tls.privateKey);
     if (tls.mutualTls && !rootCert) {
       throw new Error(
         "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
       );
     }
-    return grpc2.ServerCredentials.createSsl(
+    return grpc.ServerCredentials.createSsl(
       rootCert,
       [{ cert_chain: certChain, private_key: privateKey }],
       Boolean(tls.mutualTls)
@@ -107,7 +79,7 @@ function createServerCredentials(tls) {
     log.warn(
       `[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`
     );
-    return grpc2.ServerCredentials.createInsecure();
+    return grpc.ServerCredentials.createInsecure();
   }
 }
 function createChannelCredentials(tls) {
@@ -121,7 +93,7 @@ function createChannelCredentials(tls) {
       }
       const certChain = tls.certManager.getCertChain();
       const privateKey = tls.certManager.getPrivateKey();
-      return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
+      return grpc.credentials.createSsl(rootCert, privateKey, certChain);
     } catch (error) {
       if (isTlsEnforced()) {
         throw new Error(
@@ -131,7 +103,7 @@ function createChannelCredentials(tls) {
       log.warn(
         `[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`
       );
-      return grpc2.credentials.createInsecure();
+      return grpc.credentials.createInsecure();
     }
   }
   if (!tls?.rootCert) {
@@ -140,16 +112,19 @@ function createChannelCredentials(tls) {
         "[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true."
       );
     }
-    log.warn(
-      "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
-    );
-    return grpc2.credentials.createInsecure();
+    if (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {
+      hasWarnedInsecureChannel = true;
+      log.debug(
+        "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
+      );
+    }
+    return grpc.credentials.createInsecure();
   }
   try {
-    const rootCert = fs2.readFileSync(tls.rootCert);
-    const certChain = tls.certChain ? fs2.readFileSync(tls.certChain) : void 0;
-    const privateKey = tls.privateKey ? fs2.readFileSync(tls.privateKey) : void 0;
-    return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
+    const rootCert = fs.readFileSync(tls.rootCert);
+    const certChain = tls.certChain ? fs.readFileSync(tls.certChain) : void 0;
+    const privateKey = tls.privateKey ? fs.readFileSync(tls.privateKey) : void 0;
+    return grpc.credentials.createSsl(rootCert, privateKey, certChain);
   } catch (error) {
     if (isTlsEnforced()) {
       throw new Error(
@@ -159,10 +134,45 @@ function createChannelCredentials(tls) {
     log.warn(
       `[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`
     );
-    return grpc2.credentials.createInsecure();
+    return grpc.credentials.createInsecure();
   }
 }
 
+// src/rpc/channel-options.ts
+var GRPC_CHANNEL_OPTIONS = {
+  "grpc.keepalive_time_ms": 3e4,
+  "grpc.keepalive_timeout_ms": 1e4,
+  "grpc.keepalive_permit_without_calls": 1,
+  "grpc.max_send_message_length": -1,
+  "grpc.max_receive_message_length": -1,
+  "grpc.enable_retries": 1
+};
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = path.dirname(__filename2);
+var PROD_PATHS = [
+  path.resolve(__dirname2, "./protocol/liop_core.proto"),
+  // Flat dist/ (tsup)
+  path.resolve(__dirname2, "../protocol/liop_core.proto")
+  // dist/rpc/ (tsc)
+];
+var DEV_PROTO_PATH = path.resolve(
+  __dirname2,
+  "../../../../protocol/proto/liop_core.proto"
+);
+var PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;
+if (!fs.existsSync(PROTO_PATH)) {
+  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
+}
+var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
+  keepCase: true,
+  longs: String,
+  enums: String,
+  defaults: true,
+  oneofs: true
+});
+var liopProto = grpc.loadPackageDefinition(packageDefinition);
+var liopV1 = liopProto.liop.v1;
+
 export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials, liopV1 };
-//# sourceMappingURL=chunk-TKRX6CFI.js.map
-//# sourceMappingURL=chunk-TKRX6CFI.js.map
+//# sourceMappingURL=chunk-3BJ5QQHK.js.map
+//# sourceMappingURL=chunk-3BJ5QQHK.js.map

package/dist/chunk-3BJ5QQHK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/tls.ts","../src/rpc/channel-options.ts","../src/rpc/proto.ts"],"names":["__filename","__dirname","fs2","grpc2"],"mappings":";;;;;;;AAgDA,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAElC,IAAM,sBAAA,GAAyB,CAAC,GAAA,KAC/B,GAAA,EAAK,QAAA,KAAa,IAAA,IAClB,GAAA,EAAK,eAAA,KAAoB,IAAA,IACzB,OAAA,CAAQ,GAAA,CAAI,yBAAA,KAA8B,MAAA;AAE3C,IAAI,uBAAA,GAA0B,KAAA;AAC9B,IAAI,wBAAA,GAA2B,KAAA;AAOxB,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,uBAAA,EAAyB;AAC7D,MAAA,uBAAA,GAA0B,IAAA;AAC1B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,wBAAA,EAA0B;AAC9D,MAAA,wBAAA,GAA2B,IAAA;AAC3B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AACD;;;AClNO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,2BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK","file":"chunk-3BJ5QQHK.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n\t/**\n\t * Explicitly permit unencrypted (insecure) credentials for local development,\n\t * Docker testbeds, or tooling harnesses without emitting console warnings.\n\t * Ignored if isTlsEnforced() is true (production/enforced mode always throws).\n\t */\n\tinsecure?: boolean;\n\t/**\n\t * Explicitly suppress the fallback warning when insecure credentials are created.\n\t */\n\tsuppressWarning?: boolean;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\nconst isTlsWarningSuppressed = (tls?: LiopTlsOptions) =>\n\ttls?.insecure === true ||\n\ttls?.suppressWarning === true ||\n\tprocess.env.LIOP_SUPPRESS_TLS_WARNING === \"true\";\n\nlet hasWarnedInsecureServer = false;\nlet hasWarnedInsecureChannel = false;\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {\n\t\t\thasWarnedInsecureServer = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {\n\t\t\thasWarnedInsecureChannel = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n"]}

package/dist/{chunk-T7R5HUFD.js → chunk-GYJQ63L2.js}

@@ -2,7 +2,7 @@ import { TokenManager } from './chunk-ESRXG36Y.js';
 import { TokenTelemetryEngine } from './chunk-DZ2FQGJD.js';
 import { LiopVerifier } from './chunk-PEN3KFLF.js';
 import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS } from './chunk-TKRX6CFI.js';
+import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS } from './chunk-3BJ5QQHK.js';
 import { pqcHandshakesTotal, pqcHandshakeDurationMs, zkVerificationsTotal, toolCallErrorsTotal, wireEgressBytesTotal } from './chunk-PAICJCKJ.js';
 import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-EG46XMJT.js';
 import { MeshNode } from './chunk-7RXOIDXP.js';
@@ -757,6 +757,25 @@ var LiopClient = class {
     }
     return result;
   }
+  /**
+   * Returns the local PeerId string if the mesh node is active, null otherwise.
+   * PeerIds are public identifiers by libp2p protocol design (Ed25519 public key hash).
+   */
+  get peerId() {
+    return this.meshNode?.getPeerId() ?? null;
+  }
+  /**
+   * Returns true if the mesh node is initialized and running.
+   */
+  get isMeshActive() {
+    return this.meshNode?.isStarted() ?? false;
+  }
+  /**
+   * Returns the number of active P2P connections, or 0 if the mesh is inactive.
+   */
+  get connectionCount() {
+    return this.meshNode?.getPeers().length ?? 0;
+  }
   getServerInfo() {
     return this.serverInfo;
   }
@@ -771,5 +790,5 @@ var LiopClient = class {
 };
 
 export { AesGcmWrapper, LiopClient, LiopRpcClient };
-//# sourceMappingURL=chunk-T7R5HUFD.js.map
-//# sourceMappingURL=chunk-T7R5HUFD.js.map
+//# sourceMappingURL=chunk-GYJQ63L2.js.map
+//# sourceMappingURL=chunk-GYJQ63L2.js.map

package/dist/chunk-GYJQ63L2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/client.ts","../src/rpc/crypto/aes.ts","../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAsBO,IAAM,gBAAN,MAAoB;AAAA;AAAA,EAElB,MAAA;AAAA,EACA,KAAA;AAAA,EACA,iBAAA;AAAA,EACQ,OAAA;AAAA,EAEhB,WAAA,CAAY,OAAA,EAAiB,GAAA,EAAsB,KAAA,EAAuB;AACzE,IAAA,MAAM,WAAA,GAAc,yBAAyB,GAAG,CAAA;AAChD,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,MAAA,CAAO,SAAA;AAAA,MACxB,OAAA;AAAA,MACA,WAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EAChB;AAAA,EAEO,SAAS,KAAA,EAA6B;AAC5C,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAAA,IAC1B;AAAA,EACD;AAAA,EAEA,MAAc,YAAA,GAA4C;AACzD,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,UAAA,EAAY;AACrC,MAAA,IAAA,CAAK,iBAAA,GAAoB,MAAM,IAAA,CAAK,KAAA,EAAM;AAC1C,MAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,IACb;AACA,IAAA,IAAA,CAAK,oBAAoB,IAAA,CAAK,KAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,gBACZ,OAAA,EAC0B;AAC1B,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,YAAA,EAAa;AAC5C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,MAAM,QAAA,GAAW,IAAS,IAAA,CAAA,QAAA,EAAS;AACnC,MAAA,IAAI,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,WAAW,CAAA,CAAE,CAAA;AAAA,MACtD;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,eAAA;AAAA,QACX,OAAA;AAAA,QACA,QAAA;AAAA,QACA,CAAC,OAAiC,QAAA,KAA6B;AAC9D,UAAA,IAAI,KAAA,EAAO;AACV,YAAA,MAAA,CAAO,KAAK,CAAA;AAAA,UACb,CAAA,MAAO;AACN,YAAA,OAAA,CAAQ,QAAQ,CAAA;AAAA,UACjB;AAAA,QACD;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,aACN,OAAA,EAC2C;AAC3C,IAAA,MAAM,QAAA,GAAW,IAAS,IAAA,CAAA,QAAA,EAAS;AACnC,IAAA,MAAM,WAAA,GACL,KAAK,iBAAA,KACJ,OAAO,KAAK,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,MAAA,CAAA;AAChD,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,QAAA,CAAS,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,WAAW,CAAA,CAAE,CAAA;AAAA,IACtD;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEO,KAAA,GAAc;AACpB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AACD;AChGO,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5B,cAAA,CACC,SACA,YAAA,EAIC;AACD,IAAA,IAAI,YAAA,CAAa,WAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AAGA,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,aAAA,EAAe,YAAA,EAAc,KAAK,CAAA;AAGhE,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACxE,IAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAIlC,IAAA,MAAM,kBAAkB,MAAA,CAAO,MAAA,CAAO,CAAC,SAAA,EAAW,OAAO,CAAC,CAAA;AAE1D,IAAA,OAAO;AAAA,MACN,UAAA,EAAY,eAAA;AAAA,MACZ;AAAA,KACD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,gBAAA,EACA,KAAA,EACA,YAAA,EACS;AACT,IAAA,IAAI,gBAAA,CAAiB,SAAS,EAAA,EAAI;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,MAAM,aAAA,GAAgB,gBAAA,CAAiB,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AACtD,IAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,QAAA,CAAS,GAAG,CAAA;AAE7C,IAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,aAAA,EAAe,YAAA,EAAc,KAAK,CAAA;AACpE,IAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAE3B,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAAA,EACxE;AACD;;;AChCO,IAAM,aAAN,MAAiB;AAAA,EACf,QAAA,GAA4B,IAAA;AAAA,EAC5B,UAAA,uBAA6C,GAAA,EAAI;AAAA,EACjD,SAAA,uBAA2C,GAAA,EAAI;AAAA,EAC/C,UAAA;AAAA,EACA,UAAA;AAAA,EACD,QAAA,GAAyB,IAAI,YAAA,EAAa;AAAA,EACzC,UAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAGD,GAAA,GAAc,QAAA;AAAA;AAAA,EAEd,eAAA,GAA0B,oBAAA;AAAA,EAEjC,YAAY,GAAA,EAAsB;AACjC,IAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,OAAA,CACZ,OAAA,EACA,OAAA,EAWgB;AAEhB,IAAA,MAAM,QAAA,GACL,SAAS,IAAA,EAAM,QAAA,IACf,QAAQ,GAAA,CAAI,oBAAA,IACZ,QAAQ,GAAA,CAAI,cAAA;AACb,IAAA,MAAM,YAAA,GACL,SAAS,IAAA,EAAM,YAAA,IACf,QAAQ,GAAA,CAAI,wBAAA,IACZ,QAAQ,GAAA,CAAI,kBAAA;AACb,IAAA,MAAM,WACL,OAAA,EAAS,IAAA,EAAM,QAAA,IACf,OAAA,CAAQ,IAAI,cAAA,IACZ,uBAAA;AACD,IAAA,MAAM,WACL,OAAA,EAAS,IAAA,EAAM,QAAA,IACf,OAAA,CAAQ,IAAI,mBAAA,IACZ,mBAAA;AACD,IAAA,MAAM,QACL,OAAA,EAAS,IAAA,EAAM,KAAA,IACf,OAAA,CAAQ,IAAI,gBAAA,IACZ,sFAAA;AAED,IAAA,IAAA,CAAK,UAAA,GACJ,SAAS,IAAA,EAAM,KAAA,IACf,QAAQ,GAAA,CAAI,gBAAA,IACZ,QAAQ,GAAA,CAAI,UAAA;AAEb,IAAA,IAAI,YAAY,YAAA,EAAc;AAC7B,MAAA,MAAM,OAAA,GAAA,CAAW,QAAY,EAAyB,QAAA,CAAS,OAAO,IACnE,QAAY,GACZ,CAAA,EAAG,QAAmC,CAAA,KAAA,CAAA;AACzC,MAAA,MAAM,aAAA,GAAgB,GAAG,OAAO,CAAA,MAAA,CAAA;AAEhC,MAAA,IAAA,CAAK,YAAA,GAAe,IAAI,YAAA,CAAa;AAAA,QACpC,aAAA;AAAA,QACA,QAAA;AAAA,QACA,YAAA;AAAA,QACA,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACR,CAAA;AAED,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACnD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH;AAAA,SACD;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,mDACC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAChD,CAAA;AAAA,SACD;AAAA,MAED;AAAA,IACD;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,OAAA,EAAS,UAAU,CAAA;AAChD,IAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAC1B,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,6CAAA,EAAgD,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,CAAA;AAAA,KAC1E;AAEA,IAAA,IAAI,OAAA,EAAS;AACZ,MAAA,MAAM,gBAAgB,YAAY;AACjC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AAAA,QACzC;AACA,QAAA,OAAO,IAAA,CAAK,UAAA;AAAA,MACb,CAAA;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA;AAAA,QACf,QAAA;AAAA,QACA,IAAI,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,YAAY,aAAa;AAAA,OAC1D;AACA,MAAA,IAAA,CAAK,aAAa,EAAE,IAAA,EAAM,eAAe,OAAO,CAAA,CAAA,CAAA,EAAK,SAAS,OAAA,EAAQ;AACtE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,yCAAA,EAA4C,OAAO,CAAA,CAAE,CAAA;AAAA,IAC/D,CAAA,MAAO;AACN,MAAA,IAAA,CAAK,UAAA,GAAa,EAAE,IAAA,EAAM,yBAAA,EAA2B,SAAS,OAAA,EAAQ;AAAA,IACvE;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gBAAgB,KAAA,EAAgC;AAEvD,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACjC,MAAA,IAAI,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,CAAA,GAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,MAAM,EAAA,GAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC1B,QAAA,IACC,EAAA,KAAO,WAAA,IACP,CAAC,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,IACrB,EAAA,KAAO,SAAA,IACP,EAAA,KAAO,WAAA,EACN;AACD,UAAA,OAAO,EAAA;AAAA,QACR;AAAA,MACD;AAAA,IACD;AAGA,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACjC,MAAA,IAAI,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,CAAA,GAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,MACvB;AAAA,IACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,kBAAkB,QAAA,EAAmC;AACjE,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAED,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6CAAA,EAAgD,QAAQ,CAAA,GAAA,CAAK,CAAA;AACtE,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,QAAQ,CAAA;AAE5D,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,qDAAqD,QAAQ,CAAA;AAAA,OAC9D;AAAA,IACD;AAEA,IAAA,MAAM,UAAA,GAAa,UAAU,CAAC,CAAA;AAC9B,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AAEvE,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,UAAU,CAAA;AAC7D,IAAA,IAAI,QAAA,EAAU;AACb,MAAA,QAAA,GAAW,QAAA,CAAS,QAAA;AACpB,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACvC,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0CAAA,EAA6C,QAAQ,CAAA,6BAAA,EAAgC,UAAU,CAAA;AAAA,OAChG;AAAA,IACD;AAEA,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,UAAU,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC5C,IAAA,IAAI,SAAA,EAAW;AACd,MAAA,MAAM,QAAA,GAAW,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACzC,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,6DAA6D,QAAQ,CAAA;AAAA,OACtE;AACA,MAAA,OAAO,QAAA;AAAA,IACR;AAEA,IAAA,OAAO,aAAa,QAAQ,CAAA,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,oBAAoB,MAAA,EAI9B;AACF,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAkC;AAAA,QACvC,cAAA,EAAgB,kBAAA;AAAA,QAChB,YAAA,EAAc;AAAA,OACf;AACA,MAAA,IAAI,KAAK,UAAA,EAAY;AACpB,QAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,MAClD;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,QAC/B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACpB,OAAA,EAAS,KAAA;AAAA,UACT,EAAA,EAAI,CAAA;AAAA,UACJ,MAAA,EAAQ,iBAAA;AAAA,UACR,QAAQ;AAAC,SACT;AAAA,OACD,CAAA;AAED,MAAA,IAAI,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAG7B,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,EAAQ,iBAAA,IAAqB,EAAC;AACrD,QAAA,IAAI,SAAA,CAAU,QAAA,CAAS,oBAAoB,CAAA,EAAG;AAC7C,UAAA,IAAA,CAAK,GAAA,GAAM,QAAA;AACX,UAAA,IAAA,CAAK,eAAA,GAAkB,oBAAA;AACvB,UAAA,OAAO;AAAA,YACN,GAAA,EAAK,QAAA;AAAA,YACL,eAAA,EAAiB,oBAAA;AAAA,YACjB,iBAAA,EAAmB;AAAA,WACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD,SAAS,IAAA,EAAM;AAAA,IAEf;AAGA,IAAA,IAAI,0BAAA,EAA4B;AAC/B,MAAA,IAAA,CAAK,GAAA,GAAM,QAAA;AACX,MAAA,IAAA,CAAK,eAAA,GAAkB,2BAAA;AACvB,MAAA,OAAO;AAAA,QACN,GAAA,EAAK,QAAA;AAAA,QACL,eAAA,EAAiB,2BAAA;AAAA,QACjB,iBAAA,EAAmB,CAAC,2BAA2B;AAAA,OAChD;AAAA,IACD;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,aAAA,CACZ,YAAA,GAAe,KAAA,EACqC;AACpD,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AAEA,IAAA,MAAM,kBAAA,GAAqB,KAAK,GAAA,EAAI;AAEpC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iDAAiD,YAAY,CAAA,IAAA;AAAA,KAC9D;AACA,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,yBAAA,EAA0B;AAClE,IAAA,MAAM,QAAkD,EAAC;AACzD,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAY;AAElC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AACjC,MAAA,IAAI;AACH,QAAA,IAAI,WAA4C,CAAC,YAAA,GAC9C,KAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA,GACzB,KAAA,CAAA;AAEH,QAAA,IAAI,CAAC,QAAA,EAAU;AACd,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,qCAAA,EAAwC,MAAM,CAAA,CAAE,CAAA;AACzD,UAAA,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,aAAA,CAAc,MAAM,CAAA;AACnD,UAAA,IAAI,QAAA,EAAU;AACb,YAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAAA,UACpC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,wCAAA,EAA2C,MAAM,CAAA,CAAE,CAAA;AAAA,QAC7D;AAEA,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,KAAA,EAAO;AAClC,YAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AAC9B,cAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,WAAA,EAAa,IAAA,CAAK,aAAa,CAAA;AAC7D,cAAA,SAAA,CAAU,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,YACxB;AAAA,UACD;AAAA,QACD;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,6CAA6C,MAAM,CAAA,CAAA,CAAA;AAAA,UACnD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,SAChD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,uCAAA,EAA0C,MAAM,MAAM,CAAA,cAAA;AAAA,KACvD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,MAAA,MAAM,YAAA,GAAe,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACzC,MAAA,MAAM,oBAAA,GAAuB,IAAA,CAAK,SAAA,CAAU,EAAE,OAAO,CAAA;AACrD,MAAA,SAAA,CAAU,MAAA,CAAO;AAAA,QAChB,IAAA,EAAM,YAAA;AAAA,QACN,MAAA,EAAQ,eAAA;AAAA,QACR,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,YAAY,CAAA;AAAA,QACxD,qBAAA,EAAuB,SAAA,CAAU,WAAA,CAAY,oBAAoB,CAAA;AAAA,QACjE,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB,CAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QAAA,CACZ,OAAA,EACA,YAAA,EAC0B;AAC1B,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,aAAA,GAAgB,KAAK,GAAA,EAAI;AAC/B,IAAA,MAAM,WAAW,OAAA,CAAQ,IAAA;AACzB,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAE,CAAA;AAGnD,IAAA,IAAI,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,IAAI,eAAA,GAAkB,QAAA;AAEtB,IAAA,IAAI,CAAC,SAAA,EAAW;AAEf,MAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA,EAAG;AAClC,QAAA,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AACxC,QAAA,eAAA,GAAkB,QAAA;AAAA,MACnB;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,SAAA,EAAW;AAEf,MAAA,IAAI,YAAA,GAA8B,IAAA;AAClC,MAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,QAAQ,KAAK,IAAA,CAAK,SAAA,CAAU,SAAQ,EAAG;AAC1D,QAAA,IAAI,QAAA,CAAS,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,QAAQ,CAAA,EAAG;AAEpD,UAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,YAAA,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACtC,YAAA,eAAA,GAAkB,MAAA;AAClB,YAAA;AAAA,UACD;AAEA,UAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,MAAM,CAAA;AACpD,UAAA,MAAM,SAAA,GAAY,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC5C,UAAA,IAAI,SAAA,EAAW;AACd,YAAA,YAAA,GAAe,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAA,CAAS,QAAQ,CAAA,CAAA;AAChD,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,iCAAA,EAAoC,QAAQ,CAAA,uCAAA,EAA0C,YAAY,CAAA;AAAA,aACnG;AACA,YAAA,eAAA,GAAkB,MAAA;AAClB,YAAA,SAAA,GAAY,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,YAAY,CAAA;AAC1D,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,SAAA,EAAW;AACf,QAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,iBAAA,CAAkB,QAAQ,CAAA;AAC5D,QAAA,eAAA,GAAkB,QAAA;AAClB,QAAA,SAAA,GAAY,IAAA,CAAK,oBAAA,CAAqB,QAAA,EAAU,cAAc,CAAA;AAAA,MAC/D;AAAA,IACD,CAAA,MAAO;AACN,MAAA,eAAA,GAAkB,QAAA;AAClB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,0DAA0D,QAAQ,CAAA,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,oCAAA,EAAuC,QAAQ,CAAA,GAAA,CAAK,CAAA;AAC7D,IAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB,CAAA,SAAA,EAAY,KAAK,QAAA,CAAS,SAAA,EAAW,CAAA,CAAA,GACrC,oBAAA;AACH,IAAA,MAAM,aAAA,GAAgB,OAAO,IAAA,CAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,CAAA;AAC7D,IAAA,MAAM,aAAA,GAAgB,KAAK,QAAA,GACxB,MAAM,KAAK,QAAA,CAAS,IAAA,CAAK,aAAa,CAAA,GACtC,aAAA;AAEH,IAAA,IAAI,cAAA;AASJ,IAAA,IAAI;AACH,MAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,QACjD,SAAA,EAAW,QAAA;AAAA,QACX,eAAA,EAAiB,QAAA;AAAA,QACjB,eAAA,EAAiB;AAAA,OACjB,CAAA;AAAA,IACF,SAAS,GAAA,EAAc;AACtB,MAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,MAAA,IACC,KAAK,YAAA,KACJ,MAAA,CAAO,QAAA,CAAS,iBAAiB,KACjC,MAAA,CAAO,QAAA,CAAS,aAAa,CAAA,IAC7B,OAAO,QAAA,CAAS,wBAAwB,KACxC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,CAAA,EACzB;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,kDAAkD,QAAQ,CAAA,qEAAA;AAAA,SAC3D;AACA,QAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACpD,QAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,QAAA,SAAA,CAAU,SAAS,UAAU,CAAA;AAC7B,QAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,UACjD,SAAA,EAAW,QAAA;AAAA,UACX,eAAA,EAAiB,QAAA;AAAA,UACjB,eAAA,EAAiB;AAAA,SACjB,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,MAAM,GAAA;AAAA,MACP;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,eAAe,QAAA,EAAU;AAC7B,MAAA,IACC,IAAA,CAAK,iBACJ,cAAA,CAAe,aAAA,EAAe,SAAS,OAAO,CAAA,IAC9C,eAAe,aAAA,EAAe,QAAA,CAAS,iBAAiB,CAAA,IACxD,cAAA,CAAe,eAAe,QAAA,CAAS,SAAS,KAChD,cAAA,CAAe,aAAA,EAAe,QAAA,CAAS,wBAAwB,CAAA,CAAA,EAC/D;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,+CAAA,EAAkD,eAAe,aAAa,CAAA,mCAAA;AAAA,SAC/E;AACA,QAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACpD,QAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,QAAA,SAAA,CAAU,SAAS,UAAU,CAAA;AAC7B,QAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,UACjD,SAAA,EAAW,QAAA;AAAA,UACX,eAAA,EAAiB,QAAA;AAAA,UACjB,eAAA,EAAiB;AAAA,SACjB,CAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,eAAe,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,uBAAA,EAA0B,eAAe,aAAa,CAAA;AAAA,SACvD;AAAA,MACD;AAAA,IACD;AAGA,IAAA,MAAM,SAAA,GACL,cAAA,CAAe,gBAAA,IAAoB,cAAA,CAAe,cAAA;AACnD,IAAA,MAAM,YAAA,GACL,cAAA,CAAe,aAAA,IAAiB,cAAA,CAAe,YAAA;AAEhD,IAAA,IAAI,CAAC,SAAA,EAAW;AACf,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4EAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,IAAI;AACH,QAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,UACtB,SAAA,EAAW,YAAA;AAAA,UACX,MAAA,EAAQ;AAAA,SACR,CAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,QAAQ,IAAI,CAAA,GAAA;AAAA,KAC1E;AACA,IAAA,MAAM,QAAA,GAAW,YAAY,GAAA,EAAI;AACjC,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAM,eAAA,CAAgB,qBAAA,CAAsB,SAAS,CAAA;AACjE,MAAA,eAAA,GAAkB,GAAA,CAAI,UAAA;AACtB,MAAA,YAAA,GAAe,GAAA,CAAI,YAAA;AACnB,MAAA,MAAM,WAAA,GAAc,WAAA,CAAY,GAAA,EAAI,GAAI,QAAA;AACxC,MAAA,sBAAA,CAAuB,QAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA;AAClE,MAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,QACtB,SAAA,EAAW,YAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACR,CAAA;AAAA,IACF,SAAS,UAAA,EAAY;AACpB,MAAA,IAAI;AACH,QAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,UACtB,SAAA,EAAW,YAAA;AAAA,UACX,MAAA,EAAQ;AAAA,SACR,CAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,UAAA;AAAA,IACP;AAGA,IAAA,GAAA,CAAI,KAAK,CAAA,+CAAA,CAAiD,CAAA;AAE1D,IAAA,MAAM,YAAA,GAAe,YAAA,IAAgB,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA;AAGnD,IAAA,MAAM,EAAE,YAAY,aAAA,EAAe,KAAA,EAAO,UAAS,GAClD,aAAA,CAAc,cAAA,CAAe,YAAA,EAAc,YAAY,CAAA;AAGxD,IAAA,MAAM,kBAA8C,EAAC;AACrD,IAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAa,CAAA;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,MAAA,CAAO,QAAQ,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA,EAAG;AACnE,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,WAAA,CAAY,EAAE,CAAA;AACxC,MAAA,MAAM,SAAS,MAAA,CAAO,cAAA;AAAA,QACrB,aAAA;AAAA,QACA,YAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,MAAM,SAAA,GAAY,OAAO,MAAA,CAAO;AAAA,QAC/B,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,QACnC,OAAO,KAAA;AAAM,OACb,CAAA;AACD,MAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,MAAA,eAAA,CAAgB,GAAG,IAAI,MAAA,CAAO,MAAA,CAAO,CAAC,UAAA,EAAY,SAAA,EAAW,OAAO,CAAC,CAAA;AAAA,IACtE;AAGA,IAAA,MAAM,YAAA,GAA6B;AAAA,MAClC,aAAA,EAAe,YAAA;AAAA,MACf,WAAA,EAAa,aAAA;AAAA,MACb,MAAA,EAAQ,eAAA;AAAA,MACR,cAAA,EAAgB,eAAA;AAAA,MAChB,SAAA,EAAW;AAAA,KACZ;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,YAAA,CAAa,YAAY,CAAA;AAClD,MAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,oDAAoD,CAAC,CAAA;AACtE,QAAA;AAAA,MACD;AACA,MAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,MAAA,IAAI,eAAA,GAAkB,KAAA;AAEtB,MAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,OAAO,QAAA,KAA4B;AACpD,QAAA,IAAI,eAAA,EAAiB;AACrB,QAAA,eAAA,GAAkB,IAAA;AAElB,QAAA,GAAA,CAAI,KAAK,0DAA0D,CAAA;AAEnE,QAAA,IAAI;AAIH,UAAA,IAAI,CAAC,SAAS,QAAA,EAAU;AACvB,YAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,QAAA,CAAS,eAAA;AAAA,cACnC,YAAA;AAAA,cACA,OAAO,IAAA,CAAK,QAAA,CAAS,mBAAmB,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,cACxD,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,UAAU,CAAA;AAAA,cAC/B,MAAA,CAAO,KAAK,YAAY,CAAA;AAAA,cACxB,QAAA,CAAS;AAAA,aACV;AAEA,YAAA,IAAI;AACH,cAAA,oBAAA,CAAqB,GAAA,CAAI;AAAA,gBACxB,MAAA,EAAQ,UAAU,OAAA,GAAU;AAAA,eAC5B,CAAA;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAEA,YAAA,IAAI,CAAC,OAAA,EAAS;AACb,cAAA,IAAI;AACH,gBAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,kBACvB,UAAA,EAAY,QAAA;AAAA,kBACZ,UAAA,EAAY;AAAA,iBACZ,CAAA;AAAA,cACF,CAAA,CAAA,MAAQ;AAAA,cAAC;AACT,cAAA,MAAA;AAAA,gBACC,IAAI,KAAA;AAAA,kBACH;AAAA;AACD,eACD;AACA,cAAA;AAAA,YACD;AAAA,UACD,CAAA,MAAO;AACN,YAAA,IAAI;AACH,cAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,gBACvB,UAAA,EAAY,QAAA;AAAA,gBACZ,UAAA,EAAY;AAAA,eACZ,CAAA;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAAC;AAAA,UACV;AAEA,UAAA,eAAA,GAAkB,IAAA;AAGlB,UAAA,IAAI;AACH,YAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,YAAA,MAAM,eAAe,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA;AAC3D,YAAA,SAAA,CAAU,MAAA,CAAO;AAAA,cAChB,IAAA,EAAM,WAAA;AAAA,cACN,MAAA,EAAQ,UAAA;AAAA,cACR,QAAA;AAAA,cACA,MAAA,EACC,eAAA,KAAoB,QAAA,GAAW,eAAA,GAAkB,KAAA,CAAA;AAAA,cAClD,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,YAAY,CAAA;AAAA,cACxD,uBAAuB,SAAA,CAAU,WAAA;AAAA,gBAChC,QAAA,CAAS;AAAA,eACV;AAAA,cACA,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,aACzB,CAAA;AAED,YAAA,MAAM,cACL,MAAA,CAAO,UAAA,CAAW,QAAA,CAAS,iBAAA,IAAqB,EAAE,CAAA,IACjD,QAAA,CAAS,mBAAA,GACP,QAAA,CAAS,oBAAoB,MAAA,GAC7B,CAAA,CAAA,IACF,SAAS,UAAA,GAAa,QAAA,CAAS,WAAW,MAAA,GAAS,CAAA,CAAA;AACrD,YAAA,oBAAA,CAAqB,GAAA,CAAI,EAAE,UAAA,EAAY,QAAA,IAAY,WAAW,CAAA;AAAA,UAC/D,CAAA,CAAA,MAAQ;AAAA,UAER;AAEA,UAAA,OAAA,CAAQ;AAAA,YACP,OAAA,EAAS;AAAA,cACR;AAAA,gBACC,IAAA,EAAM,MAAA;AAAA,gBACN,MAAM,QAAA,CAAS;AAAA;AAChB,aACD;AAAA,YACA,SAAS,QAAA,CAAS;AAAA,WAClB,CAAA;AAAA,QACF,SAAS,GAAA,EAAK;AACb,UAAA,IAAI;AACH,YAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,cACvB,UAAA,EAAY,QAAA;AAAA,cACZ,UAAA,EAAY;AAAA,aACZ,CAAA;AAAA,UACF,CAAA,CAAA,MAAQ;AAAA,UAAC;AACT,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACX;AAAA,MACD,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AAE3B,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,eAAe,CAAA;AACtC,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAC/B,QAAA,IAAI;AACH,UAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,YACvB,UAAA,EAAY,QAAA;AAAA,YACZ,UAAA,EAAY;AAAA,WACZ,CAAA;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAAC;AACT,QAAA,IAAI,eAAA,EAAiB;AACrB,QAAA,GAAA,CAAI,KAAA,CAAM,8BAA8B,GAAG,CAAA;AAC3C,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,EAAA,CAAG,OAAO,MAAM;AAGtB,QAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,eAAA,EAAiB;AACzC,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gDAAgD,CAAC,CAAA;AAAA,QACnE;AAAA,MACD,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,oBAAA,CAAqB,QAAgB,OAAA,EAAgC;AAC5E,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,MAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACxC,MAAA,IAAI,UAAA,GAAa,MAAA;AAIjB,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,wBAAwB,MAAM,CAAA,+EAAA;AAAA,SAC/B;AACA,QAAA,KAAA,MAAW,CAAC,GAAA,EAAK,CAAC,KAAK,IAAA,CAAK,SAAA,CAAU,SAAQ,EAAG;AAChD,UAAA,IAAI,CAAA,CAAE,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,CAAA,EAAG;AAC3C,YAAA,QAAA,GAAW,CAAA;AACX,YAAA,UAAA,GAAa,GAAA;AACb,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,+BAA+B,MAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,sBAAA;AAAA,aAC5E;AACA,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,MAAM,YAAA,GAAe,QAAA,EAAU,UAAA,EAAY,IAAA,EAAM,aAAY,IAAK,EAAA;AAClE,MAAA,IAAI,QAAA;AAGJ,MAAA,MAAM,OAAO,QAAA,EAAU,SAAA;AACvB,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,IAAI,CAAA,CAAE,KAChC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,IAAI,CAAA,CAAE,CAAA;AACvC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,wCAAwC,IAAI,CAAA,cAAA,EAAiB,IAAI,CAAA,YAAA,EAAe,CAAC,CAAC,QAAQ,CAAA;AAAA,SAC3F;AAAA,MACD,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,gDAAgD,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,2BAA2B,KAAA,CAAM,IAAA;AAAA,YACpG,IAAA,CAAK,UAAU,IAAA;AAAK,WACrB,CACE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,EAAE,CAAC,CAAA,CACtB,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,SACb;AAAA,MACD;AAGA,MAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC5B,QAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,EAAE,EAAE,WAAA,EAAY;AACjD,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,CAAE,KACnC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAAA,MAC3C;AAGA,MAAA,IAAI,CAAC,YAAY,YAAA,EAAc;AAC9B,QAAA,MAAM,YAAY,YAAA,CAChB,WAAA,EAAY,CACZ,OAAA,CAAQ,eAAe,GAAG,CAAA;AAC5B,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,KACrC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAE,CAAA;AAAA,MAC7C;AAEA,MAAA,IAAI,QAAA,EAAU;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,sDAAsD,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,CAAA,EAAA,EAAK,gBAAgB,SAAS,CAAA,CAAA;AAAA,SACzG;AAAA,MACD;AAEA,MAAA,MAAM,gBAAgB,YAAY;AACjC,QAAA,IAAI,UAAU,OAAO,QAAA;AACrB,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AAAA,QACzC;AACA,QAAA,OAAO,IAAA,CAAK,UAAA;AAAA,MACb,CAAA;AAEA,MAAA,MAAA,GAAS,IAAI,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,YAAY,aAAa,CAAA;AAClE,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,aAAa,GAAA,EAEvB;AACF,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AACA,IAAA,MAAM,aAAA,GAAgB,KAAK,GAAA,EAAI;AAC/B,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,yCAAA,EAA4C,GAAG,CAAA,GAAA,CAAK,CAAA;AAG7D,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,GAAG,CAAA;AACvD,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,GAAG,CAAA,CAAE,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,SAAS,aAAA,CAAc,SAAA,CAAU,CAAC,CAAC,CAAA;AAC/D,IAAA,IAAI,CAAC,QAAA,EAAU;AACd,MAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,IACpE;AAGA,IAAA,MAAM,WAAA,GAAc,SAAS,SAAA,EAAW,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AACjE,IAAA,IAAI,CAAC,WAAA,EAAa;AACjB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,IACjE;AAGA,IAAA,MAAM,MAAA,GAAS;AAAA,MACd,QAAA,EAAU;AAAA,QACT;AAAA,UACC,GAAA;AAAA,UACA,QAAA,EAAU,YAAY,QAAA,IAAY,kBAAA;AAAA,UAClC,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,WAAA,EAAa,MAAM,CAAC;AAAA;AAC1C;AACD,KACD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAC3C,MAAA,SAAA,CAAU,MAAA,CAAO;AAAA,QAChB,IAAA,EAAM,eAAA;AAAA,QACN,MAAA,EAAQ,cAAA;AAAA,QACR,QAAA,EAAU,GAAA;AAAA,QACV,MAAA,EAAQ,UAAU,CAAC,CAAA;AAAA,QACnB,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,GAAG,CAAA;AAAA,QAC/C,qBAAA,EAAuB,SAAA,CAAU,WAAA,CAAY,aAAa,CAAA;AAAA,QAC1D,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB,CAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,MAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,MAAA,GAAwB;AAClC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU,IAAK,IAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,YAAA,GAAwB;AAClC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU,IAAK,KAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,eAAA,GAA0B;AACpC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,QAAA,EAAS,CAAE,MAAA,IAAU,CAAA;AAAA,EAC5C;AAAA,EAEO,aAAA,GAA+D;AACrE,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,KAAA,GAAuB;AACnC,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AAAA,EACD;AACD","file":"chunk-GYJQ63L2.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as grpc from \"@grpc/grpc-js\";\nimport { GRPC_CHANNEL_OPTIONS } from \"./channel-options.js\";\nimport { liopV1 } from \"./proto.js\";\nimport { createChannelCredentials, type LiopTlsOptions } from \"./tls.js\";\nimport type {\n\tIntentRequest,\n\tIntentResponse,\n\tLogicRequest,\n\tLogicResponse,\n} from \"./types.js\";\n\nexport type TokenProvider =\n\t| string\n\t| (() => Promise<string | undefined> | string | undefined);\n\n/**\n * LIOP gRPC Client Implementation\n * Provides a high-level interface for secure intent negotiation and logic execution.\n */\nexport class LiopRpcClient {\n\t// biome-ignore lint/suspicious/noExplicitAny: internal gRPC client type\n\tprivate client: any;\n\tprivate token?: TokenProvider;\n\tprivate lastResolvedToken?: string;\n\tpublic readonly address: string;\n\n\tconstructor(address: string, tls?: LiopTlsOptions, token?: TokenProvider) {\n\t\tconst credentials = createChannelCredentials(tls);\n\t\tthis.client = new liopV1.LogicMesh(\n\t\t\taddress,\n\t\t\tcredentials,\n\t\t\tGRPC_CHANNEL_OPTIONS,\n\t\t);\n\t\tthis.token = token;\n\t\tif (typeof token === \"string\") {\n\t\t\tthis.lastResolvedToken = token;\n\t\t}\n\t\tthis.address = address;\n\t}\n\n\tpublic setToken(token?: TokenProvider): void {\n\t\tthis.token = token;\n\t\tif (typeof token === \"string\") {\n\t\t\tthis.lastResolvedToken = token;\n\t\t}\n\t}\n\n\tprivate async resolveToken(): Promise<string | undefined> {\n\t\tif (typeof this.token === \"function\") {\n\t\t\tthis.lastResolvedToken = await this.token();\n\t\t\treturn this.lastResolvedToken;\n\t\t}\n\t\tthis.lastResolvedToken = this.token;\n\t\treturn this.token;\n\t}\n\n\t/**\n\t * Negotiates intent with the remote host.\n\t * Returns the ephemeral Kyber public key for payload encryption.\n\t */\n\tpublic async negotiateIntent(\n\t\trequest: IntentRequest,\n\t): Promise<IntentResponse> {\n\t\tconst activeToken = await this.resolveToken();\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst metadata = new grpc.Metadata();\n\t\t\tif (activeToken) {\n\t\t\t\tmetadata.add(\"authorization\", `Bearer ${activeToken}`);\n\t\t\t}\n\t\t\tthis.client.NegotiateIntent(\n\t\t\t\trequest,\n\t\t\t\tmetadata,\n\t\t\t\t(error: grpc.ServiceError | null, response: IntentResponse) => {\n\t\t\t\t\tif (error) {\n\t\t\t\t\t\treject(error);\n\t\t\t\t\t} else {\n\t\t\t\t\t\tresolve(response);\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\t}\n\n\t/**\n\t * Pushes the encrypted Logic-on-Origin payload to the origin.\n\t * Returns a stream of semantic responses and ZK proofs.\n\t */\n\tpublic executeLogic(\n\t\trequest: LogicRequest,\n\t): grpc.ClientReadableStream<LogicResponse> {\n\t\tconst metadata = new grpc.Metadata();\n\t\tconst activeToken =\n\t\t\tthis.lastResolvedToken ||\n\t\t\t(typeof this.token === \"string\" ? this.token : undefined);\n\t\tif (activeToken) {\n\t\t\tmetadata.add(\"authorization\", `Bearer ${activeToken}`);\n\t\t}\n\t\treturn this.client.ExecuteLogic(request, metadata);\n\t}\n\n\tpublic close(): void {\n\t\tthis.client.close();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\n/**\n * LIOP Symmetric Payload Encryption Wrapper\n * Uses AES-256-GCM to secure WASM Code transport over Zero-Trust networks.\n * Fully compatible with the `aes-gcm` Rust crate used by Wasmtime.\n */\nexport const AesGcmWrapper = {\n\t/**\n\t * Encrypts a raw WASM payload using the shared secret negotiated via Kyber768.\n\t *\n\t * @param payload Raw incoming WASM byte array or string.\n\t * @param sharedSecret A perfectly derived 32-byte (256-bit) shared secret array\n\t * @returns The encrypted buffer to push to the GRPc stream, along with the 12-byte initialization vector natively generated.\n\t */\n\tencryptPayload(\n\t\tpayload: Uint8Array | Buffer,\n\t\tsharedSecret: Uint8Array,\n\t): {\n\t\tciphertext: Buffer;\n\t\tnonce: Buffer;\n\t} {\n\t\tif (sharedSecret.length !== 32) {\n\t\t\tthrow new Error(\"Symmetric Key must be exactly 32 bytes (256 bits).\");\n\t\t}\n\n\t\t// LIOP standard demands 96-bit (12 byte) IVs/Nonces for AES-GCM\n\t\tconst nonce = randomBytes(12);\n\n\t\tconst cipher = createCipheriv(\"aes-256-gcm\", sharedSecret, nonce);\n\n\t\t// Encrypt the payload and seal the tag\n\t\tconst encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);\n\t\tconst authTag = cipher.getAuthTag(); // 16 bytes for GCM integrity\n\n\t\t// In LIOP, the auth tag is strictly appended to the end of the ciphertext bytes\n\t\t// mirroring the default serialization logic within `aes_gcm::Aes256Gcm` in Rust\n\t\tconst finalCiphertext = Buffer.concat([encrypted, authTag]);\n\n\t\treturn {\n\t\t\tciphertext: finalCiphertext,\n\t\t\tnonce: nonce,\n\t\t};\n\t},\n\n\t/**\n\t * Decrypts a remote Zero-Knowledge receipt using AES-256-GCM.\n\t */\n\tdecryptPayload(\n\t\tciphertextBuffer: Buffer,\n\t\tnonce: Buffer,\n\t\tsharedSecret: Uint8Array,\n\t): Buffer {\n\t\tif (ciphertextBuffer.length < 16) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Invalid GCM Ciphertext; missing authentication tag length\",\n\t\t\t);\n\t\t}\n\n\t\t// The last 16 bytes represent the AuthTag appended by rust-aes-gcm\n\t\tconst encryptedData = ciphertextBuffer.subarray(0, -16);\n\t\tconst authTag = ciphertextBuffer.subarray(-16);\n\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", sharedSecret, nonce);\n\t\tdecipher.setAuthTag(authTag);\n\n\t\treturn Buffer.concat([decipher.update(encryptedData), decipher.final()]);\n\t},\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { LiopVerifier } from \"../crypto/verifier.js\";\nimport { TokenTelemetryEngine } from \"../economy/telemetry.js\";\nimport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"../gateway/mcp-compat.js\";\nimport {\n\ttype LiopManifest,\n\tMeshNode,\n\ttype MeshNodeConfig,\n} from \"../mesh/node.js\";\nimport {\n\tpqcHandshakeDurationMs,\n\tpqcHandshakesTotal,\n\ttoolCallErrorsTotal,\n\twireEgressBytesTotal,\n\tzkVerificationsTotal,\n} from \"../observability/metrics.js\";\nimport { LiopRpcClient } from \"../rpc/client.js\";\nimport { AesGcmWrapper } from \"../rpc/crypto/aes.js\";\nimport { Kyber768Wrapper } from \"../rpc/crypto/kyber.js\";\nimport type { LiopTlsOptions } from \"../rpc/tls.js\";\nimport type { LogicRequest, LogicResponse } from \"../rpc/types.js\";\nimport { TokenManager } from \"../runtime/token-manager.js\";\nimport {\n\ttype CallToolRequest,\n\ttype CallToolResult,\n\tMCP_PROTOCOL_VERSION,\n\ttype McpEra,\n} from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\n/**\n * LIOP Client\n * High-level orchestration for discovery and execution in the Logic-Injection-on-Origin mesh.\n */\nexport class LiopClient {\n\tprivate meshNode: MeshNode | null = null;\n\tprivate rpcClients: Map<string, LiopRpcClient> = new Map();\n\tprivate manifests: Map<string, LiopManifest> = new Map();\n\tprivate tlsOptions?: LiopTlsOptions;\n\tprivate serverInfo?: { name: string; version: string };\n\tpublic verifier: LiopVerifier = new LiopVerifier();\n\tprivate oauthToken?: string;\n\tprivate tokenManager?: TokenManager;\n\n\t/** Protocol negotiation era */\n\tpublic era: McpEra = \"modern\";\n\t/** Negotiated protocol version */\n\tpublic protocolVersion: string = MCP_PROTOCOL_VERSION;\n\n\tconstructor(tls?: LiopTlsOptions) {\n\t\tthis.tlsOptions = tls;\n\t}\n\n\t/**\n\t * Discovers and connects to the target server or mesh capability.\n\t * If address is omitted, it sets up the MeshNode to act purely dynamically.\n\t */\n\tpublic async connect(\n\t\taddress?: string,\n\t\toptions?: {\n\t\t\tmeshConfig?: MeshNodeConfig;\n\t\t\tauth?: {\n\t\t\t\tclientId?: string;\n\t\t\t\tclientSecret?: string;\n\t\t\t\tnexusUrl?: string;\n\t\t\t\taudience?: string;\n\t\t\t\tscope?: string;\n\t\t\t\ttoken?: string;\n\t\t\t};\n\t\t},\n\t): Promise<void> {\n\t\t// Attempt to acquire OAuth M2M access token if credentials are provided\n\t\tconst clientId =\n\t\t\toptions?.auth?.clientId ||\n\t\t\tprocess.env.LIOP_OAUTH_CLIENT_ID ||\n\t\t\tprocess.env.LIOP_CLIENT_ID;\n\t\tconst clientSecret =\n\t\t\toptions?.auth?.clientSecret ||\n\t\t\tprocess.env.LIOP_OAUTH_CLIENT_SECRET ||\n\t\t\tprocess.env.LIOP_CLIENT_SECRET;\n\t\tconst nexusUrl =\n\t\t\toptions?.auth?.nexusUrl ||\n\t\t\tprocess.env.LIOP_NEXUS_URL ||\n\t\t\t\"http://localhost:3000\";\n\t\tconst audience =\n\t\t\toptions?.auth?.audience ||\n\t\t\tprocess.env.LIOP_OAUTH_AUDIENCE ||\n\t\t\t\"urn:liop:mesh:api\";\n\t\tconst scope =\n\t\t\toptions?.auth?.scope ||\n\t\t\tprocess.env.LIOP_OAUTH_SCOPE ||\n\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\";\n\n\t\tthis.oauthToken =\n\t\t\toptions?.auth?.token ||\n\t\t\tprocess.env.LIOP_OAUTH_TOKEN ||\n\t\t\tprocess.env.LIOP_TOKEN;\n\n\t\tif (clientId && clientSecret) {\n\t\t\tconst baseUrl = (nexusUrl || \"http://127.0.0.1:3000\").endsWith(\"/oidc\")\n\t\t\t\t? nexusUrl || \"http://127.0.0.1:3000\"\n\t\t\t\t: `${nexusUrl || \"http://127.0.0.1:3000\"}/oidc`;\n\t\t\tconst tokenEndpoint = `${baseUrl}/token`;\n\n\t\t\tthis.tokenManager = new TokenManager({\n\t\t\t\ttokenEndpoint,\n\t\t\t\tclientId,\n\t\t\t\tclientSecret,\n\t\t\t\taudience,\n\t\t\t\tscopes: scope,\n\t\t\t});\n\n\t\t\ttry {\n\t\t\t\tthis.oauthToken = await this.tokenManager.getToken();\n\t\t\t\tlog.info(\n\t\t\t\t\t\"[LiopClient] Dynamic TokenManager configured and initial token acquired.\",\n\t\t\t\t);\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.error(\n\t\t\t\t\t`[LiopClient] Failed to acquire OAuth M2M Token: ${\n\t\t\t\t\t\terr instanceof Error ? err.message : String(err)\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t\t// In development or when using static local token, allow connection to proceed\n\t\t\t}\n\t\t}\n\n\t\tthis.meshNode = new MeshNode(options?.meshConfig);\n\t\tawait this.meshNode.start();\n\t\tlog.info(\n\t\t\t`[LiopClient] Mesh Node synchronized. PeerID: ${this.meshNode.getPeerId()}`,\n\t\t);\n\n\t\tif (address) {\n\t\t\tconst tokenResolver = async () => {\n\t\t\t\tif (this.tokenManager) {\n\t\t\t\t\treturn await this.tokenManager.getToken();\n\t\t\t\t}\n\t\t\t\treturn this.oauthToken;\n\t\t\t};\n\t\t\tthis.rpcClients.set(\n\t\t\t\t\"static\",\n\t\t\t\tnew LiopRpcClient(address, this.tlsOptions, tokenResolver),\n\t\t\t);\n\t\t\tthis.serverInfo = { name: `LiopServer (${address})`, version: \"1.0.0\" };\n\t\t\tlog.info(`[LiopClient] Static gRPC configured for: ${address}`);\n\t\t} else {\n\t\t\tthis.serverInfo = { name: \"LiopServer (Mesh Alpha)\", version: \"1.0.0\" };\n\t\t}\n\t}\n\n\t/**\n\t * Selects the optimal IP from an array of multiaddrs.\n\t * Prioritizes routable non-loopback IPv4 addresses (e.g. Docker bridge, LAN, WAN)\n\t * over loopback (127.0.0.1) to prevent inter-container connection failures.\n\t */\n\tprivate selectOptimalIp(addrs: string[]): string | null {\n\t\t// Pass 1: Non-loopback, routable IPv4 addresses\n\t\tfor (const maddr of addrs) {\n\t\t\tconst parts = maddr.split(\"/\");\n\t\t\tconst ipIdx = parts.indexOf(\"ip4\");\n\t\t\tif (ipIdx !== -1 && ipIdx + 1 < parts.length) {\n\t\t\t\tconst ip = parts[ipIdx + 1];\n\t\t\t\tif (\n\t\t\t\t\tip !== \"127.0.0.1\" &&\n\t\t\t\t\t!ip.startsWith(\"127.\") &&\n\t\t\t\t\tip !== \"0.0.0.0\" &&\n\t\t\t\t\tip !== \"localhost\"\n\t\t\t\t) {\n\t\t\t\t\treturn ip;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Pass 2: Fallback to loopback if no external IP is announced\n\t\tfor (const maddr of addrs) {\n\t\t\tconst parts = maddr.split(\"/\");\n\t\t\tconst ipIdx = parts.indexOf(\"ip4\");\n\t\t\tif (ipIdx !== -1 && ipIdx + 1 < parts.length) {\n\t\t\t\treturn parts[ipIdx + 1];\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t}\n\n\t/**\n\t * Dynamically queries Kademlia DHT to find the optimal PeerID providing the Capability\n\t * and returns the physical gRPC target (host:port) resolved from the provider's manifest.\n\t */\n\tpublic async resolveCapability(toolName: string): Promise<string> {\n\t\tif (!this.meshNode)\n\t\t\tthrow new Error(\n\t\t\t\t\"Client must be connected to Mesh to resolve capabilities.\",\n\t\t\t);\n\n\t\tlog.info(`[LiopClient] Querying Mesh DHT for Provider: ${toolName}...`);\n\t\tconst providers = await this.meshNode.findProviders(toolName);\n\n\t\tif (providers.length === 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Kademlia DHT found zero providers for capability: ${toolName}`,\n\t\t\t);\n\t\t}\n\n\t\tconst providerId = providers[0];\n\t\tlog.info(`[LiopClient] Identified Alpha Provider PeerID: ${providerId}`);\n\n\t\tlet grpcPort = 50051;\n\t\tconst manifest = await this.meshNode.queryManifest(providerId);\n\t\tif (manifest) {\n\t\t\tgrpcPort = manifest.grpcPort;\n\t\t\tthis.manifests.set(providerId, manifest);\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Manifest resolved: gRPC port ${grpcPort}. Cached manifest for PeerID ${providerId}`,\n\t\t\t);\n\t\t}\n\n\t\tconst addrs = await this.meshNode.resolvePeer(providerId);\n\t\tconst optimalIp = this.selectOptimalIp(addrs);\n\t\tif (optimalIp) {\n\t\t\tconst grpcHost = `${optimalIp}:${grpcPort}`;\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Translated Multiaddr to optimal gRPC Target: ${grpcHost}`,\n\t\t\t);\n\t\t\treturn grpcHost;\n\t\t}\n\n\t\treturn `127.0.0.1:${grpcPort}`;\n\t}\n\n\t/**\n\t * Probes a remote MCP endpoint using 'server/discover' to negotiate protocol era.\n\t * Falls back to legacy initialize handshake if server/discover fails.\n\t */\n\tpublic async probeServerDiscover(mcpUrl: string): Promise<{\n\t\tera: McpEra;\n\t\tprotocolVersion: string;\n\t\tsupportedVersions: string[];\n\t}> {\n\t\ttry {\n\t\t\tconst headers: Record<string, string> = {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Mcp-Method\": \"server/discover\",\n\t\t\t};\n\t\t\tif (this.oauthToken) {\n\t\t\t\theaders.Authorization = `Bearer ${this.oauthToken}`;\n\t\t\t}\n\n\t\t\tconst res = await fetch(mcpUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders,\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\tid: 1,\n\t\t\t\t\tmethod: \"server/discover\",\n\t\t\t\t\tparams: {},\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (res.ok) {\n\t\t\t\tconst json = (await res.json()) as {\n\t\t\t\t\tresult?: { supportedVersions?: string[] };\n\t\t\t\t};\n\t\t\t\tconst supported = json.result?.supportedVersions || [];\n\t\t\t\tif (supported.includes(MCP_PROTOCOL_VERSION)) {\n\t\t\t\t\tthis.era = \"modern\";\n\t\t\t\t\tthis.protocolVersion = MCP_PROTOCOL_VERSION;\n\t\t\t\t\treturn {\n\t\t\t\t\t\tera: \"modern\",\n\t\t\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION,\n\t\t\t\t\t\tsupportedVersions: supported,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (_err) {\n\t\t\t// Ignore discovery network probe failures and fallback to legacy if enabled\n\t\t}\n\n\t\t/** @mcp-legacy Fallback to legacy era. Remove when v1 EOL. */\n\t\tif (MCP_LEGACY_SUPPORT_ENABLED) {\n\t\t\tthis.era = \"legacy\";\n\t\t\tthis.protocolVersion = MCP_PROTOCOL_VERSION_LEGACY;\n\t\t\treturn {\n\t\t\t\tera: \"legacy\",\n\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\t\tsupportedVersions: [MCP_PROTOCOL_VERSION_LEGACY],\n\t\t\t};\n\t\t}\n\n\t\tthrow new Error(\n\t\t\t\"Server does not support MCP 2026-07-28 and legacy support is disabled.\",\n\t\t);\n\t}\n\n\t/**\n\t * Discovers remote capabilities via the LIOP Manifest Protocol.\n\t * Utilizes a memory cache to avoid redundant network dials against live peers.\n\t */\n\tpublic async discoverTools(\n\t\tforceRefresh = false,\n\t): Promise<{ name: string; description?: string }[]> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before discovering tools.\");\n\t\t}\n\n\t\tconst discoveryStartTime = Date.now();\n\n\t\tlog.info(\n\t\t\t`[LiopClient] Discovery started (forceRefresh: ${forceRefresh})...`,\n\t\t);\n\t\tconst providerIds = await this.meshNode.discoverManifestProviders();\n\t\tconst tools: { name: string; description?: string }[] = [];\n\t\tconst seenNames = new Set<string>();\n\n\t\tfor (const peerId of providerIds) {\n\t\t\ttry {\n\t\t\t\tlet manifest: LiopManifest | null | undefined = !forceRefresh\n\t\t\t\t\t? this.manifests.get(peerId)\n\t\t\t\t\t: undefined;\n\n\t\t\t\tif (!manifest) {\n\t\t\t\t\tlog.info(`[LiopClient] Querying manifest from: ${peerId}`);\n\t\t\t\t\tmanifest = await this.meshNode.queryManifest(peerId);\n\t\t\t\t\tif (manifest) {\n\t\t\t\t\t\tthis.manifests.set(peerId, manifest);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tlog.info(`[LiopClient] Using cached manifest for: ${peerId}`);\n\t\t\t\t}\n\n\t\t\t\tif (manifest) {\n\t\t\t\t\tfor (const tool of manifest.tools) {\n\t\t\t\t\t\tif (!seenNames.has(tool.name)) {\n\t\t\t\t\t\t\ttools.push({ name: tool.name, description: tool.description });\n\t\t\t\t\t\t\tseenNames.add(tool.name);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Error querying manifest from ${peerId}:`,\n\t\t\t\t\terr instanceof Error ? err.message : String(err),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[LiopClient] Discovery finished. Found ${tools.length} unique tools.`,\n\t\t);\n\n\t\t// [Token Economy] Record telemetry for discoverTools\n\t\ttry {\n\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\tconst toolsPayload = JSON.stringify(tools);\n\t\t\tconst toolsResponsePayload = JSON.stringify({ tools });\n\t\t\ttelemetry.record({\n\t\t\t\ttype: \"tools_list\",\n\t\t\t\tmethod: \"discoverTools\",\n\t\t\t\testimatedInputTokens: telemetry.countTokens(toolsPayload),\n\t\t\t\testimatedOutputTokens: telemetry.countTokens(toolsResponsePayload),\n\t\t\t\tdurationMs: Date.now() - discoveryStartTime,\n\t\t\t});\n\t\t} catch {\n\t\t\t// Telemetry error isolation\n\t\t}\n\n\t\treturn tools;\n\t}\n\n\t/**\n\t * Invokes a tool.\n\t */\n\tpublic async callTool(\n\t\trequest: CallToolRequest,\n\t\t_wasmPayload?: Buffer,\n\t): Promise<CallToolResult> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before calling tools.\");\n\t\t}\n\n\t\tconst callStartTime = Date.now();\n\t\tconst toolName = request.name;\n\t\tlog.info(`[LiopClient] Resolving Tool: ${toolName}`);\n\n\t\t// [ALPHA-FIX] Bypass DHT discovery if we are already statically connected to a provider (Enterprise/Test mode)\n\t\tlet rpcClient = this.rpcClients.get(\"static\");\n\t\tlet targetClientKey = toolName;\n\n\t\tif (!rpcClient) {\n\t\t\t// 1. If an RPC client was already registered for this toolName, reuse it\n\t\t\tif (this.rpcClients.has(toolName)) {\n\t\t\t\trpcClient = this.rpcClients.get(toolName);\n\t\t\t\ttargetClientKey = toolName;\n\t\t\t}\n\t\t}\n\n\t\tif (!rpcClient) {\n\t\t\t// 2. Fast-path: Check if capability already exists in cached manifests to bypass DHT walk\n\t\t\tlet resolvedHost: string | null = null;\n\t\t\tfor (const [peerId, manifest] of this.manifests.entries()) {\n\t\t\t\tif (manifest.tools.some((t) => t.name === toolName)) {\n\t\t\t\t\t// If we already have a client registered for this peerId, reuse it immediately\n\t\t\t\t\tif (this.rpcClients.has(peerId)) {\n\t\t\t\t\t\trpcClient = this.rpcClients.get(peerId);\n\t\t\t\t\t\ttargetClientKey = peerId;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tconst addrs = await this.meshNode.resolvePeer(peerId);\n\t\t\t\t\tconst optimalIp = this.selectOptimalIp(addrs);\n\t\t\t\t\tif (optimalIp) {\n\t\t\t\t\t\tresolvedHost = `${optimalIp}:${manifest.grpcPort}`;\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LiopClient] Fast-path: Resolved ${toolName} from manifest cache to optimal target ${resolvedHost}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\ttargetClientKey = peerId;\n\t\t\t\t\t\trpcClient = this.getOrCreateRpcClient(peerId, resolvedHost);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!rpcClient) {\n\t\t\t\tconst dynamicAddress = await this.resolveCapability(toolName);\n\t\t\t\ttargetClientKey = toolName;\n\t\t\t\trpcClient = this.getOrCreateRpcClient(toolName, dynamicAddress);\n\t\t\t}\n\t\t} else {\n\t\t\ttargetClientKey = \"static\";\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Using existing static gRPC connection for ${toolName}.`,\n\t\t\t);\n\t\t}\n\n\t\tlog.info(`[LiopClient] Negotiating intent for ${toolName}...`);\n\t\tconst agentDid = this.meshNode\n\t\t\t? `did:liop:${this.meshNode.getPeerId()}`\n\t\t\t: \"did:liop:ephemeral\";\n\t\tconst intentPayload = Buffer.from(`${toolName}:${Date.now()}`);\n\t\tconst proofOfIntent = this.meshNode\n\t\t\t? await this.meshNode.sign(intentPayload)\n\t\t\t: intentPayload;\n\n\t\tlet intentResponse: {\n\t\t\taccepted: boolean;\n\t\t\terror_message: string;\n\t\t\tkyber_public_key: Uint8Array;\n\t\t\tkyberPublicKey: Uint8Array;\n\t\t\tsession_token: string;\n\t\t\tsessionToken: string;\n\t\t};\n\n\t\ttry {\n\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\tagent_did: agentDid,\n\t\t\t\tcapability_hash: toolName,\n\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t})) as unknown as typeof intentResponse;\n\t\t} catch (err: unknown) {\n\t\t\tconst errMsg = err instanceof Error ? err.message : String(err);\n\t\t\tif (\n\t\t\t\tthis.tokenManager &&\n\t\t\t\t(errMsg.includes(\"UNAUTHENTICATED\") ||\n\t\t\t\t\terrMsg.includes(\"Invalid JWT\") ||\n\t\t\t\t\terrMsg.includes(\"timestamp check failed\") ||\n\t\t\t\t\terrMsg.includes(\"expired\"))\n\t\t\t) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[LiopClient] Token expired/unauthenticated for ${toolName}. Preemptively refreshing OAuth token and retrying negotiateIntent...`,\n\t\t\t\t);\n\t\t\t\tthis.tokenManager.invalidate();\n\t\t\t\tconst freshToken = await this.tokenManager.getToken();\n\t\t\t\tthis.oauthToken = freshToken;\n\t\t\t\trpcClient.setToken(freshToken);\n\t\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\t\tagent_did: agentDid,\n\t\t\t\t\tcapability_hash: toolName,\n\t\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t\t})) as unknown as typeof intentResponse;\n\t\t\t} else {\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t}\n\n\t\tif (!intentResponse.accepted) {\n\t\t\tif (\n\t\t\t\tthis.tokenManager &&\n\t\t\t\t(intentResponse.error_message?.includes(\"token\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"UNAUTHENTICATED\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"expired\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"timestamp check failed\"))\n\t\t\t) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[LiopClient] Intent rejected with auth error: \"${intentResponse.error_message}\". Refreshing token and retrying...`,\n\t\t\t\t);\n\t\t\t\tthis.tokenManager.invalidate();\n\t\t\t\tconst freshToken = await this.tokenManager.getToken();\n\t\t\t\tthis.oauthToken = freshToken;\n\t\t\t\trpcClient.setToken(freshToken);\n\t\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\t\tagent_did: agentDid,\n\t\t\t\t\tcapability_hash: toolName,\n\t\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t\t})) as unknown as typeof intentResponse;\n\t\t\t}\n\t\t\tif (!intentResponse.accepted) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Intent denied by host: ${intentResponse.error_message}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// LIOP Robust Field Extraction (Supports both snake_case and camelCase via gRPC-JS)\n\t\tconst publicKey =\n\t\t\tintentResponse.kyber_public_key || intentResponse.kyberPublicKey;\n\t\tconst sessionToken =\n\t\t\tintentResponse.session_token || intentResponse.sessionToken;\n\n\t\tif (!publicKey) {\n\t\t\tlog.info(\n\t\t\t\t\"[LiopClient] Critical Error: Kyber Public Key not found in IntentResponse.\",\n\t\t\t\tintentResponse,\n\t\t\t);\n\t\t\ttry {\n\t\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\t\tstatus: \"failure\",\n\t\t\t\t});\n\t\t\t} catch {}\n\t\t\tthrow new Error(\n\t\t\t\t\"Handshake failed: Remote host did not provide a valid Kyber Public Key.\",\n\t\t\t);\n\t\t}\n\n\t\t// 2. Post-Quantum Encapsulation (ML-KEM-768)\n\t\tlog.info(\n\t\t\t`[LiopClient] Encapsulating Post-Quantum Shared Secret for ${request.name}...`,\n\t\t);\n\t\tconst pqcStart = performance.now();\n\t\tlet kyberCiphertext: Uint8Array;\n\t\tlet sharedSecret: Uint8Array;\n\t\ttry {\n\t\t\tconst res = await Kyber768Wrapper.encapsulateAsymmetric(publicKey);\n\t\t\tkyberCiphertext = res.ciphertext;\n\t\t\tsharedSecret = res.sharedSecret;\n\t\t\tconst pqcDuration = performance.now() - pqcStart;\n\t\t\tpqcHandshakeDurationMs.observe({ tool: request.name }, pqcDuration);\n\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\tstatus: \"success\",\n\t\t\t});\n\t\t} catch (encapError) {\n\t\t\ttry {\n\t\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\t\tstatus: \"failure\",\n\t\t\t\t});\n\t\t\t} catch {}\n\t\t\tthrow encapError;\n\t\t}\n\n\t\t// 3. Symmetric Sealing (AES-256-GCM)\n\t\tlog.info(`[LiopClient] Sealing WASM Payload and Inputs...`);\n\n\t\tconst _safePayload = _wasmPayload || Buffer.from(\"\");\n\n\t\t// Encrypt WASM binary\n\t\tconst { ciphertext: encryptedWasm, nonce: aesNonce } =\n\t\t\tAesGcmWrapper.encryptPayload(_safePayload, sharedSecret);\n\n\t\t// Encrypt inputs using a fresh random nonce per input to prevent AES-GCM nonce reuse\n\t\tconst encryptedInputs: Record<string, Uint8Array> = {};\n\t\tconst crypto = await import(\"node:crypto\");\n\t\tfor (const [key, value] of Object.entries(request.arguments || {})) {\n\t\t\tconst inputNonce = crypto.randomBytes(12);\n\t\t\tconst cipher = crypto.createCipheriv(\n\t\t\t\t\"aes-256-gcm\",\n\t\t\t\tsharedSecret,\n\t\t\t\tinputNonce,\n\t\t\t);\n\t\t\tconst encrypted = Buffer.concat([\n\t\t\t\tcipher.update(JSON.stringify(value)),\n\t\t\t\tcipher.final(),\n\t\t\t]);\n\t\t\tconst authTag = cipher.getAuthTag();\n\t\t\t// Prepend the 12-byte nonce to the ciphertext\n\t\t\tencryptedInputs[key] = Buffer.concat([inputNonce, encrypted, authTag]);\n\t\t}\n\n\t\t// 4. Assemble and Execute gRPC LogicRequest\n\t\tconst logicRequest: LogicRequest = {\n\t\t\tsession_token: sessionToken,\n\t\t\twasm_binary: encryptedWasm,\n\t\t\tinputs: encryptedInputs,\n\t\t\tpqc_ciphertext: kyberCiphertext,\n\t\t\taes_nonce: aesNonce,\n\t\t};\n\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst stream = rpcClient.executeLogic(logicRequest);\n\t\t\tif (!stream) {\n\t\t\t\treject(new Error(\"RPC Client unavailable or failed to create stream.\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlet resultFulfilled = false;\n\t\t\tlet hasReceivedData = false;\n\n\t\t\tstream.on(\"data\", async (response: LogicResponse) => {\n\t\t\t\tif (resultFulfilled) return;\n\t\t\t\thasReceivedData = true;\n\n\t\t\t\tlog.info(\"[LiopClient] Logic Executed. Verification in progress...\");\n\n\t\t\t\ttry {\n\t\t\t\t\t// Only verify ZK-Receipt if the remote execution succeeded.\n\t\t\t\t\t// If the remote execution failed due to a policy error (e.g. Egress Shield),\n\t\t\t\t\t// the ZK proof is empty and we should bypass validation to propagate the original error.\n\t\t\t\t\tif (!response.is_error) {\n\t\t\t\t\t\tconst isValid = await this.verifier.verifyZkReceipt(\n\t\t\t\t\t\t\t_safePayload,\n\t\t\t\t\t\t\tBuffer.from(response.cryptographic_proof).toString(\"hex\"),\n\t\t\t\t\t\t\tBuffer.from(response.zk_receipt),\n\t\t\t\t\t\t\tBuffer.from(sharedSecret),\n\t\t\t\t\t\t\tresponse.semantic_evidence,\n\t\t\t\t\t\t);\n\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tzkVerificationsTotal.inc({\n\t\t\t\t\t\t\t\tstatus: isValid ? \"valid\" : \"invalid\",\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\t// Metrics isolation\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (!isValid) {\n\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\t\t\terror_type: \"zk_verification_failed\",\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t} catch {}\n\t\t\t\t\t\t\treject(\n\t\t\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t\t\t\"PROTOCOL INTEGRITY VIOLATION: ZK-Receipt verification failed.\",\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\t\terror_type: \"remote_execution_error\",\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} catch {}\n\t\t\t\t\t}\n\n\t\t\t\t\tresultFulfilled = true;\n\n\t\t\t\t\t// [Token Economy & Wire Telemetry] Record telemetry for callTool\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\t\t\t\tconst inputPayload = JSON.stringify(request.arguments ?? {});\n\t\t\t\t\t\ttelemetry.record({\n\t\t\t\t\t\t\ttype: \"tool_call\",\n\t\t\t\t\t\t\tmethod: \"callTool\",\n\t\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\t\tpeerId:\n\t\t\t\t\t\t\t\ttargetClientKey !== toolName ? targetClientKey : undefined,\n\t\t\t\t\t\t\testimatedInputTokens: telemetry.countTokens(inputPayload),\n\t\t\t\t\t\t\testimatedOutputTokens: telemetry.countTokens(\n\t\t\t\t\t\t\t\tresponse.semantic_evidence,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tdurationMs: Date.now() - callStartTime,\n\t\t\t\t\t\t});\n\n\t\t\t\t\t\tconst egressBytes =\n\t\t\t\t\t\t\tBuffer.byteLength(response.semantic_evidence || \"\") +\n\t\t\t\t\t\t\t(response.cryptographic_proof\n\t\t\t\t\t\t\t\t? response.cryptographic_proof.length\n\t\t\t\t\t\t\t\t: 0) +\n\t\t\t\t\t\t\t(response.zk_receipt ? response.zk_receipt.length : 0);\n\t\t\t\t\t\twireEgressBytesTotal.inc({ capability: toolName }, egressBytes);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\t// Telemetry error isolation\n\t\t\t\t\t}\n\n\t\t\t\t\tresolve({\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: response.semantic_evidence,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tisError: response.is_error,\n\t\t\t\t\t});\n\t\t\t\t} catch (err) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\terror_type: \"verification_exception\",\n\t\t\t\t\t\t});\n\t\t\t\t\t} catch {}\n\t\t\t\t\treject(err);\n\t\t\t\t}\n\t\t\t});\n\n\t\t\tstream.on(\"error\", (err) => {\n\t\t\t\t// Evict faulted client from cache so subsequent requests reconnect cleanly\n\t\t\t\tthis.rpcClients.delete(targetClientKey);\n\t\t\t\tthis.rpcClients.delete(toolName);\n\t\t\t\ttry {\n\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\terror_type: \"stream_error\",\n\t\t\t\t\t});\n\t\t\t\t} catch {}\n\t\t\t\tif (resultFulfilled) return;\n\t\t\t\tlog.error(\"[LiopClient] Stream Error:\", err);\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tstream.on(\"end\", () => {\n\t\t\t\t// We don't throw here if we already received a response block that is currently\n\t\t\t\t// undergoing ZK Verification in the Piscina worker pool.\n\t\t\t\tif (!hasReceivedData && !resultFulfilled) {\n\t\t\t\t\treject(new Error(\"Logic-on-Origin stream closed without results.\"));\n\t\t\t\t}\n\t\t\t});\n\t\t});\n\t}\n\n\tprivate getOrCreateRpcClient(peerId: string, address: string): LiopRpcClient {\n\t\tlet client = this.rpcClients.get(peerId);\n\t\tif (!client) {\n\t\t\tlet manifest = this.manifests.get(peerId);\n\t\t\tlet realPeerId = peerId;\n\n\t\t\t// If peerId is actually a toolName (which happens when called from callTool),\n\t\t\t// resolve the real PeerID and its manifest from the manifest cache.\n\t\t\tif (!manifest) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] PeerID \"${peerId}\" not found in manifest cache as PeerID. Searching tools in cached manifests...`,\n\t\t\t\t);\n\t\t\t\tfor (const [pId, m] of this.manifests.entries()) {\n\t\t\t\t\tif (m.tools.some((t) => t.name === peerId)) {\n\t\t\t\t\t\tmanifest = m;\n\t\t\t\t\t\trealPeerId = pId;\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LiopClient] Resolved tool \"${peerId}\" to provider PeerID \"${pId.slice(-8)}\" from manifest cache.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst providerName = manifest?.serverInfo?.name?.toLowerCase() || \"\";\n\t\t\tlet envToken: string | undefined;\n\n\t\t\t// 0. Deterministic tokenSlug resolution (highest priority, zero heuristic)\n\t\t\tconst slug = manifest?.tokenSlug;\n\t\t\tif (slug) {\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${slug}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${slug}`];\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Resolved via tokenSlug \"${slug}\" (LIOP_TOKEN_${slug}) -> found: ${!!envToken}`,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] No tokenSlug available for peer ${realPeerId.slice(-8)}. Available cache keys: ${Array.from(\n\t\t\t\t\t\tthis.manifests.keys(),\n\t\t\t\t\t)\n\t\t\t\t\t\t.map((k) => k.slice(-8))\n\t\t\t\t\t\t.join(\", \")}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// 1. PeerID-specific resolution: LIOP_TOKEN_<last 8 chars of PeerID in uppercase>\n\t\t\tif (!envToken && realPeerId) {\n\t\t\t\tconst shortId = realPeerId.slice(-8).toUpperCase();\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${shortId}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${shortId}`];\n\t\t\t}\n\n\t\t\t// 2. Provider-name resolution: LIOP_TOKEN_<CLEAN_PROVIDER_NAME_UPPERCASE>\n\t\t\tif (!envToken && providerName) {\n\t\t\t\tconst cleanName = providerName\n\t\t\t\t\t.toUpperCase()\n\t\t\t\t\t.replace(/[^A-Z0-9_]/g, \"_\");\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${cleanName}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${cleanName}`];\n\t\t\t}\n\n\t\t\tif (envToken) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Resolved node-specific token for peer ${realPeerId.slice(-8)} (${providerName || \"unknown\"})`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst tokenResolver = async () => {\n\t\t\t\tif (envToken) return envToken;\n\t\t\t\tif (this.tokenManager) {\n\t\t\t\t\treturn await this.tokenManager.getToken();\n\t\t\t\t}\n\t\t\t\treturn this.oauthToken;\n\t\t\t};\n\n\t\t\tclient = new LiopRpcClient(address, this.tlsOptions, tokenResolver);\n\t\t\tthis.rpcClients.set(peerId, client);\n\t\t}\n\t\treturn client;\n\t}\n\n\t/**\n\t * Reads a specific resource by URI.\n\t * In LIOP, resources can be static definitions or dynamic streams.\n\t */\n\tpublic async readResource(uri: string): Promise<{\n\t\tcontents: Array<{ uri: string; mimeType?: string; text: string }>;\n\t}> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before reading resources.\");\n\t\t}\n\t\tconst readStartTime = Date.now();\n\t\tlog.info(`[LiopClient] Querying Mesh for Resource: ${uri}...`);\n\n\t\t// We search for the peer hosting the resource in the P2P Mesh\n\t\tconst providers = await this.meshNode.findProviders(uri);\n\t\tif (providers.length === 0) {\n\t\t\tthrow new Error(`No mesh providers found for resource: ${uri}`);\n\t\t}\n\n\t\t// Query the remote peer's manifest\n\t\tconst manifest = await this.meshNode.queryManifest(providers[0]);\n\t\tif (!manifest) {\n\t\t\tthrow new Error(\"Target peer did not return a valid LIOP Manifest.\");\n\t\t}\n\n\t\t// Locate the exact resource metadata\n\t\tconst resourceDef = manifest.resources?.find((r) => r.uri === uri);\n\t\tif (!resourceDef) {\n\t\t\tthrow new Error(`Resource ${uri} not listed in remote manifest.`);\n\t\t}\n\n\t\t// Return the declarative metadata (Logic-Injection is required for actual data extraction)\n\t\tconst result = {\n\t\t\tcontents: [\n\t\t\t\t{\n\t\t\t\t\turi,\n\t\t\t\t\tmimeType: resourceDef.mimeType || \"application/json\",\n\t\t\t\t\ttext: JSON.stringify(resourceDef, null, 2),\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\n\t\t// [Token Economy] Record telemetry for readResource\n\t\ttry {\n\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\tconst outputPayload = JSON.stringify(result);\n\t\t\ttelemetry.record({\n\t\t\t\ttype: \"resource_read\",\n\t\t\t\tmethod: \"readResource\",\n\t\t\t\ttoolName: uri,\n\t\t\t\tpeerId: providers[0],\n\t\t\t\testimatedInputTokens: telemetry.countTokens(uri),\n\t\t\t\testimatedOutputTokens: telemetry.countTokens(outputPayload),\n\t\t\t\tdurationMs: Date.now() - readStartTime,\n\t\t\t});\n\t\t} catch {\n\t\t\t// Telemetry error isolation\n\t\t}\n\n\t\treturn result;\n\t}\n\n\t/**\n\t * Returns the local PeerId string if the mesh node is active, null otherwise.\n\t * PeerIds are public identifiers by libp2p protocol design (Ed25519 public key hash).\n\t */\n\tpublic get peerId(): string | null {\n\t\treturn this.meshNode?.getPeerId() ?? null;\n\t}\n\n\t/**\n\t * Returns true if the mesh node is initialized and running.\n\t */\n\tpublic get isMeshActive(): boolean {\n\t\treturn this.meshNode?.isStarted() ?? false;\n\t}\n\n\t/**\n\t * Returns the number of active P2P connections, or 0 if the mesh is inactive.\n\t */\n\tpublic get connectionCount(): number {\n\t\treturn this.meshNode?.getPeers().length ?? 0;\n\t}\n\n\tpublic getServerInfo(): { name: string; version: string } | undefined {\n\t\treturn this.serverInfo;\n\t}\n\n\t/**\n\t * Destroys the active Mesh Node resources.\n\t */\n\tpublic async close(): Promise<void> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t}\n}\n"]}

package/dist/{chunk-3L2O2XKG.js → chunk-JPYPTJHX.js}

@@ -1,4 +1,4 @@
-import { LiopMcpRouter } from './chunk-L6J72C5X.js';
+import { LiopMcpRouter } from './chunk-V2TP43CD.js';
 import { LIOP_SCOPES } from './chunk-VH4K4U45.js';
 import { meshPeersConnected, manifestCacheSize, protocolMetrics } from './chunk-PAICJCKJ.js';
 import { log } from './chunk-HA6YZ42O.js';
@@ -719,5 +719,5 @@ var LiopHybridGateway = class {
 };
 
 export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, isGrpcWebRequest };
-//# sourceMappingURL=chunk-3L2O2XKG.js.map
-//# sourceMappingURL=chunk-3L2O2XKG.js.map
+//# sourceMappingURL=chunk-JPYPTJHX.js.map
+//# sourceMappingURL=chunk-JPYPTJHX.js.map