@nekzus/liop 2.4.0-alpha.12 → 2.4.0-alpha.14

package/dist/{chunk-ESRXG36Y.js → chunk-VRZ3UIYA.js}

@@ -1,4 +1,4 @@
-import { log } from './chunk-HA6YZ42O.js';
+import { log } from './chunk-LIBI3HMN.js';
 
 // src/runtime/token-manager.ts
 var TokenManager = class _TokenManager {
@@ -111,5 +111,5 @@ var TokenManager = class _TokenManager {
 };
 
 export { TokenManager };
-//# sourceMappingURL=chunk-ESRXG36Y.js.map
-//# sourceMappingURL=chunk-ESRXG36Y.js.map
+//# sourceMappingURL=chunk-VRZ3UIYA.js.map
+//# sourceMappingURL=chunk-VRZ3UIYA.js.map

package/dist/{chunk-ESRXG36Y.js.map → chunk-VRZ3UIYA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/runtime/token-manager.ts"],"names":[],"mappings":";;;AAwBO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,WAAA,GAA6B,IAAA;AAAA,EAC7B,SAAA,GAAY,CAAA;AAAA;AAAA,EACZ,cAAA,GAAyC,IAAA;AAAA,EAEhC,aAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACT,WAAA;AAAA;AAAA,EAGR,OAAwB,iBAAA,GAAoB,GAAA;AAAA,EAE5C,YAAY,OAAA,EAA8B;AACzC,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACpC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,GACtC,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GACtB,OAAA,CAAQ,MAAA,IACV,sFAAA;AACF,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,QAAA,GAA4B;AACxC,IAAA,IAAI,KAAK,WAAA,EAAa;AACrB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IACC,KAAK,WAAA,IACL,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,cAAa,iBAAA,EACnC;AACD,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACxB,MAAA,OAAO,IAAA,CAAK,cAAA;AAAA,IACb;AAEA,IAAA,IAAA,CAAK,kBAAkB,YAAY;AAClC,MAAA,IAAI;AACH,QAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AACvC,QAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,QAAA,OAAO,KAAA;AAAA,MACR,CAAA,SAAE;AACD,QAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,MACvB;AAAA,IACD,CAAA,GAAG;AAEH,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,UAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,YAAA,EAAc;AACvC,MAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAAA,IACpB;AACA,IAAA,GAAA,CAAI,KAAK,uDAAuD,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKO,SAAA,GAAqB;AAC3B,IAAA,IAAI,IAAA,CAAK,aAAa,OAAO,KAAA;AAC7B,IAAA,OACC,CAAC,KAAK,WAAA,IACN,IAAA,CAAK,KAAI,IAAK,IAAA,CAAK,YAAY,aAAA,CAAa,iBAAA;AAAA,EAE9C;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACb;AAAA,EAEA,MAAc,aAAA,GAAiC;AAC9C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yCAAA,EAA4C,IAAA,CAAK,aAAa,CAAA,aAAA,EAAgB,KAAK,QAAQ,CAAA,IAAA;AAAA,KAC5F;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAClC,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,IAAA,CAAK,QAAA;AAAA,MAChB,eAAe,IAAA,CAAK,YAAA;AAAA,MACpB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,OAAO,IAAA,CAAK;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACR,cAAA,EAAgB,mCAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACT;AAAA,MACA,IAAA,EAAM,OAAO,QAAA,EAAS;AAAA,MACtB,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AACjB,MAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,IAAA,EAAK;AACtC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,iCAAA,EAAoC,QAAA,CAAS,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAMlC,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,eACL,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,IAAA;AACzD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,YAAA,GAAe,GAAA;AAE7C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iEAAiE,YAAY,CAAA,EAAA;AAAA,KAC9E;AAEA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACb;AACD","file":"chunk-ESRXG36Y.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Token Manager — Adaptive OAuth 2.1 M2M Token Lifecycle\n *\n * Implements resilient token caching with preemptive refresh (30s safety buffer),\n * concurrency de-duplication (single in-flight HTTP request), and on-demand\n * invalidation for 401 Unauthorized handling.\n *\n * Standards: RFC 6749, RFC 8707 (Resource Indicators), RFC 9068 (JWT Profile)\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface TokenManagerOptions {\n\ttokenEndpoint: string;\n\tclientId: string;\n\tclientSecret: string;\n\taudience?: string;\n\tscopes?: string | string[];\n\tstaticToken?: string;\n}\n\nexport class TokenManager {\n\tprivate cachedToken: string | null = null;\n\tprivate expiresAt = 0; // Epoch ms\n\tprivate pendingPromise: Promise<string> | null = null;\n\n\tprivate readonly tokenEndpoint: string;\n\tprivate readonly clientId: string;\n\tprivate readonly clientSecret: string;\n\tprivate readonly audience: string;\n\tprivate readonly scope: string;\n\tprivate staticToken?: string;\n\n\t// Preemptive refresh threshold: 30 seconds before expiration\n\tprivate static readonly REFRESH_BUFFER_MS = 30_000;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.tokenEndpoint = options.tokenEndpoint;\n\t\tthis.clientId = options.clientId;\n\t\tthis.clientSecret = options.clientSecret;\n\t\tthis.audience = options.audience ?? \"urn:liop:mesh:api\";\n\t\tthis.scope = Array.isArray(options.scopes)\n\t\t\t? options.scopes.join(\" \")\n\t\t\t: (options.scopes ??\n\t\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\");\n\t\tthis.staticToken = options.staticToken;\n\t}\n\n\t/**\n\t * Returns a valid OAuth 2.1 access token.\n\t * Automatically performs preemptive refresh if the token is close to expiry.\n\t */\n\tpublic async getToken(): Promise<string> {\n\t\tif (this.staticToken) {\n\t\t\treturn this.staticToken;\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tif (\n\t\t\tthis.cachedToken &&\n\t\t\tnow < this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t) {\n\t\t\treturn this.cachedToken;\n\t\t}\n\n\t\tif (this.pendingPromise) {\n\t\t\treturn this.pendingPromise;\n\t\t}\n\n\t\tthis.pendingPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tconst token = await this.fetchNewToken();\n\t\t\t\tthis.cachedToken = token;\n\t\t\t\treturn token;\n\t\t\t} finally {\n\t\t\t\tthis.pendingPromise = null;\n\t\t\t}\n\t\t})();\n\n\t\treturn this.pendingPromise;\n\t}\n\n\t/**\n\t * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.\n\t */\n\tpublic invalidate(): void {\n\t\tthis.cachedToken = null;\n\t\tthis.expiresAt = 0;\n\t\tif (this.clientId && this.clientSecret) {\n\t\t\tthis.staticToken = undefined;\n\t\t}\n\t\tlog.info(\"[TokenManager] Cached OAuth access token invalidated.\");\n\t}\n\n\t/**\n\t * Returns true if the token is absent or has passed the refresh threshold.\n\t */\n\tpublic isExpired(): boolean {\n\t\tif (this.staticToken) return false;\n\t\treturn (\n\t\t\t!this.cachedToken ||\n\t\t\tDate.now() >= this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t);\n\t}\n\n\tpublic getExpiresAt(): number {\n\t\treturn this.expiresAt;\n\t}\n\n\tprivate async fetchNewToken(): Promise<string> {\n\t\tlog.info(\n\t\t\t`[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`,\n\t\t);\n\n\t\tconst params = new URLSearchParams({\n\t\t\tgrant_type: \"client_credentials\",\n\t\t\tclient_id: this.clientId,\n\t\t\tclient_secret: this.clientSecret,\n\t\t\tresource: this.audience,\n\t\t\tscope: this.scope,\n\t\t});\n\n\t\tconst response = await fetch(this.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\tAccept: \"application/json\",\n\t\t\t},\n\t\t\tbody: params.toString(),\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst errorText = await response.text();\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth token request failed [HTTP ${response.status}]: ${errorText}`,\n\t\t\t);\n\t\t}\n\n\t\tconst data = (await response.json()) as {\n\t\t\taccess_token?: string;\n\t\t\texpires_in?: number;\n\t\t\ttoken_type?: string;\n\t\t};\n\n\t\tif (!data.access_token) {\n\t\t\tthrow new Error(\n\t\t\t\t\"OAuth token response did not contain an 'access_token' field.\",\n\t\t\t);\n\t\t}\n\n\t\tconst expiresInSec =\n\t\t\ttypeof data.expires_in === \"number\" ? data.expires_in : 3600;\n\t\tthis.expiresAt = Date.now() + expiresInSec * 1000;\n\n\t\tlog.info(\n\t\t\t`[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`,\n\t\t);\n\n\t\treturn data.access_token;\n\t}\n}\n"]}
+{"version":3,"sources":["../src/runtime/token-manager.ts"],"names":[],"mappings":";;;AAwBO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,WAAA,GAA6B,IAAA;AAAA,EAC7B,SAAA,GAAY,CAAA;AAAA;AAAA,EACZ,cAAA,GAAyC,IAAA;AAAA,EAEhC,aAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACT,WAAA;AAAA;AAAA,EAGR,OAAwB,iBAAA,GAAoB,GAAA;AAAA,EAE5C,YAAY,OAAA,EAA8B;AACzC,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACpC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,GACtC,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GACtB,OAAA,CAAQ,MAAA,IACV,sFAAA;AACF,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,QAAA,GAA4B;AACxC,IAAA,IAAI,KAAK,WAAA,EAAa;AACrB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IACC,KAAK,WAAA,IACL,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,cAAa,iBAAA,EACnC;AACD,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACxB,MAAA,OAAO,IAAA,CAAK,cAAA;AAAA,IACb;AAEA,IAAA,IAAA,CAAK,kBAAkB,YAAY;AAClC,MAAA,IAAI;AACH,QAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AACvC,QAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,QAAA,OAAO,KAAA;AAAA,MACR,CAAA,SAAE;AACD,QAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,MACvB;AAAA,IACD,CAAA,GAAG;AAEH,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,UAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,YAAA,EAAc;AACvC,MAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAAA,IACpB;AACA,IAAA,GAAA,CAAI,KAAK,uDAAuD,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKO,SAAA,GAAqB;AAC3B,IAAA,IAAI,IAAA,CAAK,aAAa,OAAO,KAAA;AAC7B,IAAA,OACC,CAAC,KAAK,WAAA,IACN,IAAA,CAAK,KAAI,IAAK,IAAA,CAAK,YAAY,aAAA,CAAa,iBAAA;AAAA,EAE9C;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACb;AAAA,EAEA,MAAc,aAAA,GAAiC;AAC9C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yCAAA,EAA4C,IAAA,CAAK,aAAa,CAAA,aAAA,EAAgB,KAAK,QAAQ,CAAA,IAAA;AAAA,KAC5F;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAClC,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,IAAA,CAAK,QAAA;AAAA,MAChB,eAAe,IAAA,CAAK,YAAA;AAAA,MACpB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,OAAO,IAAA,CAAK;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACR,cAAA,EAAgB,mCAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACT;AAAA,MACA,IAAA,EAAM,OAAO,QAAA,EAAS;AAAA,MACtB,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AACjB,MAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,IAAA,EAAK;AACtC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,iCAAA,EAAoC,QAAA,CAAS,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAMlC,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,eACL,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,IAAA;AACzD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,YAAA,GAAe,GAAA;AAE7C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iEAAiE,YAAY,CAAA,EAAA;AAAA,KAC9E;AAEA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACb;AACD","file":"chunk-VRZ3UIYA.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Token Manager — Adaptive OAuth 2.1 M2M Token Lifecycle\n *\n * Implements resilient token caching with preemptive refresh (30s safety buffer),\n * concurrency de-duplication (single in-flight HTTP request), and on-demand\n * invalidation for 401 Unauthorized handling.\n *\n * Standards: RFC 6749, RFC 8707 (Resource Indicators), RFC 9068 (JWT Profile)\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface TokenManagerOptions {\n\ttokenEndpoint: string;\n\tclientId: string;\n\tclientSecret: string;\n\taudience?: string;\n\tscopes?: string | string[];\n\tstaticToken?: string;\n}\n\nexport class TokenManager {\n\tprivate cachedToken: string | null = null;\n\tprivate expiresAt = 0; // Epoch ms\n\tprivate pendingPromise: Promise<string> | null = null;\n\n\tprivate readonly tokenEndpoint: string;\n\tprivate readonly clientId: string;\n\tprivate readonly clientSecret: string;\n\tprivate readonly audience: string;\n\tprivate readonly scope: string;\n\tprivate staticToken?: string;\n\n\t// Preemptive refresh threshold: 30 seconds before expiration\n\tprivate static readonly REFRESH_BUFFER_MS = 30_000;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.tokenEndpoint = options.tokenEndpoint;\n\t\tthis.clientId = options.clientId;\n\t\tthis.clientSecret = options.clientSecret;\n\t\tthis.audience = options.audience ?? \"urn:liop:mesh:api\";\n\t\tthis.scope = Array.isArray(options.scopes)\n\t\t\t? options.scopes.join(\" \")\n\t\t\t: (options.scopes ??\n\t\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\");\n\t\tthis.staticToken = options.staticToken;\n\t}\n\n\t/**\n\t * Returns a valid OAuth 2.1 access token.\n\t * Automatically performs preemptive refresh if the token is close to expiry.\n\t */\n\tpublic async getToken(): Promise<string> {\n\t\tif (this.staticToken) {\n\t\t\treturn this.staticToken;\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tif (\n\t\t\tthis.cachedToken &&\n\t\t\tnow < this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t) {\n\t\t\treturn this.cachedToken;\n\t\t}\n\n\t\tif (this.pendingPromise) {\n\t\t\treturn this.pendingPromise;\n\t\t}\n\n\t\tthis.pendingPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tconst token = await this.fetchNewToken();\n\t\t\t\tthis.cachedToken = token;\n\t\t\t\treturn token;\n\t\t\t} finally {\n\t\t\t\tthis.pendingPromise = null;\n\t\t\t}\n\t\t})();\n\n\t\treturn this.pendingPromise;\n\t}\n\n\t/**\n\t * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.\n\t */\n\tpublic invalidate(): void {\n\t\tthis.cachedToken = null;\n\t\tthis.expiresAt = 0;\n\t\tif (this.clientId && this.clientSecret) {\n\t\t\tthis.staticToken = undefined;\n\t\t}\n\t\tlog.info(\"[TokenManager] Cached OAuth access token invalidated.\");\n\t}\n\n\t/**\n\t * Returns true if the token is absent or has passed the refresh threshold.\n\t */\n\tpublic isExpired(): boolean {\n\t\tif (this.staticToken) return false;\n\t\treturn (\n\t\t\t!this.cachedToken ||\n\t\t\tDate.now() >= this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t);\n\t}\n\n\tpublic getExpiresAt(): number {\n\t\treturn this.expiresAt;\n\t}\n\n\tprivate async fetchNewToken(): Promise<string> {\n\t\tlog.info(\n\t\t\t`[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`,\n\t\t);\n\n\t\tconst params = new URLSearchParams({\n\t\t\tgrant_type: \"client_credentials\",\n\t\t\tclient_id: this.clientId,\n\t\t\tclient_secret: this.clientSecret,\n\t\t\tresource: this.audience,\n\t\t\tscope: this.scope,\n\t\t});\n\n\t\tconst response = await fetch(this.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\tAccept: \"application/json\",\n\t\t\t},\n\t\t\tbody: params.toString(),\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst errorText = await response.text();\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth token request failed [HTTP ${response.status}]: ${errorText}`,\n\t\t\t);\n\t\t}\n\n\t\tconst data = (await response.json()) as {\n\t\t\taccess_token?: string;\n\t\t\texpires_in?: number;\n\t\t\ttoken_type?: string;\n\t\t};\n\n\t\tif (!data.access_token) {\n\t\t\tthrow new Error(\n\t\t\t\t\"OAuth token response did not contain an 'access_token' field.\",\n\t\t\t);\n\t\t}\n\n\t\tconst expiresInSec =\n\t\t\ttypeof data.expires_in === \"number\" ? data.expires_in : 3600;\n\t\tthis.expiresAt = Date.now() + expiresInSec * 1000;\n\n\t\tlog.info(\n\t\t\t`[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`,\n\t\t);\n\n\t\treturn data.access_token;\n\t}\n}\n"]}

package/dist/client.d.ts

@@ -1,7 +1,7 @@
 import './verifier-COnid_dg.js';
 import './node-B0b2vUFS.js';
-export { c as LiopClient } from './index-CYr7H4aY.js';
-import './types-lJIxBlWF.js';
+export { c as LiopClient } from './index-DHdTB7B8.js';
+import './types-CMYlWlX2.js';
 import '@grpc/grpc-js';
 import 'node:events';
 import 'zod';

package/dist/client.js

@@ -1,13 +1,13 @@
-export { LiopClient } from './chunk-GYJQ63L2.js';
-import './chunk-ESRXG36Y.js';
-import './chunk-DZ2FQGJD.js';
-import './chunk-PEN3KFLF.js';
+export { LiopClient } from './chunk-KB7LNCVI.js';
+import './chunk-VRZ3UIYA.js';
+import './chunk-UAUBVKMK.js';
+import './chunk-RWBFGRF7.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
-import './chunk-3BJ5QQHK.js';
+import './chunk-COISHJK5.js';
 import './chunk-PAICJCKJ.js';
-import './chunk-EG46XMJT.js';
-import './chunk-7RXOIDXP.js';
-import './chunk-HA6YZ42O.js';
+import './chunk-2KSO3W4A.js';
+import './chunk-QJIXNZTL.js';
+import './chunk-LIBI3HMN.js';
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,7 +1,7 @@
 import './node-B0b2vUFS.js';
-import './index-DoW2gzBZ.js';
-export { L as LiopHybridGateway } from './hybrid-CrKB50nh.js';
+import './index-Dqn4dtZP.js';
+import './types-CMYlWlX2.js';
+export { L as LiopHybridGateway } from './hybrid-CTC9oYVp.js';
 import 'zod';
-import './types-lJIxBlWF.js';
 import 'jose';
 import './verifier-COnid_dg.js';

package/dist/gateway.js

@@ -1,13 +1,13 @@
-export { LiopHybridGateway } from './chunk-JPYPTJHX.js';
-import './chunk-V2TP43CD.js';
-import './chunk-DZ2FQGJD.js';
-import './chunk-PEN3KFLF.js';
+export { LiopHybridGateway } from './chunk-TDTGUVLB.js';
+import './chunk-JPN5456V.js';
+import './chunk-UAUBVKMK.js';
+import './chunk-RWBFGRF7.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
 import './chunk-VH4K4U45.js';
-import './chunk-3BJ5QQHK.js';
+import './chunk-COISHJK5.js';
 import './chunk-PAICJCKJ.js';
-import './chunk-EG46XMJT.js';
-import './chunk-HA6YZ42O.js';
+import './chunk-2KSO3W4A.js';
+import './chunk-LIBI3HMN.js';
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/{hybrid-CrKB50nh.d.ts → hybrid-CTC9oYVp.d.ts}

@@ -1,7 +1,7 @@
 import { a as MeshNode } from './node-B0b2vUFS.js';
-import { L as LiopServer } from './index-DoW2gzBZ.js';
+import { L as LiopServer } from './index-Dqn4dtZP.js';
+import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-CMYlWlX2.js';
 import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse } from './types-lJIxBlWF.js';
 
 /**
  * LIOP Sliding-Window Rate Limiter
@@ -153,9 +153,10 @@ declare class LiopHybridGateway {
     private jwtValidator?;
     private oauthProvider?;
     private rateLimiter;
+    private readonly interceptorOptions?;
     private isDraining;
     private activeRequests;
-    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number, rateLimiterOptions?: RateLimiterOptions);
+    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number, rateLimiterOptions?: RateLimiterOptions, interceptorOptions?: GatewayInterceptorOptions);
     private setupH2Routes;
     private setupH1Routes;
     private handleGrpcStream;

package/dist/{index-CYr7H4aY.d.ts → index-DHdTB7B8.d.ts}

@@ -2,7 +2,7 @@ import { L as LiopVerifier } from './verifier-COnid_dg.js';
 import { M as MeshNodeConfig } from './node-B0b2vUFS.js';
 import * as grpc from '@grpc/grpc-js';
 import { EventEmitter } from 'node:events';
-import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-lJIxBlWF.js';
+import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-CMYlWlX2.js';
 
 interface CertManagerOptions {
     /** Path to the root CA certificate (PEM format) */

package/dist/{index-DoW2gzBZ.d.ts → index-Dqn4dtZP.d.ts}

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { M as MeshNodeConfig, a as MeshNode } from './node-B0b2vUFS.js';
-import { J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, G as GetPromptRequest, d as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-lJIxBlWF.js';
+import { d as AuditLogger, J as JwtValidator, S as ServerInfo, a as CallToolResult, P as Prompt, e as GetPromptRequest, f as GetPromptResult, C as CallToolRequest, T as Tool, R as Resource } from './types-CMYlWlX2.js';
 
 /**
  * LIOP OAuth 2.1 Hybrid Auth — Configuration Types
@@ -100,55 +100,6 @@ declare const AUTH_DEFAULTS: {
     readonly signingAlgorithm: "EdDSA";
 };
 
-type AuditStatus = "SUCCESS" | "BLOCKED_EGRESS" | "ERROR" | "POLICY_VIOLATION";
-interface AuditEntry {
-    id: string;
-    timestamp: string;
-    traceId: string;
-    agentDid: string;
-    peerId: string;
-    toolName: string;
-    datasetHash: string;
-    fuelConsumed: number;
-    outputHash: string;
-    zkReceiptSig: string;
-    status: AuditStatus;
-    prevEntryHash: string;
-    entryHash: string;
-}
-interface AuditRecordParams {
-    timestamp?: string;
-    traceId?: string;
-    agentDid: string;
-    peerId: string;
-    toolName: string;
-    datasetHash?: string;
-    fuelConsumed: number;
-    outputHash?: string;
-    zkReceiptSig?: string;
-    status: AuditStatus;
-}
-declare const GENESIS_HASH: string;
-declare function computeEntryHash(entryWithoutHash: Omit<AuditEntry, "entryHash">): string;
-declare class AuditLogger {
-    private entries;
-    private lastEntryHash;
-    private filePath?;
-    constructor(filePath?: string);
-    recordExecution(params: AuditRecordParams): AuditEntry;
-    getEntries(): readonly AuditEntry[];
-    getEntryCount(): number;
-    verifyIntegrity(): {
-        valid: boolean;
-        totalEntries: number;
-        brokenIndex?: number;
-        reason?: string;
-    };
-    exportJsonl(): string;
-    private loadFromFile;
-}
-declare const globalAuditLogger: AuditLogger;
-
 /** Single named entity detected by the NER scanner. */
 interface NerEntity {
     type: "person" | "place" | "organization";
@@ -563,4 +514,4 @@ declare class LiopServer {
     private applyInMemoryBudget;
 }
 
-export { AUTH_DEFAULTS as A, GENESIS_HASH as G, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuditEntry as c, AuditLogger as d, type AuditRecordParams as e, type AuditStatus as f, type AuthRole as g, type LiopAuthConfig as h, type LogicExecutionPolicy as i, type OutputSanitizerConfig as j, PII_PRESETS as k, type PiiRule as l, PiiScanner as m, computeEntryHash as n, globalAuditLogger as o, sanitizeOutput as s };
+export { AUTH_DEFAULTS as A, LiopServer as L, NerScanner as N, type OAuthClientConfig as O, PII_PATTERNS as P, type ToolHandler as T, type LiopServerOptions as a, type AggregationPolicy as b, type AuthRole as c, type LiopAuthConfig as d, type LogicExecutionPolicy as e, type OutputSanitizerConfig as f, PII_PRESETS as g, type PiiRule as h, PiiScanner as i, sanitizeOutput as s };

package/dist/index.d.ts

@@ -1,14 +1,14 @@
 export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOptions } from './bridge.js';
-import { L as LiopTlsOptions } from './index-CYr7H4aY.js';
-export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient, d as createChannelCredentials, e as createServerCredentials } from './index-CYr7H4aY.js';
+import { L as LiopTlsOptions } from './index-DHdTB7B8.js';
+export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient, d as createChannelCredentials, e as createServerCredentials } from './index-DHdTB7B8.js';
 import * as http from 'node:http';
-export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-CrKB50nh.js';
+export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-CTC9oYVp.js';
+import { A as AuthInfo } from './types-CMYlWlX2.js';
+export { g as AuditEntry, h as AuditInterceptor, d as AuditLogger, i as AuditRecordParams, j as AuditStatus, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, l as GENESIS_HASH, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, J as JwtValidator, L as LogEvent, r as LogInterceptor, s as MCP_LEGACY_SUPPORT_ENABLED, t as MCP_PROTOCOL_VERSION, u as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, v as McpRequestMeta, c as McpResponse, P as Prompt, w as PromptSchema, R as Resource, x as ResourceSchema, S as ServerInfo, T as Tool, y as ToolSchema, z as computeEntryHash, B as executeGatewayInterceptor, E as globalAuditLogger } from './types-CMYlWlX2.js';
 export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-B0b2vUFS.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuditEntry, d as AuditLogger, e as AuditRecordParams, f as AuditStatus, g as AuthRole, G as GENESIS_HASH, h as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, i as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, j as OutputSanitizerConfig, P as PII_PATTERNS, k as PII_PRESETS, l as PiiRule, m as PiiScanner, T as ToolHandler, n as computeEntryHash, o as globalAuditLogger, s as sanitizeOutput } from './index-DoW2gzBZ.js';
-import { A as AuthInfo } from './types-lJIxBlWF.js';
-export { e as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, G as GetPromptRequest, d as GetPromptResult, I as InputRequest, f as InputRequiredResult, g as InputResponse, J as JwtValidator, h as MCP_LEGACY_SUPPORT_ENABLED, i as MCP_PROTOCOL_VERSION, j as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, k as McpRequestMeta, c as McpResponse, P as Prompt, l as PromptSchema, R as Resource, m as ResourceSchema, S as ServerInfo, T as Tool, n as ToolSchema } from './types-lJIxBlWF.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-Dqn4dtZP.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
 import '@modelcontextprotocol/sdk/server/mcp.js';

package/dist/index.js

@@ -1,23 +1,23 @@
 export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-7BSCUYUE.js';
-export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-GYJQ63L2.js';
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-U2KYB6FN.js';
-export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, isGrpcWebRequest } from './chunk-JPYPTJHX.js';
-export { RoutingTable, probeTopology } from './chunk-UCVP3XAL.js';
-export { TokenManager } from './chunk-ESRXG36Y.js';
-export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-UWC7OY7K.js';
+export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-KB7LNCVI.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-OSJDFUBY.js';
+export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest } from './chunk-TDTGUVLB.js';
+export { RoutingTable, probeTopology } from './chunk-HWUCX2II.js';
+export { TokenManager } from './chunk-VRZ3UIYA.js';
+export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-6CPRIMCD.js';
 export { sanitizeOutput } from './chunk-Y62GORQF.js';
-export { LiopMcpRouter } from './chunk-V2TP43CD.js';
-export { HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-DZ2FQGJD.js';
-import './chunk-PEN3KFLF.js';
+export { LiopMcpRouter } from './chunk-JPN5456V.js';
+export { HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-UAUBVKMK.js';
+import './chunk-RWBFGRF7.js';
 import './chunk-IK7CGWAZ.js';
 export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
 export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest } from './chunk-VH4K4U45.js';
-export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials } from './chunk-3BJ5QQHK.js';
+export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials } from './chunk-COISHJK5.js';
 export { Counter, Gauge, Histogram, MetricsRegistry, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, protocolMetrics, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, wireEgressBytesTotal, wireSavedBytesTotal, zkVerificationDurationMs, zkVerificationsTotal } from './chunk-PAICJCKJ.js';
-export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-EG46XMJT.js';
+export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-2KSO3W4A.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
-export { MeshNode } from './chunk-7RXOIDXP.js';
-import { log } from './chunk-HA6YZ42O.js';
+export { MeshNode } from './chunk-QJIXNZTL.js';
+import { log } from './chunk-LIBI3HMN.js';
 import * as crypto from 'crypto';
 import { EventEmitter } from 'events';
 import * as fs from 'fs';

package/dist/mesh.js

@@ -1,6 +1,6 @@
 import './chunk-FTF6AMF6.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';
-export { MeshNode } from './chunk-7RXOIDXP.js';
-import './chunk-HA6YZ42O.js';
+export { MeshNode } from './chunk-QJIXNZTL.js';
+import './chunk-LIBI3HMN.js';
 //# sourceMappingURL=mesh.js.map
 //# sourceMappingURL=mesh.js.map

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, i as LogicExecutionPolicy, N as NerScanner, j as OutputSanitizerConfig, P as PII_PATTERNS, k as PII_PRESETS, l as PiiRule, m as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-DoW2gzBZ.js';
+export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-Dqn4dtZP.js';
 import 'zod';
 import './node-B0b2vUFS.js';
-import './types-lJIxBlWF.js';
+import './types-CMYlWlX2.js';
 import 'jose';

package/dist/server.js

@@ -1,9 +1,9 @@
-export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner } from './chunk-UWC7OY7K.js';
+export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner } from './chunk-6CPRIMCD.js';
 export { sanitizeOutput } from './chunk-Y62GORQF.js';
 import './chunk-VH4K4U45.js';
-import './chunk-3BJ5QQHK.js';
+import './chunk-COISHJK5.js';
 import './chunk-PAICJCKJ.js';
-import './chunk-7RXOIDXP.js';
-import './chunk-HA6YZ42O.js';
+import './chunk-QJIXNZTL.js';
+import './chunk-LIBI3HMN.js';
 //# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map

package/dist/{types-lJIxBlWF.d.ts → types-CMYlWlX2.d.ts}

@@ -1,6 +1,80 @@
 import { z } from 'zod';
 import * as jose from 'jose';
 
+/**
+ * Technology-agnostic cryptographic audit interceptor.
+ *
+ * Fires asynchronously (fire-and-forget) AFTER each AuditEntry
+ * has been sealed (hash computed, chain linked, and optionally
+ * persisted to JSONL). The interceptor receives a frozen deep-clone
+ * of the completed AuditEntry — mutations cannot tamper with the
+ * hash chain.
+ *
+ * Use cases: forward audit entries to TypeSafe Jev for threat
+ * pattern detection, stream to SOC 2 SIEM aggregators, trigger
+ * PagerDuty alerts on BLOCKED_EGRESS/POLICY_VIOLATION statuses,
+ * or feed into compliance dashboards.
+ */
+type AuditInterceptor = (entry: Readonly<AuditEntry>) => void | Promise<void>;
+
+type AuditStatus = "SUCCESS" | "BLOCKED_EGRESS" | "ERROR" | "POLICY_VIOLATION";
+interface AuditEntry {
+    id: string;
+    timestamp: string;
+    traceId: string;
+    agentDid: string;
+    peerId: string;
+    toolName: string;
+    datasetHash: string;
+    fuelConsumed: number;
+    outputHash: string;
+    zkReceiptSig: string;
+    status: AuditStatus;
+    prevEntryHash: string;
+    entryHash: string;
+}
+interface AuditRecordParams {
+    timestamp?: string;
+    traceId?: string;
+    agentDid: string;
+    peerId: string;
+    toolName: string;
+    datasetHash?: string;
+    fuelConsumed: number;
+    outputHash?: string;
+    zkReceiptSig?: string;
+    status: AuditStatus;
+}
+declare const GENESIS_HASH: string;
+declare function computeEntryHash(entryWithoutHash: Omit<AuditEntry, "entryHash">): string;
+declare class AuditLogger {
+    private entries;
+    private lastEntryHash;
+    private filePath?;
+    private interceptor?;
+    constructor(filePath?: string);
+    /**
+     * Registers a technology-agnostic audit interceptor.
+     * The interceptor fires AFTER the entry is sealed (hash computed)
+     * and appended to the chain. It receives a frozen deep-clone
+     * that cannot tamper with the hash chain.
+     * Pass `undefined` to disable interception (zero overhead).
+     */
+    setInterceptor(interceptor: AuditInterceptor | undefined): void;
+    recordExecution(params: AuditRecordParams): AuditEntry;
+    getEntries(): readonly AuditEntry[];
+    getEntryCount(): number;
+    verifyIntegrity(): {
+        valid: boolean;
+        totalEntries: number;
+        brokenIndex?: number;
+        reason?: string;
+    };
+    exportJsonl(): string;
+    private loadFromFile;
+}
+declare const globalAuditLogger: AuditLogger;
+
 /**
  * LIOP JWT Validator — Token Verification Engine
  *
@@ -97,6 +171,95 @@ declare const MCP_LEGACY_SUPPORT_ENABLED = true;
  */
 declare const MCP_PROTOCOL_VERSION_LEGACY: "2025-11-25";
 
+/**
+ * Verdict returned by a GatewayInterceptor function.
+ * Determines whether the request is admitted into the routing pipeline.
+ */
+interface GatewayAdmissionResult {
+    /** true = request passes to router.dispatch(). false = rejected at perimeter. */
+    allowed: boolean;
+    /** Human-readable denial reason (included in JSON-RPC error response). */
+    reason?: string;
+    /** Custom JSON-RPC error code. Defaults to -32099 when omitted. */
+    errorCode?: number;
+    /** Opaque metadata bag for telemetry or audit logging downstream. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Contextual information passed to the interceptor alongside the request.
+ * Contains only non-sensitive, non-cryptographic perimeter metadata.
+ */
+interface GatewayInterceptorContext {
+    /** Originating client IP address (post-JWT, post-rate-limit). */
+    clientIp: string;
+    /** Authenticated identity from JWT validation, or null for unauthenticated gateways. */
+    authInfo: AuthInfo | null;
+    /** Transport protocol that received this request. */
+    protocol: "http1" | "http2";
+    /** Abort signal that fires when the interceptor timeout expires. */
+    signal: AbortSignal;
+}
+/**
+ * Technology-agnostic admission function.
+ * The developer implements this in their application code, connecting
+ * any decision engine (TypeSafe Jev, ONNX, regex rules, custom logic).
+ *
+ * Receives a frozen deep-clone of the request to prevent prototype pollution.
+ * May return synchronously or asynchronously.
+ */
+type GatewayInterceptor = (request: Readonly<McpRequest>, context: GatewayInterceptorContext) => Promise<GatewayAdmissionResult> | GatewayAdmissionResult;
+/**
+ * Configuration for the perimeter admission hook.
+ */
+interface GatewayInterceptorOptions {
+    /** The interceptor function. When undefined, the gateway skips interception entirely. */
+    interceptor?: GatewayInterceptor;
+    /** Maximum milliseconds to wait for the interceptor. Default: 2500. */
+    timeoutMs?: number;
+    /** Behavior when the interceptor throws or times out. Default: "closed". */
+    failMode?: "closed" | "open";
+}
+/**
+ * Executes the interceptor with timeout enforcement via AbortSignal.timeout(),
+ * prototype pollution isolation via structuredClone + Object.freeze,
+ * and fail-mode policy enforcement.
+ *
+ * AbortSignal.timeout() is stable since Node.js 17.3 (available in Node.js 20+ LTS).
+ * Promise.race guarantees the gateway never blocks beyond timeoutMs even if the
+ * interceptor ignores the signal.
+ */
+declare function executeGatewayInterceptor(request: McpRequest, context: Omit<GatewayInterceptorContext, "signal">, options: Required<Pick<GatewayInterceptorOptions, "interceptor">> & GatewayInterceptorOptions): Promise<GatewayAdmissionResult>;
+
+type LogLevel = "silent" | "error" | "warn" | "info" | "debug";
+
+/**
+ * Structured snapshot of an operational log event.
+ * Frozen copy — mutations have no effect on the logger.
+ */
+interface LogEvent {
+    /** ISO 8601 timestamp of the log emission. */
+    timestamp: string;
+    /** Severity level that triggered this event. */
+    level: LogLevel;
+    /** Formatted log message (already interpolated by LiopLogger). */
+    message: string;
+    /** Additional variadic arguments passed to the log method. */
+    args: readonly unknown[];
+}
+/**
+ * Technology-agnostic operational log interceptor.
+ *
+ * Fires asynchronously (fire-and-forget) after each log emission
+ * that passes the current level filter. The interceptor receives
+ * a frozen snapshot of the log event. Errors thrown by the
+ * interceptor are caught silently and never propagate to the caller.
+ *
+ * Use cases: forward logs to TypeSafe Jev for anomaly detection,
+ * stream to a SIEM (Splunk, Datadog), aggregate in NotebookLM,
+ * or persist to a custom observability backend.
+ */
+type LogInterceptor = (event: Readonly<LogEvent>) => void | Promise<void>;
+
 /**
  * Protocol Version Identifiers
  */
@@ -253,4 +416,4 @@ interface McpResponse {
     };
 }
 
-export { type AuthInfo as A, type CallToolRequest as C, type DiscoverResult as D, type GetPromptRequest as G, type InputRequest as I, JwtValidator as J, type McpEra as M, type Prompt as P, type Resource as R, type ServerInfo as S, type Tool as T, type CallToolResult as a, type McpRequest as b, type McpResponse as c, type GetPromptResult as d, type CacheableResult as e, type InputRequiredResult as f, type InputResponse as g, MCP_LEGACY_SUPPORT_ENABLED as h, MCP_PROTOCOL_VERSION as i, MCP_PROTOCOL_VERSION_LEGACY as j, type McpRequestMeta as k, PromptSchema as l, ResourceSchema as m, ToolSchema as n };
+export { type AuthInfo as A, executeGatewayInterceptor as B, type CallToolRequest as C, type DiscoverResult as D, globalAuditLogger as E, type GatewayInterceptorOptions as G, type InputRequest as I, JwtValidator as J, type LogEvent as L, type McpEra as M, type Prompt as P, type Resource as R, type ServerInfo as S, type Tool as T, type CallToolResult as a, type McpRequest as b, type McpResponse as c, AuditLogger as d, type GetPromptRequest as e, type GetPromptResult as f, type AuditEntry as g, type AuditInterceptor as h, type AuditRecordParams as i, type AuditStatus as j, type CacheableResult as k, GENESIS_HASH as l, type GatewayAdmissionResult as m, type GatewayInterceptor as n, type GatewayInterceptorContext as o, type InputRequiredResult as p, type InputResponse as q, type LogInterceptor as r, MCP_LEGACY_SUPPORT_ENABLED as s, MCP_PROTOCOL_VERSION as t, MCP_PROTOCOL_VERSION_LEGACY as u, type McpRequestMeta as v, PromptSchema as w, ResourceSchema as x, ToolSchema as y, computeEntryHash as z };

package/dist/types.d.ts

@@ -1,3 +1,3 @@
 import 'zod';
-export { A as AuthInfo, e as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, G as GetPromptRequest, d as GetPromptResult, I as InputRequest, f as InputRequiredResult, g as InputResponse, h as MCP_LEGACY_SUPPORT_ENABLED, i as MCP_PROTOCOL_VERSION, j as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, k as McpRequestMeta, c as McpResponse, P as Prompt, l as PromptSchema, R as Resource, m as ResourceSchema, S as ServerInfo, T as Tool, n as ToolSchema } from './types-lJIxBlWF.js';
+export { h as AuditInterceptor, A as AuthInfo, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, L as LogEvent, r as LogInterceptor, s as MCP_LEGACY_SUPPORT_ENABLED, t as MCP_PROTOCOL_VERSION, u as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, v as McpRequestMeta, c as McpResponse, P as Prompt, w as PromptSchema, R as Resource, x as ResourceSchema, S as ServerInfo, T as Tool, y as ToolSchema } from './types-CMYlWlX2.js';
 import 'jose';

package/dist/types.js

@@ -1,3 +1,3 @@
-export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-EG46XMJT.js';
+export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-2KSO3W4A.js';
 //# sourceMappingURL=types.js.map
 //# sourceMappingURL=types.js.map

package/dist/verifier-A7HX6KAJ.js

@@ -0,0 +1,6 @@
+export { LiopVerifier } from './chunk-RWBFGRF7.js';
+import './chunk-IK7CGWAZ.js';
+import './chunk-PAICJCKJ.js';
+import './chunk-LIBI3HMN.js';
+//# sourceMappingURL=verifier-A7HX6KAJ.js.map
+//# sourceMappingURL=verifier-A7HX6KAJ.js.map

package/dist/{verifier-HRFXBKT5.js.map → verifier-A7HX6KAJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-HRFXBKT5.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-A7HX6KAJ.js"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nekzus/liop",
-  "version": "2.4.0-alpha.12",
+  "version": "2.4.0-alpha.14",
   "description": "Official SDK for Logic-Injection-on-Origin Protocol (LIOP). Deploy Logic-on-Origin with WebAssembly at gRPC speed and bidirectional MCP compatibility.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -86,15 +86,15 @@
     "node": ">=20.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.10",
+    "@biomejs/biome": "2.5.14",
     "@opentelemetry/api": "1.9.1",
-    "@opentelemetry/sdk-metrics": "2.10.0",
+    "@opentelemetry/sdk-metrics": "2.11.0",
     "@types/node": "26.4.0",
-    "@types/oidc-provider": "9.11.1",
+    "@types/oidc-provider": "9.12.1",
     "@vitest/coverage-v8": "4.1.11",
     "gpt-tokenizer": "4.0.0",
     "tsup": "8.5.1",
-    "tsx": "4.23.12",
+    "tsx": "4.23.13",
     "typescript": "6.0.3",
     "vitest": "4.1.11"
   },
@@ -105,37 +105,37 @@
     "@grpc/proto-loader": "0.8.1",
     "@hono/node-server": "2.1.1",
     "@libp2p/autonat": "^3.0.27",
-    "@libp2p/bootstrap": "12.0.30",
+    "@libp2p/bootstrap": "12.0.32",
     "@libp2p/circuit-relay-v2": "^4.2.12",
     "@libp2p/crypto": "5.1.23",
     "@libp2p/dcutr": "^3.0.27",
-    "@libp2p/identify": "4.1.13",
-    "@libp2p/kad-dht": "16.4.4",
+    "@libp2p/identify": "4.1.14",
+    "@libp2p/kad-dht": "16.4.5",
     "@libp2p/mdns": "^12.0.30",
     "@libp2p/peer-id": "6.0.15",
-    "@libp2p/ping": "3.1.12",
+    "@libp2p/ping": "3.1.13",
     "@libp2p/pnet": "^3.0.29",
-    "@libp2p/tcp": "11.0.27",
-    "@libp2p/websockets": "10.1.20",
+    "@libp2p/tcp": "11.0.28",
+    "@libp2p/websockets": "10.1.21",
     "@multiformats/multiaddr": "13.0.3",
-    "@noble/post-quantum": "0.7.0",
+    "@noble/post-quantum": "0.7.1",
     "acorn": "8.18.0",
     "acorn-walk": "8.3.5",
-    "hono": "4.13.5",
+    "hono": "4.13.8",
     "it-pipe": "3.0.1",
-    "jose": "6.2.10",
-    "libp2p": "3.3.9",
+    "jose": "6.2.12",
+    "libp2p": "3.3.11",
     "mlkem": "2.7.0",
     "multiformats": "14.0.5",
-    "oidc-provider": "9.11.5",
+    "oidc-provider": "9.12.2",
     "optional": "0.1.4",
-    "piscina": "5.3.1",
+    "piscina": "5.3.2",
     "uint8arrays": "6.1.1",
-    "zod": "4.4.3"
+    "zod": "4.6.5"
   },
   "optionalDependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
-    "compromise": "14.16.0"
+    "compromise": "14.17.0"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
@@ -152,9 +152,9 @@
   "overrides": {
     "content-type": "1.0.5",
     "protobufjs": "^7.6.1",
-    "piscina": "5.3.1",
+    "piscina": "5.3.2",
     "ws": "^8.21.0",
-    "hono": "4.13.5",
+    "hono": "4.13.8",
     "fast-uri": "^3.1.5",
     "brace-expansion": "^1.1.18",
     "ip-address": "^10.3.1",