@nekzus/liop 2.4.0-alpha.13 → 2.4.0-alpha.14

package/dist/{chunk-3BJ5QQHK.js → chunk-COISHJK5.js}

@@ -1,4 +1,4 @@
-import { log } from './chunk-HA6YZ42O.js';
+import { log } from './chunk-LIBI3HMN.js';
 import * as fs from 'fs';
 import * as grpc from '@grpc/grpc-js';
 import path from 'path';
@@ -174,5 +174,5 @@ var liopProto = grpc.loadPackageDefinition(packageDefinition);
 var liopV1 = liopProto.liop.v1;
 
 export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials, liopV1 };
-//# sourceMappingURL=chunk-3BJ5QQHK.js.map
-//# sourceMappingURL=chunk-3BJ5QQHK.js.map
+//# sourceMappingURL=chunk-COISHJK5.js.map
+//# sourceMappingURL=chunk-COISHJK5.js.map

package/dist/{chunk-3BJ5QQHK.js.map → chunk-COISHJK5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/rpc/tls.ts","../src/rpc/channel-options.ts","../src/rpc/proto.ts"],"names":["__filename","__dirname","fs2","grpc2"],"mappings":";;;;;;;AAgDA,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAElC,IAAM,sBAAA,GAAyB,CAAC,GAAA,KAC/B,GAAA,EAAK,QAAA,KAAa,IAAA,IAClB,GAAA,EAAK,eAAA,KAAoB,IAAA,IACzB,OAAA,CAAQ,GAAA,CAAI,yBAAA,KAA8B,MAAA;AAE3C,IAAI,uBAAA,GAA0B,KAAA;AAC9B,IAAI,wBAAA,GAA2B,KAAA;AAOxB,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,uBAAA,EAAyB;AAC7D,MAAA,uBAAA,GAA0B,IAAA;AAC1B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,wBAAA,EAA0B;AAC9D,MAAA,wBAAA,GAA2B,IAAA;AAC3B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AACD;;;AClNO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,2BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK","file":"chunk-3BJ5QQHK.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n\t/**\n\t * Explicitly permit unencrypted (insecure) credentials for local development,\n\t * Docker testbeds, or tooling harnesses without emitting console warnings.\n\t * Ignored if isTlsEnforced() is true (production/enforced mode always throws).\n\t */\n\tinsecure?: boolean;\n\t/**\n\t * Explicitly suppress the fallback warning when insecure credentials are created.\n\t */\n\tsuppressWarning?: boolean;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\nconst isTlsWarningSuppressed = (tls?: LiopTlsOptions) =>\n\ttls?.insecure === true ||\n\ttls?.suppressWarning === true ||\n\tprocess.env.LIOP_SUPPRESS_TLS_WARNING === \"true\";\n\nlet hasWarnedInsecureServer = false;\nlet hasWarnedInsecureChannel = false;\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {\n\t\t\thasWarnedInsecureServer = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {\n\t\t\thasWarnedInsecureChannel = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n"]}
+{"version":3,"sources":["../src/rpc/tls.ts","../src/rpc/channel-options.ts","../src/rpc/proto.ts"],"names":["__filename","__dirname","fs2","grpc2"],"mappings":";;;;;;;AAgDA,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAElC,IAAM,sBAAA,GAAyB,CAAC,GAAA,KAC/B,GAAA,EAAK,QAAA,KAAa,IAAA,IAClB,GAAA,EAAK,eAAA,KAAoB,IAAA,IACzB,OAAA,CAAQ,GAAA,CAAI,yBAAA,KAA8B,MAAA;AAE3C,IAAI,uBAAA,GAA0B,KAAA;AAC9B,IAAI,wBAAA,GAA2B,KAAA;AAOxB,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,uBAAA,EAAyB;AAC7D,MAAA,uBAAA,GAA0B,IAAA;AAC1B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,wBAAA,EAA0B;AAC9D,MAAA,wBAAA,GAA2B,IAAA;AAC3B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AACD;;;AClNO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,2BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK","file":"chunk-COISHJK5.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n\t/**\n\t * Explicitly permit unencrypted (insecure) credentials for local development,\n\t * Docker testbeds, or tooling harnesses without emitting console warnings.\n\t * Ignored if isTlsEnforced() is true (production/enforced mode always throws).\n\t */\n\tinsecure?: boolean;\n\t/**\n\t * Explicitly suppress the fallback warning when insecure credentials are created.\n\t */\n\tsuppressWarning?: boolean;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\nconst isTlsWarningSuppressed = (tls?: LiopTlsOptions) =>\n\ttls?.insecure === true ||\n\ttls?.suppressWarning === true ||\n\tprocess.env.LIOP_SUPPRESS_TLS_WARNING === \"true\";\n\nlet hasWarnedInsecureServer = false;\nlet hasWarnedInsecureChannel = false;\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {\n\t\t\thasWarnedInsecureServer = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {\n\t\t\thasWarnedInsecureChannel = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n"]}

package/dist/{chunk-UCVP3XAL.js → chunk-HWUCX2II.js}

@@ -1,4 +1,4 @@
-import { log } from './chunk-HA6YZ42O.js';
+import { log } from './chunk-LIBI3HMN.js';
 
 // src/runtime/routing-table.ts
 var RoutingTable = class _RoutingTable {
@@ -275,5 +275,5 @@ async function probeTopology(options = {}) {
 }
 
 export { RoutingTable, probeTopology };
-//# sourceMappingURL=chunk-UCVP3XAL.js.map
-//# sourceMappingURL=chunk-UCVP3XAL.js.map
+//# sourceMappingURL=chunk-HWUCX2II.js.map
+//# sourceMappingURL=chunk-HWUCX2II.js.map

package/dist/{chunk-UCVP3XAL.js.map → chunk-HWUCX2II.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/runtime/routing-table.ts","../src/runtime/topology-probe.ts"],"names":[],"mappings":";;;AAoCO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,MAAA,uBAAa,GAAA,EAAuB;AAAA,EAC5C,OAAwB,YAAA,GAAe,CAAA;AAAA;AAAA;AAAA;AAAA,EAKhC,oBAAA,CACN,KAAA,EACA,WAAA,EACA,YAAA,GAAe,IAAA,EACR;AACP,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,IAAI,CAAA;AAC1C,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,QAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,QAAA,EAAU,cAAA;AAAA,QACV,QAAA,EAAU,WAAA;AAAA,QACV,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,SAAA,EAAW,UAAU,SAAA,IAAa,CAAA;AAAA,QAClC,SAAA,EAAW,CAAA;AAAA,QACX,WAAA,EAAa,QAAA,EAAU,WAAA,IAAe,IAAA,CAAK,GAAA,EAAI;AAAA,QAC/C;AAAA,OACA,CAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0BAAA,EAA6B,KAAA,CAAM,MAAM,CAAA,2BAAA,EAA8B,WAAW,CAAA,CAAA;AAAA,KACnF;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,iBAAA,CACN,KAAA,EACA,UAAA,EACA,YAAA,GAAe,KAAA,EACR;AACP,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,IAAI,CAAA;AAE1C,MAAA,IACC,YACA,QAAA,CAAS,QAAA,KAAa,cAAA,IACtB,QAAA,CAAS,cAAc,CAAA,EACtB;AACD,QAAA;AAAA,MACD;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,QAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,QAAA,EAAU,UAAA;AAAA,QACV,QAAA,EAAU,UAAA;AAAA,QACV,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,SAAA,EAAW,UAAU,SAAA,IAAa,CAAA;AAAA,QAClC,SAAA,EAAW,CAAA;AAAA,QACX,WAAA,EAAa,QAAA,EAAU,WAAA,IAAe,IAAA,CAAK,GAAA,EAAI;AAAA,QAC/C;AAAA,OACA,CAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0BAAA,EAA6B,KAAA,CAAM,MAAM,CAAA,4BAAA,EAA+B,UAAU,CAAA,CAAA;AAAA,KACnF;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAkB,IAAA,EAA4B;AACpD,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,MAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,QAAA,EAAU,OAAA;AAAA,MACV,QAAA,EAAU,YAAA;AAAA,MACV,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,SAAA,EAAW,CAAA;AAAA,MACX,SAAA,EAAW,CAAA;AAAA,MACX,WAAA,EAAa,KAAK,GAAA,EAAI;AAAA,MACtB,YAAA,EAAc;AAAA,KACd,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKO,QAAQ,QAAA,EAAyC;AACvD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACtC,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AAGnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,aAAA,CAAa,YAAA,EAAc;AACjD,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,qBAAA,EAAwB,QAAQ,CAAA,qCAAA,EAAwC,KAAA,CAAM,SAAS,CAAA,uBAAA;AAAA,OACxF;AAAA,IACD;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKO,aAAA,CAAc,UAAkB,SAAA,EAAyB;AAC/D,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,KAAA,CAAM,SAAA,GAAY,CAAA;AAClB,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAClB,MAAA,KAAA,CAAM,WAAA,GAAc,KAAK,GAAA,EAAI;AAAA,IAC9B;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,QAAA,EAAwB;AAC5C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,KAAA,CAAM,SAAA,IAAa,CAAA;AACnB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0CAAA,EAA6C,QAAQ,CAAA,cAAA,EAAiB,KAAA,CAAM,SAAS,CAAA,CAAA;AAAA,OACtF;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,qBAAA,GAA0C;AAChD,IAAA,MAAM,OAAyB,EAAC;AAChC,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,IAAA,CAAK,IAAA,CAAK;AAAA,QACT,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,aAAa,KAAA,CAAM,WAAA;AAAA,QACnB,aAAa,KAAA,CAAM;AAAA,OACnB,CAAA;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EACxD;AAAA,EAEO,SAAS,QAAA,EAAyC;AACxD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AAAA,EAChC;AAAA,EAEO,IAAA,GAAe;AACrB,IAAA,OAAO,KAAK,MAAA,CAAO,IAAA;AAAA,EACpB;AAAA,EAEO,KAAA,GAAc;AACpB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AACD;;;ACrIA,eAAe,eAAA,CACd,cACA,OAAA,EACsC;AACtC,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,GAAG,UAAU,CAAA,OAAA,CAAA;AAE/B,EAAA,IAAI;AACH,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,8CAAA,EAAiD,SAAS,CAAA,CAAE,CAAA;AACrE,IAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,MACxC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,MACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KAChC,CAAA;AAED,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AAClB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,gCAAA,EAAmC,SAAS,CAAA,OAAA,EAAU,SAAA,CAAU,MAAM,CAAA,CAAA;AAAA,OACvE;AACA,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,UAAA,GAAc,MAAM,SAAA,CAAU,IAAA,EAAK;AAazC,IAAA,IAAI,UAAA,CAAW,WAAW,SAAA,EAAW;AACpC,MAAA,OAAO,IAAA;AAAA,IACR;AAGA,IAAA,IAAI,MAAA,GAAS,UAAA,CAAW,IAAA,EAAM,MAAA,IAAU,EAAA;AACxC,IAAA,IAAI,aAAA,GAAgB,UAAA,CAAW,IAAA,EAAM,cAAA,IAAkB,EAAA;AACvD,IAAA,IAAI,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACnC,IAAA,IAAI,MAAA,GAAmB;AAAA,MACtB,iBAAA;AAAA,MACA,iBAAA;AAAA,MACA,qBAAA;AAAA,MACA,kBAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,GAAG,UAAU,CAAA,qCAAA,CAAA;AAC5B,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,QAClC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OAChC,CAAA;AACD,MAAA,IAAI,OAAO,EAAA,EAAI;AACd,QAAA,MAAM,OAAA,GAAW,MAAM,MAAA,CAAO,IAAA,EAAK;AAKnC,QAAA,IAAI,OAAA,CAAQ,QAAA,EAAU,QAAA,GAAW,OAAA,CAAQ,QAAA;AACzC,QAAA,IAAI,OAAA,CAAQ,uBAAuB,MAAA,EAAQ;AAC1C,UAAA,MAAA,GAAS,OAAA,CAAQ,sBAAsB,CAAC,CAAA;AAAA,QACzC;AACA,QAAA,IAAI,OAAA,CAAQ,kBAAkB,MAAA,EAAQ;AACrC,UAAA,MAAA,GAAS,OAAA,CAAQ,gBAAA;AAAA,QAClB;AAAA,MACD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAGA,IAAA,IAAI,CAAC,iBAAiB,MAAA,EAAQ;AAC7B,MAAA,MAAM,aAAa,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAAI,MAAA,GAAS,GAAG,MAAM,CAAA,KAAA,CAAA;AAChE,MAAA,aAAA,GAAgB,GAAG,UAAU,CAAA,MAAA,CAAA;AAAA,IAC9B;AAGA,IAAA,IAAI,aAAA,EAAe;AAClB,MAAA,IAAI;AACH,QAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,aAAa,CAAA;AAC5C,QAAA,IAAI,QAAQ,QAAA,EAAU;AACrB,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACrD,UAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,IAAA;AACrC,UAAA,cAAA,CAAe,IAAA,GAAO,SAAA;AACtB,UAAA,aAAA,GAAgB,eAAe,QAAA,EAAS;AAAA,QACzC,CAAA,MAAA,IAAA,CACE,cAAA,CAAe,QAAA,KAAa,OAAA,IAC5B,eAAe,QAAA,KAAa,YAAA,IAC5B,cAAA,CAAe,QAAA,CAAS,WAAW,MAAM,CAAA,KAC1C,UAAA,CAAW,QAAA,CAAS,WAAW,CAAA,EAC9B;AACD,UAAA,cAAA,CAAe,IAAA,GAAO,iBAAA;AACtB,UAAA,aAAA,GAAgB,eAAe,QAAA,EAAS;AAAA,QACzC;AAAA,MACD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,2CAAA,EAAyC,UAAU,CAAA,SAAA,EAAY,UAAA,CAAW,KAAA,EAAO,MAAA,IAAU,CAAC,CAAA,QAAA,EAAW,UAAA,CAAW,QAAA,EAAU,IAAA,IAAQ,CAAC,CAAA,CAAA;AAAA,KACtI;AAEA,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,UAAA;AAAA,MACT,WAAA,EAAa,GAAG,UAAU,CAAA,IAAA,CAAA;AAAA,MAC1B,cAAA,EAAgB,GAAG,UAAU,CAAA,OAAA,CAAA;AAAA,MAC7B,aAAA;AAAA,MACA,MAAA;AAAA,MACA,QAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAA,EAAO,UAAA,CAAW,KAAA,IAAS,EAAC;AAAA,MAC5B,IAAA,EAAM,UAAA,CAAW,QAAA,EAAU,IAAA,IAAQ;AAAA,KACpC;AAAA,EACD,SAAS,GAAA,EAAK;AACb,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,6CAAA,EAAgD,UAAU,CAAA,EAAA,EAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KAChH;AACA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAKA,eAAsB,aAAA,CACrB,OAAA,GAAgC,EAAC,EACF;AAC/B,EAAA,GAAA,CAAI,KAAK,iEAAiE,CAAA;AAE1E,EAAA,IAAI,WAAA,GAA0C,IAAA;AAG9C,EAAA,IAAI,QAAQ,MAAA,EAAQ;AACnB,IAAA,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC5D;AAGA,EAAA,IAAI,CAAC,WAAA,KAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA,CAAA,EAAO;AACrD,IAAA,MAAM,aAAA,GAAgB;AAAA,MACrB,wBAAA;AAAA;AAAA,MACA,wBAAA;AAAA;AAAA,MACA;AAAA;AAAA,KACD;AAEA,IAAA,KAAA,MAAW,OAAO,aAAA,EAAe;AAEhC,MAAA,IAAI,OAAA,CAAQ,UAAU,GAAA,CAAI,QAAA,CAAS,IAAI,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAI,CAAA;AAC9D,QAAA;AAED,MAAA,WAAA,GAAc,MAAM,eAAA,CAAgB,GAAA,EAAK,OAAO,CAAA;AAChD,MAAA,IAAI,WAAA,EAAa;AAAA,IAClB;AAAA,EACD;AAGA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,cAAA,IAAkB,EAAC;AAClD,EAAA,MAAM,iBAAA,GAAoB,eAAe,MAAA,GAAS,CAAA;AAGlD,EAAA,IAAI,eAAe,iBAAA,EAAmB;AACrC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yDAAA,EAAuD,WAAA,CAAY,OAAO,CAAA,GAAA,EAAM,eAAe,MAAM,CAAA,gBAAA;AAAA,KACtG;AACA,IAAA,OAAO;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,OAAA,EAAS,WAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACL,cAAA;AAAA,QACA,cAAc,OAAA,CAAQ;AAAA;AACvB,KACD;AAAA,EACD;AAEA,EAAA,IAAI,WAAA,EAAa;AAChB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,iFAAA,EAA6E,YAAY,OAAO,CAAA,CAAA;AAAA,KACjG;AACA,IAAA,OAAO;AAAA,MACN,IAAA,EAAM,SAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,GAAA,CAAI,IAAA;AAAA,IACH,CAAA,+EAAA,EAA2E,eAAe,MAAM,CAAA,CAAA;AAAA,GACjG;AACA,EAAA,OAAO;AAAA,IACN,IAAA,EAAM,MAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACL,cAAA;AAAA,MACA,cAAc,OAAA,CAAQ;AAAA;AACvB,GACD;AACD","file":"chunk-UCVP3XAL.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Routing Table — Per-Tool Hybrid Routing & Resilience\n *\n * Maintains deterministic per-tool routes across heterogeneous transports:\n * - \"http-gateway\": Route through Border LIO Gateway or reverse proxy via HTTP/JSON-RPC.\n * - \"p2p-grpc\": Route directly to sovereign node via libp2p + gRPC (Kyber768/ZK-Receipt).\n * - \"local\": Handled in-process (e.g. LiopMeshStatus, diagnostic probes).\n *\n * Implements per-route latency tracking, failure backoff, and circuit breaking.\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport type TransportProvider = \"http-gateway\" | \"p2p-grpc\" | \"local\";\n\nexport interface ToolDefinition {\n\tname: string;\n\tdescription?: string;\n\tinputSchema?: Record<string, unknown>;\n}\n\nexport interface ToolRoute {\n\tname: string;\n\tprovider: TransportProvider;\n\tendpoint: string;\n\tdescription?: string;\n\tinputSchema?: Record<string, unknown>;\n\tlatencyMs: number;\n\tfailCount: number;\n\tlastSuccess: number;\n\tauthRequired?: boolean;\n}\n\nexport class RoutingTable {\n\tprivate routes = new Map<string, ToolRoute>();\n\tprivate static readonly MAX_FAILURES = 5;\n\n\t/**\n\t * Registers or updates a collection of tools exposed via an HTTP Gateway.\n\t */\n\tpublic registerGatewayTools(\n\t\ttools: ToolDefinition[],\n\t\tmcpEndpoint: string,\n\t\tauthRequired = true,\n\t): void {\n\t\tfor (const tool of tools) {\n\t\t\tconst existing = this.routes.get(tool.name);\n\t\t\tthis.routes.set(tool.name, {\n\t\t\t\tname: tool.name,\n\t\t\t\tprovider: \"http-gateway\",\n\t\t\t\tendpoint: mcpEndpoint,\n\t\t\t\tdescription: tool.description ?? existing?.description,\n\t\t\t\tinputSchema: tool.inputSchema ?? existing?.inputSchema,\n\t\t\t\tlatencyMs: existing?.latencyMs ?? 0,\n\t\t\t\tfailCount: 0,\n\t\t\t\tlastSuccess: existing?.lastSuccess ?? Date.now(),\n\t\t\t\tauthRequired,\n\t\t\t});\n\t\t}\n\t\tlog.info(\n\t\t\t`[RoutingTable] Registered ${tools.length} tool(s) via HTTP Gateway (${mcpEndpoint})`,\n\t\t);\n\t}\n\n\t/**\n\t * Registers tools discovered directly over the P2P Mesh (gRPC).\n\t */\n\tpublic registerMeshTools(\n\t\ttools: ToolDefinition[],\n\t\tgrpcTarget: string,\n\t\tauthRequired = false,\n\t): void {\n\t\tfor (const tool of tools) {\n\t\t\tconst existing = this.routes.get(tool.name);\n\t\t\t// Do not overwrite healthy gateway routes unless explicitly preferred\n\t\t\tif (\n\t\t\t\texisting &&\n\t\t\t\texisting.provider === \"http-gateway\" &&\n\t\t\t\texisting.failCount === 0\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthis.routes.set(tool.name, {\n\t\t\t\tname: tool.name,\n\t\t\t\tprovider: \"p2p-grpc\",\n\t\t\t\tendpoint: grpcTarget,\n\t\t\t\tdescription: tool.description ?? existing?.description,\n\t\t\t\tinputSchema: tool.inputSchema ?? existing?.inputSchema,\n\t\t\t\tlatencyMs: existing?.latencyMs ?? 0,\n\t\t\t\tfailCount: 0,\n\t\t\t\tlastSuccess: existing?.lastSuccess ?? Date.now(),\n\t\t\t\tauthRequired,\n\t\t\t});\n\t\t}\n\t\tlog.info(\n\t\t\t`[RoutingTable] Registered ${tools.length} tool(s) via P2P Mesh gRPC (${grpcTarget})`,\n\t\t);\n\t}\n\n\t/**\n\t * Registers an in-process local tool (e.g. LiopMeshStatus).\n\t */\n\tpublic registerLocalTool(tool: ToolDefinition): void {\n\t\tthis.routes.set(tool.name, {\n\t\t\tname: tool.name,\n\t\t\tprovider: \"local\",\n\t\t\tendpoint: \"in-process\",\n\t\t\tdescription: tool.description,\n\t\t\tinputSchema: tool.inputSchema,\n\t\t\tlatencyMs: 0,\n\t\t\tfailCount: 0,\n\t\t\tlastSuccess: Date.now(),\n\t\t\tauthRequired: false,\n\t\t});\n\t}\n\n\t/**\n\t * Resolves the optimal route for a specific tool.\n\t */\n\tpublic resolve(toolName: string): ToolRoute | undefined {\n\t\tconst route = this.routes.get(toolName);\n\t\tif (!route) return undefined;\n\n\t\t// If circuit is tripped (excessive failures), still return route but log warning\n\t\tif (route.failCount >= RoutingTable.MAX_FAILURES) {\n\t\t\tlog.warn(\n\t\t\t\t`[RoutingTable] Tool '${toolName}' route has tripped circuit breaker (${route.failCount} consecutive failures).`,\n\t\t\t);\n\t\t}\n\n\t\treturn route;\n\t}\n\n\t/**\n\t * Records a successful invocation on a route, resetting failures and updating latency.\n\t */\n\tpublic recordSuccess(toolName: string, latencyMs: number): void {\n\t\tconst route = this.routes.get(toolName);\n\t\tif (route) {\n\t\t\troute.failCount = 0;\n\t\t\troute.latencyMs = latencyMs;\n\t\t\troute.lastSuccess = Date.now();\n\t\t}\n\t}\n\n\t/**\n\t * Records a failed invocation on a route.\n\t */\n\tpublic recordFailure(toolName: string): void {\n\t\tconst route = this.routes.get(toolName);\n\t\tif (route) {\n\t\t\troute.failCount += 1;\n\t\t\tlog.warn(\n\t\t\t\t`[RoutingTable] Failure recorded for tool '${toolName}' (failCount: ${route.failCount})`,\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Lists all registered tools in sorted format for tools/list.\n\t */\n\tpublic getAllToolDefinitions(): ToolDefinition[] {\n\t\tconst list: ToolDefinition[] = [];\n\t\tfor (const route of this.routes.values()) {\n\t\t\tlist.push({\n\t\t\t\tname: route.name,\n\t\t\t\tdescription: route.description,\n\t\t\t\tinputSchema: route.inputSchema,\n\t\t\t});\n\t\t}\n\t\treturn list.sort((a, b) => a.name.localeCompare(b.name));\n\t}\n\n\tpublic getRoute(toolName: string): ToolRoute | undefined {\n\t\treturn this.routes.get(toolName);\n\t}\n\n\tpublic size(): number {\n\t\treturn this.routes.size;\n\t}\n\n\tpublic clear(): void {\n\t\tthis.routes.clear();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Topology Probe — RFC 9728 PRM Chain & Adaptive Network Detection\n *\n * Implements single-URL auto-discovery of multi-tier mesh environments:\n * 1. Probes RFC 9728 Protected Resource Metadata (PRM) or /health endpoint.\n * 2. Chains discovery to obtain OAuth 2.1 authorization server endpoints.\n * 3. Identifies whether the node should operate in \"gateway\", \"mesh\", or \"hybrid\" mode.\n *\n * Standards: RFC 9728, RFC 8414, RFC 8707, NIST SP 800-207\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface GatewayTopologyInfo {\n\tbaseUrl: string;\n\tmcpEndpoint: string;\n\thealthEndpoint: string;\n\ttokenEndpoint: string;\n\tissuer: string;\n\taudience: string;\n\tscopes: string[];\n\ttools: string[];\n\ttier: number;\n}\n\nexport interface MeshTopologyInfo {\n\tbootstrapNodes: string[];\n\tidentityPath?: string;\n}\n\nexport interface TopologyProbeResult {\n\tmode: \"gateway\" | \"mesh\" | \"hybrid\";\n\tgateway?: GatewayTopologyInfo;\n\tmesh?: MeshTopologyInfo;\n}\n\nexport interface TopologyProbeOptions {\n\tblgUrl?: string;\n\tnexusUrl?: string;\n\tclientId?: string;\n\tclientSecret?: string;\n\taudience?: string;\n\tstaticToken?: string;\n\tbootstrapNodes?: string[];\n\tidentityPath?: string;\n\tautoProbeLocal?: boolean;\n}\n\n/**\n * Executes the RFC 9728 PRM chain and health probe on a candidate Gateway URL.\n */\nasync function probeGatewayUrl(\n\tcandidateUrl: string,\n\toptions: TopologyProbeOptions,\n): Promise<GatewayTopologyInfo | null> {\n\tconst trimmedUrl = candidateUrl.replace(/\\/+$/, \"\");\n\tconst healthUrl = `${trimmedUrl}/health`;\n\n\ttry {\n\t\tlog.info(`[TopologyProbe] Probing candidate Gateway at: ${healthUrl}`);\n\t\tconst healthRes = await fetch(healthUrl, {\n\t\t\theaders: { Accept: \"application/json\" },\n\t\t\tsignal: AbortSignal.timeout(3000),\n\t\t});\n\n\t\tif (!healthRes.ok) {\n\t\t\tlog.info(\n\t\t\t\t`[TopologyProbe] Probe failed at ${healthUrl} [HTTP ${healthRes.status}]`,\n\t\t\t);\n\t\t\treturn null;\n\t\t}\n\n\t\tconst healthData = (await healthRes.json()) as {\n\t\t\tstatus?: string;\n\t\t\ttools?: string[];\n\t\t\tauth?: {\n\t\t\t\tissuer?: string;\n\t\t\t\ttoken_endpoint?: string;\n\t\t\t\tjwks_uri?: string;\n\t\t\t};\n\t\t\ttopology?: {\n\t\t\t\ttier?: number;\n\t\t\t};\n\t\t};\n\n\t\tif (healthData.status !== \"healthy\") {\n\t\t\treturn null;\n\t\t}\n\n\t\t// Discover OAuth metadata via PRM (RFC 9728)\n\t\tlet issuer = healthData.auth?.issuer || \"\";\n\t\tlet tokenEndpoint = healthData.auth?.token_endpoint || \"\";\n\t\tlet audience = options.audience || \"urn:liop:mesh:api\";\n\t\tlet scopes: string[] = [\n\t\t\t\"liop:tools:list\",\n\t\t\t\"liop:tools:call\",\n\t\t\t\"liop:resources:read\",\n\t\t\t\"liop:schema:read\",\n\t\t\t\"liop:mesh:query\",\n\t\t];\n\n\t\ttry {\n\t\t\tconst prmUrl = `${trimmedUrl}/.well-known/oauth-protected-resource`;\n\t\t\tconst prmRes = await fetch(prmUrl, {\n\t\t\t\theaders: { Accept: \"application/json\" },\n\t\t\t\tsignal: AbortSignal.timeout(2000),\n\t\t\t});\n\t\t\tif (prmRes.ok) {\n\t\t\t\tconst prmData = (await prmRes.json()) as {\n\t\t\t\t\tresource?: string;\n\t\t\t\t\tauthorization_servers?: string[];\n\t\t\t\t\tscopes_supported?: string[];\n\t\t\t\t};\n\t\t\t\tif (prmData.resource) audience = prmData.resource;\n\t\t\t\tif (prmData.authorization_servers?.length) {\n\t\t\t\t\tissuer = prmData.authorization_servers[0];\n\t\t\t\t}\n\t\t\t\tif (prmData.scopes_supported?.length) {\n\t\t\t\t\tscopes = prmData.scopes_supported;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Non-fatal if PRM endpoint is not present\n\t\t}\n\n\t\t// If token endpoint is not explicitly given, resolve from issuer\n\t\tif (!tokenEndpoint && issuer) {\n\t\t\tconst baseIssuer = issuer.endsWith(\"/oidc\") ? issuer : `${issuer}/oidc`;\n\t\t\ttokenEndpoint = `${baseIssuer}/token`;\n\t\t}\n\n\t\t// Normalize tokenEndpoint for Docker-to-Host bridge environments\n\t\tif (tokenEndpoint) {\n\t\t\ttry {\n\t\t\t\tconst parsedEndpoint = new URL(tokenEndpoint);\n\t\t\t\tif (options.nexusUrl) {\n\t\t\t\t\tconst nexusBase = options.nexusUrl.replace(/\\/+$/, \"\");\n\t\t\t\t\tconst nexusHost = new URL(nexusBase).host;\n\t\t\t\t\tparsedEndpoint.host = nexusHost;\n\t\t\t\t\ttokenEndpoint = parsedEndpoint.toString();\n\t\t\t\t} else if (\n\t\t\t\t\t(parsedEndpoint.hostname === \"nexus\" ||\n\t\t\t\t\t\tparsedEndpoint.hostname === \"nexus-prod\" ||\n\t\t\t\t\t\tparsedEndpoint.hostname.startsWith(\"172.\")) &&\n\t\t\t\t\ttrimmedUrl.includes(\"127.0.0.1\")\n\t\t\t\t) {\n\t\t\t\t\tparsedEndpoint.host = \"127.0.0.1:15000\";\n\t\t\t\t\ttokenEndpoint = parsedEndpoint.toString();\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t/* keep original tokenEndpoint */\n\t\t\t}\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[TopologyProbe] ✅ Verified Gateway at ${trimmedUrl} (Tools: ${healthData.tools?.length ?? 0}, Tier: ${healthData.topology?.tier ?? 2})`,\n\t\t);\n\n\t\treturn {\n\t\t\tbaseUrl: trimmedUrl,\n\t\t\tmcpEndpoint: `${trimmedUrl}/mcp`,\n\t\t\thealthEndpoint: `${trimmedUrl}/health`,\n\t\t\ttokenEndpoint,\n\t\t\tissuer,\n\t\t\taudience,\n\t\t\tscopes,\n\t\t\ttools: healthData.tools || [],\n\t\t\ttier: healthData.topology?.tier ?? 2,\n\t\t};\n\t} catch (err) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] Gateway probe unreachable at ${trimmedUrl}: ${err instanceof Error ? err.message : String(err)}`,\n\t\t);\n\t\treturn null;\n\t}\n}\n\n/**\n * Probes the runtime environment and determines the optimal architecture mode.\n */\nexport async function probeTopology(\n\toptions: TopologyProbeOptions = {},\n): Promise<TopologyProbeResult> {\n\tlog.info(\"[TopologyProbe] Starting adaptive network topology discovery...\");\n\n\tlet gatewayInfo: GatewayTopologyInfo | null = null;\n\n\t// 1. Check explicit Border LIO Gateway URL (Highest priority)\n\tif (options.blgUrl) {\n\t\tgatewayInfo = await probeGatewayUrl(options.blgUrl, options);\n\t}\n\n\t// 2. Auto-probing known local infrastructure ports if enabled/unspecified\n\tif (!gatewayInfo && (options.autoProbeLocal ?? true)) {\n\t\tconst candidateUrls = [\n\t\t\t\"http://127.0.0.1:15018\", // Production BLG port\n\t\t\t\"http://127.0.0.1:15000\", // Production Nexus port\n\t\t\t\"http://127.0.0.1:13000\", // Demo Nexus port\n\t\t];\n\n\t\tfor (const url of candidateUrls) {\n\t\t\t// Skip if already probed\n\t\t\tif (options.blgUrl && url.includes(new URL(options.blgUrl).port))\n\t\t\t\tcontinue;\n\n\t\t\tgatewayInfo = await probeGatewayUrl(url, options);\n\t\t\tif (gatewayInfo) break;\n\t\t}\n\t}\n\n\t// 3. Evaluate P2P Mesh connectivity\n\tconst bootstrapNodes = options.bootstrapNodes || [];\n\tconst hasMeshBootstraps = bootstrapNodes.length > 0;\n\n\t// 4. Decide runtime mode\n\tif (gatewayInfo && hasMeshBootstraps) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] ⚡ Mode Determined: HYBRID (Gateway: ${gatewayInfo.baseUrl} + ${bootstrapNodes.length} P2P bootstraps)`,\n\t\t);\n\t\treturn {\n\t\t\tmode: \"hybrid\",\n\t\t\tgateway: gatewayInfo,\n\t\t\tmesh: {\n\t\t\t\tbootstrapNodes,\n\t\t\t\tidentityPath: options.identityPath,\n\t\t\t},\n\t\t};\n\t}\n\n\tif (gatewayInfo) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] 🚀 Mode Determined: GATEWAY (Zero-P2P overhead, direct to ${gatewayInfo.baseUrl})`,\n\t\t);\n\t\treturn {\n\t\t\tmode: \"gateway\",\n\t\t\tgateway: gatewayInfo,\n\t\t};\n\t}\n\n\tlog.info(\n\t\t`[TopologyProbe] 🌐 Mode Determined: MESH (Standard P2P DHT, Bootstraps: ${bootstrapNodes.length})`,\n\t);\n\treturn {\n\t\tmode: \"mesh\",\n\t\tmesh: {\n\t\t\tbootstrapNodes,\n\t\t\tidentityPath: options.identityPath,\n\t\t},\n\t};\n}\n"]}
+{"version":3,"sources":["../src/runtime/routing-table.ts","../src/runtime/topology-probe.ts"],"names":[],"mappings":";;;AAoCO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,MAAA,uBAAa,GAAA,EAAuB;AAAA,EAC5C,OAAwB,YAAA,GAAe,CAAA;AAAA;AAAA;AAAA;AAAA,EAKhC,oBAAA,CACN,KAAA,EACA,WAAA,EACA,YAAA,GAAe,IAAA,EACR;AACP,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,IAAI,CAAA;AAC1C,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,QAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,QAAA,EAAU,cAAA;AAAA,QACV,QAAA,EAAU,WAAA;AAAA,QACV,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,SAAA,EAAW,UAAU,SAAA,IAAa,CAAA;AAAA,QAClC,SAAA,EAAW,CAAA;AAAA,QACX,WAAA,EAAa,QAAA,EAAU,WAAA,IAAe,IAAA,CAAK,GAAA,EAAI;AAAA,QAC/C;AAAA,OACA,CAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0BAAA,EAA6B,KAAA,CAAM,MAAM,CAAA,2BAAA,EAA8B,WAAW,CAAA,CAAA;AAAA,KACnF;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,iBAAA,CACN,KAAA,EACA,UAAA,EACA,YAAA,GAAe,KAAA,EACR;AACP,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,IAAI,CAAA;AAE1C,MAAA,IACC,YACA,QAAA,CAAS,QAAA,KAAa,cAAA,IACtB,QAAA,CAAS,cAAc,CAAA,EACtB;AACD,QAAA;AAAA,MACD;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,QAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,QAAA,EAAU,UAAA;AAAA,QACV,QAAA,EAAU,UAAA;AAAA,QACV,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,SAAA,EAAW,UAAU,SAAA,IAAa,CAAA;AAAA,QAClC,SAAA,EAAW,CAAA;AAAA,QACX,WAAA,EAAa,QAAA,EAAU,WAAA,IAAe,IAAA,CAAK,GAAA,EAAI;AAAA,QAC/C;AAAA,OACA,CAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0BAAA,EAA6B,KAAA,CAAM,MAAM,CAAA,4BAAA,EAA+B,UAAU,CAAA,CAAA;AAAA,KACnF;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAkB,IAAA,EAA4B;AACpD,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,MAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,QAAA,EAAU,OAAA;AAAA,MACV,QAAA,EAAU,YAAA;AAAA,MACV,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,SAAA,EAAW,CAAA;AAAA,MACX,SAAA,EAAW,CAAA;AAAA,MACX,WAAA,EAAa,KAAK,GAAA,EAAI;AAAA,MACtB,YAAA,EAAc;AAAA,KACd,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKO,QAAQ,QAAA,EAAyC;AACvD,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACtC,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AAGnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,aAAA,CAAa,YAAA,EAAc;AACjD,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,qBAAA,EAAwB,QAAQ,CAAA,qCAAA,EAAwC,KAAA,CAAM,SAAS,CAAA,uBAAA;AAAA,OACxF;AAAA,IACD;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKO,aAAA,CAAc,UAAkB,SAAA,EAAyB;AAC/D,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,KAAA,CAAM,SAAA,GAAY,CAAA;AAClB,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAClB,MAAA,KAAA,CAAM,WAAA,GAAc,KAAK,GAAA,EAAI;AAAA,IAC9B;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,QAAA,EAAwB;AAC5C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,KAAA,CAAM,SAAA,IAAa,CAAA;AACnB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0CAAA,EAA6C,QAAQ,CAAA,cAAA,EAAiB,KAAA,CAAM,SAAS,CAAA,CAAA;AAAA,OACtF;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,qBAAA,GAA0C;AAChD,IAAA,MAAM,OAAyB,EAAC;AAChC,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,IAAA,CAAK,IAAA,CAAK;AAAA,QACT,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,aAAa,KAAA,CAAM,WAAA;AAAA,QACnB,aAAa,KAAA,CAAM;AAAA,OACnB,CAAA;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EACxD;AAAA,EAEO,SAAS,QAAA,EAAyC;AACxD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AAAA,EAChC;AAAA,EAEO,IAAA,GAAe;AACrB,IAAA,OAAO,KAAK,MAAA,CAAO,IAAA;AAAA,EACpB;AAAA,EAEO,KAAA,GAAc;AACpB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AACD;;;ACrIA,eAAe,eAAA,CACd,cACA,OAAA,EACsC;AACtC,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,GAAG,UAAU,CAAA,OAAA,CAAA;AAE/B,EAAA,IAAI;AACH,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,8CAAA,EAAiD,SAAS,CAAA,CAAE,CAAA;AACrE,IAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,MACxC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,MACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KAChC,CAAA;AAED,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AAClB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,gCAAA,EAAmC,SAAS,CAAA,OAAA,EAAU,SAAA,CAAU,MAAM,CAAA,CAAA;AAAA,OACvE;AACA,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,UAAA,GAAc,MAAM,SAAA,CAAU,IAAA,EAAK;AAazC,IAAA,IAAI,UAAA,CAAW,WAAW,SAAA,EAAW;AACpC,MAAA,OAAO,IAAA;AAAA,IACR;AAGA,IAAA,IAAI,MAAA,GAAS,UAAA,CAAW,IAAA,EAAM,MAAA,IAAU,EAAA;AACxC,IAAA,IAAI,aAAA,GAAgB,UAAA,CAAW,IAAA,EAAM,cAAA,IAAkB,EAAA;AACvD,IAAA,IAAI,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACnC,IAAA,IAAI,MAAA,GAAmB;AAAA,MACtB,iBAAA;AAAA,MACA,iBAAA;AAAA,MACA,qBAAA;AAAA,MACA,kBAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,GAAG,UAAU,CAAA,qCAAA,CAAA;AAC5B,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,QAClC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OAChC,CAAA;AACD,MAAA,IAAI,OAAO,EAAA,EAAI;AACd,QAAA,MAAM,OAAA,GAAW,MAAM,MAAA,CAAO,IAAA,EAAK;AAKnC,QAAA,IAAI,OAAA,CAAQ,QAAA,EAAU,QAAA,GAAW,OAAA,CAAQ,QAAA;AACzC,QAAA,IAAI,OAAA,CAAQ,uBAAuB,MAAA,EAAQ;AAC1C,UAAA,MAAA,GAAS,OAAA,CAAQ,sBAAsB,CAAC,CAAA;AAAA,QACzC;AACA,QAAA,IAAI,OAAA,CAAQ,kBAAkB,MAAA,EAAQ;AACrC,UAAA,MAAA,GAAS,OAAA,CAAQ,gBAAA;AAAA,QAClB;AAAA,MACD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAGA,IAAA,IAAI,CAAC,iBAAiB,MAAA,EAAQ;AAC7B,MAAA,MAAM,aAAa,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAAI,MAAA,GAAS,GAAG,MAAM,CAAA,KAAA,CAAA;AAChE,MAAA,aAAA,GAAgB,GAAG,UAAU,CAAA,MAAA,CAAA;AAAA,IAC9B;AAGA,IAAA,IAAI,aAAA,EAAe;AAClB,MAAA,IAAI;AACH,QAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,aAAa,CAAA;AAC5C,QAAA,IAAI,QAAQ,QAAA,EAAU;AACrB,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACrD,UAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,IAAA;AACrC,UAAA,cAAA,CAAe,IAAA,GAAO,SAAA;AACtB,UAAA,aAAA,GAAgB,eAAe,QAAA,EAAS;AAAA,QACzC,CAAA,MAAA,IAAA,CACE,cAAA,CAAe,QAAA,KAAa,OAAA,IAC5B,eAAe,QAAA,KAAa,YAAA,IAC5B,cAAA,CAAe,QAAA,CAAS,WAAW,MAAM,CAAA,KAC1C,UAAA,CAAW,QAAA,CAAS,WAAW,CAAA,EAC9B;AACD,UAAA,cAAA,CAAe,IAAA,GAAO,iBAAA;AACtB,UAAA,aAAA,GAAgB,eAAe,QAAA,EAAS;AAAA,QACzC;AAAA,MACD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,2CAAA,EAAyC,UAAU,CAAA,SAAA,EAAY,UAAA,CAAW,KAAA,EAAO,MAAA,IAAU,CAAC,CAAA,QAAA,EAAW,UAAA,CAAW,QAAA,EAAU,IAAA,IAAQ,CAAC,CAAA,CAAA;AAAA,KACtI;AAEA,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,UAAA;AAAA,MACT,WAAA,EAAa,GAAG,UAAU,CAAA,IAAA,CAAA;AAAA,MAC1B,cAAA,EAAgB,GAAG,UAAU,CAAA,OAAA,CAAA;AAAA,MAC7B,aAAA;AAAA,MACA,MAAA;AAAA,MACA,QAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAA,EAAO,UAAA,CAAW,KAAA,IAAS,EAAC;AAAA,MAC5B,IAAA,EAAM,UAAA,CAAW,QAAA,EAAU,IAAA,IAAQ;AAAA,KACpC;AAAA,EACD,SAAS,GAAA,EAAK;AACb,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,6CAAA,EAAgD,UAAU,CAAA,EAAA,EAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KAChH;AACA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAKA,eAAsB,aAAA,CACrB,OAAA,GAAgC,EAAC,EACF;AAC/B,EAAA,GAAA,CAAI,KAAK,iEAAiE,CAAA;AAE1E,EAAA,IAAI,WAAA,GAA0C,IAAA;AAG9C,EAAA,IAAI,QAAQ,MAAA,EAAQ;AACnB,IAAA,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC5D;AAGA,EAAA,IAAI,CAAC,WAAA,KAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA,CAAA,EAAO;AACrD,IAAA,MAAM,aAAA,GAAgB;AAAA,MACrB,wBAAA;AAAA;AAAA,MACA,wBAAA;AAAA;AAAA,MACA;AAAA;AAAA,KACD;AAEA,IAAA,KAAA,MAAW,OAAO,aAAA,EAAe;AAEhC,MAAA,IAAI,OAAA,CAAQ,UAAU,GAAA,CAAI,QAAA,CAAS,IAAI,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAI,CAAA;AAC9D,QAAA;AAED,MAAA,WAAA,GAAc,MAAM,eAAA,CAAgB,GAAA,EAAK,OAAO,CAAA;AAChD,MAAA,IAAI,WAAA,EAAa;AAAA,IAClB;AAAA,EACD;AAGA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,cAAA,IAAkB,EAAC;AAClD,EAAA,MAAM,iBAAA,GAAoB,eAAe,MAAA,GAAS,CAAA;AAGlD,EAAA,IAAI,eAAe,iBAAA,EAAmB;AACrC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yDAAA,EAAuD,WAAA,CAAY,OAAO,CAAA,GAAA,EAAM,eAAe,MAAM,CAAA,gBAAA;AAAA,KACtG;AACA,IAAA,OAAO;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,OAAA,EAAS,WAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACL,cAAA;AAAA,QACA,cAAc,OAAA,CAAQ;AAAA;AACvB,KACD;AAAA,EACD;AAEA,EAAA,IAAI,WAAA,EAAa;AAChB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,iFAAA,EAA6E,YAAY,OAAO,CAAA,CAAA;AAAA,KACjG;AACA,IAAA,OAAO;AAAA,MACN,IAAA,EAAM,SAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,GAAA,CAAI,IAAA;AAAA,IACH,CAAA,+EAAA,EAA2E,eAAe,MAAM,CAAA,CAAA;AAAA,GACjG;AACA,EAAA,OAAO;AAAA,IACN,IAAA,EAAM,MAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACL,cAAA;AAAA,MACA,cAAc,OAAA,CAAQ;AAAA;AACvB,GACD;AACD","file":"chunk-HWUCX2II.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Routing Table — Per-Tool Hybrid Routing & Resilience\n *\n * Maintains deterministic per-tool routes across heterogeneous transports:\n * - \"http-gateway\": Route through Border LIO Gateway or reverse proxy via HTTP/JSON-RPC.\n * - \"p2p-grpc\": Route directly to sovereign node via libp2p + gRPC (Kyber768/ZK-Receipt).\n * - \"local\": Handled in-process (e.g. LiopMeshStatus, diagnostic probes).\n *\n * Implements per-route latency tracking, failure backoff, and circuit breaking.\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport type TransportProvider = \"http-gateway\" | \"p2p-grpc\" | \"local\";\n\nexport interface ToolDefinition {\n\tname: string;\n\tdescription?: string;\n\tinputSchema?: Record<string, unknown>;\n}\n\nexport interface ToolRoute {\n\tname: string;\n\tprovider: TransportProvider;\n\tendpoint: string;\n\tdescription?: string;\n\tinputSchema?: Record<string, unknown>;\n\tlatencyMs: number;\n\tfailCount: number;\n\tlastSuccess: number;\n\tauthRequired?: boolean;\n}\n\nexport class RoutingTable {\n\tprivate routes = new Map<string, ToolRoute>();\n\tprivate static readonly MAX_FAILURES = 5;\n\n\t/**\n\t * Registers or updates a collection of tools exposed via an HTTP Gateway.\n\t */\n\tpublic registerGatewayTools(\n\t\ttools: ToolDefinition[],\n\t\tmcpEndpoint: string,\n\t\tauthRequired = true,\n\t): void {\n\t\tfor (const tool of tools) {\n\t\t\tconst existing = this.routes.get(tool.name);\n\t\t\tthis.routes.set(tool.name, {\n\t\t\t\tname: tool.name,\n\t\t\t\tprovider: \"http-gateway\",\n\t\t\t\tendpoint: mcpEndpoint,\n\t\t\t\tdescription: tool.description ?? existing?.description,\n\t\t\t\tinputSchema: tool.inputSchema ?? existing?.inputSchema,\n\t\t\t\tlatencyMs: existing?.latencyMs ?? 0,\n\t\t\t\tfailCount: 0,\n\t\t\t\tlastSuccess: existing?.lastSuccess ?? Date.now(),\n\t\t\t\tauthRequired,\n\t\t\t});\n\t\t}\n\t\tlog.info(\n\t\t\t`[RoutingTable] Registered ${tools.length} tool(s) via HTTP Gateway (${mcpEndpoint})`,\n\t\t);\n\t}\n\n\t/**\n\t * Registers tools discovered directly over the P2P Mesh (gRPC).\n\t */\n\tpublic registerMeshTools(\n\t\ttools: ToolDefinition[],\n\t\tgrpcTarget: string,\n\t\tauthRequired = false,\n\t): void {\n\t\tfor (const tool of tools) {\n\t\t\tconst existing = this.routes.get(tool.name);\n\t\t\t// Do not overwrite healthy gateway routes unless explicitly preferred\n\t\t\tif (\n\t\t\t\texisting &&\n\t\t\t\texisting.provider === \"http-gateway\" &&\n\t\t\t\texisting.failCount === 0\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthis.routes.set(tool.name, {\n\t\t\t\tname: tool.name,\n\t\t\t\tprovider: \"p2p-grpc\",\n\t\t\t\tendpoint: grpcTarget,\n\t\t\t\tdescription: tool.description ?? existing?.description,\n\t\t\t\tinputSchema: tool.inputSchema ?? existing?.inputSchema,\n\t\t\t\tlatencyMs: existing?.latencyMs ?? 0,\n\t\t\t\tfailCount: 0,\n\t\t\t\tlastSuccess: existing?.lastSuccess ?? Date.now(),\n\t\t\t\tauthRequired,\n\t\t\t});\n\t\t}\n\t\tlog.info(\n\t\t\t`[RoutingTable] Registered ${tools.length} tool(s) via P2P Mesh gRPC (${grpcTarget})`,\n\t\t);\n\t}\n\n\t/**\n\t * Registers an in-process local tool (e.g. LiopMeshStatus).\n\t */\n\tpublic registerLocalTool(tool: ToolDefinition): void {\n\t\tthis.routes.set(tool.name, {\n\t\t\tname: tool.name,\n\t\t\tprovider: \"local\",\n\t\t\tendpoint: \"in-process\",\n\t\t\tdescription: tool.description,\n\t\t\tinputSchema: tool.inputSchema,\n\t\t\tlatencyMs: 0,\n\t\t\tfailCount: 0,\n\t\t\tlastSuccess: Date.now(),\n\t\t\tauthRequired: false,\n\t\t});\n\t}\n\n\t/**\n\t * Resolves the optimal route for a specific tool.\n\t */\n\tpublic resolve(toolName: string): ToolRoute | undefined {\n\t\tconst route = this.routes.get(toolName);\n\t\tif (!route) return undefined;\n\n\t\t// If circuit is tripped (excessive failures), still return route but log warning\n\t\tif (route.failCount >= RoutingTable.MAX_FAILURES) {\n\t\t\tlog.warn(\n\t\t\t\t`[RoutingTable] Tool '${toolName}' route has tripped circuit breaker (${route.failCount} consecutive failures).`,\n\t\t\t);\n\t\t}\n\n\t\treturn route;\n\t}\n\n\t/**\n\t * Records a successful invocation on a route, resetting failures and updating latency.\n\t */\n\tpublic recordSuccess(toolName: string, latencyMs: number): void {\n\t\tconst route = this.routes.get(toolName);\n\t\tif (route) {\n\t\t\troute.failCount = 0;\n\t\t\troute.latencyMs = latencyMs;\n\t\t\troute.lastSuccess = Date.now();\n\t\t}\n\t}\n\n\t/**\n\t * Records a failed invocation on a route.\n\t */\n\tpublic recordFailure(toolName: string): void {\n\t\tconst route = this.routes.get(toolName);\n\t\tif (route) {\n\t\t\troute.failCount += 1;\n\t\t\tlog.warn(\n\t\t\t\t`[RoutingTable] Failure recorded for tool '${toolName}' (failCount: ${route.failCount})`,\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Lists all registered tools in sorted format for tools/list.\n\t */\n\tpublic getAllToolDefinitions(): ToolDefinition[] {\n\t\tconst list: ToolDefinition[] = [];\n\t\tfor (const route of this.routes.values()) {\n\t\t\tlist.push({\n\t\t\t\tname: route.name,\n\t\t\t\tdescription: route.description,\n\t\t\t\tinputSchema: route.inputSchema,\n\t\t\t});\n\t\t}\n\t\treturn list.sort((a, b) => a.name.localeCompare(b.name));\n\t}\n\n\tpublic getRoute(toolName: string): ToolRoute | undefined {\n\t\treturn this.routes.get(toolName);\n\t}\n\n\tpublic size(): number {\n\t\treturn this.routes.size;\n\t}\n\n\tpublic clear(): void {\n\t\tthis.routes.clear();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Topology Probe — RFC 9728 PRM Chain & Adaptive Network Detection\n *\n * Implements single-URL auto-discovery of multi-tier mesh environments:\n * 1. Probes RFC 9728 Protected Resource Metadata (PRM) or /health endpoint.\n * 2. Chains discovery to obtain OAuth 2.1 authorization server endpoints.\n * 3. Identifies whether the node should operate in \"gateway\", \"mesh\", or \"hybrid\" mode.\n *\n * Standards: RFC 9728, RFC 8414, RFC 8707, NIST SP 800-207\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface GatewayTopologyInfo {\n\tbaseUrl: string;\n\tmcpEndpoint: string;\n\thealthEndpoint: string;\n\ttokenEndpoint: string;\n\tissuer: string;\n\taudience: string;\n\tscopes: string[];\n\ttools: string[];\n\ttier: number;\n}\n\nexport interface MeshTopologyInfo {\n\tbootstrapNodes: string[];\n\tidentityPath?: string;\n}\n\nexport interface TopologyProbeResult {\n\tmode: \"gateway\" | \"mesh\" | \"hybrid\";\n\tgateway?: GatewayTopologyInfo;\n\tmesh?: MeshTopologyInfo;\n}\n\nexport interface TopologyProbeOptions {\n\tblgUrl?: string;\n\tnexusUrl?: string;\n\tclientId?: string;\n\tclientSecret?: string;\n\taudience?: string;\n\tstaticToken?: string;\n\tbootstrapNodes?: string[];\n\tidentityPath?: string;\n\tautoProbeLocal?: boolean;\n}\n\n/**\n * Executes the RFC 9728 PRM chain and health probe on a candidate Gateway URL.\n */\nasync function probeGatewayUrl(\n\tcandidateUrl: string,\n\toptions: TopologyProbeOptions,\n): Promise<GatewayTopologyInfo | null> {\n\tconst trimmedUrl = candidateUrl.replace(/\\/+$/, \"\");\n\tconst healthUrl = `${trimmedUrl}/health`;\n\n\ttry {\n\t\tlog.info(`[TopologyProbe] Probing candidate Gateway at: ${healthUrl}`);\n\t\tconst healthRes = await fetch(healthUrl, {\n\t\t\theaders: { Accept: \"application/json\" },\n\t\t\tsignal: AbortSignal.timeout(3000),\n\t\t});\n\n\t\tif (!healthRes.ok) {\n\t\t\tlog.info(\n\t\t\t\t`[TopologyProbe] Probe failed at ${healthUrl} [HTTP ${healthRes.status}]`,\n\t\t\t);\n\t\t\treturn null;\n\t\t}\n\n\t\tconst healthData = (await healthRes.json()) as {\n\t\t\tstatus?: string;\n\t\t\ttools?: string[];\n\t\t\tauth?: {\n\t\t\t\tissuer?: string;\n\t\t\t\ttoken_endpoint?: string;\n\t\t\t\tjwks_uri?: string;\n\t\t\t};\n\t\t\ttopology?: {\n\t\t\t\ttier?: number;\n\t\t\t};\n\t\t};\n\n\t\tif (healthData.status !== \"healthy\") {\n\t\t\treturn null;\n\t\t}\n\n\t\t// Discover OAuth metadata via PRM (RFC 9728)\n\t\tlet issuer = healthData.auth?.issuer || \"\";\n\t\tlet tokenEndpoint = healthData.auth?.token_endpoint || \"\";\n\t\tlet audience = options.audience || \"urn:liop:mesh:api\";\n\t\tlet scopes: string[] = [\n\t\t\t\"liop:tools:list\",\n\t\t\t\"liop:tools:call\",\n\t\t\t\"liop:resources:read\",\n\t\t\t\"liop:schema:read\",\n\t\t\t\"liop:mesh:query\",\n\t\t];\n\n\t\ttry {\n\t\t\tconst prmUrl = `${trimmedUrl}/.well-known/oauth-protected-resource`;\n\t\t\tconst prmRes = await fetch(prmUrl, {\n\t\t\t\theaders: { Accept: \"application/json\" },\n\t\t\t\tsignal: AbortSignal.timeout(2000),\n\t\t\t});\n\t\t\tif (prmRes.ok) {\n\t\t\t\tconst prmData = (await prmRes.json()) as {\n\t\t\t\t\tresource?: string;\n\t\t\t\t\tauthorization_servers?: string[];\n\t\t\t\t\tscopes_supported?: string[];\n\t\t\t\t};\n\t\t\t\tif (prmData.resource) audience = prmData.resource;\n\t\t\t\tif (prmData.authorization_servers?.length) {\n\t\t\t\t\tissuer = prmData.authorization_servers[0];\n\t\t\t\t}\n\t\t\t\tif (prmData.scopes_supported?.length) {\n\t\t\t\t\tscopes = prmData.scopes_supported;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Non-fatal if PRM endpoint is not present\n\t\t}\n\n\t\t// If token endpoint is not explicitly given, resolve from issuer\n\t\tif (!tokenEndpoint && issuer) {\n\t\t\tconst baseIssuer = issuer.endsWith(\"/oidc\") ? issuer : `${issuer}/oidc`;\n\t\t\ttokenEndpoint = `${baseIssuer}/token`;\n\t\t}\n\n\t\t// Normalize tokenEndpoint for Docker-to-Host bridge environments\n\t\tif (tokenEndpoint) {\n\t\t\ttry {\n\t\t\t\tconst parsedEndpoint = new URL(tokenEndpoint);\n\t\t\t\tif (options.nexusUrl) {\n\t\t\t\t\tconst nexusBase = options.nexusUrl.replace(/\\/+$/, \"\");\n\t\t\t\t\tconst nexusHost = new URL(nexusBase).host;\n\t\t\t\t\tparsedEndpoint.host = nexusHost;\n\t\t\t\t\ttokenEndpoint = parsedEndpoint.toString();\n\t\t\t\t} else if (\n\t\t\t\t\t(parsedEndpoint.hostname === \"nexus\" ||\n\t\t\t\t\t\tparsedEndpoint.hostname === \"nexus-prod\" ||\n\t\t\t\t\t\tparsedEndpoint.hostname.startsWith(\"172.\")) &&\n\t\t\t\t\ttrimmedUrl.includes(\"127.0.0.1\")\n\t\t\t\t) {\n\t\t\t\t\tparsedEndpoint.host = \"127.0.0.1:15000\";\n\t\t\t\t\ttokenEndpoint = parsedEndpoint.toString();\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t/* keep original tokenEndpoint */\n\t\t\t}\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[TopologyProbe] ✅ Verified Gateway at ${trimmedUrl} (Tools: ${healthData.tools?.length ?? 0}, Tier: ${healthData.topology?.tier ?? 2})`,\n\t\t);\n\n\t\treturn {\n\t\t\tbaseUrl: trimmedUrl,\n\t\t\tmcpEndpoint: `${trimmedUrl}/mcp`,\n\t\t\thealthEndpoint: `${trimmedUrl}/health`,\n\t\t\ttokenEndpoint,\n\t\t\tissuer,\n\t\t\taudience,\n\t\t\tscopes,\n\t\t\ttools: healthData.tools || [],\n\t\t\ttier: healthData.topology?.tier ?? 2,\n\t\t};\n\t} catch (err) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] Gateway probe unreachable at ${trimmedUrl}: ${err instanceof Error ? err.message : String(err)}`,\n\t\t);\n\t\treturn null;\n\t}\n}\n\n/**\n * Probes the runtime environment and determines the optimal architecture mode.\n */\nexport async function probeTopology(\n\toptions: TopologyProbeOptions = {},\n): Promise<TopologyProbeResult> {\n\tlog.info(\"[TopologyProbe] Starting adaptive network topology discovery...\");\n\n\tlet gatewayInfo: GatewayTopologyInfo | null = null;\n\n\t// 1. Check explicit Border LIO Gateway URL (Highest priority)\n\tif (options.blgUrl) {\n\t\tgatewayInfo = await probeGatewayUrl(options.blgUrl, options);\n\t}\n\n\t// 2. Auto-probing known local infrastructure ports if enabled/unspecified\n\tif (!gatewayInfo && (options.autoProbeLocal ?? true)) {\n\t\tconst candidateUrls = [\n\t\t\t\"http://127.0.0.1:15018\", // Production BLG port\n\t\t\t\"http://127.0.0.1:15000\", // Production Nexus port\n\t\t\t\"http://127.0.0.1:13000\", // Demo Nexus port\n\t\t];\n\n\t\tfor (const url of candidateUrls) {\n\t\t\t// Skip if already probed\n\t\t\tif (options.blgUrl && url.includes(new URL(options.blgUrl).port))\n\t\t\t\tcontinue;\n\n\t\t\tgatewayInfo = await probeGatewayUrl(url, options);\n\t\t\tif (gatewayInfo) break;\n\t\t}\n\t}\n\n\t// 3. Evaluate P2P Mesh connectivity\n\tconst bootstrapNodes = options.bootstrapNodes || [];\n\tconst hasMeshBootstraps = bootstrapNodes.length > 0;\n\n\t// 4. Decide runtime mode\n\tif (gatewayInfo && hasMeshBootstraps) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] ⚡ Mode Determined: HYBRID (Gateway: ${gatewayInfo.baseUrl} + ${bootstrapNodes.length} P2P bootstraps)`,\n\t\t);\n\t\treturn {\n\t\t\tmode: \"hybrid\",\n\t\t\tgateway: gatewayInfo,\n\t\t\tmesh: {\n\t\t\t\tbootstrapNodes,\n\t\t\t\tidentityPath: options.identityPath,\n\t\t\t},\n\t\t};\n\t}\n\n\tif (gatewayInfo) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] 🚀 Mode Determined: GATEWAY (Zero-P2P overhead, direct to ${gatewayInfo.baseUrl})`,\n\t\t);\n\t\treturn {\n\t\t\tmode: \"gateway\",\n\t\t\tgateway: gatewayInfo,\n\t\t};\n\t}\n\n\tlog.info(\n\t\t`[TopologyProbe] 🌐 Mode Determined: MESH (Standard P2P DHT, Bootstraps: ${bootstrapNodes.length})`,\n\t);\n\treturn {\n\t\tmode: \"mesh\",\n\t\tmesh: {\n\t\t\tbootstrapNodes,\n\t\t\tidentityPath: options.identityPath,\n\t\t},\n\t};\n}\n"]}

package/dist/{chunk-NFPQJCWL.js → chunk-JPN5456V.js}

@@ -1,11 +1,11 @@
-import { TokenTelemetryEngine } from './chunk-DZ2FQGJD.js';
-import { LiopVerifier } from './chunk-PEN3KFLF.js';
+import { TokenTelemetryEngine } from './chunk-UAUBVKMK.js';
+import { LiopVerifier } from './chunk-RWBFGRF7.js';
 import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
 import { authorizeRequest, Dilithium65Wrapper } from './chunk-VH4K4U45.js';
-import { liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-3BJ5QQHK.js';
+import { liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-COISHJK5.js';
 import { toolCallErrorsTotal, pqcHandshakeDurationMs, pqcHandshakesTotal, zkVerificationsTotal, wireEgressBytesTotal } from './chunk-PAICJCKJ.js';
-import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, adaptResponseForLegacyClient, MCP_PROTOCOL_VERSION_LEGACY, buildLegacyInitializeResponse } from './chunk-NFFBJALJ.js';
-import { log } from './chunk-HA6YZ42O.js';
+import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, adaptResponseForLegacyClient, MCP_PROTOCOL_VERSION_LEGACY, buildLegacyInitializeResponse } from './chunk-2KSO3W4A.js';
+import { log } from './chunk-LIBI3HMN.js';
 import * as crypto from 'crypto';
 import * as grpc from '@grpc/grpc-js';
 
@@ -1473,5 +1473,5 @@ ${cachedToolList}` : "\nNo remote tools discovered yet.",
 };
 
 export { LiopMcpRouter };
-//# sourceMappingURL=chunk-NFPQJCWL.js.map
-//# sourceMappingURL=chunk-NFPQJCWL.js.map
+//# sourceMappingURL=chunk-JPN5456V.js.map
+//# sourceMappingURL=chunk-JPN5456V.js.map