@nekzus/liop 2.4.0-alpha.14 → 2.4.0-alpha.15

package/dist/bin/agent.js

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
-import { probeTopology, RoutingTable } from '../chunk-HWUCX2II.js';
-import { TokenManager } from '../chunk-VRZ3UIYA.js';
-import { LiopServer } from '../chunk-6CPRIMCD.js';
+import { probeTopology, RoutingTable } from '../chunk-PUDETPL4.js';
+import { TokenManager } from '../chunk-3QH44NKZ.js';
+import { LiopServer } from '../chunk-O37AERO7.js';
 import '../chunk-Y62GORQF.js';
-import { LiopMcpRouter } from '../chunk-JPN5456V.js';
-import '../chunk-UAUBVKMK.js';
-import '../chunk-RWBFGRF7.js';
+import { LiopMcpRouter } from '../chunk-FPL5ZKW5.js';
+import '../chunk-H2SNR7PB.js';
+import '../chunk-2STZHJ24.js';
 import '../chunk-IK7CGWAZ.js';
 import '../chunk-7PITYWOV.js';
 import '../chunk-VH4K4U45.js';
-import '../chunk-COISHJK5.js';
+import '../chunk-3UBNOYMH.js';
 import '../chunk-PAICJCKJ.js';
 import { isLegacyRequest } from '../chunk-2KSO3W4A.js';
 import '../chunk-FTF6AMF6.js';
 import '../chunk-ZP3VVXOI.js';
-import { MeshNode } from '../chunk-QJIXNZTL.js';
-import { log } from '../chunk-LIBI3HMN.js';
+import { MeshNode } from '../chunk-XRDN232O.js';
+import { log } from '../chunk-K3DGJLUY.js';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';

package/dist/bridge.d.ts

@@ -1,8 +1,8 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { L as LiopServer, a as LiopServerOptions } from './index-Dqn4dtZP.js';
+import { L as LiopServer, a as LiopServerOptions } from './index-DW1-7ClN.js';
 import 'zod';
 import './node-B0b2vUFS.js';
-import './types-CMYlWlX2.js';
+import './types-Bo6hcrS6.js';
 import 'jose';
 
 /**

package/dist/bridge.js

@@ -1,5 +1,5 @@
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-OSJDFUBY.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-ZKKAUQ3E.js';
 import './chunk-2KSO3W4A.js';
-import './chunk-LIBI3HMN.js';
+import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=bridge.js.map
 //# sourceMappingURL=bridge.js.map

package/dist/{chunk-RWBFGRF7.js → chunk-2STZHJ24.js}

@@ -1,6 +1,6 @@
 import { deriveLogicImageDigest } from './chunk-IK7CGWAZ.js';
 import { zkVerificationDurationMs } from './chunk-PAICJCKJ.js';
-import { log } from './chunk-LIBI3HMN.js';
+import { log } from './chunk-K3DGJLUY.js';
 import * as fs from 'fs';
 import { createRequire } from 'module';
 import path from 'path';
@@ -110,5 +110,5 @@ var LiopVerifier = class _LiopVerifier {
 };
 
 export { LiopVerifier };
-//# sourceMappingURL=chunk-RWBFGRF7.js.map
-//# sourceMappingURL=chunk-RWBFGRF7.js.map
+//# sourceMappingURL=chunk-2STZHJ24.js.map
+//# sourceMappingURL=chunk-2STZHJ24.js.map

package/dist/{chunk-RWBFGRF7.js.map → chunk-2STZHJ24.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/crypto/verifier.ts"],"names":["__filename","__dirname"],"mappings":";;;;;;;;;AAYA,IAAMA,YAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,WAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,YAAU,CAAA;AASlC,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA;AAAA,EAEzB,OAAe,YAAA,GAA+B,IAAA;AAAA,EAEtC,SAAA,GAAY;AACnB,IAAA,IAAI,CAAC,cAAa,YAAA,EAAc;AAC/B,MAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA,CAAY,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAC3C,MAAA,MAAM,SAAA,GAAY,OAAO,KAAA,GAAQ,KAAA;AAEjC,MAAA,IAAI,WAAqB,EAAC;AAC1B,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACzC,UAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,kBAAkB,CAAA;AAC7C,UAAA,MAAM,WAAA,GAAc,aAAA;AAAA,YACnB,KAAK,IAAA,CAAK,IAAA,CAAK,QAAQ,MAAM,CAAA,EAAG,QAAQ,YAAY;AAAA,WACrD,CAAE,IAAA;AACF,UAAA,QAAA,GAAW,CAAC,YAAY,WAAW,CAAA;AAAA,QACpC,SAAS,EAAA,EAAI;AACZ,UAAA,QAAA,GAAW,CAAC,YAAY,KAAK,CAAA;AAAA,QAC9B;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QACnB,IAAA,CAAK,OAAA,CAAQC,WAAA,EAAW,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAE,CAAA;AAAA;AAAA,QAC3D,IAAA,CAAK,OAAA,CAAQA,WAAA,EAAW,CAAA,sBAAA,EAAyB,SAAS,CAAA,CAAE;AAAA;AAAA,OAC7D;AAEA,MAAA,MAAM,cAAA,GACL,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAS,cAAW,CAAC,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA;AAE3D,MAAA,aAAA,CAAa,YAAA,GAAe,IAAI,OAAA,CAAQ;AAAA,QACvC,QAAA,EAAU,cAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY,CAAA;AAAA;AAAA,QACZ,WAAA,EAAa,GAAA;AAAA,QACb;AAAA,OACA,CAAA;AAGD,MAAA,aAAA,CAAa,YAAA,CAAa,IAAI,EAAE,MAAA,EAAQ,UAAU,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAClE,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,CAAA,sDAAA,EAAyD,IAAI,OAAO,CAAA;AAAA,SACrE;AAAA,MACD,CAAC,CAAA;AAAA,IACF;AACA,IAAA,OAAO,aAAA,CAAa,YAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,eAAA,CACZ,YAAA,EACA,gBAAA,EACA,SAAA,EACA,eACA,cAAA,EACmB;AACnB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAC9D,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI;AAAA,MAC7B,MAAA,EAAQ,gBAAA;AAAA,MACR,YAAA,EAAc,IAAI,UAAA,CAAW,YAAY,CAAA;AAAA,MACzC,gBAAA;AAAA,MACA,SAAA,EAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AAAA,MACnC,aAAA,EAAe,aAAA,GAAgB,IAAI,UAAA,CAAW,aAAa,CAAA,GAAI,MAAA;AAAA,MAC/D;AAAA,KACA,CAAA;AACD,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAEvC,IAAA,IAAI;AACH,MAAA,wBAAA,CAAyB,OAAA;AAAA,QACxB,EAAE,MAAA,EAAQ,MAAA,CAAO,QAAA,GAAW,aAAa,QAAA,EAAS;AAAA,QAClD;AAAA,OACD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,OAAO,QAAA,EAAU;AACpB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,qBACZ,iBAAA,EACmB;AACnB,IAAA,IAAI,iBAAA,CAAkB,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE3C,IAAA,IAAI;AAKH,MAAA,GAAA,CAAI,KAAK,yDAAyD,CAAA;AAClE,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,GAAA,EAAK;AACb,MAAA,GAAA,CAAI,KAAA,CAAM,2CAA2C,GAAG,CAAA;AACxD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,YAAA,EAA8B;AAClD,IAAA,OAAO,uBAAuB,YAAY,CAAA;AAAA,EAC3C;AACD","file":"chunk-RWBFGRF7.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Piscina } from \"piscina\";\nimport { zkVerificationDurationMs } from \"../observability/metrics.js\";\nimport { log } from \"../utils/logger.js\";\nimport { deriveLogicImageDigest } from \"./logic-image-id.js\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\n/**\n * LIOP Tier-0 Industrial Verifier\n *\n * This engine is responsible for the trustless verification of remote logic execution.\n * It validates both the integrity of the code (ZkImageID) and the mathematical proof\n * of its execution (ZkSeal), as well as hardware-level attestation (TEE).\n */\nexport class LiopVerifier {\n\t// Singleton Worker Pool for heavy ZK verification\n\tprivate static zkWorkerPool: Piscina | null = null;\n\n\tprivate getZkPool() {\n\t\tif (!LiopVerifier.zkWorkerPool) {\n\t\t\tconst isTS = import.meta.url.endsWith(\".ts\");\n\t\t\tconst workerExt = isTS ? \".ts\" : \".js\";\n\n\t\t\tlet execArgv: string[] = [];\n\t\t\tif (isTS) {\n\t\t\t\ttry {\n\t\t\t\t\tconst req = createRequire(import.meta.url);\n\t\t\t\t\tconst tsxPkg = req.resolve(\"tsx/package.json\");\n\t\t\t\t\tconst absoluteTsx = pathToFileURL(\n\t\t\t\t\t\tpath.join(path.dirname(tsxPkg), \"dist\", \"loader.mjs\"),\n\t\t\t\t\t).href;\n\t\t\t\t\texecArgv = [\"--import\", absoluteTsx];\n\t\t\t\t} catch (_e) {\n\t\t\t\t\texecArgv = [\"--import\", \"tsx\"];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Support both flat dist/ and original src/ structure\n\t\t\tconst workerPaths = [\n\t\t\t\tpath.resolve(__dirname, `./workers/zk-verifier${workerExt}`), // Flat dist/ (tsup)\n\t\t\t\tpath.resolve(__dirname, `../workers/zk-verifier${workerExt}`), // Original src/\n\t\t\t];\n\n\t\t\tconst workerFilename =\n\t\t\t\tworkerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];\n\n\t\t\tLiopVerifier.zkWorkerPool = new Piscina({\n\t\t\t\tfilename: workerFilename,\n\t\t\t\tminThreads: 1,\n\t\t\t\tmaxThreads: 2, // Minimal footprint since verification is fast compared to generation\n\t\t\t\tidleTimeout: 30000,\n\t\t\t\texecArgv,\n\t\t\t});\n\n\t\t\t// Pre-warm the verification worker\n\t\t\tLiopVerifier.zkWorkerPool.run({ action: \"warmup\" }).catch((err) => {\n\t\t\t\tlog.debug(\n\t\t\t\t\t`[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`,\n\t\t\t\t);\n\t\t\t});\n\t\t}\n\t\treturn LiopVerifier.zkWorkerPool;\n\t}\n\n\t/**\n\t * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.\n\t *\n\t * @param logicPayload The raw WASM or JS logic that was sent to the provider.\n\t * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).\n\t * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM.\n\t */\n\tpublic async verifyZkReceipt(\n\t\tlogicPayload: Buffer,\n\t\tremoteImageIdHex: string,\n\t\tzkReceipt: Buffer,\n\t\tsessionSecret?: Buffer,\n\t\texpectedOutput?: unknown,\n\t): Promise<boolean> {\n\t\tconst pool = this.getZkPool();\n\t\tif (!pool) throw new Error(\"Worker pool initialization failed\");\n\t\tconst startTime = performance.now();\n\t\tconst result = await pool.run({\n\t\t\taction: \"verify_receipt\",\n\t\t\tlogicPayload: new Uint8Array(logicPayload),\n\t\t\tremoteImageIdHex,\n\t\t\tzkReceipt: new Uint8Array(zkReceipt),\n\t\t\tsessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : undefined,\n\t\t\texpectedOutput,\n\t\t});\n\t\tconst durationMs = performance.now() - startTime;\n\n\t\ttry {\n\t\t\tzkVerificationDurationMs.observe(\n\t\t\t\t{ status: result.verified ? \"verified\" : \"failed\" },\n\t\t\t\tdurationMs,\n\t\t\t);\n\t\t} catch {\n\t\t\t// Metrics observation failure must never disrupt cryptographic verification\n\t\t}\n\n\t\tif (result.verified) {\n\t\t\tlog.info(`[LiopVerifier] ${result.message}`);\n\t\t\treturn true;\n\t\t}\n\n\t\tlog.error(`[LiopVerifier] FAILED: ${result.message}`);\n\t\treturn false;\n\t}\n\n\t/**\n\t * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).\n\t *\n\t * @param attestationReport The COSE-signed attestation document from the hardware.\n\t */\n\tpublic async verifyTeeAttestation(\n\t\tattestationReport: Buffer,\n\t): Promise<boolean> {\n\t\tif (attestationReport.length === 0) return true; // Optional in Mesh Alpha\n\n\t\ttry {\n\t\t\t// Architecture for AWS Nitro Enclaves:\n\t\t\t// 1. Decode CBOR/COSE\n\t\t\t// 2. Verify Signature against AWS Nitro Root CA\n\t\t\t// 3. Compare PCRs\n\t\t\tlog.info(\"[LiopVerifier] TEE Attestation: Not configured (no-op).\");\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tlog.error(\"[LiopVerifier] TEE Verification Failed:\", err);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Derives the ImageID of a logic payload following the LIOP v1 Standard.\n\t */\n\tpublic deriveImageId(logicPayload: Buffer): Buffer {\n\t\treturn deriveLogicImageDigest(logicPayload);\n\t}\n}\n"]}
+{"version":3,"sources":["../src/crypto/verifier.ts"],"names":["__filename","__dirname"],"mappings":";;;;;;;;;AAYA,IAAMA,YAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,WAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,YAAU,CAAA;AASlC,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA;AAAA,EAEzB,OAAe,YAAA,GAA+B,IAAA;AAAA,EAEtC,SAAA,GAAY;AACnB,IAAA,IAAI,CAAC,cAAa,YAAA,EAAc;AAC/B,MAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA,CAAY,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAC3C,MAAA,MAAM,SAAA,GAAY,OAAO,KAAA,GAAQ,KAAA;AAEjC,MAAA,IAAI,WAAqB,EAAC;AAC1B,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACzC,UAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,kBAAkB,CAAA;AAC7C,UAAA,MAAM,WAAA,GAAc,aAAA;AAAA,YACnB,KAAK,IAAA,CAAK,IAAA,CAAK,QAAQ,MAAM,CAAA,EAAG,QAAQ,YAAY;AAAA,WACrD,CAAE,IAAA;AACF,UAAA,QAAA,GAAW,CAAC,YAAY,WAAW,CAAA;AAAA,QACpC,SAAS,EAAA,EAAI;AACZ,UAAA,QAAA,GAAW,CAAC,YAAY,KAAK,CAAA;AAAA,QAC9B;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QACnB,IAAA,CAAK,OAAA,CAAQC,WAAA,EAAW,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAE,CAAA;AAAA;AAAA,QAC3D,IAAA,CAAK,OAAA,CAAQA,WAAA,EAAW,CAAA,sBAAA,EAAyB,SAAS,CAAA,CAAE;AAAA;AAAA,OAC7D;AAEA,MAAA,MAAM,cAAA,GACL,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAS,cAAW,CAAC,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA;AAE3D,MAAA,aAAA,CAAa,YAAA,GAAe,IAAI,OAAA,CAAQ;AAAA,QACvC,QAAA,EAAU,cAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY,CAAA;AAAA;AAAA,QACZ,WAAA,EAAa,GAAA;AAAA,QACb;AAAA,OACA,CAAA;AAGD,MAAA,aAAA,CAAa,YAAA,CAAa,IAAI,EAAE,MAAA,EAAQ,UAAU,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAClE,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,CAAA,sDAAA,EAAyD,IAAI,OAAO,CAAA;AAAA,SACrE;AAAA,MACD,CAAC,CAAA;AAAA,IACF;AACA,IAAA,OAAO,aAAA,CAAa,YAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAa,eAAA,CACZ,YAAA,EACA,gBAAA,EACA,SAAA,EACA,eACA,cAAA,EACmB;AACnB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAC9D,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI;AAAA,MAC7B,MAAA,EAAQ,gBAAA;AAAA,MACR,YAAA,EAAc,IAAI,UAAA,CAAW,YAAY,CAAA;AAAA,MACzC,gBAAA;AAAA,MACA,SAAA,EAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AAAA,MACnC,aAAA,EAAe,aAAA,GAAgB,IAAI,UAAA,CAAW,aAAa,CAAA,GAAI,MAAA;AAAA,MAC/D;AAAA,KACA,CAAA;AACD,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAEvC,IAAA,IAAI;AACH,MAAA,wBAAA,CAAyB,OAAA;AAAA,QACxB,EAAE,MAAA,EAAQ,MAAA,CAAO,QAAA,GAAW,aAAa,QAAA,EAAS;AAAA,QAClD;AAAA,OACD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,OAAO,QAAA,EAAU;AACpB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,qBACZ,iBAAA,EACmB;AACnB,IAAA,IAAI,iBAAA,CAAkB,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE3C,IAAA,IAAI;AAKH,MAAA,GAAA,CAAI,KAAK,yDAAyD,CAAA;AAClE,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,GAAA,EAAK;AACb,MAAA,GAAA,CAAI,KAAA,CAAM,2CAA2C,GAAG,CAAA;AACxD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,YAAA,EAA8B;AAClD,IAAA,OAAO,uBAAuB,YAAY,CAAA;AAAA,EAC3C;AACD","file":"chunk-2STZHJ24.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Piscina } from \"piscina\";\nimport { zkVerificationDurationMs } from \"../observability/metrics.js\";\nimport { log } from \"../utils/logger.js\";\nimport { deriveLogicImageDigest } from \"./logic-image-id.js\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\n/**\n * LIOP Tier-0 Industrial Verifier\n *\n * This engine is responsible for the trustless verification of remote logic execution.\n * It validates both the integrity of the code (ZkImageID) and the mathematical proof\n * of its execution (ZkSeal), as well as hardware-level attestation (TEE).\n */\nexport class LiopVerifier {\n\t// Singleton Worker Pool for heavy ZK verification\n\tprivate static zkWorkerPool: Piscina | null = null;\n\n\tprivate getZkPool() {\n\t\tif (!LiopVerifier.zkWorkerPool) {\n\t\t\tconst isTS = import.meta.url.endsWith(\".ts\");\n\t\t\tconst workerExt = isTS ? \".ts\" : \".js\";\n\n\t\t\tlet execArgv: string[] = [];\n\t\t\tif (isTS) {\n\t\t\t\ttry {\n\t\t\t\t\tconst req = createRequire(import.meta.url);\n\t\t\t\t\tconst tsxPkg = req.resolve(\"tsx/package.json\");\n\t\t\t\t\tconst absoluteTsx = pathToFileURL(\n\t\t\t\t\t\tpath.join(path.dirname(tsxPkg), \"dist\", \"loader.mjs\"),\n\t\t\t\t\t).href;\n\t\t\t\t\texecArgv = [\"--import\", absoluteTsx];\n\t\t\t\t} catch (_e) {\n\t\t\t\t\texecArgv = [\"--import\", \"tsx\"];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Support both flat dist/ and original src/ structure\n\t\t\tconst workerPaths = [\n\t\t\t\tpath.resolve(__dirname, `./workers/zk-verifier${workerExt}`), // Flat dist/ (tsup)\n\t\t\t\tpath.resolve(__dirname, `../workers/zk-verifier${workerExt}`), // Original src/\n\t\t\t];\n\n\t\t\tconst workerFilename =\n\t\t\t\tworkerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];\n\n\t\t\tLiopVerifier.zkWorkerPool = new Piscina({\n\t\t\t\tfilename: workerFilename,\n\t\t\t\tminThreads: 1,\n\t\t\t\tmaxThreads: 2, // Minimal footprint since verification is fast compared to generation\n\t\t\t\tidleTimeout: 30000,\n\t\t\t\texecArgv,\n\t\t\t});\n\n\t\t\t// Pre-warm the verification worker\n\t\t\tLiopVerifier.zkWorkerPool.run({ action: \"warmup\" }).catch((err) => {\n\t\t\t\tlog.debug(\n\t\t\t\t\t`[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`,\n\t\t\t\t);\n\t\t\t});\n\t\t}\n\t\treturn LiopVerifier.zkWorkerPool;\n\t}\n\n\t/**\n\t * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.\n\t *\n\t * @param logicPayload The raw WASM or JS logic that was sent to the provider.\n\t * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).\n\t * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM.\n\t */\n\tpublic async verifyZkReceipt(\n\t\tlogicPayload: Buffer,\n\t\tremoteImageIdHex: string,\n\t\tzkReceipt: Buffer,\n\t\tsessionSecret?: Buffer,\n\t\texpectedOutput?: unknown,\n\t): Promise<boolean> {\n\t\tconst pool = this.getZkPool();\n\t\tif (!pool) throw new Error(\"Worker pool initialization failed\");\n\t\tconst startTime = performance.now();\n\t\tconst result = await pool.run({\n\t\t\taction: \"verify_receipt\",\n\t\t\tlogicPayload: new Uint8Array(logicPayload),\n\t\t\tremoteImageIdHex,\n\t\t\tzkReceipt: new Uint8Array(zkReceipt),\n\t\t\tsessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : undefined,\n\t\t\texpectedOutput,\n\t\t});\n\t\tconst durationMs = performance.now() - startTime;\n\n\t\ttry {\n\t\t\tzkVerificationDurationMs.observe(\n\t\t\t\t{ status: result.verified ? \"verified\" : \"failed\" },\n\t\t\t\tdurationMs,\n\t\t\t);\n\t\t} catch {\n\t\t\t// Metrics observation failure must never disrupt cryptographic verification\n\t\t}\n\n\t\tif (result.verified) {\n\t\t\tlog.info(`[LiopVerifier] ${result.message}`);\n\t\t\treturn true;\n\t\t}\n\n\t\tlog.error(`[LiopVerifier] FAILED: ${result.message}`);\n\t\treturn false;\n\t}\n\n\t/**\n\t * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).\n\t *\n\t * @param attestationReport The COSE-signed attestation document from the hardware.\n\t */\n\tpublic async verifyTeeAttestation(\n\t\tattestationReport: Buffer,\n\t): Promise<boolean> {\n\t\tif (attestationReport.length === 0) return true; // Optional in Mesh Alpha\n\n\t\ttry {\n\t\t\t// Architecture for AWS Nitro Enclaves:\n\t\t\t// 1. Decode CBOR/COSE\n\t\t\t// 2. Verify Signature against AWS Nitro Root CA\n\t\t\t// 3. Compare PCRs\n\t\t\tlog.info(\"[LiopVerifier] TEE Attestation: Not configured (no-op).\");\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tlog.error(\"[LiopVerifier] TEE Verification Failed:\", err);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Derives the ImageID of a logic payload following the LIOP v1 Standard.\n\t */\n\tpublic deriveImageId(logicPayload: Buffer): Buffer {\n\t\treturn deriveLogicImageDigest(logicPayload);\n\t}\n}\n"]}

package/dist/{chunk-VRZ3UIYA.js → chunk-3QH44NKZ.js}

@@ -1,4 +1,4 @@
-import { log } from './chunk-LIBI3HMN.js';
+import { log } from './chunk-K3DGJLUY.js';
 
 // src/runtime/token-manager.ts
 var TokenManager = class _TokenManager {
@@ -111,5 +111,5 @@ var TokenManager = class _TokenManager {
 };
 
 export { TokenManager };
-//# sourceMappingURL=chunk-VRZ3UIYA.js.map
-//# sourceMappingURL=chunk-VRZ3UIYA.js.map
+//# sourceMappingURL=chunk-3QH44NKZ.js.map
+//# sourceMappingURL=chunk-3QH44NKZ.js.map

package/dist/{chunk-VRZ3UIYA.js.map → chunk-3QH44NKZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/runtime/token-manager.ts"],"names":[],"mappings":";;;AAwBO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,WAAA,GAA6B,IAAA;AAAA,EAC7B,SAAA,GAAY,CAAA;AAAA;AAAA,EACZ,cAAA,GAAyC,IAAA;AAAA,EAEhC,aAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACT,WAAA;AAAA;AAAA,EAGR,OAAwB,iBAAA,GAAoB,GAAA;AAAA,EAE5C,YAAY,OAAA,EAA8B;AACzC,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACpC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,GACtC,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GACtB,OAAA,CAAQ,MAAA,IACV,sFAAA;AACF,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,QAAA,GAA4B;AACxC,IAAA,IAAI,KAAK,WAAA,EAAa;AACrB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IACC,KAAK,WAAA,IACL,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,cAAa,iBAAA,EACnC;AACD,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACxB,MAAA,OAAO,IAAA,CAAK,cAAA;AAAA,IACb;AAEA,IAAA,IAAA,CAAK,kBAAkB,YAAY;AAClC,MAAA,IAAI;AACH,QAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AACvC,QAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,QAAA,OAAO,KAAA;AAAA,MACR,CAAA,SAAE;AACD,QAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,MACvB;AAAA,IACD,CAAA,GAAG;AAEH,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,UAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,YAAA,EAAc;AACvC,MAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAAA,IACpB;AACA,IAAA,GAAA,CAAI,KAAK,uDAAuD,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKO,SAAA,GAAqB;AAC3B,IAAA,IAAI,IAAA,CAAK,aAAa,OAAO,KAAA;AAC7B,IAAA,OACC,CAAC,KAAK,WAAA,IACN,IAAA,CAAK,KAAI,IAAK,IAAA,CAAK,YAAY,aAAA,CAAa,iBAAA;AAAA,EAE9C;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACb;AAAA,EAEA,MAAc,aAAA,GAAiC;AAC9C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yCAAA,EAA4C,IAAA,CAAK,aAAa,CAAA,aAAA,EAAgB,KAAK,QAAQ,CAAA,IAAA;AAAA,KAC5F;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAClC,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,IAAA,CAAK,QAAA;AAAA,MAChB,eAAe,IAAA,CAAK,YAAA;AAAA,MACpB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,OAAO,IAAA,CAAK;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACR,cAAA,EAAgB,mCAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACT;AAAA,MACA,IAAA,EAAM,OAAO,QAAA,EAAS;AAAA,MACtB,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AACjB,MAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,IAAA,EAAK;AACtC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,iCAAA,EAAoC,QAAA,CAAS,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAMlC,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,eACL,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,IAAA;AACzD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,YAAA,GAAe,GAAA;AAE7C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iEAAiE,YAAY,CAAA,EAAA;AAAA,KAC9E;AAEA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACb;AACD","file":"chunk-VRZ3UIYA.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Token Manager — Adaptive OAuth 2.1 M2M Token Lifecycle\n *\n * Implements resilient token caching with preemptive refresh (30s safety buffer),\n * concurrency de-duplication (single in-flight HTTP request), and on-demand\n * invalidation for 401 Unauthorized handling.\n *\n * Standards: RFC 6749, RFC 8707 (Resource Indicators), RFC 9068 (JWT Profile)\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface TokenManagerOptions {\n\ttokenEndpoint: string;\n\tclientId: string;\n\tclientSecret: string;\n\taudience?: string;\n\tscopes?: string | string[];\n\tstaticToken?: string;\n}\n\nexport class TokenManager {\n\tprivate cachedToken: string | null = null;\n\tprivate expiresAt = 0; // Epoch ms\n\tprivate pendingPromise: Promise<string> | null = null;\n\n\tprivate readonly tokenEndpoint: string;\n\tprivate readonly clientId: string;\n\tprivate readonly clientSecret: string;\n\tprivate readonly audience: string;\n\tprivate readonly scope: string;\n\tprivate staticToken?: string;\n\n\t// Preemptive refresh threshold: 30 seconds before expiration\n\tprivate static readonly REFRESH_BUFFER_MS = 30_000;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.tokenEndpoint = options.tokenEndpoint;\n\t\tthis.clientId = options.clientId;\n\t\tthis.clientSecret = options.clientSecret;\n\t\tthis.audience = options.audience ?? \"urn:liop:mesh:api\";\n\t\tthis.scope = Array.isArray(options.scopes)\n\t\t\t? options.scopes.join(\" \")\n\t\t\t: (options.scopes ??\n\t\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\");\n\t\tthis.staticToken = options.staticToken;\n\t}\n\n\t/**\n\t * Returns a valid OAuth 2.1 access token.\n\t * Automatically performs preemptive refresh if the token is close to expiry.\n\t */\n\tpublic async getToken(): Promise<string> {\n\t\tif (this.staticToken) {\n\t\t\treturn this.staticToken;\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tif (\n\t\t\tthis.cachedToken &&\n\t\t\tnow < this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t) {\n\t\t\treturn this.cachedToken;\n\t\t}\n\n\t\tif (this.pendingPromise) {\n\t\t\treturn this.pendingPromise;\n\t\t}\n\n\t\tthis.pendingPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tconst token = await this.fetchNewToken();\n\t\t\t\tthis.cachedToken = token;\n\t\t\t\treturn token;\n\t\t\t} finally {\n\t\t\t\tthis.pendingPromise = null;\n\t\t\t}\n\t\t})();\n\n\t\treturn this.pendingPromise;\n\t}\n\n\t/**\n\t * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.\n\t */\n\tpublic invalidate(): void {\n\t\tthis.cachedToken = null;\n\t\tthis.expiresAt = 0;\n\t\tif (this.clientId && this.clientSecret) {\n\t\t\tthis.staticToken = undefined;\n\t\t}\n\t\tlog.info(\"[TokenManager] Cached OAuth access token invalidated.\");\n\t}\n\n\t/**\n\t * Returns true if the token is absent or has passed the refresh threshold.\n\t */\n\tpublic isExpired(): boolean {\n\t\tif (this.staticToken) return false;\n\t\treturn (\n\t\t\t!this.cachedToken ||\n\t\t\tDate.now() >= this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t);\n\t}\n\n\tpublic getExpiresAt(): number {\n\t\treturn this.expiresAt;\n\t}\n\n\tprivate async fetchNewToken(): Promise<string> {\n\t\tlog.info(\n\t\t\t`[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`,\n\t\t);\n\n\t\tconst params = new URLSearchParams({\n\t\t\tgrant_type: \"client_credentials\",\n\t\t\tclient_id: this.clientId,\n\t\t\tclient_secret: this.clientSecret,\n\t\t\tresource: this.audience,\n\t\t\tscope: this.scope,\n\t\t});\n\n\t\tconst response = await fetch(this.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\tAccept: \"application/json\",\n\t\t\t},\n\t\t\tbody: params.toString(),\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst errorText = await response.text();\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth token request failed [HTTP ${response.status}]: ${errorText}`,\n\t\t\t);\n\t\t}\n\n\t\tconst data = (await response.json()) as {\n\t\t\taccess_token?: string;\n\t\t\texpires_in?: number;\n\t\t\ttoken_type?: string;\n\t\t};\n\n\t\tif (!data.access_token) {\n\t\t\tthrow new Error(\n\t\t\t\t\"OAuth token response did not contain an 'access_token' field.\",\n\t\t\t);\n\t\t}\n\n\t\tconst expiresInSec =\n\t\t\ttypeof data.expires_in === \"number\" ? data.expires_in : 3600;\n\t\tthis.expiresAt = Date.now() + expiresInSec * 1000;\n\n\t\tlog.info(\n\t\t\t`[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`,\n\t\t);\n\n\t\treturn data.access_token;\n\t}\n}\n"]}
+{"version":3,"sources":["../src/runtime/token-manager.ts"],"names":[],"mappings":";;;AAwBO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,WAAA,GAA6B,IAAA;AAAA,EAC7B,SAAA,GAAY,CAAA;AAAA;AAAA,EACZ,cAAA,GAAyC,IAAA;AAAA,EAEhC,aAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACT,WAAA;AAAA;AAAA,EAGR,OAAwB,iBAAA,GAAoB,GAAA;AAAA,EAE5C,YAAY,OAAA,EAA8B;AACzC,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACpC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,GACtC,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GACtB,OAAA,CAAQ,MAAA,IACV,sFAAA;AACF,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,QAAA,GAA4B;AACxC,IAAA,IAAI,KAAK,WAAA,EAAa;AACrB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IACC,KAAK,WAAA,IACL,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,cAAa,iBAAA,EACnC;AACD,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACxB,MAAA,OAAO,IAAA,CAAK,cAAA;AAAA,IACb;AAEA,IAAA,IAAA,CAAK,kBAAkB,YAAY;AAClC,MAAA,IAAI;AACH,QAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AACvC,QAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,QAAA,OAAO,KAAA;AAAA,MACR,CAAA,SAAE;AACD,QAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,MACvB;AAAA,IACD,CAAA,GAAG;AAEH,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,UAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,YAAA,EAAc;AACvC,MAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAAA,IACpB;AACA,IAAA,GAAA,CAAI,KAAK,uDAAuD,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKO,SAAA,GAAqB;AAC3B,IAAA,IAAI,IAAA,CAAK,aAAa,OAAO,KAAA;AAC7B,IAAA,OACC,CAAC,KAAK,WAAA,IACN,IAAA,CAAK,KAAI,IAAK,IAAA,CAAK,YAAY,aAAA,CAAa,iBAAA;AAAA,EAE9C;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACb;AAAA,EAEA,MAAc,aAAA,GAAiC;AAC9C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yCAAA,EAA4C,IAAA,CAAK,aAAa,CAAA,aAAA,EAAgB,KAAK,QAAQ,CAAA,IAAA;AAAA,KAC5F;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAClC,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,IAAA,CAAK,QAAA;AAAA,MAChB,eAAe,IAAA,CAAK,YAAA;AAAA,MACpB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,OAAO,IAAA,CAAK;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACR,cAAA,EAAgB,mCAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACT;AAAA,MACA,IAAA,EAAM,OAAO,QAAA,EAAS;AAAA,MACtB,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AACjB,MAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,IAAA,EAAK;AACtC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,iCAAA,EAAoC,QAAA,CAAS,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAMlC,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,eACL,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,IAAA;AACzD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,YAAA,GAAe,GAAA;AAE7C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iEAAiE,YAAY,CAAA,EAAA;AAAA,KAC9E;AAEA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACb;AACD","file":"chunk-3QH44NKZ.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Token Manager — Adaptive OAuth 2.1 M2M Token Lifecycle\n *\n * Implements resilient token caching with preemptive refresh (30s safety buffer),\n * concurrency de-duplication (single in-flight HTTP request), and on-demand\n * invalidation for 401 Unauthorized handling.\n *\n * Standards: RFC 6749, RFC 8707 (Resource Indicators), RFC 9068 (JWT Profile)\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface TokenManagerOptions {\n\ttokenEndpoint: string;\n\tclientId: string;\n\tclientSecret: string;\n\taudience?: string;\n\tscopes?: string | string[];\n\tstaticToken?: string;\n}\n\nexport class TokenManager {\n\tprivate cachedToken: string | null = null;\n\tprivate expiresAt = 0; // Epoch ms\n\tprivate pendingPromise: Promise<string> | null = null;\n\n\tprivate readonly tokenEndpoint: string;\n\tprivate readonly clientId: string;\n\tprivate readonly clientSecret: string;\n\tprivate readonly audience: string;\n\tprivate readonly scope: string;\n\tprivate staticToken?: string;\n\n\t// Preemptive refresh threshold: 30 seconds before expiration\n\tprivate static readonly REFRESH_BUFFER_MS = 30_000;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.tokenEndpoint = options.tokenEndpoint;\n\t\tthis.clientId = options.clientId;\n\t\tthis.clientSecret = options.clientSecret;\n\t\tthis.audience = options.audience ?? \"urn:liop:mesh:api\";\n\t\tthis.scope = Array.isArray(options.scopes)\n\t\t\t? options.scopes.join(\" \")\n\t\t\t: (options.scopes ??\n\t\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\");\n\t\tthis.staticToken = options.staticToken;\n\t}\n\n\t/**\n\t * Returns a valid OAuth 2.1 access token.\n\t * Automatically performs preemptive refresh if the token is close to expiry.\n\t */\n\tpublic async getToken(): Promise<string> {\n\t\tif (this.staticToken) {\n\t\t\treturn this.staticToken;\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tif (\n\t\t\tthis.cachedToken &&\n\t\t\tnow < this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t) {\n\t\t\treturn this.cachedToken;\n\t\t}\n\n\t\tif (this.pendingPromise) {\n\t\t\treturn this.pendingPromise;\n\t\t}\n\n\t\tthis.pendingPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tconst token = await this.fetchNewToken();\n\t\t\t\tthis.cachedToken = token;\n\t\t\t\treturn token;\n\t\t\t} finally {\n\t\t\t\tthis.pendingPromise = null;\n\t\t\t}\n\t\t})();\n\n\t\treturn this.pendingPromise;\n\t}\n\n\t/**\n\t * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.\n\t */\n\tpublic invalidate(): void {\n\t\tthis.cachedToken = null;\n\t\tthis.expiresAt = 0;\n\t\tif (this.clientId && this.clientSecret) {\n\t\t\tthis.staticToken = undefined;\n\t\t}\n\t\tlog.info(\"[TokenManager] Cached OAuth access token invalidated.\");\n\t}\n\n\t/**\n\t * Returns true if the token is absent or has passed the refresh threshold.\n\t */\n\tpublic isExpired(): boolean {\n\t\tif (this.staticToken) return false;\n\t\treturn (\n\t\t\t!this.cachedToken ||\n\t\t\tDate.now() >= this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t);\n\t}\n\n\tpublic getExpiresAt(): number {\n\t\treturn this.expiresAt;\n\t}\n\n\tprivate async fetchNewToken(): Promise<string> {\n\t\tlog.info(\n\t\t\t`[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`,\n\t\t);\n\n\t\tconst params = new URLSearchParams({\n\t\t\tgrant_type: \"client_credentials\",\n\t\t\tclient_id: this.clientId,\n\t\t\tclient_secret: this.clientSecret,\n\t\t\tresource: this.audience,\n\t\t\tscope: this.scope,\n\t\t});\n\n\t\tconst response = await fetch(this.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\tAccept: \"application/json\",\n\t\t\t},\n\t\t\tbody: params.toString(),\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst errorText = await response.text();\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth token request failed [HTTP ${response.status}]: ${errorText}`,\n\t\t\t);\n\t\t}\n\n\t\tconst data = (await response.json()) as {\n\t\t\taccess_token?: string;\n\t\t\texpires_in?: number;\n\t\t\ttoken_type?: string;\n\t\t};\n\n\t\tif (!data.access_token) {\n\t\t\tthrow new Error(\n\t\t\t\t\"OAuth token response did not contain an 'access_token' field.\",\n\t\t\t);\n\t\t}\n\n\t\tconst expiresInSec =\n\t\t\ttypeof data.expires_in === \"number\" ? data.expires_in : 3600;\n\t\tthis.expiresAt = Date.now() + expiresInSec * 1000;\n\n\t\tlog.info(\n\t\t\t`[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`,\n\t\t);\n\n\t\treturn data.access_token;\n\t}\n}\n"]}

package/dist/{chunk-COISHJK5.js → chunk-3UBNOYMH.js}

@@ -1,4 +1,4 @@
-import { log } from './chunk-LIBI3HMN.js';
+import { log } from './chunk-K3DGJLUY.js';
 import * as fs from 'fs';
 import * as grpc from '@grpc/grpc-js';
 import path from 'path';
@@ -174,5 +174,5 @@ var liopProto = grpc.loadPackageDefinition(packageDefinition);
 var liopV1 = liopProto.liop.v1;
 
 export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials, liopV1 };
-//# sourceMappingURL=chunk-COISHJK5.js.map
-//# sourceMappingURL=chunk-COISHJK5.js.map
+//# sourceMappingURL=chunk-3UBNOYMH.js.map
+//# sourceMappingURL=chunk-3UBNOYMH.js.map

package/dist/{chunk-COISHJK5.js.map → chunk-3UBNOYMH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/rpc/tls.ts","../src/rpc/channel-options.ts","../src/rpc/proto.ts"],"names":["__filename","__dirname","fs2","grpc2"],"mappings":";;;;;;;AAgDA,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAElC,IAAM,sBAAA,GAAyB,CAAC,GAAA,KAC/B,GAAA,EAAK,QAAA,KAAa,IAAA,IAClB,GAAA,EAAK,eAAA,KAAoB,IAAA,IACzB,OAAA,CAAQ,GAAA,CAAI,yBAAA,KAA8B,MAAA;AAE3C,IAAI,uBAAA,GAA0B,KAAA;AAC9B,IAAI,wBAAA,GAA2B,KAAA;AAOxB,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,uBAAA,EAAyB;AAC7D,MAAA,uBAAA,GAA0B,IAAA;AAC1B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,wBAAA,EAA0B;AAC9D,MAAA,wBAAA,GAA2B,IAAA;AAC3B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AACD;;;AClNO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,2BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK","file":"chunk-COISHJK5.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n\t/**\n\t * Explicitly permit unencrypted (insecure) credentials for local development,\n\t * Docker testbeds, or tooling harnesses without emitting console warnings.\n\t * Ignored if isTlsEnforced() is true (production/enforced mode always throws).\n\t */\n\tinsecure?: boolean;\n\t/**\n\t * Explicitly suppress the fallback warning when insecure credentials are created.\n\t */\n\tsuppressWarning?: boolean;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\nconst isTlsWarningSuppressed = (tls?: LiopTlsOptions) =>\n\ttls?.insecure === true ||\n\ttls?.suppressWarning === true ||\n\tprocess.env.LIOP_SUPPRESS_TLS_WARNING === \"true\";\n\nlet hasWarnedInsecureServer = false;\nlet hasWarnedInsecureChannel = false;\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {\n\t\t\thasWarnedInsecureServer = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {\n\t\t\thasWarnedInsecureChannel = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n"]}
+{"version":3,"sources":["../src/rpc/tls.ts","../src/rpc/channel-options.ts","../src/rpc/proto.ts"],"names":["__filename","__dirname","fs2","grpc2"],"mappings":";;;;;;;AAgDA,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAElC,IAAM,sBAAA,GAAyB,CAAC,GAAA,KAC/B,GAAA,EAAK,QAAA,KAAa,IAAA,IAClB,GAAA,EAAK,eAAA,KAAoB,IAAA,IACzB,OAAA,CAAQ,GAAA,CAAI,yBAAA,KAA8B,MAAA;AAE3C,IAAI,uBAAA,GAA0B,KAAA;AAC9B,IAAI,wBAAA,GAA2B,KAAA;AAOxB,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,uBAAA,EAAyB;AAC7D,MAAA,uBAAA,GAA0B,IAAA;AAC1B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,wBAAA,EAA0B;AAC9D,MAAA,wBAAA,GAA2B,IAAA;AAC3B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AACD;;;AClNO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,2BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK","file":"chunk-3UBNOYMH.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n\t/**\n\t * Explicitly permit unencrypted (insecure) credentials for local development,\n\t * Docker testbeds, or tooling harnesses without emitting console warnings.\n\t * Ignored if isTlsEnforced() is true (production/enforced mode always throws).\n\t */\n\tinsecure?: boolean;\n\t/**\n\t * Explicitly suppress the fallback warning when insecure credentials are created.\n\t */\n\tsuppressWarning?: boolean;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\nconst isTlsWarningSuppressed = (tls?: LiopTlsOptions) =>\n\ttls?.insecure === true ||\n\ttls?.suppressWarning === true ||\n\tprocess.env.LIOP_SUPPRESS_TLS_WARNING === \"true\";\n\nlet hasWarnedInsecureServer = false;\nlet hasWarnedInsecureChannel = false;\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {\n\t\t\thasWarnedInsecureServer = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {\n\t\t\thasWarnedInsecureChannel = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n"]}

package/dist/{chunk-JPN5456V.js → chunk-FPL5ZKW5.js}

@@ -1,11 +1,11 @@
-import { TokenTelemetryEngine } from './chunk-UAUBVKMK.js';
-import { LiopVerifier } from './chunk-RWBFGRF7.js';
+import { TokenTelemetryEngine } from './chunk-H2SNR7PB.js';
+import { LiopVerifier } from './chunk-2STZHJ24.js';
 import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
 import { authorizeRequest, Dilithium65Wrapper } from './chunk-VH4K4U45.js';
-import { liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-COISHJK5.js';
+import { liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-3UBNOYMH.js';
 import { toolCallErrorsTotal, pqcHandshakeDurationMs, pqcHandshakesTotal, zkVerificationsTotal, wireEgressBytesTotal } from './chunk-PAICJCKJ.js';
 import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, adaptResponseForLegacyClient, MCP_PROTOCOL_VERSION_LEGACY, buildLegacyInitializeResponse } from './chunk-2KSO3W4A.js';
-import { log } from './chunk-LIBI3HMN.js';
+import { log } from './chunk-K3DGJLUY.js';
 import * as crypto from 'crypto';
 import * as grpc from '@grpc/grpc-js';
 
@@ -1473,5 +1473,5 @@ ${cachedToolList}` : "\nNo remote tools discovered yet.",
 };
 
 export { LiopMcpRouter };
-//# sourceMappingURL=chunk-JPN5456V.js.map
-//# sourceMappingURL=chunk-JPN5456V.js.map
+//# sourceMappingURL=chunk-FPL5ZKW5.js.map
+//# sourceMappingURL=chunk-FPL5ZKW5.js.map