@nekzus/liop 2.4.0-alpha.18 → 2.4.0-alpha.19

package/dist/{chunk-H2SNR7PB.js → chunk-UJFWPRDM.js}

@@ -1,5 +1,10 @@
 import { tokensInputTotal, tokensOutputTotal, tokensSavedTotal, operationDurationMs } from './chunk-PAICJCKJ.js';
 import { log } from './chunk-K3DGJLUY.js';
+import * as fs from 'fs';
+import * as grpc from '@grpc/grpc-js';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import * as protoLoader from '@grpc/proto-loader';
 
 // ../../node_modules/.pnpm/gpt-tokenizer@4.0.0/node_modules/gpt-tokenizer/esm/constants.js
 var DEFAULT_MERGE_CACHE_SIZE = 1e5;
@@ -206706,7 +206711,174 @@ var TokenTelemetryEngine = class _TokenTelemetryEngine {
     _TokenTelemetryEngine.instance = null;
   }
 };
+var isTlsEnforced = () => process.env.NODE_ENV === "production" || process.env.LIOP_ENFORCE_TLS === "true";
+var isTlsWarningSuppressed = (tls) => tls?.insecure === true || tls?.suppressWarning === true || process.env.LIOP_SUPPRESS_TLS_WARNING === "true";
+var hasWarnedInsecureServer = false;
+var hasWarnedInsecureChannel = false;
+function createServerCredentials(tls) {
+  if (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {
+    throw new Error(
+      "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
+    );
+  }
+  if (tls?.certManager) {
+    try {
+      const certChain = tls.certManager.getCertChain();
+      const privateKey = tls.certManager.getPrivateKey();
+      const rootCert = tls.certManager.getRootCert();
+      if (tls.mutualTls && !rootCert) {
+        throw new Error(
+          "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded."
+        );
+      }
+      return grpc.ServerCredentials.createSsl(
+        rootCert,
+        [{ cert_chain: certChain, private_key: privateKey }],
+        Boolean(tls.mutualTls)
+      );
+    } catch (error) {
+      if (isTlsEnforced()) {
+        throw new Error(
+          `[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`
+        );
+      }
+      log.warn(
+        `[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`
+      );
+      return grpc.ServerCredentials.createInsecure();
+    }
+  }
+  if (!tls?.certChain || !tls?.privateKey) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true."
+      );
+    }
+    if (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {
+      hasWarnedInsecureServer = true;
+      log.debug(
+        "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
+      );
+    }
+    return grpc.ServerCredentials.createInsecure();
+  }
+  try {
+    const rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;
+    const certChain = fs.readFileSync(tls.certChain);
+    const privateKey = fs.readFileSync(tls.privateKey);
+    if (tls.mutualTls && !rootCert) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
+      );
+    }
+    return grpc.ServerCredentials.createSsl(
+      rootCert,
+      [{ cert_chain: certChain, private_key: privateKey }],
+      Boolean(tls.mutualTls)
+    );
+  } catch (error) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc.ServerCredentials.createInsecure();
+  }
+}
+function createChannelCredentials(tls) {
+  if (tls?.certManager) {
+    try {
+      const rootCert = tls.certManager.getRootCert();
+      if (!rootCert) {
+        throw new Error(
+          "[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager."
+        );
+      }
+      const certChain = tls.certManager.getCertChain();
+      const privateKey = tls.certManager.getPrivateKey();
+      return grpc.credentials.createSsl(rootCert, privateKey, certChain);
+    } catch (error) {
+      if (isTlsEnforced()) {
+        throw new Error(
+          `[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`
+        );
+      }
+      log.warn(
+        `[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`
+      );
+      return grpc.credentials.createInsecure();
+    }
+  }
+  if (!tls?.rootCert) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true."
+      );
+    }
+    if (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {
+      hasWarnedInsecureChannel = true;
+      log.debug(
+        "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
+      );
+    }
+    return grpc.credentials.createInsecure();
+  }
+  try {
+    const rootCert = fs.readFileSync(tls.rootCert);
+    const certChain = tls.certChain ? fs.readFileSync(tls.certChain) : void 0;
+    const privateKey = tls.privateKey ? fs.readFileSync(tls.privateKey) : void 0;
+    return grpc.credentials.createSsl(rootCert, privateKey, certChain);
+  } catch (error) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc.credentials.createInsecure();
+  }
+}
+
+// src/rpc/channel-options.ts
+var GRPC_CHANNEL_OPTIONS = {
+  "grpc.keepalive_time_ms": 3e4,
+  "grpc.keepalive_timeout_ms": 1e4,
+  "grpc.keepalive_permit_without_calls": 1,
+  "grpc.max_send_message_length": -1,
+  "grpc.max_receive_message_length": -1,
+  "grpc.enable_retries": 1
+};
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = path.dirname(__filename2);
+var PROD_PATHS = [
+  path.resolve(__dirname2, "./protocol/liop_core.proto"),
+  // Flat dist/ (tsup)
+  path.resolve(__dirname2, "../protocol/liop_core.proto")
+  // dist/rpc/ (tsc)
+];
+var DEV_PROTO_PATH = path.resolve(
+  __dirname2,
+  "../../../../protocol/proto/liop_core.proto"
+);
+var PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;
+if (!fs.existsSync(PROTO_PATH)) {
+  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
+}
+var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
+  keepCase: true,
+  longs: String,
+  enums: String,
+  defaults: true,
+  oneofs: true
+});
+var liopProto = grpc.loadPackageDefinition(packageDefinition);
+var liopV1 = liopProto.liop.v1;
 
-export { HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator };
-//# sourceMappingURL=chunk-H2SNR7PB.js.map
-//# sourceMappingURL=chunk-H2SNR7PB.js.map
+export { GRPC_CHANNEL_OPTIONS, HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createChannelCredentials, createServerCredentials, createSyncTokenEstimator, createTokenEstimator, liopV1 };
+//# sourceMappingURL=chunk-UJFWPRDM.js.map
+//# sourceMappingURL=chunk-UJFWPRDM.js.map