@nekzus/liop 2.4.0-alpha.18 → 2.4.0-alpha.19

package/dist/gateway.js

@@ -1,11 +1,10 @@
-export { LiopHybridGateway } from './chunk-OBFNAQAU.js';
-import './chunk-TBEZMRDI.js';
-import './chunk-H2SNR7PB.js';
+export { LiopHybridGateway } from './chunk-EJ426URA.js';
+import './chunk-VRB5HUYU.js';
 import './chunk-2STZHJ24.js';
 import './chunk-IK7CGWAZ.js';
 import './chunk-7PITYWOV.js';
 import './chunk-WPTOJYN5.js';
-import './chunk-3UBNOYMH.js';
+import './chunk-UJFWPRDM.js';
 import './chunk-PAICJCKJ.js';
 import './chunk-2KSO3W4A.js';
 import './chunk-K3DGJLUY.js';

package/dist/{hybrid-jxpMTiMn.d.ts → hybrid-DWe1bMoV.d.ts}

@@ -1,5 +1,5 @@
 import { a as MeshNode } from './node-B0b2vUFS.js';
-import { L as LiopServer } from './index-KQfBZcaH.js';
+import { L as LiopServer } from './index-CdW8j8Bn.js';
 import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-CzRSOlOo.js';
 import { L as LiopVerifier } from './verifier-COnid_dg.js';
 

package/dist/{index-KQfBZcaH.d.ts → index-CdW8j8Bn.d.ts}

@@ -478,6 +478,10 @@ declare class LiopServer {
      * Injects data into the secure sandbox context for Logic-on-Origin tools.
      */
     setSandboxData(records: Record<string, unknown>[]): void;
+    /**
+     * Returns the read-only sandbox records registered in the enclave.
+     */
+    getSandboxData(): readonly Record<string, unknown>[];
     getBoundPort(): number | null;
     /**
      * Connects to the libp2p Kademlia DHT and announces capabilities.

package/dist/index.d.ts

@@ -2,13 +2,13 @@ export { LiopBridgeOptions, LiopMcpBridge, LiopStreamBridge, LiopStreamBridgeOpt
 import { L as LiopTlsOptions } from './index-BuEQtBHD.js';
 export { C as CertInfo, a as CertManager, b as CertManagerOptions, c as LiopClient, d as createChannelCredentials, e as createServerCredentials } from './index-BuEQtBHD.js';
 import * as http from 'node:http';
-export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-jxpMTiMn.js';
+export { I as InMemoryRateLimiter, L as LiopHybridGateway, a as LiopMcpRouter, R as RateLimitStatus, b as RateLimiterOptions } from './hybrid-DWe1bMoV.js';
 import { A as AuthInfo } from './types-CzRSOlOo.js';
 export { g as AuditEntry, h as AuditInterceptor, d as AuditLogger, i as AuditRecordParams, j as AuditStatus, k as CacheableResult, C as CallToolRequest, a as CallToolResult, D as DiscoverResult, l as GENESIS_HASH, m as GatewayAdmissionResult, n as GatewayInterceptor, o as GatewayInterceptorContext, G as GatewayInterceptorOptions, e as GetPromptRequest, f as GetPromptResult, I as InputRequest, p as InputRequiredResult, q as InputResponse, J as JwtValidator, L as LiopLogger, r as LogEvent, s as LogInterceptor, t as LogLevel, u as MCP_LEGACY_SUPPORT_ENABLED, v as MCP_PROTOCOL_VERSION, w as MCP_PROTOCOL_VERSION_LEGACY, M as McpEra, b as McpRequest, x as McpRequestMeta, c as McpResponse, P as Prompt, y as PromptSchema, R as Resource, z as ResourceSchema, S as ServerInfo, T as Tool, B as ToolSchema, E as computeEntryHash, F as executeGatewayInterceptor, H as globalAuditLogger, K as log } from './types-CzRSOlOo.js';
 export { L as LiopManifest, a as MeshNode, M as MeshNodeConfig } from './node-B0b2vUFS.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './mesh.js';
 import * as grpc from '@grpc/grpc-js';
-export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-KQfBZcaH.js';
+export { A as AUTH_DEFAULTS, b as AggregationPolicy, c as AuthRole, d as LiopAuthConfig, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, O as OAuthClientConfig, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-CdW8j8Bn.js';
 import * as jose from 'jose';
 import Provider from 'oidc-provider';
 import '@modelcontextprotocol/sdk/server/mcp.js';

package/dist/index.js

@@ -1,18 +1,17 @@
 export { WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment } from './chunk-7BSCUYUE.js';
-export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-Y6YXTITY.js';
-export { LiopMcpBridge, LiopStreamBridge } from './chunk-2HIUVRCS.js';
-export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest } from './chunk-OBFNAQAU.js';
+export { AesGcmWrapper, LiopClient, LiopRpcClient } from './chunk-FCFTYOAS.js';
+export { LiopMcpBridge, LiopStreamBridge } from './chunk-VRDZ5IKE.js';
+export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest } from './chunk-EJ426URA.js';
 export { RoutingTable, probeTopology } from './chunk-PUDETPL4.js';
 export { TokenManager } from './chunk-3QH44NKZ.js';
-export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-IEG6ZTTA.js';
+export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger } from './chunk-5SWHE62F.js';
 export { sanitizeOutput } from './chunk-Y62GORQF.js';
-export { LiopMcpRouter } from './chunk-TBEZMRDI.js';
-export { HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator } from './chunk-H2SNR7PB.js';
+export { LiopMcpRouter } from './chunk-VRB5HUYU.js';
 import './chunk-2STZHJ24.js';
 import './chunk-IK7CGWAZ.js';
 export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
 export { DILITHIUM65_CONSTANTS, Dilithium65Wrapper, LIOP_SCOPES, authorizeRequest } from './chunk-WPTOJYN5.js';
-export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials } from './chunk-3UBNOYMH.js';
+export { GRPC_CHANNEL_OPTIONS, HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createChannelCredentials, createServerCredentials, createSyncTokenEstimator, createTokenEstimator } from './chunk-UJFWPRDM.js';
 export { Counter, Gauge, Histogram, MetricsRegistry, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, operationDurationMs, pqcHandshakeDurationMs, pqcHandshakesTotal, protocolMetrics, tokensInputTotal, tokensOutputTotal, tokensSavedTotal, toolCallErrorsTotal, toolCallsTotal, wireEgressBytesTotal, wireSavedBytesTotal, zkVerificationDurationMs, zkVerificationsTotal } from './chunk-PAICJCKJ.js';
 export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema } from './chunk-2KSO3W4A.js';
 export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey } from './chunk-ZP3VVXOI.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/observability/tracing.ts","../src/prompts/adapters.ts","../src/security/cert-manager.ts"],"names":["ErrorCode","crypto2"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAGO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;ACQA,IAAM,iBAAA,GACL,6DAAA;AAEM,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAc,eAAA,GAA0B;AACvC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC3C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,cAAA,GAAyB;AACtC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC1C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,MAAA,EACA,UAAU,IAAA,EACD;AACT,IAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,GAAO,IAAA;AAC/B,IAAA,OAAO,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,EAAI,MAAM,IAAI,KAAK,CAAA,CAAA;AAAA,EACxC;AAAA,EAEA,OAAc,iBAAiB,MAAA,EAA4C;AAC1E,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,MAAA,OAAO,IAAA;AAAA,IACR;AACA,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,GAAG,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,GAAI,KAAA;AAE5C,IAAA,IAAI,YAAY,IAAA,EAAM;AACrB,MAAA,IAAI,OAAA,KAAY,IAAI,MAAA,CAAO,EAAE,KAAK,MAAA,KAAW,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AAC5D,QAAA,OAAO,IAAA;AAAA,MACR;AAAA,IACD;AAEA,IAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,IAAI,CAAA,MAAU,CAAA;AACxD,IAAA,OAAO;AAAA,MACN,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,OAAA,EACO;AACP,IAAA,OAAA,CAAQ,cAAc,WAAA,CAAW,iBAAA;AAAA,MAChC,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACT;AAAA,EACD;AAAA,EAEA,OAAc,mBACb,OAAA,EACqB;AACrB,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,WAAA,CAAW,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,WAAA,CAAW,iBAAiB,GAAG,CAAA;AAAA,EACvC;AAAA,EAEO,SAAA,CACN,IAAA,EACA,MAAA,EACA,UAAA,GAAwD,EAAC,EAC9C;AACX,IAAA,MAAM,OAAA,GAAU,MAAA,EAAQ,OAAA,IAAW,WAAA,CAAW,eAAA,EAAgB;AAC9D,IAAA,MAAM,MAAA,GAAS,YAAW,cAAA,EAAe;AACzC,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,MAAA,CAAO,OAAA,GAAU,IAAA;AAE1C,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC5B,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,MAAM,IAAA,GAAiB;AAAA,MACtB,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,MACpB,UAAA,EAAY,EAAE,GAAG,UAAA,EAAW;AAAA,MAC5B,MAAA,EAAQ,IAAA;AAAA,MACR,YAAA,CAAa,KAAK,KAAA,EAAO;AACxB,QAAA,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,gBAAgB,GAAA,EAAK;AACpB,QAAA,IAAA,CAAK,MAAA,GAAS,OAAA;AACd,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAO,GAAA,KAAQ,QAAA,GAAW,MAAM,GAAA,CAAI,OAAA;AACjD,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,GAAA,GAAM;AACL,QAAA,IAAA,CAAK,OAAA,GAAU,KAAK,GAAA,EAAI;AAAA,MACzB;AAAA,KACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAEO,IAAM,aAAA,GAAgB,IAAI,UAAA;;;AChIjC,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR;ACrCO,IAAM,WAAA,GAAN,cAA0B,YAAA,CAAa;AAAA,EAS7C,YAA6B,OAAA,EAA6B;AACzD,IAAA,KAAA,EAAM;AADsB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAE5B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,EAAA;AAC1C,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,GAAA;AACxC,IAAA,IAAA,CAAK,gBAAA,EAAiB;AAEtB,IAAA,IAAI,OAAA,CAAQ,eAAe,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,aAAA,EAAc;AAAA,IACpB;AAAA,EACD;AAAA,EAT6B,OAAA;AAAA,EARrB,cAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAiC,IAAA;AAAA,EACjC,gBAAA,GAAkC,IAAA;AAAA,EAClC,WAA2B,EAAC;AAAA,EAC5B,mBAAA,GAA6C,IAAA;AAAA,EACpC,WAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA,EAgBV,gBAAA,GAAyB;AAC/B,IAAA,IAAI;AACH,MAAA,IACC,KAAK,OAAA,CAAQ,YAAA,IACV,cAAW,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA,EACtC;AACD,QAAA,IAAA,CAAK,cAAA,GAAoB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA;AAAA,MAChE;AAEA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC/C,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kCAAA,EAAqC,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAAA,SAChE;AAAA,MACD;AACA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAAA,SAC3D;AAAA,MACD;AAEA,MAAA,IAAA,CAAK,eAAA,GAAqB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AACjE,MAAA,IAAA,CAAK,gBAAA,GAAsB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAEnE,MAAA,GAAA,CAAI,KAAK,iDAAiD,CAAA;AAAA,IAC3D,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,KAAA;AAAA,IACP;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAA,GAA+B;AACrC,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,IAAA,GAAO,IAAWC,MAAA,CAAA,eAAA,CAAgB,IAAA,CAAK,eAAe,CAAA;AAC5D,IAAA,MAAM,WAAA,GAAc,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,MAAM,WAAA,GAAc,WAAA,CAAY,OAAA,EAAQ,GAAI,IAAI,OAAA,EAAQ;AACxD,IAAA,MAAM,gBAAgB,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA;AAAA,MACA,KAAK,KAAA,CAAM,WAAA,IAAe,GAAA,GAAO,EAAA,GAAK,KAAK,EAAA,CAAG;AAAA,KAC/C;AACA,IAAA,MAAM,YAAY,WAAA,IAAe,CAAA;AACjC,IAAA,MAAM,cAAA,GAAiB,iBAAiB,IAAA,CAAK,WAAA;AAE7C,IAAA,OAAO;AAAA,MACN,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,aAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC7B,IAAA,MAAM,YAAA,GAAe;AAAA,MACpB,KAAK,OAAA,CAAQ,aAAA;AAAA,MACb,KAAK,OAAA,CAAQ,cAAA;AAAA,MACb,KAAK,OAAA,CAAQ;AAAA,KACd,CAAE,OAAO,CAAC,CAAA,KAAmB,QAAQ,CAAA,IAAQ,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AAE3D,IAAA,KAAA,MAAW,YAAY,YAAA,EAAc;AACpC,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAa,EAAA,CAAA,KAAA,CAAM,QAAA,EAAU,MAAM;AACxC,UAAA,IAAA,CAAK,cAAA,EAAe;AAAA,QACrB,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,MAC3B,SAAS,GAAA,EAAK;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,8BAAA,EAAiC,QAAQ,CAAA,oBAAA,EAAuB,GAAG,CAAA;AAAA,SACpE;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAA,GAAuB;AAC9B,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AAAA,IACtC;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,WAAW,MAAM;AAC3C,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,QAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,SACpF;AACA,QAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACf,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAE,CAAA;AACrD,QAAA,IAAA,CAAK,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,MACzB;AAAA,IACD,CAAA,EAAG,KAAK,UAAU,CAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKO,MAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,KACpF;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAC5B,IAAA,OAAO,QAAA;AAAA,EACR;AAAA,EAEO,WAAA,GAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC9D;AACA,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACb;AAAA,EAEO,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC3B,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACxD;AACA,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AACrC,MAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA;AAAA,IAC5B;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACpC,MAAA,IAAI;AACH,QAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,MACf,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AACA,IAAA,IAAA,CAAK,WAAW,EAAC;AACjB,IAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,EACzB;AACD","file":"index.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)\n * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.\n * Spec: https://www.w3.org/TR/trace-context/\n */\n\nimport * as crypto from \"node:crypto\";\n\nexport interface SpanContext {\n\ttraceId: string;\n\tspanId: string;\n\tsampled: boolean;\n}\n\nexport interface LiopSpan {\n\treadonly name: string;\n\treadonly context: SpanContext;\n\treadonly startTime: number;\n\tendTime?: number;\n\tattributes: Record<string, string | number | boolean>;\n\tstatus: \"OK\" | \"ERROR\";\n\terror?: string;\n\tsetAttribute(key: string, value: string | number | boolean): LiopSpan;\n\trecordException(error: Error | string): LiopSpan;\n\tend(): void;\n}\n\nconst TRACEPARENT_REGEX =\n\t/^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;\n\nexport class LiopTracer {\n\tpublic static generateTraceId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(16).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(32));\n\t\treturn id;\n\t}\n\n\tpublic static generateSpanId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(8).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(16));\n\t\treturn id;\n\t}\n\n\tpublic static formatTraceparent(\n\t\ttraceId: string,\n\t\tspanId: string,\n\t\tsampled = true,\n\t): string {\n\t\tconst flags = sampled ? \"01\" : \"00\";\n\t\treturn `00-${traceId}-${spanId}-${flags}`;\n\t}\n\n\tpublic static parseTraceparent(header?: string | null): SpanContext | null {\n\t\tif (!header || typeof header !== \"string\") {\n\t\t\treturn null;\n\t\t}\n\t\tconst trimmed = header.trim();\n\t\tconst match = TRACEPARENT_REGEX.exec(trimmed);\n\t\tif (!match) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst [, version, traceId, spanId, flags] = match;\n\t\t// Version 00 cannot have all-zeros traceId or spanId\n\t\tif (version === \"00\") {\n\t\t\tif (traceId === \"0\".repeat(32) || spanId === \"0\".repeat(16)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t}\n\n\t\tconst sampled = (Number.parseInt(flags, 16) & 0x01) === 1;\n\t\treturn {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\t}\n\n\tpublic static injectTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t\tcontext: SpanContext,\n\t): void {\n\t\tcarrier.traceparent = LiopTracer.formatTraceparent(\n\t\t\tcontext.traceId,\n\t\t\tcontext.spanId,\n\t\t\tcontext.sampled,\n\t\t);\n\t}\n\n\tpublic static extractTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t): SpanContext | null {\n\t\tconst val = carrier.traceparent || carrier.Traceparent;\n\t\tif (Array.isArray(val)) {\n\t\t\treturn LiopTracer.parseTraceparent(val[0]);\n\t\t}\n\t\treturn LiopTracer.parseTraceparent(val);\n\t}\n\n\tpublic startSpan(\n\t\tname: string,\n\t\tparent?: SpanContext | null,\n\t\tattributes: Record<string, string | number | boolean> = {},\n\t): LiopSpan {\n\t\tconst traceId = parent?.traceId || LiopTracer.generateTraceId();\n\t\tconst spanId = LiopTracer.generateSpanId();\n\t\tconst sampled = parent ? parent.sampled : true;\n\n\t\tconst context: SpanContext = {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\n\t\tconst span: LiopSpan = {\n\t\t\tname,\n\t\t\tcontext,\n\t\t\tstartTime: Date.now(),\n\t\t\tattributes: { ...attributes },\n\t\t\tstatus: \"OK\",\n\t\t\tsetAttribute(key, value) {\n\t\t\t\tthis.attributes[key] = value;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\trecordException(err) {\n\t\t\t\tthis.status = \"ERROR\";\n\t\t\t\tthis.error = typeof err === \"string\" ? err : err.message;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\tend() {\n\t\t\t\tthis.endTime = Date.now();\n\t\t\t},\n\t\t};\n\n\t\treturn span;\n\t}\n}\n\nexport const defaultTracer = new LiopTracer();\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Certificate Manager (CertManager)\n * Provides automated certificate monitoring, X.509 validity inspection,\n * and hot-reloading for mutual TLS (mTLS) without node restarts.\n *\n * Compliance:\n * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS\n * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification\n */\n\nimport * as crypto from \"node:crypto\";\nimport { EventEmitter } from \"node:events\";\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface CertManagerOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCertPath?: string;\n\t/** Path to the server/client certificate chain (PEM format) */\n\tcertChainPath: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKeyPath: string;\n\t/** Expiration warning threshold in days (default: 30) */\n\twarningDays?: number;\n\t/** Enable file watching for automatic hot-reloading (default: true) */\n\twatchFiles?: boolean;\n\t/** Debounce delay in ms for hot reloading (default: 150) */\n\tdebounceMs?: number;\n}\n\nexport interface CertInfo {\n\tsubject: string;\n\tissuer: string;\n\tvalidFrom: string;\n\tvalidTo: string;\n\tfingerprint256: string;\n\tdaysRemaining: number;\n\tisExpired: boolean;\n\tisExpiringSoon: boolean;\n}\n\nexport class CertManager extends EventEmitter {\n\tprivate rootCertBuffer: Buffer | null = null;\n\tprivate certChainBuffer: Buffer | null = null;\n\tprivate privateKeyBuffer: Buffer | null = null;\n\tprivate watchers: fs.FSWatcher[] = [];\n\tprivate reloadDebounceTimer: NodeJS.Timeout | null = null;\n\tprivate readonly warningDays: number;\n\tprivate readonly debounceMs: number;\n\n\tconstructor(private readonly options: CertManagerOptions) {\n\t\tsuper();\n\t\tthis.warningDays = options.warningDays ?? 30;\n\t\tthis.debounceMs = options.debounceMs ?? 150;\n\t\tthis.loadCertificates();\n\n\t\tif (options.watchFiles !== false) {\n\t\t\tthis.setupWatchers();\n\t\t}\n\t}\n\n\t/**\n\t * Synchronously loads or reloads certificates from filesystem into memory.\n\t */\n\tpublic loadCertificates(): void {\n\t\ttry {\n\t\t\tif (\n\t\t\t\tthis.options.rootCertPath &&\n\t\t\t\tfs.existsSync(this.options.rootCertPath)\n\t\t\t) {\n\t\t\t\tthis.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);\n\t\t\t}\n\n\t\t\tif (!fs.existsSync(this.options.certChainPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Certificate chain file not found: ${this.options.certChainPath}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!fs.existsSync(this.options.privateKeyPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Private key file not found: ${this.options.privateKeyPath}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tthis.certChainBuffer = fs.readFileSync(this.options.certChainPath);\n\t\t\tthis.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);\n\n\t\t\tlog.info(\"[CertManager] Certificates loaded successfully.\");\n\t\t} catch (error) {\n\t\t\tlog.error(`[CertManager] Failed to load certificates: ${error}`);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.\n\t */\n\tpublic inspectCertificate(): CertInfo {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] No certificate loaded to inspect.\");\n\t\t}\n\n\t\tconst x509 = new crypto.X509Certificate(this.certChainBuffer);\n\t\tconst validToDate = new Date(x509.validTo);\n\t\tconst now = new Date();\n\t\tconst msRemaining = validToDate.getTime() - now.getTime();\n\t\tconst daysRemaining = Math.max(\n\t\t\t0,\n\t\t\tMath.floor(msRemaining / (1000 * 60 * 60 * 24)),\n\t\t);\n\t\tconst isExpired = msRemaining <= 0;\n\t\tconst isExpiringSoon = daysRemaining <= this.warningDays;\n\n\t\treturn {\n\t\t\tsubject: x509.subject,\n\t\t\tissuer: x509.issuer,\n\t\t\tvalidFrom: x509.validFrom,\n\t\t\tvalidTo: x509.validTo,\n\t\t\tfingerprint256: x509.fingerprint256,\n\t\t\tdaysRemaining,\n\t\t\tisExpired,\n\t\t\tisExpiringSoon,\n\t\t};\n\t}\n\n\t/**\n\t * Sets up non-blocking filesystem watchers to detect certificate renewals\n\t * and trigger hot-reloading without process restarts.\n\t */\n\tprivate setupWatchers(): void {\n\t\tconst filesToWatch = [\n\t\t\tthis.options.certChainPath,\n\t\t\tthis.options.privateKeyPath,\n\t\t\tthis.options.rootCertPath,\n\t\t].filter((p): p is string => Boolean(p && fs.existsSync(p)));\n\n\t\tfor (const filePath of filesToWatch) {\n\t\t\ttry {\n\t\t\t\tconst watcher = fs.watch(filePath, () => {\n\t\t\t\t\tthis.scheduleReload();\n\t\t\t\t});\n\t\t\t\tthis.watchers.push(watcher);\n\t\t\t} catch (err) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[CertManager] Could not watch ${filePath} for hot reloading: ${err}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Debounces reload events to ensure files have finished writing.\n\t */\n\tprivate scheduleReload(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t}\n\n\t\tthis.reloadDebounceTimer = setTimeout(() => {\n\t\t\ttry {\n\t\t\t\tthis.loadCertificates();\n\t\t\t\tconst certInfo = this.inspectCertificate();\n\t\t\t\tlog.info(\n\t\t\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t\t\t);\n\t\t\t\tthis.emit(\"reload\", certInfo);\n\t\t\t} catch (error) {\n\t\t\t\tlog.error(`[CertManager] Hot reload failed: ${error}`);\n\t\t\t\tthis.emit(\"error\", error);\n\t\t\t}\n\t\t}, this.debounceMs);\n\t}\n\n\t/**\n\t * Manually triggers a reload of certificates and emits the 'reload' event.\n\t */\n\tpublic reload(): CertInfo {\n\t\tthis.loadCertificates();\n\t\tconst certInfo = this.inspectCertificate();\n\t\tlog.info(\n\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t);\n\t\tthis.emit(\"reload\", certInfo);\n\t\treturn certInfo;\n\t}\n\n\tpublic getRootCert(): Buffer | null {\n\t\treturn this.rootCertBuffer;\n\t}\n\n\tpublic getCertChain(): Buffer {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Certificate chain not loaded.\");\n\t\t}\n\t\treturn this.certChainBuffer;\n\t}\n\n\tpublic getPrivateKey(): Buffer {\n\t\tif (!this.privateKeyBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Private key not loaded.\");\n\t\t}\n\t\treturn this.privateKeyBuffer;\n\t}\n\n\t/**\n\t * Stops all active file watchers and releases resources.\n\t */\n\tpublic dispose(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t\tthis.reloadDebounceTimer = null;\n\t\t}\n\t\tfor (const watcher of this.watchers) {\n\t\t\ttry {\n\t\t\t\twatcher.close();\n\t\t\t} catch {\n\t\t\t\t// Ignore watcher close errors\n\t\t\t}\n\t\t}\n\t\tthis.watchers = [];\n\t\tthis.removeAllListeners();\n\t}\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/observability/tracing.ts","../src/prompts/adapters.ts","../src/security/cert-manager.ts"],"names":["ErrorCode","crypto2"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAGO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;ACQA,IAAM,iBAAA,GACL,6DAAA;AAEM,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAc,eAAA,GAA0B;AACvC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC3C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,cAAA,GAAyB;AACtC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC1C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,MAAA,EACA,UAAU,IAAA,EACD;AACT,IAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,GAAO,IAAA;AAC/B,IAAA,OAAO,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,EAAI,MAAM,IAAI,KAAK,CAAA,CAAA;AAAA,EACxC;AAAA,EAEA,OAAc,iBAAiB,MAAA,EAA4C;AAC1E,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,MAAA,OAAO,IAAA;AAAA,IACR;AACA,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,GAAG,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,GAAI,KAAA;AAE5C,IAAA,IAAI,YAAY,IAAA,EAAM;AACrB,MAAA,IAAI,OAAA,KAAY,IAAI,MAAA,CAAO,EAAE,KAAK,MAAA,KAAW,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AAC5D,QAAA,OAAO,IAAA;AAAA,MACR;AAAA,IACD;AAEA,IAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,IAAI,CAAA,MAAU,CAAA;AACxD,IAAA,OAAO;AAAA,MACN,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,OAAA,EACO;AACP,IAAA,OAAA,CAAQ,cAAc,WAAA,CAAW,iBAAA;AAAA,MAChC,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACT;AAAA,EACD;AAAA,EAEA,OAAc,mBACb,OAAA,EACqB;AACrB,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,WAAA,CAAW,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,WAAA,CAAW,iBAAiB,GAAG,CAAA;AAAA,EACvC;AAAA,EAEO,SAAA,CACN,IAAA,EACA,MAAA,EACA,UAAA,GAAwD,EAAC,EAC9C;AACX,IAAA,MAAM,OAAA,GAAU,MAAA,EAAQ,OAAA,IAAW,WAAA,CAAW,eAAA,EAAgB;AAC9D,IAAA,MAAM,MAAA,GAAS,YAAW,cAAA,EAAe;AACzC,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,MAAA,CAAO,OAAA,GAAU,IAAA;AAE1C,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC5B,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,MAAM,IAAA,GAAiB;AAAA,MACtB,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,MACpB,UAAA,EAAY,EAAE,GAAG,UAAA,EAAW;AAAA,MAC5B,MAAA,EAAQ,IAAA;AAAA,MACR,YAAA,CAAa,KAAK,KAAA,EAAO;AACxB,QAAA,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,gBAAgB,GAAA,EAAK;AACpB,QAAA,IAAA,CAAK,MAAA,GAAS,OAAA;AACd,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAO,GAAA,KAAQ,QAAA,GAAW,MAAM,GAAA,CAAI,OAAA;AACjD,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,GAAA,GAAM;AACL,QAAA,IAAA,CAAK,OAAA,GAAU,KAAK,GAAA,EAAI;AAAA,MACzB;AAAA,KACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAEO,IAAM,aAAA,GAAgB,IAAI,UAAA;;;AChIjC,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR;ACrCO,IAAM,WAAA,GAAN,cAA0B,YAAA,CAAa;AAAA,EAS7C,YAA6B,OAAA,EAA6B;AACzD,IAAA,KAAA,EAAM;AADsB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAE5B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,EAAA;AAC1C,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,GAAA;AACxC,IAAA,IAAA,CAAK,gBAAA,EAAiB;AAEtB,IAAA,IAAI,OAAA,CAAQ,eAAe,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,aAAA,EAAc;AAAA,IACpB;AAAA,EACD;AAAA,EAT6B,OAAA;AAAA,EARrB,cAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAiC,IAAA;AAAA,EACjC,gBAAA,GAAkC,IAAA;AAAA,EAClC,WAA2B,EAAC;AAAA,EAC5B,mBAAA,GAA6C,IAAA;AAAA,EACpC,WAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA,EAgBV,gBAAA,GAAyB;AAC/B,IAAA,IAAI;AACH,MAAA,IACC,KAAK,OAAA,CAAQ,YAAA,IACV,cAAW,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA,EACtC;AACD,QAAA,IAAA,CAAK,cAAA,GAAoB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA;AAAA,MAChE;AAEA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC/C,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kCAAA,EAAqC,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAAA,SAChE;AAAA,MACD;AACA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAAA,SAC3D;AAAA,MACD;AAEA,MAAA,IAAA,CAAK,eAAA,GAAqB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AACjE,MAAA,IAAA,CAAK,gBAAA,GAAsB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAEnE,MAAA,GAAA,CAAI,KAAK,iDAAiD,CAAA;AAAA,IAC3D,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,KAAA;AAAA,IACP;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAA,GAA+B;AACrC,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,IAAA,GAAO,IAAWC,MAAA,CAAA,eAAA,CAAgB,IAAA,CAAK,eAAe,CAAA;AAC5D,IAAA,MAAM,WAAA,GAAc,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,MAAM,WAAA,GAAc,WAAA,CAAY,OAAA,EAAQ,GAAI,IAAI,OAAA,EAAQ;AACxD,IAAA,MAAM,gBAAgB,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA;AAAA,MACA,KAAK,KAAA,CAAM,WAAA,IAAe,GAAA,GAAO,EAAA,GAAK,KAAK,EAAA,CAAG;AAAA,KAC/C;AACA,IAAA,MAAM,YAAY,WAAA,IAAe,CAAA;AACjC,IAAA,MAAM,cAAA,GAAiB,iBAAiB,IAAA,CAAK,WAAA;AAE7C,IAAA,OAAO;AAAA,MACN,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,aAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC7B,IAAA,MAAM,YAAA,GAAe;AAAA,MACpB,KAAK,OAAA,CAAQ,aAAA;AAAA,MACb,KAAK,OAAA,CAAQ,cAAA;AAAA,MACb,KAAK,OAAA,CAAQ;AAAA,KACd,CAAE,OAAO,CAAC,CAAA,KAAmB,QAAQ,CAAA,IAAQ,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AAE3D,IAAA,KAAA,MAAW,YAAY,YAAA,EAAc;AACpC,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAa,EAAA,CAAA,KAAA,CAAM,QAAA,EAAU,MAAM;AACxC,UAAA,IAAA,CAAK,cAAA,EAAe;AAAA,QACrB,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,MAC3B,SAAS,GAAA,EAAK;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,8BAAA,EAAiC,QAAQ,CAAA,oBAAA,EAAuB,GAAG,CAAA;AAAA,SACpE;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAA,GAAuB;AAC9B,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AAAA,IACtC;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,WAAW,MAAM;AAC3C,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,QAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,SACpF;AACA,QAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACf,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAE,CAAA;AACrD,QAAA,IAAA,CAAK,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,MACzB;AAAA,IACD,CAAA,EAAG,KAAK,UAAU,CAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKO,MAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,KACpF;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAC5B,IAAA,OAAO,QAAA;AAAA,EACR;AAAA,EAEO,WAAA,GAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC9D;AACA,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACb;AAAA,EAEO,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC3B,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACxD;AACA,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AACrC,MAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA;AAAA,IAC5B;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACpC,MAAA,IAAI;AACH,QAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,MACf,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AACA,IAAA,IAAA,CAAK,WAAW,EAAC;AACjB,IAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,EACzB;AACD","file":"index.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)\n * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.\n * Spec: https://www.w3.org/TR/trace-context/\n */\n\nimport * as crypto from \"node:crypto\";\n\nexport interface SpanContext {\n\ttraceId: string;\n\tspanId: string;\n\tsampled: boolean;\n}\n\nexport interface LiopSpan {\n\treadonly name: string;\n\treadonly context: SpanContext;\n\treadonly startTime: number;\n\tendTime?: number;\n\tattributes: Record<string, string | number | boolean>;\n\tstatus: \"OK\" | \"ERROR\";\n\terror?: string;\n\tsetAttribute(key: string, value: string | number | boolean): LiopSpan;\n\trecordException(error: Error | string): LiopSpan;\n\tend(): void;\n}\n\nconst TRACEPARENT_REGEX =\n\t/^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;\n\nexport class LiopTracer {\n\tpublic static generateTraceId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(16).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(32));\n\t\treturn id;\n\t}\n\n\tpublic static generateSpanId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(8).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(16));\n\t\treturn id;\n\t}\n\n\tpublic static formatTraceparent(\n\t\ttraceId: string,\n\t\tspanId: string,\n\t\tsampled = true,\n\t): string {\n\t\tconst flags = sampled ? \"01\" : \"00\";\n\t\treturn `00-${traceId}-${spanId}-${flags}`;\n\t}\n\n\tpublic static parseTraceparent(header?: string | null): SpanContext | null {\n\t\tif (!header || typeof header !== \"string\") {\n\t\t\treturn null;\n\t\t}\n\t\tconst trimmed = header.trim();\n\t\tconst match = TRACEPARENT_REGEX.exec(trimmed);\n\t\tif (!match) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst [, version, traceId, spanId, flags] = match;\n\t\t// Version 00 cannot have all-zeros traceId or spanId\n\t\tif (version === \"00\") {\n\t\t\tif (traceId === \"0\".repeat(32) || spanId === \"0\".repeat(16)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t}\n\n\t\tconst sampled = (Number.parseInt(flags, 16) & 0x01) === 1;\n\t\treturn {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\t}\n\n\tpublic static injectTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t\tcontext: SpanContext,\n\t): void {\n\t\tcarrier.traceparent = LiopTracer.formatTraceparent(\n\t\t\tcontext.traceId,\n\t\t\tcontext.spanId,\n\t\t\tcontext.sampled,\n\t\t);\n\t}\n\n\tpublic static extractTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t): SpanContext | null {\n\t\tconst val = carrier.traceparent || carrier.Traceparent;\n\t\tif (Array.isArray(val)) {\n\t\t\treturn LiopTracer.parseTraceparent(val[0]);\n\t\t}\n\t\treturn LiopTracer.parseTraceparent(val);\n\t}\n\n\tpublic startSpan(\n\t\tname: string,\n\t\tparent?: SpanContext | null,\n\t\tattributes: Record<string, string | number | boolean> = {},\n\t): LiopSpan {\n\t\tconst traceId = parent?.traceId || LiopTracer.generateTraceId();\n\t\tconst spanId = LiopTracer.generateSpanId();\n\t\tconst sampled = parent ? parent.sampled : true;\n\n\t\tconst context: SpanContext = {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\n\t\tconst span: LiopSpan = {\n\t\t\tname,\n\t\t\tcontext,\n\t\t\tstartTime: Date.now(),\n\t\t\tattributes: { ...attributes },\n\t\t\tstatus: \"OK\",\n\t\t\tsetAttribute(key, value) {\n\t\t\t\tthis.attributes[key] = value;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\trecordException(err) {\n\t\t\t\tthis.status = \"ERROR\";\n\t\t\t\tthis.error = typeof err === \"string\" ? err : err.message;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\tend() {\n\t\t\t\tthis.endTime = Date.now();\n\t\t\t},\n\t\t};\n\n\t\treturn span;\n\t}\n}\n\nexport const defaultTracer = new LiopTracer();\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Certificate Manager (CertManager)\n * Provides automated certificate monitoring, X.509 validity inspection,\n * and hot-reloading for mutual TLS (mTLS) without node restarts.\n *\n * Compliance:\n * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS\n * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification\n */\n\nimport * as crypto from \"node:crypto\";\nimport { EventEmitter } from \"node:events\";\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface CertManagerOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCertPath?: string;\n\t/** Path to the server/client certificate chain (PEM format) */\n\tcertChainPath: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKeyPath: string;\n\t/** Expiration warning threshold in days (default: 30) */\n\twarningDays?: number;\n\t/** Enable file watching for automatic hot-reloading (default: true) */\n\twatchFiles?: boolean;\n\t/** Debounce delay in ms for hot reloading (default: 150) */\n\tdebounceMs?: number;\n}\n\nexport interface CertInfo {\n\tsubject: string;\n\tissuer: string;\n\tvalidFrom: string;\n\tvalidTo: string;\n\tfingerprint256: string;\n\tdaysRemaining: number;\n\tisExpired: boolean;\n\tisExpiringSoon: boolean;\n}\n\nexport class CertManager extends EventEmitter {\n\tprivate rootCertBuffer: Buffer | null = null;\n\tprivate certChainBuffer: Buffer | null = null;\n\tprivate privateKeyBuffer: Buffer | null = null;\n\tprivate watchers: fs.FSWatcher[] = [];\n\tprivate reloadDebounceTimer: NodeJS.Timeout | null = null;\n\tprivate readonly warningDays: number;\n\tprivate readonly debounceMs: number;\n\n\tconstructor(private readonly options: CertManagerOptions) {\n\t\tsuper();\n\t\tthis.warningDays = options.warningDays ?? 30;\n\t\tthis.debounceMs = options.debounceMs ?? 150;\n\t\tthis.loadCertificates();\n\n\t\tif (options.watchFiles !== false) {\n\t\t\tthis.setupWatchers();\n\t\t}\n\t}\n\n\t/**\n\t * Synchronously loads or reloads certificates from filesystem into memory.\n\t */\n\tpublic loadCertificates(): void {\n\t\ttry {\n\t\t\tif (\n\t\t\t\tthis.options.rootCertPath &&\n\t\t\t\tfs.existsSync(this.options.rootCertPath)\n\t\t\t) {\n\t\t\t\tthis.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);\n\t\t\t}\n\n\t\t\tif (!fs.existsSync(this.options.certChainPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Certificate chain file not found: ${this.options.certChainPath}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!fs.existsSync(this.options.privateKeyPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Private key file not found: ${this.options.privateKeyPath}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tthis.certChainBuffer = fs.readFileSync(this.options.certChainPath);\n\t\t\tthis.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);\n\n\t\t\tlog.info(\"[CertManager] Certificates loaded successfully.\");\n\t\t} catch (error) {\n\t\t\tlog.error(`[CertManager] Failed to load certificates: ${error}`);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.\n\t */\n\tpublic inspectCertificate(): CertInfo {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] No certificate loaded to inspect.\");\n\t\t}\n\n\t\tconst x509 = new crypto.X509Certificate(this.certChainBuffer);\n\t\tconst validToDate = new Date(x509.validTo);\n\t\tconst now = new Date();\n\t\tconst msRemaining = validToDate.getTime() - now.getTime();\n\t\tconst daysRemaining = Math.max(\n\t\t\t0,\n\t\t\tMath.floor(msRemaining / (1000 * 60 * 60 * 24)),\n\t\t);\n\t\tconst isExpired = msRemaining <= 0;\n\t\tconst isExpiringSoon = daysRemaining <= this.warningDays;\n\n\t\treturn {\n\t\t\tsubject: x509.subject,\n\t\t\tissuer: x509.issuer,\n\t\t\tvalidFrom: x509.validFrom,\n\t\t\tvalidTo: x509.validTo,\n\t\t\tfingerprint256: x509.fingerprint256,\n\t\t\tdaysRemaining,\n\t\t\tisExpired,\n\t\t\tisExpiringSoon,\n\t\t};\n\t}\n\n\t/**\n\t * Sets up non-blocking filesystem watchers to detect certificate renewals\n\t * and trigger hot-reloading without process restarts.\n\t */\n\tprivate setupWatchers(): void {\n\t\tconst filesToWatch = [\n\t\t\tthis.options.certChainPath,\n\t\t\tthis.options.privateKeyPath,\n\t\t\tthis.options.rootCertPath,\n\t\t].filter((p): p is string => Boolean(p && fs.existsSync(p)));\n\n\t\tfor (const filePath of filesToWatch) {\n\t\t\ttry {\n\t\t\t\tconst watcher = fs.watch(filePath, () => {\n\t\t\t\t\tthis.scheduleReload();\n\t\t\t\t});\n\t\t\t\tthis.watchers.push(watcher);\n\t\t\t} catch (err) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[CertManager] Could not watch ${filePath} for hot reloading: ${err}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Debounces reload events to ensure files have finished writing.\n\t */\n\tprivate scheduleReload(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t}\n\n\t\tthis.reloadDebounceTimer = setTimeout(() => {\n\t\t\ttry {\n\t\t\t\tthis.loadCertificates();\n\t\t\t\tconst certInfo = this.inspectCertificate();\n\t\t\t\tlog.info(\n\t\t\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t\t\t);\n\t\t\t\tthis.emit(\"reload\", certInfo);\n\t\t\t} catch (error) {\n\t\t\t\tlog.error(`[CertManager] Hot reload failed: ${error}`);\n\t\t\t\tthis.emit(\"error\", error);\n\t\t\t}\n\t\t}, this.debounceMs);\n\t}\n\n\t/**\n\t * Manually triggers a reload of certificates and emits the 'reload' event.\n\t */\n\tpublic reload(): CertInfo {\n\t\tthis.loadCertificates();\n\t\tconst certInfo = this.inspectCertificate();\n\t\tlog.info(\n\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t);\n\t\tthis.emit(\"reload\", certInfo);\n\t\treturn certInfo;\n\t}\n\n\tpublic getRootCert(): Buffer | null {\n\t\treturn this.rootCertBuffer;\n\t}\n\n\tpublic getCertChain(): Buffer {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Certificate chain not loaded.\");\n\t\t}\n\t\treturn this.certChainBuffer;\n\t}\n\n\tpublic getPrivateKey(): Buffer {\n\t\tif (!this.privateKeyBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Private key not loaded.\");\n\t\t}\n\t\treturn this.privateKeyBuffer;\n\t}\n\n\t/**\n\t * Stops all active file watchers and releases resources.\n\t */\n\tpublic dispose(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t\tthis.reloadDebounceTimer = null;\n\t\t}\n\t\tfor (const watcher of this.watchers) {\n\t\t\ttry {\n\t\t\t\twatcher.close();\n\t\t\t} catch {\n\t\t\t\t// Ignore watcher close errors\n\t\t\t}\n\t\t}\n\t\tthis.watchers = [];\n\t\tthis.removeAllListeners();\n\t}\n}\n"]}

package/dist/server.d.ts

@@ -1,4 +1,4 @@
-export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-KQfBZcaH.js';
+export { b as AggregationPolicy, L as LiopServer, a as LiopServerOptions, e as LogicExecutionPolicy, N as NerScanner, f as OutputSanitizerConfig, P as PII_PATTERNS, g as PII_PRESETS, h as PiiRule, i as PiiScanner, T as ToolHandler, s as sanitizeOutput } from './index-CdW8j8Bn.js';
 import 'zod';
 import './node-B0b2vUFS.js';
 import './types-CzRSOlOo.js';

package/dist/server.js

@@ -1,7 +1,7 @@
-export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner } from './chunk-IEG6ZTTA.js';
+export { LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner } from './chunk-5SWHE62F.js';
 export { sanitizeOutput } from './chunk-Y62GORQF.js';
 import './chunk-WPTOJYN5.js';
-import './chunk-3UBNOYMH.js';
+import './chunk-UJFWPRDM.js';
 import './chunk-PAICJCKJ.js';
 import './chunk-XRDN232O.js';
 import './chunk-K3DGJLUY.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nekzus/liop",
-  "version": "2.4.0-alpha.18",
+  "version": "2.4.0-alpha.19",
   "description": "Official SDK for Logic-Injection-on-Origin Protocol (LIOP). Deploy Logic-on-Origin with WebAssembly at gRPC speed and bidirectional MCP compatibility.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/chunk-3UBNOYMH.js

@@ -1,178 +0,0 @@
-import { log } from './chunk-K3DGJLUY.js';
-import * as fs from 'fs';
-import * as grpc from '@grpc/grpc-js';
-import path from 'path';
-import { fileURLToPath } from 'url';
-import * as protoLoader from '@grpc/proto-loader';
-
-var isTlsEnforced = () => process.env.NODE_ENV === "production" || process.env.LIOP_ENFORCE_TLS === "true";
-var isTlsWarningSuppressed = (tls) => tls?.insecure === true || tls?.suppressWarning === true || process.env.LIOP_SUPPRESS_TLS_WARNING === "true";
-var hasWarnedInsecureServer = false;
-var hasWarnedInsecureChannel = false;
-function createServerCredentials(tls) {
-  if (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {
-    throw new Error(
-      "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
-    );
-  }
-  if (tls?.certManager) {
-    try {
-      const certChain = tls.certManager.getCertChain();
-      const privateKey = tls.certManager.getPrivateKey();
-      const rootCert = tls.certManager.getRootCert();
-      if (tls.mutualTls && !rootCert) {
-        throw new Error(
-          "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded."
-        );
-      }
-      return grpc.ServerCredentials.createSsl(
-        rootCert,
-        [{ cert_chain: certChain, private_key: privateKey }],
-        Boolean(tls.mutualTls)
-      );
-    } catch (error) {
-      if (isTlsEnforced()) {
-        throw new Error(
-          `[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`
-        );
-      }
-      log.warn(
-        `[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`
-      );
-      return grpc.ServerCredentials.createInsecure();
-    }
-  }
-  if (!tls?.certChain || !tls?.privateKey) {
-    if (isTlsEnforced()) {
-      throw new Error(
-        "[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true."
-      );
-    }
-    if (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {
-      hasWarnedInsecureServer = true;
-      log.debug(
-        "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
-      );
-    }
-    return grpc.ServerCredentials.createInsecure();
-  }
-  try {
-    const rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;
-    const certChain = fs.readFileSync(tls.certChain);
-    const privateKey = fs.readFileSync(tls.privateKey);
-    if (tls.mutualTls && !rootCert) {
-      throw new Error(
-        "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
-      );
-    }
-    return grpc.ServerCredentials.createSsl(
-      rootCert,
-      [{ cert_chain: certChain, private_key: privateKey }],
-      Boolean(tls.mutualTls)
-    );
-  } catch (error) {
-    if (isTlsEnforced()) {
-      throw new Error(
-        `[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
-      );
-    }
-    log.warn(
-      `[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`
-    );
-    return grpc.ServerCredentials.createInsecure();
-  }
-}
-function createChannelCredentials(tls) {
-  if (tls?.certManager) {
-    try {
-      const rootCert = tls.certManager.getRootCert();
-      if (!rootCert) {
-        throw new Error(
-          "[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager."
-        );
-      }
-      const certChain = tls.certManager.getCertChain();
-      const privateKey = tls.certManager.getPrivateKey();
-      return grpc.credentials.createSsl(rootCert, privateKey, certChain);
-    } catch (error) {
-      if (isTlsEnforced()) {
-        throw new Error(
-          `[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`
-        );
-      }
-      log.warn(
-        `[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`
-      );
-      return grpc.credentials.createInsecure();
-    }
-  }
-  if (!tls?.rootCert) {
-    if (isTlsEnforced()) {
-      throw new Error(
-        "[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true."
-      );
-    }
-    if (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {
-      hasWarnedInsecureChannel = true;
-      log.debug(
-        "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
-      );
-    }
-    return grpc.credentials.createInsecure();
-  }
-  try {
-    const rootCert = fs.readFileSync(tls.rootCert);
-    const certChain = tls.certChain ? fs.readFileSync(tls.certChain) : void 0;
-    const privateKey = tls.privateKey ? fs.readFileSync(tls.privateKey) : void 0;
-    return grpc.credentials.createSsl(rootCert, privateKey, certChain);
-  } catch (error) {
-    if (isTlsEnforced()) {
-      throw new Error(
-        `[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
-      );
-    }
-    log.warn(
-      `[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`
-    );
-    return grpc.credentials.createInsecure();
-  }
-}
-
-// src/rpc/channel-options.ts
-var GRPC_CHANNEL_OPTIONS = {
-  "grpc.keepalive_time_ms": 3e4,
-  "grpc.keepalive_timeout_ms": 1e4,
-  "grpc.keepalive_permit_without_calls": 1,
-  "grpc.max_send_message_length": -1,
-  "grpc.max_receive_message_length": -1,
-  "grpc.enable_retries": 1
-};
-var __filename2 = fileURLToPath(import.meta.url);
-var __dirname2 = path.dirname(__filename2);
-var PROD_PATHS = [
-  path.resolve(__dirname2, "./protocol/liop_core.proto"),
-  // Flat dist/ (tsup)
-  path.resolve(__dirname2, "../protocol/liop_core.proto")
-  // dist/rpc/ (tsc)
-];
-var DEV_PROTO_PATH = path.resolve(
-  __dirname2,
-  "../../../../protocol/proto/liop_core.proto"
-);
-var PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;
-if (!fs.existsSync(PROTO_PATH)) {
-  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
-}
-var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
-  keepCase: true,
-  longs: String,
-  enums: String,
-  defaults: true,
-  oneofs: true
-});
-var liopProto = grpc.loadPackageDefinition(packageDefinition);
-var liopV1 = liopProto.liop.v1;
-
-export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials, liopV1 };
-//# sourceMappingURL=chunk-3UBNOYMH.js.map
-//# sourceMappingURL=chunk-3UBNOYMH.js.map

package/dist/chunk-3UBNOYMH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rpc/tls.ts","../src/rpc/channel-options.ts","../src/rpc/proto.ts"],"names":["__filename","__dirname","fs2","grpc2"],"mappings":";;;;;;;AAgDA,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAElC,IAAM,sBAAA,GAAyB,CAAC,GAAA,KAC/B,GAAA,EAAK,QAAA,KAAa,IAAA,IAClB,GAAA,EAAK,eAAA,KAAoB,IAAA,IACzB,OAAA,CAAQ,GAAA,CAAI,yBAAA,KAA8B,MAAA;AAE3C,IAAI,uBAAA,GAA0B,KAAA;AAC9B,IAAI,wBAAA,GAA2B,KAAA;AAOxB,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,uBAAA,EAAyB;AAC7D,MAAA,uBAAA,GAA0B,IAAA;AAC1B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,IAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,uBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,IAAI,CAAC,sBAAA,CAAuB,GAAG,CAAA,IAAK,CAAC,wBAAA,EAA0B;AAC9D,MAAA,wBAAA,GAA2B,IAAA;AAC3B,MAAA,GAAA,CAAI,KAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,EAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,IAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,iBAAY,cAAA,EAAe;AAAA,EACxC;AACD;;;AClNO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,EAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,2BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK","file":"chunk-3UBNOYMH.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n\t/**\n\t * Explicitly permit unencrypted (insecure) credentials for local development,\n\t * Docker testbeds, or tooling harnesses without emitting console warnings.\n\t * Ignored if isTlsEnforced() is true (production/enforced mode always throws).\n\t */\n\tinsecure?: boolean;\n\t/**\n\t * Explicitly suppress the fallback warning when insecure credentials are created.\n\t */\n\tsuppressWarning?: boolean;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\nconst isTlsWarningSuppressed = (tls?: LiopTlsOptions) =>\n\ttls?.insecure === true ||\n\ttls?.suppressWarning === true ||\n\tprocess.env.LIOP_SUPPRESS_TLS_WARNING === \"true\";\n\nlet hasWarnedInsecureServer = false;\nlet hasWarnedInsecureChannel = false;\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {\n\t\t\thasWarnedInsecureServer = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tif (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {\n\t\t\thasWarnedInsecureChannel = true;\n\t\t\tlog.debug(\n\t\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t\t);\n\t\t}\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n"]}