@nekzus/liop 2.4.0-alpha.7 → 2.4.0-alpha.8

package/dist/chunk-L6J72C5X.js

@@ -0,0 +1,1477 @@
+import { TokenTelemetryEngine } from './chunk-DZ2FQGJD.js';
+import { LiopVerifier } from './chunk-PEN3KFLF.js';
+import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
+import { authorizeRequest, Dilithium65Wrapper } from './chunk-VH4K4U45.js';
+import { liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-TKRX6CFI.js';
+import { toolCallErrorsTotal, pqcHandshakeDurationMs, pqcHandshakesTotal, zkVerificationsTotal, wireEgressBytesTotal } from './chunk-PAICJCKJ.js';
+import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, adaptResponseForLegacyClient, MCP_PROTOCOL_VERSION_LEGACY, buildLegacyInitializeResponse } from './chunk-EG46XMJT.js';
+import { log } from './chunk-HA6YZ42O.js';
+import * as crypto from 'crypto';
+import * as grpc from '@grpc/grpc-js';
+
+// src/utils/mcpCompact.ts
+function mcpCompactToolDescriptions() {
+  const v = process.env.LIOP_MCP_COMPACT_TOOL_DESCRIPTIONS?.toLowerCase().trim();
+  if (v === "0" || v === "false" || v === "no") return false;
+  return true;
+}
+function stripVerboseLiopToolDescription(description) {
+  let d = description;
+  const markers = [
+    "\n\n[LIOP-PROTO-V1:",
+    "\r\n\r\n[LIOP-PROTO-V1:",
+    "\n[LIOP-PROTO-V1:"
+    // rare
+  ];
+  for (const m of markers) {
+    const i = d.indexOf(m);
+    if (i !== -1) {
+      d = d.slice(0, i);
+      break;
+    }
+  }
+  return d.trimEnd();
+}
+
+// src/gateway/router.ts
+var MANIFEST_CACHE_TTL_S = 300;
+var MANIFEST_DISCOVERY_RETRIES = 5;
+var LiopMcpRouter = class _LiopMcpRouter {
+  constructor(liopServer, meshNode = null, defaultRpcPort = 50051) {
+    this.liopServer = liopServer;
+    this.meshNode = meshNode;
+    this.defaultRpcPort = defaultRpcPort;
+    if (this.meshNode) {
+      this.meshNode.registerManifestHandler(() => {
+        const remoteTools = this.liopServer.listTools().map((t) => ({
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema
+        }));
+        const resources = this.liopServer.listResources().map((r) => ({
+          name: r.name,
+          uri: r.uri,
+          description: r.description,
+          mimeType: r.mimeType
+        }));
+        const serverConfig = this.liopServer.config;
+        return {
+          peerId: this.meshNode?.getPeerId() || "unknown",
+          grpcPort: this.defaultRpcPort,
+          tools: [...remoteTools],
+          resources,
+          serverInfo: this.liopServer.getServerInfo(),
+          authRequired: this.liopServer.jwtValidator !== void 0,
+          tokenSlug: serverConfig?.tokenSlug,
+          taxonomy: serverConfig?.taxonomy ? {
+            domain: serverConfig.taxonomy.domain || "Unknown Domain",
+            clearanceTier: serverConfig.taxonomy.clearanceTier ?? 0,
+            executionTypes: serverConfig.taxonomy.executionTypes || []
+          } : void 0
+        };
+      });
+      this.meshNode.announceManifest().catch((err) => {
+        log.info(
+          `[LIOP-Router] Failed to announce manifest: ${err instanceof Error ? err.message : String(err)}`
+        );
+      });
+    }
+    if (process.env.LIOP_DIAGNOSTIC_LEVEL === "full") {
+      process.stderr.write(
+        "\u26A0\uFE0F [LIOP-Security] Diagnostic level set to FULL \u2014 PeerIDs and network topology are exposed. Do NOT use in production.\n"
+      );
+    }
+  }
+  liopServer;
+  meshNode;
+  defaultRpcPort;
+  /** Cached manifests from remote peers. Key = PeerID */
+  manifestCache = /* @__PURE__ */ new Map();
+  /** Guards against concurrent discovery storms */
+  currentDiscovery = null;
+  /** Verifier for Tier-0 integrity checks */
+  verifier = new LiopVerifier();
+  /** Callback when new remote tools are discovered */
+  onToolsChanged;
+  /** Circuit-breaker state for peers that repeatedly fail manifest queries. */
+  manifestFailureState = /* @__PURE__ */ new Map();
+  static MANIFEST_FAILURE_BASE_COOLDOWN_MS = 15e3;
+  static MANIFEST_FAILURE_MAX_COOLDOWN_MS = 5 * 6e4;
+  static MANIFEST_SKIP_LOG_THROTTLE_MS = 3e4;
+  getManifestCacheSize() {
+    return this.manifestCache.size;
+  }
+  shouldSkipManifestQuery(peerId) {
+    const state = this.manifestFailureState.get(peerId);
+    if (!state) return false;
+    const now = Date.now();
+    if (now >= state.cooldownUntil) return false;
+    if (now - state.lastSkipLogAt > _LiopMcpRouter.MANIFEST_SKIP_LOG_THROTTLE_MS) {
+      log.info(
+        `[LIOP-Router] Skipping manifest query for ${peerId} during cooldown (${Math.ceil((state.cooldownUntil - now) / 1e3)}s remaining)`
+      );
+      state.lastSkipLogAt = now;
+    }
+    return true;
+  }
+  recordManifestQuerySuccess(peerId) {
+    this.manifestFailureState.delete(peerId);
+  }
+  recordManifestQueryFailure(peerId) {
+    const now = Date.now();
+    const prev = this.manifestFailureState.get(peerId);
+    const failures = (prev?.failures || 0) + 1;
+    const backoff = Math.min(
+      _LiopMcpRouter.MANIFEST_FAILURE_BASE_COOLDOWN_MS * 2 ** Math.max(0, failures - 1),
+      _LiopMcpRouter.MANIFEST_FAILURE_MAX_COOLDOWN_MS
+    );
+    this.manifestFailureState.set(peerId, {
+      failures,
+      cooldownUntil: now + backoff,
+      lastSkipLogAt: 0
+    });
+  }
+  /**
+   * Detects the protocol era of an incoming request.
+   * Modern requests carry '_meta' with protocol version "2026-07-28" or use modern RPCs.
+   * Legacy requests use 'initialize' handshake or lack '_meta' envelopes.
+   */
+  detectEra(request) {
+    const params = request.params;
+    const meta = params?._meta;
+    const version = meta?.["io.modelcontextprotocol/protocolVersion"];
+    if (version === MCP_PROTOCOL_VERSION) {
+      return "modern";
+    }
+    if (MCP_LEGACY_SUPPORT_ENABLED && isLegacyRequest(request)) {
+      return "legacy";
+    }
+    return "modern";
+  }
+  async dispatch(request, authInfo) {
+    const { method, params, id } = request;
+    log.info(`[LIOP-Router] Processing: ${method}`);
+    if (this.liopServer.jwtValidator) {
+      const authResult = authorizeRequest(method, authInfo ?? null);
+      if (!authResult.allowed) {
+        log.info(
+          `[LIOP-Router] RBAC Access Denied for method '${method}': ${authResult.reason}`
+        );
+        return {
+          jsonrpc: "2.0",
+          id,
+          error: {
+            code: -32099,
+            // Custom authentication/authorization failure code
+            message: authResult.reason || "Access Denied"
+          }
+        };
+      }
+    }
+    switch (method) {
+      /** @mcp-legacy Initialize handshake for 2025-era clients. Remove when v1 EOL. */
+      case "initialize": {
+        if (!MCP_LEGACY_SUPPORT_ENABLED) {
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: {
+              code: -32601,
+              message: "Method retired: initialize (MCP 2026-07-28 is stateless)"
+            }
+          };
+        }
+        log.info(
+          "[LIOP-Router] \u26A0\uFE0F Legacy MCP client detected (2025-era initialize)."
+        );
+        return buildLegacyInitializeResponse(
+          this.liopServer.getServerInfo(),
+          id
+        );
+      }
+      /** @mcp-legacy Initialized notification for 2025-era clients. Remove when v1 EOL. */
+      case "notifications/initialized":
+        if (!MCP_LEGACY_SUPPORT_ENABLED) return null;
+        this.kickDiscoveryAfterInitialized().catch(() => {
+        });
+        return null;
+      case "notifications/cancelled":
+        return null;
+      // No-op for MCP spec compliance
+      case "server/discover":
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            resultType: "complete",
+            supportedVersions: MCP_LEGACY_SUPPORT_ENABLED ? [MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY] : [MCP_PROTOCOL_VERSION],
+            capabilities: {
+              tools: { listChanged: true },
+              resources: { listChanged: true },
+              prompts: { listChanged: true }
+            },
+            serverInfo: this.liopServer.getServerInfo()
+          }
+        };
+      case "ping":
+        return { jsonrpc: "2.0", id, result: {} };
+      case "tools/list": {
+        const localTools = this.liopServer.listTools();
+        const remoteTools = await this.getRemoteTools();
+        const listedLocals = mcpCompactToolDescriptions() ? localTools.map((t) => ({
+          ...t,
+          description: stripVerboseLiopToolDescription(t.description ?? "")
+        })) : localTools;
+        log.info(
+          `[LIOP-Router] tools/list: ${localTools.length} local, ${remoteTools.length} remote tools found`
+        );
+        const diagnosticTool = {
+          name: "LiopMeshStatus",
+          description: "LiopMeshStatus: Returns the current dynamic diagnostic status of the Zero-Trust Neural Mesh.",
+          inputSchema: {
+            type: "object",
+            properties: {},
+            additionalProperties: false
+          }
+        };
+        const allTools = [diagnosticTool, ...listedLocals, ...remoteTools].sort(
+          (a, b) => a.name.localeCompare(b.name)
+        );
+        const telemetry = TokenTelemetryEngine.getInstance();
+        const toolsPayload = JSON.stringify(allTools);
+        const toolsResponsePayload = JSON.stringify({ tools: allTools });
+        telemetry.record({
+          type: "tools_list",
+          method: "tools/list",
+          estimatedInputTokens: telemetry.countTokens(toolsPayload),
+          estimatedOutputTokens: telemetry.countTokens(toolsResponsePayload)
+        });
+        const era = this.detectEra(request);
+        let response = {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            resultType: "complete",
+            ttlMs: 3e5,
+            cacheScope: "public",
+            tools: allTools
+          }
+        };
+        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+          response = adaptResponseForLegacyClient(response);
+        }
+        return response;
+      }
+      case "tools/call": {
+        const response = await this.transcodeMcpToLiop(
+          id,
+          params,
+          authInfo?.token
+        );
+        if (!response) return null;
+        const era = this.detectEra(request);
+        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+          return adaptResponseForLegacyClient(response);
+        }
+        if (response.result && typeof response.result === "object") {
+          const resObj = response.result;
+          if (!resObj.resultType) {
+            resObj.resultType = "complete";
+          }
+        }
+        return response;
+      }
+      case "resources/list": {
+        const localResources = this.liopServer.listResources();
+        const remoteResources = await this.getRemoteResources();
+        const allResources = [...localResources, ...remoteResources].sort(
+          (a, b) => a.uri.localeCompare(b.uri)
+        );
+        const rlTelemetry = TokenTelemetryEngine.getInstance();
+        const rlPayload = JSON.stringify(allResources);
+        rlTelemetry.record({
+          type: "resource_list",
+          method: "resources/list",
+          estimatedInputTokens: 0,
+          estimatedOutputTokens: rlTelemetry.countTokens(rlPayload)
+        });
+        const era = this.detectEra(request);
+        let response = {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            resultType: "complete",
+            ttlMs: 3e5,
+            cacheScope: "public",
+            resources: allResources
+          }
+        };
+        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+          response = adaptResponseForLegacyClient(response);
+        }
+        return response;
+      }
+      case "resources/read": {
+        const typedParams = params;
+        if (!typedParams?.uri)
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: { code: -32602, message: "Missing resource uri" }
+          };
+        try {
+          const rrStartTime = Date.now();
+          const result = await this.liopServer.readResource(typedParams.uri);
+          const rrTelemetry = TokenTelemetryEngine.getInstance();
+          const rrOutputPayload = JSON.stringify(result);
+          rrTelemetry.record({
+            type: "resource_read",
+            method: "resources/read",
+            toolName: typedParams.uri,
+            estimatedInputTokens: rrTelemetry.countTokens(typedParams.uri),
+            estimatedOutputTokens: rrTelemetry.countTokens(rrOutputPayload),
+            durationMs: Date.now() - rrStartTime
+          });
+          const era = this.detectEra(request);
+          const rawResult = typeof result === "object" && result !== null ? {
+            resultType: "complete",
+            ttlMs: 6e4,
+            cacheScope: "private",
+            ...result
+          } : {
+            resultType: "complete",
+            ttlMs: 6e4,
+            cacheScope: "private",
+            contents: result
+          };
+          let response = { jsonrpc: "2.0", id, result: rawResult };
+          if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+            response = adaptResponseForLegacyClient(response);
+          }
+          return response;
+        } catch (err) {
+          const targetUri = typedParams.uri;
+          for (const { manifest } of this.manifestCache.values()) {
+            const remoteResource = manifest.resources.find(
+              (r) => r.uri === targetUri
+            );
+            if (remoteResource) {
+              log.info(
+                `[LIOP-Router] Resolved resource ${targetUri} from cache (Peer: ${manifest.peerId})`
+              );
+              const era = this.detectEra(request);
+              let response = {
+                jsonrpc: "2.0",
+                id,
+                result: {
+                  resultType: "complete",
+                  ttlMs: 6e4,
+                  cacheScope: "private",
+                  contents: [
+                    {
+                      uri: remoteResource.uri,
+                      mimeType: remoteResource.mimeType || "text/plain",
+                      text: remoteResource.text || remoteResource.description || "No content provided"
+                    }
+                  ]
+                }
+              };
+              if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+                response = adaptResponseForLegacyClient(response);
+              }
+              return response;
+            }
+          }
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: {
+              code: -32e3,
+              message: err instanceof Error ? err.message : String(err)
+            }
+          };
+        }
+      }
+      case "prompts/list": {
+        const promptsList = this.liopServer.listPrompts().sort((a, b) => a.name.localeCompare(b.name));
+        const plTelemetry = TokenTelemetryEngine.getInstance();
+        const plPayload = JSON.stringify(promptsList);
+        plTelemetry.record({
+          type: "prompt_list",
+          method: "prompts/list",
+          estimatedInputTokens: 0,
+          estimatedOutputTokens: plTelemetry.countTokens(plPayload)
+        });
+        const era = this.detectEra(request);
+        let response = {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            resultType: "complete",
+            ttlMs: 3e5,
+            cacheScope: "public",
+            prompts: promptsList
+          }
+        };
+        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+          response = adaptResponseForLegacyClient(response);
+        }
+        return response;
+      }
+      case "prompts/get": {
+        const typedParams = params;
+        if (!typedParams?.name)
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: { code: -32602, message: "Missing prompt name" }
+          };
+        try {
+          const pgStartTime = Date.now();
+          const result = await this.liopServer.getPrompt({
+            name: typedParams.name,
+            arguments: typedParams.arguments || {}
+          });
+          const pgTelemetry = TokenTelemetryEngine.getInstance();
+          const pgInputPayload = JSON.stringify({
+            name: typedParams.name,
+            arguments: typedParams.arguments
+          });
+          const pgOutputPayload = JSON.stringify(result);
+          pgTelemetry.record({
+            type: "prompt_get",
+            method: "prompts/get",
+            toolName: typedParams.name,
+            estimatedInputTokens: pgTelemetry.countTokens(pgInputPayload),
+            estimatedOutputTokens: pgTelemetry.countTokens(pgOutputPayload),
+            durationMs: Date.now() - pgStartTime
+          });
+          const era = this.detectEra(request);
+          const rawResult = typeof result === "object" && result !== null ? { resultType: "complete", ...result } : result;
+          let response = { jsonrpc: "2.0", id, result: rawResult };
+          if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+            response = adaptResponseForLegacyClient(response);
+          }
+          return response;
+        } catch (err) {
+          return {
+            jsonrpc: "2.0",
+            id,
+            error: {
+              code: -32e3,
+              message: err instanceof Error ? err.message : String(err)
+            }
+          };
+        }
+      }
+      case "resources/templates/list": {
+        const era = this.detectEra(request);
+        let response = {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            resultType: "complete",
+            ttlMs: 3e5,
+            cacheScope: "public",
+            resourceTemplates: []
+          }
+        };
+        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+          response = adaptResponseForLegacyClient(response);
+        }
+        return response;
+      }
+      case "subscriptions/listen": {
+        const era = this.detectEra(request);
+        let response = {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            resultType: "complete"
+          }
+        };
+        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
+          response = adaptResponseForLegacyClient(response);
+        }
+        return response;
+      }
+      default:
+        return {
+          jsonrpc: "2.0",
+          id,
+          error: { code: -32601, message: `Method not found: ${method}` }
+        };
+    }
+  }
+  /**
+   * MCP clients often send notifications/initialized then immediately tools/list.
+   * Start manifest discovery without blocking the notification handler.
+   */
+  kickDiscoveryAfterInitialized() {
+    return (async () => {
+      await new Promise((r) => setTimeout(r, 250));
+      await Promise.race([
+        this.refreshManifestCache(true),
+        new Promise((r) => setTimeout(r, 15e3))
+      ]).catch(() => {
+      });
+    })();
+  }
+  /**
+   * Discovers and caches manifests from all remote LIOP providers in the mesh.
+   * Uses Kademlia DHT to find "liop:manifest" providers, then opens
+   * /liop/manifest/1.0.0 protocol streams to retrieve their full metadata.
+   */
+  async refreshManifestCache(silent = false) {
+    if (!this.meshNode) return;
+    if (this.currentDiscovery) return this.currentDiscovery;
+    if (!silent && this.manifestCache.size > 0) {
+      const now = Date.now();
+      const allFresh = Array.from(this.manifestCache.values()).every(
+        ({ cachedAt }) => now - cachedAt < MANIFEST_CACHE_TTL_S * 1e3
+      );
+      if (allFresh) return;
+    }
+    this.currentDiscovery = (async () => {
+      try {
+        const prevCount = Array.from(this.manifestCache.values()).reduce(
+          (acc, { manifest }) => acc + manifest.tools.length,
+          0
+        );
+        if (this.manifestCache.size === 0) {
+          for (let i = 0; i < 3; i++) {
+            const connections = (
+              // biome-ignore lint/suspicious/noExplicitAny: access internal nodes for connection count
+              this.meshNode.node?.getConnections().length || 0
+            );
+            if (connections > 0) {
+              log.info(
+                `[LIOP-Router] P2P Connection established. Starting discovery...`
+              );
+              break;
+            }
+            log.info(
+              `[LIOP-Router] Waiting for P2P connections (attempt ${i + 1}/10)...`
+            );
+            await new Promise((r) => setTimeout(r, 1e3));
+          }
+        }
+        let providerIds = [];
+        const MAX_COLD_ATTEMPTS = this.manifestCache.size === 0 ? 5 : 1;
+        for (let coldAttempt = 0; coldAttempt < MAX_COLD_ATTEMPTS; coldAttempt++) {
+          for (let attempt = 0; attempt < MANIFEST_DISCOVERY_RETRIES; attempt++) {
+            providerIds = await this.meshNode?.discoverManifestProviders() || [];
+            const selfId2 = this.meshNode?.getPeerId();
+            const remoteIds = providerIds.filter((id) => id !== selfId2);
+            if (remoteIds.length > 0) break;
+            if (attempt < MANIFEST_DISCOVERY_RETRIES - 1) {
+              log.info(
+                `[LIOP-Router] DHT discovery attempt ${attempt + 1}/${MANIFEST_DISCOVERY_RETRIES}...`
+              );
+              await new Promise((r) => setTimeout(r, 1e3));
+            }
+          }
+          const activePeers = (
+            // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
+            this.meshNode.node?.getConnections().map(
+              (c) => c.remotePeer.toString()
+            ) || []
+          );
+          if (activePeers.length > 0) {
+            providerIds = Array.from(/* @__PURE__ */ new Set([...providerIds, ...activePeers]));
+          }
+          const selfIdEnd = this.meshNode?.getPeerId();
+          const remoteIdsEnd = providerIds.filter((id) => id !== selfIdEnd);
+          if (remoteIdsEnd.length > 0) break;
+          if (coldAttempt < MAX_COLD_ATTEMPTS - 1) {
+            log.info(
+              `[LIOP-Router] Initial discovery failed (0 providers). Retrying in 1s (${coldAttempt + 1}/${MAX_COLD_ATTEMPTS})...`
+            );
+            await new Promise((r) => setTimeout(r, 1e3));
+          }
+        }
+        if (providerIds.length === 0) {
+          log.info(
+            `[LIOP-Router] No manifest providers found after all attempts.`
+          );
+          return;
+        }
+        if (!silent) {
+          log.info(
+            `[LIOP-Router] Discovered ${providerIds.length} candidate manifest providers`
+          );
+        }
+        const connectedPeers = new Set(
+          // biome-ignore lint/suspicious/noExplicitAny: internal node access for fast peer ordering
+          (this.meshNode.node?.getConnections?.() || []).map(
+            (c) => c.remotePeer.toString()
+          )
+        );
+        providerIds = [...providerIds].sort((a, b) => {
+          const aConnected = connectedPeers.has(a) ? 1 : 0;
+          const bConnected = connectedPeers.has(b) ? 1 : 0;
+          return bConnected - aConnected;
+        });
+        let successCount = 0;
+        let errorCount = 0;
+        let cacheUpdated = false;
+        const selfId = this.meshNode?.getPeerId();
+        const eligiblePeers = providerIds.filter((peerId) => {
+          if (!this.meshNode) return false;
+          if (peerId === selfId) return false;
+          if (this.shouldSkipManifestQuery(peerId)) return false;
+          const cached = this.manifestCache.get(peerId);
+          if (cached && Date.now() - cached.cachedAt < MANIFEST_CACHE_TTL_S * 1e3) {
+            successCount++;
+            return false;
+          }
+          return true;
+        });
+        const queryResults = await Promise.allSettled(
+          eligiblePeers.map(async (peerId) => {
+            if (!this.meshNode) return null;
+            log.info(`[LIOP-Router] Querying manifest from: ${peerId}`);
+            return {
+              peerId,
+              manifest: await this.meshNode.queryManifest(peerId)
+            };
+          })
+        );
+        for (const result of queryResults) {
+          if (result.status === "fulfilled" && result.value?.manifest) {
+            const { peerId, manifest } = result.value;
+            if (manifest.pqcSignature && manifest.pqcPublicKey) {
+              const isValid = Dilithium65Wrapper.verifyManifest(
+                manifest,
+                manifest.pqcSignature,
+                manifest.pqcPublicKey
+              );
+              if (!isValid) {
+                log.warn(
+                  `[LIOP-Router] \u26A0\uFE0F Tampered manifest rejected for peer ${peerId} (ML-DSA-65 signature invalid)`
+                );
+                this.recordManifestQueryFailure(peerId);
+                errorCount++;
+                continue;
+              }
+              log.info(
+                `[LIOP-Router] \u{1F512} ML-DSA-65 (FIPS 204) Manifest attestation verified for peer ${peerId}`
+              );
+            }
+            this.manifestCache.set(peerId, {
+              manifest,
+              cachedAt: Date.now()
+            });
+            this.recordManifestQuerySuccess(peerId);
+            cacheUpdated = true;
+            successCount++;
+            log.info(
+              `[LIOP-Router] Manifest received from ${peerId} (${manifest.tools.length} tools)`
+            );
+          } else if (result.status === "fulfilled" && result.value) {
+            this.recordManifestQueryFailure(result.value.peerId);
+            errorCount++;
+            log.info(
+              `[LIOP-Router] Manifest query returned NULL for ${result.value.peerId}`
+            );
+          } else if (result.status === "rejected") {
+            errorCount++;
+            log.info(
+              `[LIOP-Router] Fatal error querying manifest:`,
+              result.reason instanceof Error ? result.reason.message : String(result.reason)
+            );
+          }
+        }
+        this._discoveryStats = {
+          candidates: providerIds.length,
+          success: successCount,
+          failures: errorCount,
+          lastDiscovery: Date.now()
+        };
+        if (cacheUpdated) {
+          const newCount = Array.from(this.manifestCache.values()).reduce(
+            (acc, { manifest }) => acc + manifest.tools.length,
+            0
+          );
+          if (newCount !== prevCount && this.onToolsChanged) {
+            process.stderr.write(
+              "[LIOP-Router] Mesh topology updated! Emitting notifications/tools/list_changed.\n"
+            );
+            this.onToolsChanged();
+          }
+        }
+      } finally {
+        this.currentDiscovery = null;
+      }
+    })();
+    return this.currentDiscovery;
+  }
+  /**
+   * Returns the current manifest cache size for external telemetry.
+   * Used by the adaptive polling system to detect topology stabilization.
+   */
+  getCacheSize() {
+    return this.manifestCache.size;
+  }
+  /**
+   * Returns all remote tools discovered via the manifest protocol.
+   */
+  async getRemoteTools() {
+    const EXPECTED_PROVIDERS = Number.parseInt(
+      process.env.LIOP_EXPECTED_PROVIDERS ?? "1",
+      10
+    );
+    if (this.manifestCache.size < EXPECTED_PROVIDERS && this.meshNode) {
+      const initialTimeoutMs = Number.parseInt(
+        process.env.LIOP_INITIAL_DISCOVERY_TIMEOUT_MS ?? "8000",
+        10
+      );
+      const boundedTimeoutMs = Number.isFinite(initialTimeoutMs) && initialTimeoutMs > 0 ? initialTimeoutMs : 12e3;
+      const deadline = Date.now() + boundedTimeoutMs;
+      let stableCount = 0;
+      let lastCacheSize = -1;
+      while (Date.now() < deadline) {
+        if (this.manifestCache.size >= EXPECTED_PROVIDERS) break;
+        await Promise.race([
+          this.refreshManifestCache(true),
+          new Promise((resolve) => setTimeout(resolve, 3e3))
+        ]).catch(() => {
+        });
+        if (this.manifestCache.size >= EXPECTED_PROVIDERS) break;
+        if (this.manifestCache.size === lastCacheSize) {
+          stableCount++;
+          if (stableCount >= 3 && this.manifestCache.size > 0) {
+            log.info(
+              `[LIOP-Router] Provider count stabilized at ${this.manifestCache.size}/${EXPECTED_PROVIDERS}. Proceeding with available mesh.`
+            );
+            break;
+          }
+        } else {
+          stableCount = 0;
+          lastCacheSize = this.manifestCache.size;
+        }
+        await new Promise((r) => setTimeout(r, 1e3));
+      }
+      if (this.manifestCache.size < EXPECTED_PROVIDERS) {
+        log.info(
+          `[LIOP-Router] \u26A0\uFE0F Mesh partially available: ${this.manifestCache.size}/${EXPECTED_PROVIDERS} providers. Some tools may be unavailable. Check Docker containers.`
+        );
+        this.refreshManifestCache(true).catch(() => {
+        });
+      }
+    }
+    const tools = [];
+    const seenNames = /* @__PURE__ */ new Set();
+    const localToolNames = new Set(
+      this.liopServer.listTools().map((t) => t.name)
+    );
+    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
+      for (const tool of manifest.tools) {
+        if (tool.name === "LiopMeshStatus") continue;
+        let finalName = tool.name;
+        if (seenNames.has(tool.name) || localToolNames.has(tool.name)) {
+          finalName = `${tool.name}_${peerId.slice(-4)}`;
+        }
+        seenNames.add(finalName);
+        const providerName = manifest.serverInfo?.name || "Unknown Provider";
+        const baseDesc = tool.description || `Remote tool from ${providerName}`;
+        const cleanTool = {
+          name: finalName,
+          description: mcpCompactToolDescriptions() ? stripVerboseLiopToolDescription(baseDesc) : baseDesc,
+          inputSchema: tool.inputSchema || {
+            type: "object",
+            properties: {}
+          }
+        };
+        if (typeof cleanTool.inputSchema === "object" && !cleanTool.inputSchema.type) {
+          cleanTool.inputSchema.type = "object";
+        }
+        if (typeof cleanTool.inputSchema === "object" && !cleanTool.inputSchema.properties) {
+          cleanTool.inputSchema.properties = {};
+        }
+        let blueprint = "";
+        if (manifest.taxonomy) {
+          blueprint = `
+[LIOP-DOMAIN: ${manifest.taxonomy.domain}]`;
+        }
+        const properties = cleanTool.inputSchema.properties || {};
+        let envelopeDoc = "";
+        if (!mcpCompactToolDescriptions() && properties.payload) {
+          envelopeDoc = `
+[REQUIRES: LIOP-PROTO-V1 ENVELOPE]`;
+        }
+        if (!mcpCompactToolDescriptions() && cleanTool.description.includes("STRICT SCHEMA ADHERENCE")) {
+          cleanTool.description = cleanTool.description.replace(
+            "STRICT SCHEMA ADHERENCE:",
+            "[INDUSTRIAL-REQUISITE] STRICT SCHEMA ADHERENCE (MANDATORY):"
+          );
+        }
+        const originStamp = mcpCompactToolDescriptions() ? `
+(Peer: ${peerId.slice(-8)})${blueprint}` : `
+(Origin: ${peerId.slice(-8)})${blueprint}${envelopeDoc}`;
+        cleanTool.description = `${cleanTool.description}${originStamp}`;
+        tools.push(cleanTool);
+      }
+    }
+    return tools;
+  }
+  /**
+   * Returns all remote resources discovered via the manifest protocol.
+   */
+  async getRemoteResources() {
+    if (!this.currentDiscovery) {
+      this.refreshManifestCache(true).catch(() => {
+      });
+    }
+    const resources = [];
+    const seenUris = new Set(this.liopServer.listResources().map((r) => r.uri));
+    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
+      for (const resource of manifest.resources) {
+        if (!seenUris.has(resource.uri)) {
+          const augmentedResource = { ...resource };
+          const providerName = manifest.serverInfo?.name || "Unknown Provider";
+          let blueprint = "";
+          if (manifest.taxonomy) {
+            blueprint = `
+
+[LIOP Zero-Trust Blueprint]
+Domain: ${manifest.taxonomy.domain}
+Clearance Tier: ${manifest.taxonomy.clearanceTier}`;
+            if (manifest.taxonomy.executionTypes && manifest.taxonomy.executionTypes.length > 0) {
+              blueprint += `
+Execution Types: ${manifest.taxonomy.executionTypes.join(", ")}`;
+            }
+          }
+          const originStamp = `
+
+[LIOP Zero-Trust Origin]
+Provider: ${providerName}
+Network ID: ${peerId}${blueprint}`;
+          if (augmentedResource.uri.startsWith("liop://schema/")) {
+            augmentedResource.name = `[SCHEMA] ${augmentedResource.name}`;
+            augmentedResource.description = `[CRITICAL SCHEMA] ${augmentedResource.description || "Data Dictionary for Zero-Shot Autonomy"}${originStamp}`;
+          } else {
+            augmentedResource.description = augmentedResource.description ? `${augmentedResource.description}${originStamp}` : originStamp.trim();
+          }
+          resources.push(augmentedResource);
+          seenUris.add(resource.uri);
+        }
+      }
+    }
+    return resources;
+  }
+  /**
+   * Resolves the gRPC target (host:port) AND the peerId for a given tool name
+   * by searching the manifest cache. Supports exact names and suffixed names.
+   */
+  resolveManifestTarget(toolName) {
+    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
+      const tool = manifest.tools.find((t) => t.name === toolName);
+      if (tool) {
+        return {
+          peerId,
+          originalToolName: toolName
+        };
+      }
+    }
+    const parts = toolName.split("_");
+    if (parts.length > 1) {
+      const suffix = parts.pop();
+      const baseName = parts.join("_");
+      for (const [peerId, { manifest }] of this.manifestCache.entries()) {
+        if (peerId.endsWith(suffix || "")) {
+          const tool = manifest.tools.find((t) => t.name === baseName);
+          if (tool) {
+            return {
+              peerId,
+              originalToolName: baseName
+            };
+          }
+        }
+      }
+    }
+    return null;
+  }
+  /**
+   * Redacts a PeerID for external-facing diagnostics.
+   * LIOP_DIAGNOSTIC_LEVEL controls verbosity:
+   *   - "redacted" (default): truncated to last 8 chars
+   *   - "full": complete PeerID (development only)
+   */
+  redactPeerId(peerId) {
+    const level = process.env.LIOP_DIAGNOSTIC_LEVEL || "redacted";
+    if (level === "full") return peerId;
+    return `***${peerId.slice(-8)}`;
+  }
+  async transcodeMcpToLiop(id, params, token) {
+    const toolName = params.name;
+    if (toolName === "LiopMeshStatus") {
+      this.refreshManifestCache(true).catch(() => {
+      });
+      const stats = this._discoveryStats || {
+        candidates: 0,
+        success: 0,
+        failures: 0
+      };
+      const providerCount = this.manifestCache.size;
+      const meshState = this.meshNode ? "Active" : "Offline";
+      const cachedTools = Array.from(this.manifestCache.values()).reduce(
+        (acc, { manifest }) => acc + manifest.tools.length,
+        0
+      );
+      const connections = this.meshNode ? (
+        // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
+        this.meshNode.node?.getConnections().length
+      ) : 0;
+      const bootstrapNodes = this.meshNode && // biome-ignore lint/suspicious/noExplicitAny: access internal config
+      this.meshNode.config?.bootstrapNodes ? (
+        // biome-ignore lint/suspicious/noExplicitAny: access internal config
+        this.meshNode.config.bootstrapNodes
+      ) : [];
+      const bootstrapCount = bootstrapNodes.length;
+      const diagLevel = process.env.LIOP_DIAGNOSTIC_LEVEL || "redacted";
+      const showBootstraps = diagLevel !== "minimal";
+      const bootstrapList = showBootstraps ? bootstrapNodes.map((addr) => {
+        const parts = addr.split("/");
+        const id2 = parts[parts.length - 1];
+        return `  \u2022 ${id2 ? id2.slice(-8) : "Unknown"} (bootstrap)`;
+      }).join("\n") : "";
+      const routingTableSize = this.meshNode ? (
+        // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
+        this.meshNode.getRoutingTableSize()
+      ) : 0;
+      const rawPeerId = this.meshNode?.getPeerId() || "Offline";
+      const localPeerId = rawPeerId === "Offline" ? rawPeerId : this.redactPeerId(rawPeerId);
+      const cachedToolList = Array.from(this.manifestCache.entries()).flatMap(
+        ([peerId, { manifest }]) => manifest.tools.map(
+          (t) => `  \u2022 ${t.name} (from origin: ${this.redactPeerId(peerId)})`
+        )
+      ).join("\n");
+      const statusText = [
+        `LIOP Mesh Status: ${meshState === "Active" ? "Active" : "Offline"}`,
+        `Local Agent Identity: ${localPeerId}`,
+        `Network: ${connections} Conns | ${routingTableSize} Mesh Nodes | ${bootstrapCount} Bootstraps`,
+        showBootstraps && bootstrapCount > 0 ? `
+Active Bootstraps:
+${bootstrapList}
+` : "",
+        `Discovery: ${stats.candidates} Candidates | ${stats.success} OK | ${stats.failures} FAIL`,
+        `Tooling: ${providerCount} Providers | ${cachedTools} Total Remote Tools`,
+        cachedTools > 0 ? `
+Discovered Remote Tools (Zero-Trust Origins):
+${cachedToolList}` : "\nNo remote tools discovered yet.",
+        // [Token Economy] Telemetry block (only appears when operations exist)
+        TokenTelemetryEngine.getInstance().formatStatusBlock()
+      ].filter((line) => line !== "").join("\n");
+      const diagTelemetry = TokenTelemetryEngine.getInstance();
+      diagTelemetry.record({
+        type: "diagnostic",
+        method: "tools/call",
+        toolName: "LiopMeshStatus",
+        estimatedInputTokens: 0,
+        estimatedOutputTokens: diagTelemetry.countTokens(statusText)
+      });
+      return {
+        jsonrpc: "2.0",
+        id,
+        result: {
+          content: [
+            {
+              type: "text",
+              text: statusText
+            }
+          ]
+        }
+      };
+    }
+    const isLocal = this.liopServer.listTools().some((t) => t.name === toolName);
+    if (!isLocal && this.meshNode) {
+      let target = this.resolveManifestTarget(toolName);
+      if (!target) {
+        await this.refreshManifestCache();
+        target = this.resolveManifestTarget(toolName);
+      }
+      if (target) {
+        log.info(
+          `[LIOP-Router] Resolved ${toolName} via manifest cache (Peer: ${target.peerId}, Original: ${target.originalToolName})`
+        );
+        const manifestEntry = this.manifestCache.get(target.peerId);
+        let effectiveToken = token;
+        if (manifestEntry?.manifest.authRequired) {
+          const resolvedToken = token || await this.getOrAcquireMeshAgentToken(target.peerId);
+          if (!resolvedToken) {
+            const providerName = manifestEntry.manifest.serverInfo?.name?.toLowerCase() || "unknown";
+            const slug = manifestEntry.manifest.tokenSlug;
+            const shortId = target.peerId.slice(-8).toUpperCase();
+            const primaryVar = slug ? `LIOP_TOKEN_${slug}` : `LIOP_TOKEN_${providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
+            return {
+              jsonrpc: "2.0",
+              id,
+              result: {
+                content: [
+                  {
+                    type: "text",
+                    text: `Authentication Required: The restricted node (${providerName}) requires an access token. Please define the ${primaryVar} or LIOP_TOKEN_${shortId} environment variable on your agent/client host.`
+                  }
+                ],
+                isError: true
+              }
+            };
+          }
+          effectiveToken = resolvedToken;
+        }
+        return this.routeToRemoteProvider(
+          id,
+          target.originalToolName,
+          target.peerId,
+          params,
+          effectiveToken
+        );
+      }
+      let providers = [];
+      for (let i = 0; i < 3; i++) {
+        providers = await this.meshNode.findProviders(toolName);
+        if (providers.length > 0) break;
+        if (i < 2) await new Promise((r) => setTimeout(r, 1e3));
+      }
+      if (providers.length > 0) {
+        return this.routeToRemoteProvider(
+          id,
+          toolName,
+          providers[0],
+          params,
+          token
+        );
+      }
+    }
+    if (isLocal) {
+      try {
+        const localStartTime = Date.now();
+        const result = await this.liopServer.callTool({
+          name: toolName,
+          arguments: params.arguments || {}
+        });
+        const localTelemetry = TokenTelemetryEngine.getInstance();
+        const localInputPayload = JSON.stringify(params.arguments || {});
+        const localOutputPayload = JSON.stringify(result);
+        localTelemetry.record({
+          type: "tool_call",
+          method: "tools/call",
+          toolName,
+          estimatedInputTokens: localTelemetry.countTokens(localInputPayload),
+          estimatedOutputTokens: localTelemetry.countTokens(localOutputPayload),
+          durationMs: Date.now() - localStartTime
+        });
+        return { jsonrpc: "2.0", id, result };
+      } catch (err) {
+        return {
+          jsonrpc: "2.0",
+          id,
+          error: {
+            code: -32e3,
+            message: err instanceof Error ? err.message : String(err)
+          }
+        };
+      }
+    }
+    return {
+      jsonrpc: "2.0",
+      id,
+      error: {
+        code: -32002,
+        message: `No provider found for tool: ${toolName}. Ensure the provider node is active and connected to the mesh.`
+      }
+    };
+  }
+  async routeToRemoteProvider(id, toolName, peerId, params, token) {
+    if (!this.meshNode)
+      return {
+        jsonrpc: "2.0",
+        id,
+        error: { code: -32603, message: "Mesh Node inactive" }
+      };
+    let manifestEntry = this.manifestCache.get(peerId);
+    let grpcPort = this.defaultRpcPort;
+    if (manifestEntry) {
+      grpcPort = manifestEntry.manifest.grpcPort;
+    } else {
+      const manifest = await this.meshNode.queryManifest(peerId);
+      if (manifest) {
+        grpcPort = manifest.grpcPort;
+        this.manifestCache.set(peerId, {
+          manifest,
+          cachedAt: Date.now()
+        });
+        manifestEntry = this.manifestCache.get(peerId);
+      }
+    }
+    const addrs = await this.meshNode.resolvePeer(peerId);
+    const nexusUrl = process.env.LIOP_NEXUS_URL || "";
+    const isDockerDemo = nexusUrl.includes("127.0.0.1:13000") || nexusUrl.includes("localhost:13000") || nexusUrl.includes("127.0.0.1:13001") || nexusUrl.includes("localhost:13001");
+    const isDockerPort = addrs.some(
+      (a) => a.includes("13001") || a.includes("13003") || a.includes("13004") || a.includes("13005") || a.includes("13011") || a.includes("13021") || a.includes("13031")
+    );
+    const shouldRemapGrpcPorts = process.env.LIOP_USE_PUBLISHED_GRPC_PORTS === "1" || process.env.LIOP_DOCKER_MAP === "true" || process.env.LIOP_DEV_MODE === "true" || process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test" || isDockerDemo || isDockerPort;
+    if (shouldRemapGrpcPorts) {
+      const providerName = manifestEntry?.manifest?.serverInfo?.name?.toLowerCase() || "";
+      const tn = toolName.toLowerCase();
+      if (providerName.includes("vault") || tn.includes("medical")) {
+        grpcPort = 13011;
+      } else if (providerName.includes("bank") || tn.includes("bank")) {
+        grpcPort = 13021;
+      } else if (providerName.includes("oracle") || tn.includes("hft") || tn.includes("market")) {
+        grpcPort = 13031;
+      }
+    }
+    let targetAddr = null;
+    if (shouldRemapGrpcPorts) {
+      targetAddr = `127.0.0.1:${grpcPort}`;
+    } else {
+      const os = await import('os');
+      const localInterfaces = Object.values(os.networkInterfaces()).flat().filter((i) => i?.family === "IPv4").map((i) => i?.address);
+      for (const addr of addrs) {
+        const parts = addr.split("/");
+        const ipIdx = parts.indexOf("ip4");
+        if (ipIdx !== -1) {
+          const advertisedIp = parts[ipIdx + 1];
+          if (advertisedIp === "127.0.0.1" || localInterfaces.includes(advertisedIp)) {
+            targetAddr = `127.0.0.1:${grpcPort}`;
+            break;
+          }
+          if (!targetAddr) {
+            targetAddr = `${advertisedIp}:${grpcPort}`;
+          }
+        }
+      }
+    }
+    if (!targetAddr) {
+      targetAddr = `127.0.0.1:${grpcPort}`;
+    }
+    log.info(
+      `[LIOP-Router] Dynamic route: ${toolName} -> ${targetAddr} (PeerID: ${peerId})`
+    );
+    const remoteClient = new liopV1.LogicMesh(
+      targetAddr,
+      createChannelCredentials(),
+      GRPC_CHANNEL_OPTIONS
+    );
+    return this.performTranscoding(
+      id,
+      remoteClient,
+      toolName,
+      params,
+      peerId,
+      token
+    );
+  }
+  /** Cached M2M token for dynamic gateway-to-node routing */
+  meshAgentToken;
+  /**
+   * Dynamically acquires an M2M access token from the Nexus Authorization Server.
+   * If peerId is provided, checks if there are node-specific environment tokens
+   * before falling back to the global static token or Nexus acquisition.
+   */
+  async getOrAcquireMeshAgentToken(peerId) {
+    if (peerId) {
+      const manifestEntry = this.manifestCache.get(peerId);
+      const providerName = manifestEntry?.manifest.serverInfo?.name?.toLowerCase() || "";
+      let nodeToken;
+      const slug = manifestEntry?.manifest.tokenSlug;
+      if (slug) {
+        const envKey = `LIOP_TOKEN_${slug}`;
+        nodeToken = process.env[envKey] || process.env[`LIOP_OAUTH_TOKEN_${slug}`];
+        log.info(
+          `[LIOP-Router] Step0 tokenSlug=${slug} envKey=${envKey} found=${!!nodeToken} peer=${peerId.slice(-8)}`
+        );
+      } else {
+        log.info(
+          `[LIOP-Router] Step0 tokenSlug=MISSING (manifest has no tokenSlug) peer=${peerId.slice(-8)} provider=${providerName}`
+        );
+      }
+      if (!nodeToken) {
+        const shortId = peerId.slice(-8).toUpperCase();
+        nodeToken = process.env[`LIOP_TOKEN_${shortId}`] || process.env[`LIOP_OAUTH_TOKEN_${shortId}`];
+      }
+      if (!nodeToken && providerName) {
+        const cleanName = providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        nodeToken = process.env[`LIOP_TOKEN_${cleanName}`] || process.env[`LIOP_OAUTH_TOKEN_${cleanName}`];
+      }
+      if (nodeToken) {
+        log.info(
+          `[LIOP-Router] Resolved node-specific token for peer ${peerId.slice(-8)} (${providerName || "unknown"})`
+        );
+        return nodeToken;
+      }
+    }
+    if (this.meshAgentToken) return this.meshAgentToken;
+    const staticToken = process.env.LIOP_OAUTH_TOKEN || process.env.LIOP_TOKEN;
+    if (staticToken) {
+      this.meshAgentToken = staticToken;
+      return this.meshAgentToken;
+    }
+    const nexusUrl = process.env.LIOP_NEXUS_URL;
+    if (!nexusUrl) return void 0;
+    const clientId = process.env.LIOP_OAUTH_CLIENT_ID || process.env.LIOP_CLIENT_ID || "liop-mesh-agent";
+    const clientSecret = process.env.LIOP_OAUTH_CLIENT_SECRET || process.env.LIOP_CLIENT_SECRET || "dev-secret-change-me";
+    const audience = process.env.LIOP_OAUTH_AUDIENCE || process.env.LIOP_AUDIENCE || "urn:liop:mesh:api";
+    try {
+      const baseUrl = nexusUrl.endsWith("/oidc") ? nexusUrl : `${nexusUrl}/oidc`;
+      const tokenUrl = `${baseUrl}/token`;
+      log.info(
+        `[LIOP-Router] Proactively acquiring M2M token from Nexus: ${tokenUrl}`
+      );
+      const params = new URLSearchParams({
+        grant_type: "client_credentials",
+        scope: "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query",
+        resource: audience,
+        client_id: clientId,
+        client_secret: clientSecret
+      });
+      const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: params.toString()
+      });
+      if (!response.ok) {
+        const text = await response.text();
+        log.warn(
+          `[LIOP-Router] M2M Token acquisition failed: ${response.status} ${text}`
+        );
+        return void 0;
+      }
+      const data = await response.json();
+      if (data.access_token) {
+        this.meshAgentToken = data.access_token;
+        log.info(
+          "[LIOP-Router] M2M Token acquired successfully for router routing."
+        );
+        return this.meshAgentToken;
+      }
+    } catch (err) {
+      log.warn(
+        `[LIOP-Router] Failed to acquire M2M token: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    return void 0;
+  }
+  async performTranscoding(id, client, toolName, params, peerId, token) {
+    const capabilityHash = toolName;
+    const proofOfIntent = this.meshNode ? await this.meshNode.sign(Buffer.from(capabilityHash)) : Buffer.from([]);
+    const transcodingStartTime = Date.now();
+    let activeToken = token;
+    if (!activeToken) {
+      activeToken = await this.getOrAcquireMeshAgentToken(peerId);
+    }
+    if (peerId) {
+      const manifestEntry = this.manifestCache.get(peerId);
+      if (manifestEntry?.manifest.authRequired && !activeToken) {
+        const providerName = manifestEntry.manifest.serverInfo?.name?.toLowerCase() || "unknown";
+        const slug = manifestEntry.manifest.tokenSlug;
+        const shortId = peerId.slice(-8).toUpperCase();
+        const primaryVar = slug ? `LIOP_TOKEN_${slug}` : `LIOP_TOKEN_${providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
+        return {
+          jsonrpc: "2.0",
+          id,
+          result: {
+            content: [
+              {
+                type: "text",
+                text: `Authentication Required: The restricted node (${providerName}) requires an access token. Please define the ${primaryVar} or LIOP_TOKEN_${shortId} environment variable on your agent/client host.`
+              }
+            ],
+            isError: true
+          }
+        };
+      }
+    }
+    return new Promise((resolve) => {
+      const metadata = new grpc.Metadata();
+      if (activeToken) {
+        metadata.add("authorization", `Bearer ${activeToken}`);
+      }
+      client.negotiateIntent(
+        {
+          agent_did: `did:liop:${this.meshNode?.getPeerId() || "mcp-proxy"}`,
+          capability_hash: capabilityHash,
+          proof_of_intent: proofOfIntent
+        },
+        metadata,
+        async (err, response) => {
+          if (err || !response.accepted) {
+            try {
+              toolCallErrorsTotal.inc({
+                capability: toolName,
+                error_type: "handshake_failed"
+              });
+            } catch {
+            }
+            return resolve({
+              jsonrpc: "2.0",
+              id,
+              result: {
+                content: [
+                  {
+                    type: "text",
+                    text: `PQC Handshake Failed: ${err?.message || "Rejected"}`
+                  }
+                ],
+                isError: true
+              }
+            });
+          }
+          const pqcStart = performance.now();
+          const { ciphertext, sharedSecret } = await Kyber768Wrapper.encapsulateAsymmetric(
+            response.kyber_public_key
+          );
+          const pqcDuration = performance.now() - pqcStart;
+          try {
+            pqcHandshakeDurationMs.observe({ tool: toolName }, pqcDuration);
+            pqcHandshakesTotal.inc({
+              algorithm: "ml-kem-768",
+              status: "success"
+            });
+          } catch {
+          }
+          const embeddedArgs = params?.arguments ?? (params?.payload !== void 0 ? params : {});
+          const embeddedArgsJson = JSON.stringify(embeddedArgs);
+          const proxyLogic = `return { "__liop_proxy_tool": "${toolName}", "__liop_proxy_args": ${embeddedArgsJson} };`;
+          const nonce = crypto.randomBytes(12);
+          const sealedLogic = this.encryptWithNonce(
+            Buffer.from(proxyLogic),
+            sharedSecret,
+            nonce
+          );
+          const metadataCall = new grpc.Metadata();
+          if (activeToken) {
+            metadataCall.add("authorization", `Bearer ${activeToken}`);
+          }
+          const call = client.executeLogic(
+            {
+              session_token: response.session_token,
+              wasm_binary: new Uint8Array(sealedLogic),
+              inputs: {},
+              pqc_ciphertext: ciphertext,
+              aes_nonce: nonce
+            },
+            metadataCall
+          );
+          let resultBody = "";
+          let lastResponse = null;
+          call.on("data", (grpcRes) => {
+            resultBody += grpcRes.semantic_evidence;
+            lastResponse = grpcRes;
+          });
+          call.on("end", async () => {
+            try {
+              if (lastResponse) {
+                if (!lastResponse.is_error) {
+                  const proofHex = Buffer.from(
+                    lastResponse.cryptographic_proof
+                  ).toString("hex");
+                  const isValid = await this.verifier.verifyZkReceipt(
+                    Buffer.from(proxyLogic),
+                    proofHex,
+                    Buffer.from(lastResponse.zk_receipt),
+                    Buffer.from(sharedSecret),
+                    resultBody
+                  );
+                  try {
+                    zkVerificationsTotal.inc({
+                      status: isValid ? "valid" : "invalid"
+                    });
+                  } catch {
+                  }
+                  if (!isValid) {
+                    try {
+                      toolCallErrorsTotal.inc({
+                        capability: toolName,
+                        error_type: "cryptographic_audit_failed"
+                      });
+                    } catch {
+                    }
+                    return resolve({
+                      jsonrpc: "2.0",
+                      id,
+                      result: {
+                        content: [
+                          {
+                            type: "text",
+                            text: "SECURITY ALERT: Remote response failed cryptographic integrity audit."
+                          }
+                        ],
+                        isError: true
+                      }
+                    });
+                  }
+                } else {
+                  try {
+                    toolCallErrorsTotal.inc({
+                      capability: toolName,
+                      error_type: "remote_execution_error"
+                    });
+                  } catch {
+                  }
+                }
+              }
+              const parsedResult = JSON.parse(resultBody);
+              const remoteTelemetry = TokenTelemetryEngine.getInstance();
+              remoteTelemetry.record({
+                type: "tool_call",
+                method: "tools/call",
+                toolName,
+                peerId,
+                estimatedInputTokens: remoteTelemetry.countTokens(embeddedArgsJson),
+                estimatedOutputTokens: remoteTelemetry.countTokens(resultBody),
+                durationMs: Date.now() - transcodingStartTime
+              });
+              try {
+                wireEgressBytesTotal.inc(
+                  { capability: toolName },
+                  Buffer.byteLength(resultBody)
+                );
+              } catch {
+              }
+              resolve({ jsonrpc: "2.0", id, result: parsedResult });
+            } catch (_e) {
+              resolve({
+                jsonrpc: "2.0",
+                id,
+                result: { content: [{ type: "text", text: resultBody }] }
+              });
+            }
+          });
+          call.on("error", (e) => {
+            try {
+              toolCallErrorsTotal.inc({
+                capability: toolName,
+                error_type: "grpc_stream_error"
+              });
+            } catch {
+            }
+            resolve({
+              jsonrpc: "2.0",
+              id,
+              result: {
+                content: [
+                  { type: "text", text: `LIOP gRPC Error: ${e.message}` }
+                ],
+                isError: true
+              }
+            });
+          });
+        }
+      );
+    });
+  }
+  encryptWithNonce(payload, key, nonce) {
+    const cipher = crypto.createCipheriv("aes-256-gcm", key, nonce);
+    const encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);
+    return Buffer.concat([encrypted, cipher.getAuthTag()]);
+  }
+};
+
+export { LiopMcpRouter };
+//# sourceMappingURL=chunk-L6J72C5X.js.map
+//# sourceMappingURL=chunk-L6J72C5X.js.map