@nekzus/liop 2.4.0-alpha.7 → 2.4.0-alpha.8

package/dist/{chunk-PYKRQAER.js → chunk-EG46XMJT.js}

@@ -73,5 +73,5 @@ var PromptSchema = z.object({
 });
 
 export { MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY, PromptSchema, ResourceSchema, ToolSchema, adaptResponseForLegacyClient, buildLegacyInitializeResponse, isLegacyRequest };
-//# sourceMappingURL=chunk-PYKRQAER.js.map
-//# sourceMappingURL=chunk-PYKRQAER.js.map
+//# sourceMappingURL=chunk-EG46XMJT.js.map
+//# sourceMappingURL=chunk-EG46XMJT.js.map

package/dist/chunk-EG46XMJT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/gateway/mcp-compat.ts","../src/types.ts"],"names":[],"mappings":";;;;;AAiBO,IAAM,0BAAA,GAA6B;AAKnC,IAAM,2BAAA,GAA8B;AAKpC,SAAS,6BAAA,CACf,YACA,EAAA,EACc;AACd,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,IAAI,EAAA,IAAM,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,MACP,eAAA,EAAiB,2BAAA;AAAA,MACjB,YAAA,EAAc;AAAA,QACb,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC3B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC/B,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA;AAAK,OAC9B;AAAA,MACA;AAAA;AACD,GACD;AACD;AAOO,SAAS,gBAAgB,OAAA,EAA8B;AAC7D,EAAA,IACC,OAAA,CAAQ,MAAA,KAAW,YAAA,IACnB,OAAA,CAAQ,WAAW,2BAAA,EAClB;AACD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,EAAA,MAAM,OAAO,MAAA,EAAQ,KAAA;AACrB,EAAA,MAAM,OAAA,GAAU,OAAO,yCAAyC,CAAA;AAEhE,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,2BAAA,EAA6B;AACxD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAA;AACR;AAMO,SAAS,6BACf,QAAA,EACc;AACd,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,IAAU,OAAO,QAAA,CAAS,WAAW,QAAA,EAAU;AAC5D,IAAA,OAAO,QAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAA,GAAY,EAAE,GAAI,QAAA,CAAS,MAAA,EAAmC;AAGpE,EAAA,OAAO,SAAA,CAAU,UAAA;AACjB,EAAA,OAAO,SAAA,CAAU,KAAA;AACjB,EAAA,OAAO,SAAA,CAAU,UAAA;AAEjB,EAAA,OAAO;AAAA,IACN,GAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT;AACD;;;ACpFO,IAAM,oBAAA,GAAuB;AAyD7B,IAAM,UAAA,GAAa,EAAE,MAAA,CAAO;AAAA,EAClC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,CAAA,CAAE,SAAS;AAAA;AAC9C,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,EAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EACpC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAW,CAAA,CACT,KAAA;AAAA,IACA,EAAE,MAAA,CAAO;AAAA,MACR,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,MACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAC/B;AAAA,IAED,QAAA;AACH,CAAC","file":"chunk-EG46XMJT.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { McpRequest, McpResponse, ServerInfo } from \"../types.js\";\n\n/**\n * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.\n * Remove this file when MCP v1 (2025-11-25) reaches EOL.\n *\n * SUNSET INSTRUCTION: Delete this file, then grep for \"@mcp-legacy\" in the\n * codebase to find and remove all remaining legacy seams.\n */\n\n/**\n * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.\n * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.\n */\nexport const MCP_LEGACY_SUPPORT_ENABLED = true;\n\n/**\n * @mcp-legacy Legacy protocol version constant.\n */\nexport const MCP_PROTOCOL_VERSION_LEGACY = \"2025-11-25\" as const;\n\n/**\n * @mcp-legacy Build the legacy initialize handshake response.\n */\nexport function buildLegacyInitializeResponse(\n\tserverInfo: ServerInfo,\n\tid?: string | number | null,\n): McpResponse {\n\treturn {\n\t\tjsonrpc: \"2.0\",\n\t\tid: id ?? null,\n\t\tresult: {\n\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\tcapabilities: {\n\t\t\t\ttools: { listChanged: true },\n\t\t\t\tresources: { listChanged: true },\n\t\t\t\tprompts: { listChanged: true },\n\t\t\t},\n\t\t\tserverInfo,\n\t\t},\n\t};\n}\n\n/**\n * @mcp-legacy Detect if a request is strictly from a 2025-era legacy client.\n * Legacy requests either invoke 'initialize', 'notifications/initialized',\n * or lack modern '_meta' protocol envelopes.\n */\nexport function isLegacyRequest(request: McpRequest): boolean {\n\tif (\n\t\trequest.method === \"initialize\" ||\n\t\trequest.method === \"notifications/initialized\"\n\t) {\n\t\treturn true;\n\t}\n\n\tconst params = request.params as Record<string, unknown> | undefined;\n\tconst meta = params?._meta as Record<string, unknown> | undefined;\n\tconst version = meta?.[\"io.modelcontextprotocol/protocolVersion\"];\n\n\tif (!version || version === MCP_PROTOCOL_VERSION_LEGACY) {\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * @mcp-legacy Wrap and strip modern-era fields (resultType, ttlMs, cacheScope, etc.)\n * from a response to ensure 100% wire-compatibility with strict 2025 MCP clients.\n */\nexport function adaptResponseForLegacyClient(\n\tresponse: McpResponse,\n): McpResponse {\n\tif (!response.result || typeof response.result !== \"object\") {\n\t\treturn response;\n\t}\n\n\tconst rawResult = { ...(response.result as Record<string, unknown>) };\n\n\t// Strip modern-only envelope tags\n\tdelete rawResult.resultType;\n\tdelete rawResult.ttlMs;\n\tdelete rawResult.cacheScope;\n\n\treturn {\n\t\t...response,\n\t\tresult: rawResult,\n\t};\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from \"zod\";\n\n/**\n * Protocol Version Identifiers\n */\nexport const MCP_PROTOCOL_VERSION = \"2026-07-28\" as const;\n\nexport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"./gateway/mcp-compat.js\";\n\n/**\n * Protocol Era Classification\n */\nexport type McpEra = \"legacy\" | \"modern\";\n\n/**\n * Caching Hints for MCP 2026-07-28 Spec\n */\nexport interface CacheableResult {\n\tttlMs?: number;\n\tcacheScope?: \"public\" | \"private\";\n}\n\n/**\n * Multi-Round-Trip Requests (MRTR) Specification Types\n */\nexport interface InputRequest {\n\tid: string;\n\tmessage: string;\n\tschema?: Record<string, unknown>;\n}\n\nexport interface InputResponse {\n\tid: string;\n\tvalue: unknown;\n}\n\nexport interface InputRequiredResult {\n\tresultType: \"input_required\";\n\tinputRequests: InputRequest[];\n\trequestState?: string;\n}\n\n/**\n * Modern Envelope Metadata (_meta)\n */\nexport interface McpRequestMeta {\n\t\"io.modelcontextprotocol/protocolVersion\"?: string;\n\t\"io.modelcontextprotocol/clientInfo\"?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\t\"io.modelcontextprotocol/clientCapabilities\"?: Record<string, unknown>;\n\t[key: string]: unknown;\n}\n\n/**\n * Base Protocol Types representing parity with Model Context Protocol\n */\n\nexport const ToolSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tinputSchema: z.record(z.string(), z.unknown()), // Represents a JSON Schema\n});\n\nexport type Tool = z.infer<typeof ToolSchema>;\n\nexport const ResourceSchema = z.object({\n\turi: z.string(),\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tmimeType: z.string().optional(),\n});\n\nexport type Resource = z.infer<typeof ResourceSchema>;\n\nexport const PromptSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\targuments: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tdescription: z.string().optional(),\n\t\t\t\trequired: z.boolean().optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\nexport type Prompt = z.infer<typeof PromptSchema>;\n\nexport interface CallToolRequest {\n\tname: string;\n\targuments?: Record<string, unknown>;\n}\n\nexport interface CallToolResult {\n\tcontent: Array<{\n\t\ttype: \"text\" | \"image\" | \"resource\";\n\t\ttext?: string;\n\t\tdata?: string;\n\t\tmimeType?: string;\n\t\tresource?: {\n\t\t\turi: string;\n\t\t\ttext?: string;\n\t\t\tblob?: string;\n\t\t};\n\t}>;\n\tisError?: boolean;\n}\n\nexport interface GetPromptRequest {\n\tname: string;\n\targuments?: Record<string, string>;\n}\n\nexport interface GetPromptResult {\n\tdescription?: string;\n\tmessages: Array<{\n\t\trole: \"user\" | \"assistant\";\n\t\tcontent:\n\t\t\t| { type: \"text\"; text: string }\n\t\t\t| { type: \"image\"; data: string; mimeType: string }\n\t\t\t| {\n\t\t\t\t\ttype: \"resource\";\n\t\t\t\t\tresource: { uri: string; text?: string; blob?: string };\n\t\t\t  };\n\t}>;\n}\n\nexport interface ServerInfo {\n\tname: string;\n\tversion: string;\n\tcapabilities?: {\n\t\tprompts?: { listChanged?: boolean };\n\t\tresources?: { subscribe?: boolean; listChanged?: boolean };\n\t\ttools?: { listChanged?: boolean };\n\t\t/** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */\n\t\tlogging?: Record<string, unknown>;\n\t};\n}\n\nexport interface DiscoverResult {\n\tresultType: \"complete\";\n\tsupportedVersions: string[];\n\tcapabilities: ServerInfo[\"capabilities\"];\n\tserverInfo: ServerInfo;\n\tinstructions?: string;\n}\n\nexport interface McpRequest {\n\tmethod: string;\n\tparams?: unknown;\n\tid?: string | number | null;\n\tjsonrpc?: \"2.0\";\n}\n\nexport interface McpResponse {\n\tjsonrpc: \"2.0\";\n\tid?: string | number | null;\n\tresult?: unknown;\n\terror?: {\n\t\tcode: number;\n\t\tmessage: string;\n\t\tdata?: unknown;\n\t};\n}\n\n/**\n * Re-export AuthInfo from the security module for convenience.\n * Compatible with MCP TypeScript SDK AuthInfo interface shape.\n */\nexport type { AuthInfo } from \"./security/jwt-validator.js\";\n"]}

package/dist/chunk-ESRXG36Y.js

@@ -0,0 +1,115 @@
+import { log } from './chunk-HA6YZ42O.js';
+
+// src/runtime/token-manager.ts
+var TokenManager = class _TokenManager {
+  cachedToken = null;
+  expiresAt = 0;
+  // Epoch ms
+  pendingPromise = null;
+  tokenEndpoint;
+  clientId;
+  clientSecret;
+  audience;
+  scope;
+  staticToken;
+  // Preemptive refresh threshold: 30 seconds before expiration
+  static REFRESH_BUFFER_MS = 3e4;
+  constructor(options) {
+    this.tokenEndpoint = options.tokenEndpoint;
+    this.clientId = options.clientId;
+    this.clientSecret = options.clientSecret;
+    this.audience = options.audience ?? "urn:liop:mesh:api";
+    this.scope = Array.isArray(options.scopes) ? options.scopes.join(" ") : options.scopes ?? "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query";
+    this.staticToken = options.staticToken;
+  }
+  /**
+   * Returns a valid OAuth 2.1 access token.
+   * Automatically performs preemptive refresh if the token is close to expiry.
+   */
+  async getToken() {
+    if (this.staticToken) {
+      return this.staticToken;
+    }
+    const now = Date.now();
+    if (this.cachedToken && now < this.expiresAt - _TokenManager.REFRESH_BUFFER_MS) {
+      return this.cachedToken;
+    }
+    if (this.pendingPromise) {
+      return this.pendingPromise;
+    }
+    this.pendingPromise = (async () => {
+      try {
+        const token = await this.fetchNewToken();
+        this.cachedToken = token;
+        return token;
+      } finally {
+        this.pendingPromise = null;
+      }
+    })();
+    return this.pendingPromise;
+  }
+  /**
+   * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.
+   */
+  invalidate() {
+    this.cachedToken = null;
+    this.expiresAt = 0;
+    if (this.clientId && this.clientSecret) {
+      this.staticToken = void 0;
+    }
+    log.info("[TokenManager] Cached OAuth access token invalidated.");
+  }
+  /**
+   * Returns true if the token is absent or has passed the refresh threshold.
+   */
+  isExpired() {
+    if (this.staticToken) return false;
+    return !this.cachedToken || Date.now() >= this.expiresAt - _TokenManager.REFRESH_BUFFER_MS;
+  }
+  getExpiresAt() {
+    return this.expiresAt;
+  }
+  async fetchNewToken() {
+    log.info(
+      `[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`
+    );
+    const params = new URLSearchParams({
+      grant_type: "client_credentials",
+      client_id: this.clientId,
+      client_secret: this.clientSecret,
+      resource: this.audience,
+      scope: this.scope
+    });
+    const response = await fetch(this.tokenEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: params.toString(),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(
+        `OAuth token request failed [HTTP ${response.status}]: ${errorText}`
+      );
+    }
+    const data = await response.json();
+    if (!data.access_token) {
+      throw new Error(
+        "OAuth token response did not contain an 'access_token' field."
+      );
+    }
+    const expiresInSec = typeof data.expires_in === "number" ? data.expires_in : 3600;
+    this.expiresAt = Date.now() + expiresInSec * 1e3;
+    log.info(
+      `[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`
+    );
+    return data.access_token;
+  }
+};
+
+export { TokenManager };
+//# sourceMappingURL=chunk-ESRXG36Y.js.map
+//# sourceMappingURL=chunk-ESRXG36Y.js.map

package/dist/chunk-ESRXG36Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime/token-manager.ts"],"names":[],"mappings":";;;AAwBO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,WAAA,GAA6B,IAAA;AAAA,EAC7B,SAAA,GAAY,CAAA;AAAA;AAAA,EACZ,cAAA,GAAyC,IAAA;AAAA,EAEhC,aAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACT,WAAA;AAAA;AAAA,EAGR,OAAwB,iBAAA,GAAoB,GAAA;AAAA,EAE5C,YAAY,OAAA,EAA8B;AACzC,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACpC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA,GACtC,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GACtB,OAAA,CAAQ,MAAA,IACV,sFAAA;AACF,IAAA,IAAA,CAAK,cAAc,OAAA,CAAQ,WAAA;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,QAAA,GAA4B;AACxC,IAAA,IAAI,KAAK,WAAA,EAAa;AACrB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IACC,KAAK,WAAA,IACL,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,cAAa,iBAAA,EACnC;AACD,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACb;AAEA,IAAA,IAAI,KAAK,cAAA,EAAgB;AACxB,MAAA,OAAO,IAAA,CAAK,cAAA;AAAA,IACb;AAEA,IAAA,IAAA,CAAK,kBAAkB,YAAY;AAClC,MAAA,IAAI;AACH,QAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AACvC,QAAA,IAAA,CAAK,WAAA,GAAc,KAAA;AACnB,QAAA,OAAO,KAAA;AAAA,MACR,CAAA,SAAE;AACD,QAAA,IAAA,CAAK,cAAA,GAAiB,IAAA;AAAA,MACvB;AAAA,IACD,CAAA,GAAG;AAEH,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,UAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AACnB,IAAA,IAAA,CAAK,SAAA,GAAY,CAAA;AACjB,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,YAAA,EAAc;AACvC,MAAA,IAAA,CAAK,WAAA,GAAc,MAAA;AAAA,IACpB;AACA,IAAA,GAAA,CAAI,KAAK,uDAAuD,CAAA;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA,EAKO,SAAA,GAAqB;AAC3B,IAAA,IAAI,IAAA,CAAK,aAAa,OAAO,KAAA;AAC7B,IAAA,OACC,CAAC,KAAK,WAAA,IACN,IAAA,CAAK,KAAI,IAAK,IAAA,CAAK,YAAY,aAAA,CAAa,iBAAA;AAAA,EAE9C;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACb;AAAA,EAEA,MAAc,aAAA,GAAiC;AAC9C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yCAAA,EAA4C,IAAA,CAAK,aAAa,CAAA,aAAA,EAAgB,KAAK,QAAQ,CAAA,IAAA;AAAA,KAC5F;AAEA,IAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,MAClC,UAAA,EAAY,oBAAA;AAAA,MACZ,WAAW,IAAA,CAAK,QAAA;AAAA,MAChB,eAAe,IAAA,CAAK,YAAA;AAAA,MACpB,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,OAAO,IAAA,CAAK;AAAA,KACZ,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,aAAA,EAAe;AAAA,MAChD,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACR,cAAA,EAAgB,mCAAA;AAAA,QAChB,MAAA,EAAQ;AAAA,OACT;AAAA,MACA,IAAA,EAAM,OAAO,QAAA,EAAS;AAAA,MACtB,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAM;AAAA,KAClC,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AACjB,MAAA,MAAM,SAAA,GAAY,MAAM,QAAA,CAAS,IAAA,EAAK;AACtC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,iCAAA,EAAoC,QAAA,CAAS,MAAM,CAAA,GAAA,EAAM,SAAS,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAMlC,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACvB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,eACL,OAAO,IAAA,CAAK,UAAA,KAAe,QAAA,GAAW,KAAK,UAAA,GAAa,IAAA;AACzD,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,YAAA,GAAe,GAAA;AAE7C,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iEAAiE,YAAY,CAAA,EAAA;AAAA,KAC9E;AAEA,IAAA,OAAO,IAAA,CAAK,YAAA;AAAA,EACb;AACD","file":"chunk-ESRXG36Y.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Token Manager — Adaptive OAuth 2.1 M2M Token Lifecycle\n *\n * Implements resilient token caching with preemptive refresh (30s safety buffer),\n * concurrency de-duplication (single in-flight HTTP request), and on-demand\n * invalidation for 401 Unauthorized handling.\n *\n * Standards: RFC 6749, RFC 8707 (Resource Indicators), RFC 9068 (JWT Profile)\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface TokenManagerOptions {\n\ttokenEndpoint: string;\n\tclientId: string;\n\tclientSecret: string;\n\taudience?: string;\n\tscopes?: string | string[];\n\tstaticToken?: string;\n}\n\nexport class TokenManager {\n\tprivate cachedToken: string | null = null;\n\tprivate expiresAt = 0; // Epoch ms\n\tprivate pendingPromise: Promise<string> | null = null;\n\n\tprivate readonly tokenEndpoint: string;\n\tprivate readonly clientId: string;\n\tprivate readonly clientSecret: string;\n\tprivate readonly audience: string;\n\tprivate readonly scope: string;\n\tprivate staticToken?: string;\n\n\t// Preemptive refresh threshold: 30 seconds before expiration\n\tprivate static readonly REFRESH_BUFFER_MS = 30_000;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.tokenEndpoint = options.tokenEndpoint;\n\t\tthis.clientId = options.clientId;\n\t\tthis.clientSecret = options.clientSecret;\n\t\tthis.audience = options.audience ?? \"urn:liop:mesh:api\";\n\t\tthis.scope = Array.isArray(options.scopes)\n\t\t\t? options.scopes.join(\" \")\n\t\t\t: (options.scopes ??\n\t\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\");\n\t\tthis.staticToken = options.staticToken;\n\t}\n\n\t/**\n\t * Returns a valid OAuth 2.1 access token.\n\t * Automatically performs preemptive refresh if the token is close to expiry.\n\t */\n\tpublic async getToken(): Promise<string> {\n\t\tif (this.staticToken) {\n\t\t\treturn this.staticToken;\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tif (\n\t\t\tthis.cachedToken &&\n\t\t\tnow < this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t) {\n\t\t\treturn this.cachedToken;\n\t\t}\n\n\t\tif (this.pendingPromise) {\n\t\t\treturn this.pendingPromise;\n\t\t}\n\n\t\tthis.pendingPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tconst token = await this.fetchNewToken();\n\t\t\t\tthis.cachedToken = token;\n\t\t\t\treturn token;\n\t\t\t} finally {\n\t\t\t\tthis.pendingPromise = null;\n\t\t\t}\n\t\t})();\n\n\t\treturn this.pendingPromise;\n\t}\n\n\t/**\n\t * Force-invalidates cached token, e.g. after receiving a 401 Unauthorized response.\n\t */\n\tpublic invalidate(): void {\n\t\tthis.cachedToken = null;\n\t\tthis.expiresAt = 0;\n\t\tif (this.clientId && this.clientSecret) {\n\t\t\tthis.staticToken = undefined;\n\t\t}\n\t\tlog.info(\"[TokenManager] Cached OAuth access token invalidated.\");\n\t}\n\n\t/**\n\t * Returns true if the token is absent or has passed the refresh threshold.\n\t */\n\tpublic isExpired(): boolean {\n\t\tif (this.staticToken) return false;\n\t\treturn (\n\t\t\t!this.cachedToken ||\n\t\t\tDate.now() >= this.expiresAt - TokenManager.REFRESH_BUFFER_MS\n\t\t);\n\t}\n\n\tpublic getExpiresAt(): number {\n\t\treturn this.expiresAt;\n\t}\n\n\tprivate async fetchNewToken(): Promise<string> {\n\t\tlog.info(\n\t\t\t`[TokenManager] Requesting M2M token from ${this.tokenEndpoint} for client '${this.clientId}'...`,\n\t\t);\n\n\t\tconst params = new URLSearchParams({\n\t\t\tgrant_type: \"client_credentials\",\n\t\t\tclient_id: this.clientId,\n\t\t\tclient_secret: this.clientSecret,\n\t\t\tresource: this.audience,\n\t\t\tscope: this.scope,\n\t\t});\n\n\t\tconst response = await fetch(this.tokenEndpoint, {\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\tAccept: \"application/json\",\n\t\t\t},\n\t\t\tbody: params.toString(),\n\t\t\tsignal: AbortSignal.timeout(10_000),\n\t\t});\n\n\t\tif (!response.ok) {\n\t\t\tconst errorText = await response.text();\n\t\t\tthrow new Error(\n\t\t\t\t`OAuth token request failed [HTTP ${response.status}]: ${errorText}`,\n\t\t\t);\n\t\t}\n\n\t\tconst data = (await response.json()) as {\n\t\t\taccess_token?: string;\n\t\t\texpires_in?: number;\n\t\t\ttoken_type?: string;\n\t\t};\n\n\t\tif (!data.access_token) {\n\t\t\tthrow new Error(\n\t\t\t\t\"OAuth token response did not contain an 'access_token' field.\",\n\t\t\t);\n\t\t}\n\n\t\tconst expiresInSec =\n\t\t\ttypeof data.expires_in === \"number\" ? data.expires_in : 3600;\n\t\tthis.expiresAt = Date.now() + expiresInSec * 1000;\n\n\t\tlog.info(\n\t\t\t`[TokenManager] Acquired access token successfully. Expires in ${expiresInSec}s.`,\n\t\t);\n\n\t\treturn data.access_token;\n\t}\n}\n"]}

package/dist/chunk-FTF6AMF6.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=chunk-FTF6AMF6.js.map
+//# sourceMappingURL=chunk-FTF6AMF6.js.map

package/dist/{chunk-RWRRBYG4.js.map → chunk-FTF6AMF6.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-RWRRBYG4.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"chunk-FTF6AMF6.js"}

package/dist/{chunk-72MNYFR6.js → chunk-HA6YZ42O.js}

@@ -60,5 +60,5 @@ var LiopLogger = class _LiopLogger {
 var log = LiopLogger.getInstance();
 
 export { log };
-//# sourceMappingURL=chunk-72MNYFR6.js.map
-//# sourceMappingURL=chunk-72MNYFR6.js.map
+//# sourceMappingURL=chunk-HA6YZ42O.js.map
+//# sourceMappingURL=chunk-HA6YZ42O.js.map

package/dist/chunk-HA6YZ42O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/logger.ts"],"names":[],"mappings":";AAUO,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAe,QAAA;AAAA,EACP,KAAA,GAAkB,MAAA;AAAA,EAElB,WAAA,GAAc;AACrB,IAAA,IAAA,CAAK,eAAA,EAAgB;AAAA,EACtB;AAAA,EAEA,OAAc,WAAA,GAA0B;AACvC,IAAA,IAAI,CAAC,YAAW,QAAA,EAAU;AACzB,MAAA,WAAA,CAAW,QAAA,GAAW,IAAI,WAAA,EAAW;AAAA,IACtC;AACA,IAAA,OAAO,WAAA,CAAW,QAAA;AAAA,EACnB;AAAA,EAEQ,eAAA,GAAkB;AACzB,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,cAAA,EAAgB,WAAA,EAAY;AACzD,IAAA,IACC,QAAA,KAAa,YACb,QAAA,KAAa,OAAA,IACb,aAAa,MAAA,IACb,QAAA,KAAa,MAAA,IACb,QAAA,KAAa,OAAA,EACZ;AACD,MAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AAAA,IACd,CAAA,MAAO;AAEN,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,IACd;AAAA,EACD;AAAA,EAEO,SAAS,KAAA,EAAiB;AAChC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACd;AAAA,EAEQ,UAAU,WAAA,EAAgC;AACjD,IAAA,MAAM,MAAA,GAAmC;AAAA,MACxC,MAAA,EAAQ,CAAA;AAAA,MACR,KAAA,EAAO,CAAA;AAAA,MACP,IAAA,EAAM,CAAA;AAAA,MACN,IAAA,EAAM,CAAA;AAAA,MACN,KAAA,EAAO;AAAA,KACR;AACA,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,IAAK,OAAO,WAAW,CAAA;AAAA,EAChD;AAAA,EAEQ,aAAA,CAAc,OAAe,OAAA,EAAyB;AAC7D,IAAA,MAAM,EAAA,GAAA,iBAAK,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAClC,IAAA,OAAO,CAAA,CAAA,EAAI,EAAE,CAAA,GAAA,EAAM,KAAK,KAAK,OAAO,CAAA,CAAA;AAAA,EACrC;AAAA,EAEO,KAAA,CAAM,YAAoB,IAAA,EAAiB;AACjD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAC5B,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,SAAS,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,IAC5D;AAAA,EACD;AAAA,EAEO,IAAA,CAAK,YAAoB,IAAA,EAAiB;AAChD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,IAC3D;AAAA,EACD;AAAA,EAEO,IAAA,CAAK,YAAoB,IAAA,EAAiB;AAChD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG;AAC3B,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,IAC3D;AAAA,EACD;AAAA,EAEO,KAAA,CAAM,YAAoB,IAAA,EAAiB;AACjD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAC5B,MAAA,OAAA,CAAQ,MAAM,IAAA,CAAK,aAAA,CAAc,SAAS,OAAO,CAAA,EAAG,GAAG,IAAI,CAAA;AAAA,IAC5D;AAAA,EACD;AACD,CAAA;AAEO,IAAM,GAAA,GAAM,WAAW,WAAA","file":"chunk-HA6YZ42O.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport type LogLevel = \"silent\" | \"error\" | \"warn\" | \"info\" | \"debug\";\n\n/**\n * LiopLogger - Structured Logging Abstraction\n * Configurable via `process.env.LIOP_LOG_LEVEL`.\n * Emits strictly to stderr to comply with MCP stdio protocols.\n */\nexport class LiopLogger {\n\tprivate static instance: LiopLogger;\n\tprivate level: LogLevel = \"info\";\n\n\tprivate constructor() {\n\t\tthis.setLevelFromEnv();\n\t}\n\n\tpublic static getInstance(): LiopLogger {\n\t\tif (!LiopLogger.instance) {\n\t\t\tLiopLogger.instance = new LiopLogger();\n\t\t}\n\t\treturn LiopLogger.instance;\n\t}\n\n\tprivate setLevelFromEnv() {\n\t\tconst envLevel = process.env.LIOP_LOG_LEVEL?.toLowerCase();\n\t\tif (\n\t\t\tenvLevel === \"silent\" ||\n\t\t\tenvLevel === \"error\" ||\n\t\t\tenvLevel === \"warn\" ||\n\t\t\tenvLevel === \"info\" ||\n\t\t\tenvLevel === \"debug\"\n\t\t) {\n\t\t\tthis.level = envLevel as LogLevel;\n\t\t} else {\n\t\t\t// Default level: info\n\t\t\tthis.level = \"info\";\n\t\t}\n\t}\n\n\tpublic setLevel(level: LogLevel) {\n\t\tthis.level = level;\n\t}\n\n\tprivate shouldLog(targetLevel: LogLevel): boolean {\n\t\tconst levels: Record<LogLevel, number> = {\n\t\t\tsilent: 0,\n\t\t\terror: 1,\n\t\t\twarn: 2,\n\t\t\tinfo: 3,\n\t\t\tdebug: 4,\n\t\t};\n\t\treturn levels[this.level] >= levels[targetLevel];\n\t}\n\n\tprivate formatMessage(level: string, message: string): string {\n\t\tconst ts = new Date().toISOString();\n\t\treturn `[${ts}] [${level}] ${message}`;\n\t}\n\n\tpublic error(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"error\")) {\n\t\t\tconsole.error(this.formatMessage(\"ERROR\", message), ...args);\n\t\t}\n\t}\n\n\tpublic warn(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"warn\")) {\n\t\t\tconsole.error(this.formatMessage(\"WARN\", message), ...args);\n\t\t}\n\t}\n\n\tpublic info(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"info\")) {\n\t\t\tconsole.error(this.formatMessage(\"INFO\", message), ...args);\n\t\t}\n\t}\n\n\tpublic debug(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"debug\")) {\n\t\t\tconsole.error(this.formatMessage(\"DEBUG\", message), ...args);\n\t\t}\n\t}\n}\n\nexport const log = LiopLogger.getInstance();\n"]}

package/dist/{chunk-WCCGE4QR.js → chunk-HD2N3IJX.js}

@@ -1,8 +1,9 @@
-import { sanitizeOutput } from './chunk-JIJPZFR2.js';
-import { LIOP_SCOPES, Dilithium65Wrapper, authorizeRequest, egressBlocksTotal, toolCallsTotal, fuelConsumed } from './chunk-U5BZ66VX.js';
-import { GRPC_CHANNEL_OPTIONS, liopV1, createServerCredentials } from './chunk-WSW6YJNY.js';
-import { MeshNode } from './chunk-74CISO2I.js';
-import { log } from './chunk-72MNYFR6.js';
+import { sanitizeOutput } from './chunk-Y62GORQF.js';
+import { LIOP_SCOPES, Dilithium65Wrapper, authorizeRequest } from './chunk-VH4K4U45.js';
+import { GRPC_CHANNEL_OPTIONS, liopV1, createServerCredentials } from './chunk-TKRX6CFI.js';
+import { egressBlocksTotal, toolCallsTotal, fuelConsumed, wireEgressBytesTotal, wireSavedBytesTotal, toolCallErrorsTotal } from './chunk-PAICJCKJ.js';
+import { MeshNode } from './chunk-7RXOIDXP.js';
+import { log } from './chunk-HA6YZ42O.js';
 import { Buffer } from 'buffer';
 import * as crypto3 from 'crypto';
 import crypto3__default from 'crypto';
@@ -279,7 +280,9 @@ var JwtValidator = class {
       "127.0.0.1:13000",
       "localhost:13000",
       "127.0.0.1:13001",
-      "localhost:13001"
+      "localhost:13001",
+      "127.0.0.1:15000",
+      "localhost:15000"
     ];
     let issuerAuthority = "";
     try {
@@ -481,6 +484,7 @@ var TaintAnalyzer = class _TaintAnalyzer {
   ]);
   /** Reduce-family methods where the record param is the SECOND callback arg */
   static REDUCE_METHODS = /* @__PURE__ */ new Set(["reduce", "reduceRight"]);
+  currentRecordCollections = /* @__PURE__ */ new Set();
   constructor(piiFields, sensitiveKeys = []) {
     this.piiFields = new Set(piiFields.map((f) => f.toLowerCase()));
     this.sensitiveKeys = new Set(sensitiveKeys.map((f) => f.toLowerCase()));
@@ -652,6 +656,47 @@ ${sourceCode}
     }
     return false;
   }
+  /** Checks if an expression resolves to env.records, records, an alias, or a derivation chain */
+  isRecordsSource(node) {
+    if (this.isEnvRecordsAccess(node)) return true;
+    if (node.type === "Identifier" && this.currentRecordCollections.has(node.name)) {
+      return true;
+    }
+    if (node.type === "CallExpression") {
+      const call = node;
+      if (call.callee.type === "MemberExpression") {
+        const member = call.callee;
+        const method = this.getPropertyName(member);
+        if (method && (method === "slice" || method === "filter" || method === "toSorted" || method === "map" || method === "concat")) {
+          return this.isRecordsSource(member.object);
+        }
+      }
+    }
+    return false;
+  }
+  /** Gathers aliases and derivations of env.records (e.g. const accounts = env.records; const top5 = accounts.filter(...)) */
+  identifyRecordCollections(ast) {
+    this.currentRecordCollections.clear();
+    for (let pass = 0; pass < 3; pass++) {
+      const aliasVisitors = {
+        VariableDeclarator: (node) => {
+          if (!node.init || node.id.type !== "Identifier") return;
+          if (this.isRecordsSource(node.init)) {
+            this.currentRecordCollections.add(node.id.name);
+          }
+        },
+        AssignmentExpression: (node) => {
+          if (node.left.type !== "Identifier") return;
+          if (this.isRecordsSource(node.right)) {
+            this.currentRecordCollections.add(
+              node.left.name
+            );
+          }
+        }
+      };
+      simple(ast, aliasVisitors);
+    }
+  }
   /**
    * Extracts field names accessed on a record parameter within a function body.
    * e.g., in `(s, r) => s + r.balance`, extracts "balance".
@@ -733,17 +778,18 @@ ${sourceCode}
     if (call.callee.type !== "MemberExpression") return false;
     const callee = call.callee;
     const method = this.getPropertyName(callee);
-    return method === "map" && this.isEnvRecordsChain(callee.object);
+    return method === "map" && this.isRecordsSource(callee.object);
   }
   // ── Pass 1: Record-Bound Variable Identification ──────────────────
   identifyRecordBoundVars(ast, recordBoundVars) {
+    this.identifyRecordCollections(ast);
     const visitors = {
       CallExpression: (node) => {
         if (node.callee.type !== "MemberExpression") return;
         const member = node.callee;
         const methodName = this.getPropertyName(member);
         if (!methodName) return;
-        if (!this.isEnvRecordsAccess(member.object)) return;
+        if (!this.isRecordsSource(member.object)) return;
         const callback = node.arguments[0];
         if (!callback) return;
         if (callback.type === "ArrowFunctionExpression" || callback.type === "FunctionExpression") {
@@ -762,9 +808,9 @@ ${sourceCode}
           }
         }
       },
-      // for (const r of env.records) → r is record-bound
+      // for (const r of env.records) or for (const r of accounts) → r is record-bound
       ForOfStatement: (node) => {
-        if (!this.isEnvRecordsAccess(node.right)) return;
+        if (!this.isRecordsSource(node.right)) return;
         if (node.left.type === "VariableDeclaration") {
           for (const declarator of node.left.declarations) {
             if (declarator.id.type === "Identifier") {
@@ -780,7 +826,7 @@ ${sourceCode}
         if (!node.init || node.id.type !== "Identifier") return;
         if (node.init.type === "MemberExpression" && node.init.computed) {
           const member = node.init;
-          if (this.isEnvRecordsAccess(member.object)) {
+          if (this.isRecordsSource(member.object)) {
             recordBoundVars.add(node.id.name);
           }
         }
@@ -800,6 +846,18 @@ ${sourceCode}
           }
         },
         AssignmentExpression: (node) => {
+          if (node.left.type === "MemberExpression") {
+            const member = node.left;
+            if (member.computed && this.isExpressionTainted(
+              member.property,
+              recordBoundVars,
+              taintedVars
+            )) {
+              if (member.object.type === "Identifier") {
+                taintedVars.add(member.object.name);
+              }
+            }
+          }
           if (node.left.type !== "Identifier") return;
           if (this.isExpressionTainted(node.right, recordBoundVars, taintedVars)) {
             taintedVars.add(node.left.name);
@@ -921,9 +979,26 @@ ${sourceCode}
       }
       case "ObjectExpression": {
         const obj = node;
-        return obj.properties.some(
-          (prop) => prop.type === "Property" && this.isExpressionTainted(prop.value, recordBoundVars, taintedVars)
-        );
+        return obj.properties.some((prop) => {
+          if (prop.type === "Property") {
+            if (prop.computed && this.isExpressionTainted(prop.key, recordBoundVars, taintedVars)) {
+              return true;
+            }
+            return this.isExpressionTainted(
+              prop.value,
+              recordBoundVars,
+              taintedVars
+            );
+          }
+          if (prop.type === "SpreadElement") {
+            return this.isExpressionTainted(
+              prop.argument,
+              recordBoundVars,
+              taintedVars
+            );
+          }
+          return false;
+        });
       }
       case "ArrayExpression": {
         const arr = node;
@@ -960,7 +1035,7 @@ ${sourceCode}
     }
     if (member.object.type === "MemberExpression" && propName && this.piiFields.has(propName.toLowerCase())) {
       const parentMember = member.object;
-      if (parentMember.computed && this.isEnvRecordsAccess(parentMember.object)) {
+      if (parentMember.computed && this.isRecordsSource(parentMember.object)) {
         return true;
       }
     }
@@ -988,7 +1063,7 @@ ${sourceCode}
       if (methodName && _TaintAnalyzer.TAINT_PROPAGATING_METHODS.has(methodName) && this.isExpressionTainted(callee.object, recordBoundVars, taintedVars)) {
         return true;
       }
-      if (this.isEnvRecordsAccess(callee.object) && call.arguments[0]) {
+      if (this.isRecordsSource(callee.object) && call.arguments[0]) {
         const callback = call.arguments[0];
         if (callback.type === "ArrowFunctionExpression" || callback.type === "FunctionExpression") {
           return this.doesCallbackProduceTaint(
@@ -1061,6 +1136,11 @@ ${sourceCode}
         scopedTaintedVars
       );
     }
+    this.propagateTaint(
+      callback.body,
+      scopedRecordVars,
+      scopedTaintedVars
+    );
     let hasTaintedReturnOrYield = false;
     const returnVisitors = {
       ReturnStatement: (node) => {
@@ -2243,14 +2323,18 @@ Data structure: ${schemaDigest}. Full schema: resource liop://schema/global`;
             isError: true
           };
         }
-        const payloadValue = args.payload;
-        const bypassCache = args.__liop_bypass_ast_cache === true;
-        const payloadHash = crypto3__default.createHash("sha256").update(payloadValue).digest("hex");
+        const rawArgs = args && typeof args === "object" ? args : {};
+        const payloadValue = rawArgs.payload ?? rawArgs.envelope ?? rawArgs.code;
+        const bypassCache = rawArgs.__liop_bypass_ast_cache === true;
+        const payloadHash = crypto3__default.createHash("sha256").update(payloadValue || "").digest("hex");
         const logic = this.extractLogic(payloadValue);
         const cached = this.logicCache.get(payloadHash);
         if (!bypassCache && cached && now - cached.timestamp < this.CACHE_TTL_MS) {
           if (logic) {
-            args.payload = logic;
+            rawArgs.payload = logic;
+            if (rawArgs.envelope !== void 0) {
+              rawArgs.envelope = logic;
+            }
             const preflightReason = this.runPreflightPolicy(
               name,
               logic,
@@ -2281,10 +2365,11 @@ Data structure: ${schemaDigest}. Full schema: resource liop://schema/global`;
           };
         }
         try {
-          const logic2 = this.extractLogic(
-            args.payload
-          );
-          args.payload = logic2;
+          const logic2 = this.extractLogic(payloadValue);
+          rawArgs.payload = logic2;
+          if (rawArgs.envelope !== void 0) {
+            rawArgs.envelope = logic2;
+          }
           const preflightReason = this.runPreflightPolicy(
             name,
             logic2,
@@ -2771,7 +2856,7 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               log.info(
                 `[LIOP-RPC] Bypass authentication for matching localTestToken: ${localTestToken}`
               );
-              import('./kyber-3ULIJSE3.js').then(
+              import('./kyber-CGOA7Q6A.js').then(
                 async ({ Kyber768Wrapper }) => {
                   const { publicKey, secretKey } = await Kyber768Wrapper.generateKeyPair();
                   const sessionToken = crypto3__default.randomUUID();
@@ -2807,7 +2892,7 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               });
               return;
             }
-            import('./kyber-3ULIJSE3.js').then(
+            import('./kyber-CGOA7Q6A.js').then(
               async ({ Kyber768Wrapper }) => {
                 const { publicKey, secretKey } = await Kyber768Wrapper.generateKeyPair();
                 const sessionToken = crypto3__default.randomUUID();
@@ -2833,7 +2918,7 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
             });
           });
         } else {
-          import('./kyber-3ULIJSE3.js').then(async ({ Kyber768Wrapper }) => {
+          import('./kyber-CGOA7Q6A.js').then(async ({ Kyber768Wrapper }) => {
             const { publicKey, secretKey } = await Kyber768Wrapper.generateKeyPair();
             const sessionToken = crypto3__default.randomUUID();
             this.sessions.set(sessionToken, {
@@ -3057,13 +3142,37 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               status: isBlocked ? "BLOCKED_EGRESS" : "SUCCESS"
             });
             toolCallsTotal.inc({
+              capability: toolName || "unknown",
               tool: toolName || "unknown",
               status: isBlocked ? "blocked_egress" : "success"
             });
             fuelConsumed.observe(
-              { tool: toolName || "unknown" },
+              {
+                capability: toolName || "unknown",
+                tool: toolName || "unknown"
+              },
               workerResponse.fuel_consumed || 0
             );
+            try {
+              const egressBytes = Buffer.byteLength(response.semantic_evidence || "") + (response.cryptographic_proof ? response.cryptographic_proof.length : 0) + (response.zk_receipt ? response.zk_receipt.length : 0);
+              wireEgressBytesTotal.inc(
+                { capability: toolName || "unknown" },
+                egressBytes
+              );
+              if (this.sandboxRecords && this.sandboxRecords.length > 0) {
+                const rawDatasetBytes = Buffer.byteLength(
+                  JSON.stringify(this.sandboxRecords)
+                );
+                const savedBytes = Math.max(0, rawDatasetBytes - egressBytes);
+                if (savedBytes > 0) {
+                  wireSavedBytesTotal.inc(
+                    { capability: toolName || "unknown" },
+                    savedBytes
+                  );
+                }
+              }
+            } catch {
+            }
             call.write(response, () => {
               call.end();
             });
@@ -3084,9 +3193,14 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
               status: "ERROR"
             });
             toolCallsTotal.inc({
+              capability: toolName || "unknown",
               tool: toolName || "unknown",
               status: "error"
             });
+            toolCallErrorsTotal.inc({
+              capability: toolName || "unknown",
+              error_type: "runtime_error"
+            });
             const errorResponse = {
               semantic_evidence: errorMessage,
               cryptographic_proof: Buffer.from(""),
@@ -3516,5 +3630,5 @@ Data structure: ${schemaDigest}. Full schema: resource ${uri}. Guidelines: resou
 };
 
 export { AUTH_DEFAULTS, AuditLogger, GENESIS_HASH, JwtValidator, LiopRpcServer, LiopServer, NerScanner, PII_PATTERNS, PII_PRESETS, PiiScanner, computeEntryHash, createOAuthServer, globalAuditLogger };
-//# sourceMappingURL=chunk-WCCGE4QR.js.map
-//# sourceMappingURL=chunk-WCCGE4QR.js.map
+//# sourceMappingURL=chunk-HD2N3IJX.js.map
+//# sourceMappingURL=chunk-HD2N3IJX.js.map