@nekzus/liop 2.5.0 → 2.6.0

package/dist/{chunk-547TYL27.js → chunk-UJFWPRDM.js}

@@ -1,11 +1,10 @@
-import { LiopVerifier } from './chunk-32ADSAJS.js';
-import { Kyber768Wrapper } from './chunk-QLCOEP5J.js';
-import { authorizeRequest, Dilithium65Wrapper } from './chunk-U5BZ66VX.js';
-import { liopV1, createChannelCredentials, GRPC_CHANNEL_OPTIONS } from './chunk-WSW6YJNY.js';
-import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, isLegacyRequest, adaptResponseForLegacyClient, MCP_PROTOCOL_VERSION_LEGACY, buildLegacyInitializeResponse } from './chunk-PYKRQAER.js';
-import { log } from './chunk-72MNYFR6.js';
-import * as crypto2 from 'crypto';
+import { tokensInputTotal, tokensOutputTotal, tokensSavedTotal, operationDurationMs } from './chunk-PAICJCKJ.js';
+import { log } from './chunk-K3DGJLUY.js';
+import * as fs from 'fs';
 import * as grpc from '@grpc/grpc-js';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import * as protoLoader from '@grpc/proto-loader';
 
 // ../../node_modules/.pnpm/gpt-tokenizer@4.0.0/node_modules/gpt-tokenizer/esm/constants.js
 var DEFAULT_MERGE_CACHE_SIZE = 1e5;
@@ -206560,6 +206559,27 @@ var TokenTelemetryEngine = class _TokenTelemetryEngine {
       }
     } catch {
     }
+    try {
+      const promLabels = {
+        type: metric.type,
+        method: metric.method,
+        tool: metric.toolName || "none"
+      };
+      if (metric.estimatedInputTokens > 0) {
+        tokensInputTotal.inc(promLabels, metric.estimatedInputTokens);
+      }
+      if (metric.estimatedOutputTokens > 0) {
+        tokensOutputTotal.inc(promLabels, metric.estimatedOutputTokens);
+      }
+      if (metric.originDatasetTokens !== void 0 && metric.originDatasetTokens > metric.estimatedOutputTokens) {
+        const actualSaved = metric.originDatasetTokens - metric.estimatedOutputTokens;
+        tokensSavedTotal.inc({ tool: metric.toolName || "none" }, actualSaved);
+      }
+      if (metric.durationMs !== void 0 && metric.durationMs >= 0) {
+        operationDurationMs.observe(promLabels, metric.durationMs);
+      }
+    } catch {
+    }
   }
   /**
    * @deprecated Use countTokens() instead. Kept for backward compatibility.
@@ -206691,1419 +206711,174 @@ var TokenTelemetryEngine = class _TokenTelemetryEngine {
     _TokenTelemetryEngine.instance = null;
   }
 };
-
-// src/utils/mcpCompact.ts
-function mcpCompactToolDescriptions() {
-  const v = process.env.LIOP_MCP_COMPACT_TOOL_DESCRIPTIONS?.toLowerCase().trim();
-  if (v === "0" || v === "false" || v === "no") return false;
-  return true;
-}
-function stripVerboseLiopToolDescription(description) {
-  let d = description;
-  const markers = [
-    "\n\n[LIOP-PROTO-V1:",
-    "\r\n\r\n[LIOP-PROTO-V1:",
-    "\n[LIOP-PROTO-V1:"
-    // rare
-  ];
-  for (const m of markers) {
-    const i = d.indexOf(m);
-    if (i !== -1) {
-      d = d.slice(0, i);
-      break;
-    }
-  }
-  return d.trimEnd();
-}
-
-// src/gateway/router.ts
-var MANIFEST_CACHE_TTL_S = 300;
-var MANIFEST_DISCOVERY_RETRIES = 5;
-var LiopMcpRouter = class _LiopMcpRouter {
-  constructor(liopServer, meshNode = null, defaultRpcPort = 50051) {
-    this.liopServer = liopServer;
-    this.meshNode = meshNode;
-    this.defaultRpcPort = defaultRpcPort;
-    if (this.meshNode) {
-      this.meshNode.registerManifestHandler(() => {
-        const remoteTools = this.liopServer.listTools().map((t) => ({
-          name: t.name,
-          description: t.description,
-          inputSchema: t.inputSchema
-        }));
-        const resources = this.liopServer.listResources().map((r) => ({
-          name: r.name,
-          uri: r.uri,
-          description: r.description,
-          mimeType: r.mimeType
-        }));
-        const serverConfig = this.liopServer.config;
-        return {
-          peerId: this.meshNode?.getPeerId() || "unknown",
-          grpcPort: this.defaultRpcPort,
-          tools: [...remoteTools],
-          resources,
-          serverInfo: this.liopServer.getServerInfo(),
-          authRequired: this.liopServer.jwtValidator !== void 0,
-          tokenSlug: serverConfig?.tokenSlug,
-          taxonomy: serverConfig?.taxonomy ? {
-            domain: serverConfig.taxonomy.domain || "Unknown Domain",
-            clearanceTier: serverConfig.taxonomy.clearanceTier ?? 0,
-            executionTypes: serverConfig.taxonomy.executionTypes || []
-          } : void 0
-        };
-      });
-      this.meshNode.announceManifest().catch((err) => {
-        log.info(
-          `[LIOP-Router] Failed to announce manifest: ${err instanceof Error ? err.message : String(err)}`
-        );
-      });
-    }
-    if (process.env.LIOP_DIAGNOSTIC_LEVEL === "full") {
-      process.stderr.write(
-        "\u26A0\uFE0F [LIOP-Security] Diagnostic level set to FULL \u2014 PeerIDs and network topology are exposed. Do NOT use in production.\n"
-      );
-    }
-  }
-  liopServer;
-  meshNode;
-  defaultRpcPort;
-  /** Cached manifests from remote peers. Key = PeerID */
-  manifestCache = /* @__PURE__ */ new Map();
-  /** Guards against concurrent discovery storms */
-  currentDiscovery = null;
-  /** Verifier for Tier-0 integrity checks */
-  verifier = new LiopVerifier();
-  /** Callback when new remote tools are discovered */
-  onToolsChanged;
-  /** Circuit-breaker state for peers that repeatedly fail manifest queries. */
-  manifestFailureState = /* @__PURE__ */ new Map();
-  static MANIFEST_FAILURE_BASE_COOLDOWN_MS = 15e3;
-  static MANIFEST_FAILURE_MAX_COOLDOWN_MS = 5 * 6e4;
-  static MANIFEST_SKIP_LOG_THROTTLE_MS = 3e4;
-  getManifestCacheSize() {
-    return this.manifestCache.size;
-  }
-  shouldSkipManifestQuery(peerId) {
-    const state = this.manifestFailureState.get(peerId);
-    if (!state) return false;
-    const now = Date.now();
-    if (now >= state.cooldownUntil) return false;
-    if (now - state.lastSkipLogAt > _LiopMcpRouter.MANIFEST_SKIP_LOG_THROTTLE_MS) {
-      log.info(
-        `[LIOP-Router] Skipping manifest query for ${peerId} during cooldown (${Math.ceil((state.cooldownUntil - now) / 1e3)}s remaining)`
-      );
-      state.lastSkipLogAt = now;
-    }
-    return true;
-  }
-  recordManifestQuerySuccess(peerId) {
-    this.manifestFailureState.delete(peerId);
-  }
-  recordManifestQueryFailure(peerId) {
-    const now = Date.now();
-    const prev = this.manifestFailureState.get(peerId);
-    const failures = (prev?.failures || 0) + 1;
-    const backoff = Math.min(
-      _LiopMcpRouter.MANIFEST_FAILURE_BASE_COOLDOWN_MS * 2 ** Math.max(0, failures - 1),
-      _LiopMcpRouter.MANIFEST_FAILURE_MAX_COOLDOWN_MS
+var isTlsEnforced = () => process.env.NODE_ENV === "production" || process.env.LIOP_ENFORCE_TLS === "true";
+var isTlsWarningSuppressed = (tls) => tls?.insecure === true || tls?.suppressWarning === true || process.env.LIOP_SUPPRESS_TLS_WARNING === "true";
+var hasWarnedInsecureServer = false;
+var hasWarnedInsecureChannel = false;
+function createServerCredentials(tls) {
+  if (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {
+    throw new Error(
+      "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
     );
-    this.manifestFailureState.set(peerId, {
-      failures,
-      cooldownUntil: now + backoff,
-      lastSkipLogAt: 0
-    });
   }
-  /**
-   * Detects the protocol era of an incoming request.
-   * Modern requests carry '_meta' with protocol version "2026-07-28" or use modern RPCs.
-   * Legacy requests use 'initialize' handshake or lack '_meta' envelopes.
-   */
-  detectEra(request) {
-    const params = request.params;
-    const meta = params?._meta;
-    const version = meta?.["io.modelcontextprotocol/protocolVersion"];
-    if (version === MCP_PROTOCOL_VERSION) {
-      return "modern";
-    }
-    if (MCP_LEGACY_SUPPORT_ENABLED && isLegacyRequest(request)) {
-      return "legacy";
-    }
-    return "modern";
-  }
-  async dispatch(request, authInfo) {
-    const { method, params, id } = request;
-    log.info(`[LIOP-Router] Processing: ${method}`);
-    if (this.liopServer.jwtValidator) {
-      const authResult = authorizeRequest(method, authInfo ?? null);
-      if (!authResult.allowed) {
-        log.info(
-          `[LIOP-Router] RBAC Access Denied for method '${method}': ${authResult.reason}`
-        );
-        return {
-          jsonrpc: "2.0",
-          id,
-          error: {
-            code: -32099,
-            // Custom authentication/authorization failure code
-            message: authResult.reason || "Access Denied"
-          }
-        };
-      }
-    }
-    switch (method) {
-      /** @mcp-legacy Initialize handshake for 2025-era clients. Remove when v1 EOL. */
-      case "initialize": {
-        if (!MCP_LEGACY_SUPPORT_ENABLED) {
-          return {
-            jsonrpc: "2.0",
-            id,
-            error: {
-              code: -32601,
-              message: "Method retired: initialize (MCP 2026-07-28 is stateless)"
-            }
-          };
-        }
-        log.info(
-          "[LIOP-Router] \u26A0\uFE0F Legacy MCP client detected (2025-era initialize)."
-        );
-        return buildLegacyInitializeResponse(
-          this.liopServer.getServerInfo(),
-          id
-        );
-      }
-      /** @mcp-legacy Initialized notification for 2025-era clients. Remove when v1 EOL. */
-      case "notifications/initialized":
-        if (!MCP_LEGACY_SUPPORT_ENABLED) return null;
-        this.kickDiscoveryAfterInitialized().catch(() => {
-        });
-        return null;
-      case "notifications/cancelled":
-        return null;
-      // No-op for MCP spec compliance
-      case "server/discover":
-        return {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            resultType: "complete",
-            supportedVersions: MCP_LEGACY_SUPPORT_ENABLED ? [MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY] : [MCP_PROTOCOL_VERSION],
-            capabilities: {
-              tools: { listChanged: true },
-              resources: { listChanged: true },
-              prompts: { listChanged: true }
-            },
-            serverInfo: this.liopServer.getServerInfo()
-          }
-        };
-      case "ping":
-        return { jsonrpc: "2.0", id, result: {} };
-      case "tools/list": {
-        const localTools = this.liopServer.listTools();
-        const remoteTools = await this.getRemoteTools();
-        const listedLocals = mcpCompactToolDescriptions() ? localTools.map((t) => ({
-          ...t,
-          description: stripVerboseLiopToolDescription(t.description ?? "")
-        })) : localTools;
-        log.info(
-          `[LIOP-Router] tools/list: ${localTools.length} local, ${remoteTools.length} remote tools found`
-        );
-        const diagnosticTool = {
-          name: "LiopMeshStatus",
-          description: "LiopMeshStatus: Returns the current dynamic diagnostic status of the Zero-Trust Neural Mesh.",
-          inputSchema: {
-            type: "object",
-            properties: {},
-            additionalProperties: false
-          }
-        };
-        const allTools = [diagnosticTool, ...listedLocals, ...remoteTools].sort(
-          (a, b) => a.name.localeCompare(b.name)
-        );
-        const telemetry = TokenTelemetryEngine.getInstance();
-        const toolsPayload = JSON.stringify(allTools);
-        const toolsResponsePayload = JSON.stringify({ tools: allTools });
-        telemetry.record({
-          type: "tools_list",
-          method: "tools/list",
-          estimatedInputTokens: telemetry.countTokens(toolsPayload),
-          estimatedOutputTokens: telemetry.countTokens(toolsResponsePayload)
-        });
-        const era = this.detectEra(request);
-        let response = {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            resultType: "complete",
-            ttlMs: 3e5,
-            cacheScope: "public",
-            tools: allTools
-          }
-        };
-        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-          response = adaptResponseForLegacyClient(response);
-        }
-        return response;
-      }
-      case "tools/call": {
-        const response = await this.transcodeMcpToLiop(
-          id,
-          params,
-          authInfo?.token
-        );
-        if (!response) return null;
-        const era = this.detectEra(request);
-        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-          return adaptResponseForLegacyClient(response);
-        }
-        if (response.result && typeof response.result === "object") {
-          const resObj = response.result;
-          if (!resObj.resultType) {
-            resObj.resultType = "complete";
-          }
-        }
-        return response;
-      }
-      case "resources/list": {
-        const localResources = this.liopServer.listResources();
-        const remoteResources = await this.getRemoteResources();
-        const allResources = [...localResources, ...remoteResources].sort(
-          (a, b) => a.uri.localeCompare(b.uri)
+  if (tls?.certManager) {
+    try {
+      const certChain = tls.certManager.getCertChain();
+      const privateKey = tls.certManager.getPrivateKey();
+      const rootCert = tls.certManager.getRootCert();
+      if (tls.mutualTls && !rootCert) {
+        throw new Error(
+          "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded."
         );
-        const rlTelemetry = TokenTelemetryEngine.getInstance();
-        const rlPayload = JSON.stringify(allResources);
-        rlTelemetry.record({
-          type: "resource_list",
-          method: "resources/list",
-          estimatedInputTokens: 0,
-          estimatedOutputTokens: rlTelemetry.countTokens(rlPayload)
-        });
-        const era = this.detectEra(request);
-        let response = {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            resultType: "complete",
-            ttlMs: 3e5,
-            cacheScope: "public",
-            resources: allResources
-          }
-        };
-        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-          response = adaptResponseForLegacyClient(response);
-        }
-        return response;
-      }
-      case "resources/read": {
-        const typedParams = params;
-        if (!typedParams?.uri)
-          return {
-            jsonrpc: "2.0",
-            id,
-            error: { code: -32602, message: "Missing resource uri" }
-          };
-        try {
-          const rrStartTime = Date.now();
-          const result = await this.liopServer.readResource(typedParams.uri);
-          const rrTelemetry = TokenTelemetryEngine.getInstance();
-          const rrOutputPayload = JSON.stringify(result);
-          rrTelemetry.record({
-            type: "resource_read",
-            method: "resources/read",
-            toolName: typedParams.uri,
-            estimatedInputTokens: rrTelemetry.countTokens(typedParams.uri),
-            estimatedOutputTokens: rrTelemetry.countTokens(rrOutputPayload),
-            durationMs: Date.now() - rrStartTime
-          });
-          const era = this.detectEra(request);
-          const rawResult = typeof result === "object" && result !== null ? {
-            resultType: "complete",
-            ttlMs: 6e4,
-            cacheScope: "private",
-            ...result
-          } : {
-            resultType: "complete",
-            ttlMs: 6e4,
-            cacheScope: "private",
-            contents: result
-          };
-          let response = { jsonrpc: "2.0", id, result: rawResult };
-          if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-            response = adaptResponseForLegacyClient(response);
-          }
-          return response;
-        } catch (err) {
-          const targetUri = typedParams.uri;
-          for (const { manifest } of this.manifestCache.values()) {
-            const remoteResource = manifest.resources.find(
-              (r) => r.uri === targetUri
-            );
-            if (remoteResource) {
-              log.info(
-                `[LIOP-Router] Resolved resource ${targetUri} from cache (Peer: ${manifest.peerId})`
-              );
-              const era = this.detectEra(request);
-              let response = {
-                jsonrpc: "2.0",
-                id,
-                result: {
-                  resultType: "complete",
-                  ttlMs: 6e4,
-                  cacheScope: "private",
-                  contents: [
-                    {
-                      uri: remoteResource.uri,
-                      mimeType: remoteResource.mimeType || "text/plain",
-                      text: remoteResource.text || remoteResource.description || "No content provided"
-                    }
-                  ]
-                }
-              };
-              if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-                response = adaptResponseForLegacyClient(response);
-              }
-              return response;
-            }
-          }
-          return {
-            jsonrpc: "2.0",
-            id,
-            error: {
-              code: -32e3,
-              message: err instanceof Error ? err.message : String(err)
-            }
-          };
-        }
-      }
-      case "prompts/list": {
-        const promptsList = this.liopServer.listPrompts().sort((a, b) => a.name.localeCompare(b.name));
-        const plTelemetry = TokenTelemetryEngine.getInstance();
-        const plPayload = JSON.stringify(promptsList);
-        plTelemetry.record({
-          type: "prompt_list",
-          method: "prompts/list",
-          estimatedInputTokens: 0,
-          estimatedOutputTokens: plTelemetry.countTokens(plPayload)
-        });
-        const era = this.detectEra(request);
-        let response = {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            resultType: "complete",
-            ttlMs: 3e5,
-            cacheScope: "public",
-            prompts: promptsList
-          }
-        };
-        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-          response = adaptResponseForLegacyClient(response);
-        }
-        return response;
-      }
-      case "prompts/get": {
-        const typedParams = params;
-        if (!typedParams?.name)
-          return {
-            jsonrpc: "2.0",
-            id,
-            error: { code: -32602, message: "Missing prompt name" }
-          };
-        try {
-          const pgStartTime = Date.now();
-          const result = await this.liopServer.getPrompt({
-            name: typedParams.name,
-            arguments: typedParams.arguments || {}
-          });
-          const pgTelemetry = TokenTelemetryEngine.getInstance();
-          const pgInputPayload = JSON.stringify({
-            name: typedParams.name,
-            arguments: typedParams.arguments
-          });
-          const pgOutputPayload = JSON.stringify(result);
-          pgTelemetry.record({
-            type: "prompt_get",
-            method: "prompts/get",
-            toolName: typedParams.name,
-            estimatedInputTokens: pgTelemetry.countTokens(pgInputPayload),
-            estimatedOutputTokens: pgTelemetry.countTokens(pgOutputPayload),
-            durationMs: Date.now() - pgStartTime
-          });
-          const era = this.detectEra(request);
-          const rawResult = typeof result === "object" && result !== null ? { resultType: "complete", ...result } : result;
-          let response = { jsonrpc: "2.0", id, result: rawResult };
-          if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-            response = adaptResponseForLegacyClient(response);
-          }
-          return response;
-        } catch (err) {
-          return {
-            jsonrpc: "2.0",
-            id,
-            error: {
-              code: -32e3,
-              message: err instanceof Error ? err.message : String(err)
-            }
-          };
-        }
       }
-      case "resources/templates/list": {
-        const era = this.detectEra(request);
-        let response = {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            resultType: "complete",
-            ttlMs: 3e5,
-            cacheScope: "public",
-            resourceTemplates: []
-          }
-        };
-        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-          response = adaptResponseForLegacyClient(response);
-        }
-        return response;
-      }
-      case "subscriptions/listen": {
-        const era = this.detectEra(request);
-        let response = {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            resultType: "complete"
-          }
-        };
-        if (era === "legacy" && MCP_LEGACY_SUPPORT_ENABLED) {
-          response = adaptResponseForLegacyClient(response);
-        }
-        return response;
-      }
-      default:
-        return {
-          jsonrpc: "2.0",
-          id,
-          error: { code: -32601, message: `Method not found: ${method}` }
-        };
-    }
-  }
-  /**
-   * MCP clients often send notifications/initialized then immediately tools/list.
-   * Start manifest discovery without blocking the notification handler.
-   */
-  kickDiscoveryAfterInitialized() {
-    return (async () => {
-      await new Promise((r) => setTimeout(r, 250));
-      await Promise.race([
-        this.refreshManifestCache(true),
-        new Promise((r) => setTimeout(r, 15e3))
-      ]).catch(() => {
-      });
-    })();
-  }
-  /**
-   * Discovers and caches manifests from all remote LIOP providers in the mesh.
-   * Uses Kademlia DHT to find "liop:manifest" providers, then opens
-   * /liop/manifest/1.0.0 protocol streams to retrieve their full metadata.
-   */
-  async refreshManifestCache(silent = false) {
-    if (!this.meshNode) return;
-    if (this.currentDiscovery) return this.currentDiscovery;
-    if (!silent && this.manifestCache.size > 0) {
-      const now = Date.now();
-      const allFresh = Array.from(this.manifestCache.values()).every(
-        ({ cachedAt }) => now - cachedAt < MANIFEST_CACHE_TTL_S * 1e3
+      return grpc.ServerCredentials.createSsl(
+        rootCert,
+        [{ cert_chain: certChain, private_key: privateKey }],
+        Boolean(tls.mutualTls)
       );
-      if (allFresh) return;
-    }
-    this.currentDiscovery = (async () => {
-      try {
-        const prevCount = Array.from(this.manifestCache.values()).reduce(
-          (acc, { manifest }) => acc + manifest.tools.length,
-          0
+    } catch (error) {
+      if (isTlsEnforced()) {
+        throw new Error(
+          `[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`
         );
-        if (this.manifestCache.size === 0) {
-          for (let i = 0; i < 3; i++) {
-            const connections = (
-              // biome-ignore lint/suspicious/noExplicitAny: access internal nodes for connection count
-              this.meshNode.node?.getConnections().length || 0
-            );
-            if (connections > 0) {
-              log.info(
-                `[LIOP-Router] P2P Connection established. Starting discovery...`
-              );
-              break;
-            }
-            log.info(
-              `[LIOP-Router] Waiting for P2P connections (attempt ${i + 1}/10)...`
-            );
-            await new Promise((r) => setTimeout(r, 1e3));
-          }
-        }
-        let providerIds = [];
-        const MAX_COLD_ATTEMPTS = this.manifestCache.size === 0 ? 5 : 1;
-        for (let coldAttempt = 0; coldAttempt < MAX_COLD_ATTEMPTS; coldAttempt++) {
-          for (let attempt = 0; attempt < MANIFEST_DISCOVERY_RETRIES; attempt++) {
-            providerIds = await this.meshNode?.discoverManifestProviders() || [];
-            const selfId2 = this.meshNode?.getPeerId();
-            const remoteIds = providerIds.filter((id) => id !== selfId2);
-            if (remoteIds.length > 0) break;
-            if (attempt < MANIFEST_DISCOVERY_RETRIES - 1) {
-              log.info(
-                `[LIOP-Router] DHT discovery attempt ${attempt + 1}/${MANIFEST_DISCOVERY_RETRIES}...`
-              );
-              await new Promise((r) => setTimeout(r, 1e3));
-            }
-          }
-          const activePeers = (
-            // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
-            this.meshNode.node?.getConnections().map(
-              (c) => c.remotePeer.toString()
-            ) || []
-          );
-          if (activePeers.length > 0) {
-            providerIds = Array.from(/* @__PURE__ */ new Set([...providerIds, ...activePeers]));
-          }
-          const selfIdEnd = this.meshNode?.getPeerId();
-          const remoteIdsEnd = providerIds.filter((id) => id !== selfIdEnd);
-          if (remoteIdsEnd.length > 0) break;
-          if (coldAttempt < MAX_COLD_ATTEMPTS - 1) {
-            log.info(
-              `[LIOP-Router] Initial discovery failed (0 providers). Retrying in 1s (${coldAttempt + 1}/${MAX_COLD_ATTEMPTS})...`
-            );
-            await new Promise((r) => setTimeout(r, 1e3));
-          }
-        }
-        if (providerIds.length === 0) {
-          log.info(
-            `[LIOP-Router] No manifest providers found after all attempts.`
-          );
-          return;
-        }
-        if (!silent) {
-          log.info(
-            `[LIOP-Router] Discovered ${providerIds.length} candidate manifest providers`
-          );
-        }
-        const connectedPeers = new Set(
-          // biome-ignore lint/suspicious/noExplicitAny: internal node access for fast peer ordering
-          (this.meshNode.node?.getConnections?.() || []).map(
-            (c) => c.remotePeer.toString()
-          )
-        );
-        providerIds = [...providerIds].sort((a, b) => {
-          const aConnected = connectedPeers.has(a) ? 1 : 0;
-          const bConnected = connectedPeers.has(b) ? 1 : 0;
-          return bConnected - aConnected;
-        });
-        let successCount = 0;
-        let errorCount = 0;
-        let cacheUpdated = false;
-        const selfId = this.meshNode?.getPeerId();
-        const eligiblePeers = providerIds.filter((peerId) => {
-          if (!this.meshNode) return false;
-          if (peerId === selfId) return false;
-          if (this.shouldSkipManifestQuery(peerId)) return false;
-          const cached = this.manifestCache.get(peerId);
-          if (cached && Date.now() - cached.cachedAt < MANIFEST_CACHE_TTL_S * 1e3) {
-            successCount++;
-            return false;
-          }
-          return true;
-        });
-        const queryResults = await Promise.allSettled(
-          eligiblePeers.map(async (peerId) => {
-            if (!this.meshNode) return null;
-            log.info(`[LIOP-Router] Querying manifest from: ${peerId}`);
-            return {
-              peerId,
-              manifest: await this.meshNode.queryManifest(peerId)
-            };
-          })
-        );
-        for (const result of queryResults) {
-          if (result.status === "fulfilled" && result.value?.manifest) {
-            const { peerId, manifest } = result.value;
-            if (manifest.pqcSignature && manifest.pqcPublicKey) {
-              const isValid = Dilithium65Wrapper.verifyManifest(
-                manifest,
-                manifest.pqcSignature,
-                manifest.pqcPublicKey
-              );
-              if (!isValid) {
-                log.warn(
-                  `[LIOP-Router] \u26A0\uFE0F Tampered manifest rejected for peer ${peerId} (ML-DSA-65 signature invalid)`
-                );
-                this.recordManifestQueryFailure(peerId);
-                errorCount++;
-                continue;
-              }
-              log.info(
-                `[LIOP-Router] \u{1F512} ML-DSA-65 (FIPS 204) Manifest attestation verified for peer ${peerId}`
-              );
-            }
-            this.manifestCache.set(peerId, {
-              manifest,
-              cachedAt: Date.now()
-            });
-            this.recordManifestQuerySuccess(peerId);
-            cacheUpdated = true;
-            successCount++;
-            log.info(
-              `[LIOP-Router] Manifest received from ${peerId} (${manifest.tools.length} tools)`
-            );
-          } else if (result.status === "fulfilled" && result.value) {
-            this.recordManifestQueryFailure(result.value.peerId);
-            errorCount++;
-            log.info(
-              `[LIOP-Router] Manifest query returned NULL for ${result.value.peerId}`
-            );
-          } else if (result.status === "rejected") {
-            errorCount++;
-            log.info(
-              `[LIOP-Router] Fatal error querying manifest:`,
-              result.reason instanceof Error ? result.reason.message : String(result.reason)
-            );
-          }
-        }
-        this._discoveryStats = {
-          candidates: providerIds.length,
-          success: successCount,
-          failures: errorCount,
-          lastDiscovery: Date.now()
-        };
-        if (cacheUpdated) {
-          const newCount = Array.from(this.manifestCache.values()).reduce(
-            (acc, { manifest }) => acc + manifest.tools.length,
-            0
-          );
-          if (newCount !== prevCount && this.onToolsChanged) {
-            process.stderr.write(
-              "[LIOP-Router] Mesh topology updated! Emitting notifications/tools/list_changed.\n"
-            );
-            this.onToolsChanged();
-          }
-        }
-      } finally {
-        this.currentDiscovery = null;
       }
-    })();
-    return this.currentDiscovery;
-  }
-  /**
-   * Returns the current manifest cache size for external telemetry.
-   * Used by the adaptive polling system to detect topology stabilization.
-   */
-  getCacheSize() {
-    return this.manifestCache.size;
-  }
-  /**
-   * Returns all remote tools discovered via the manifest protocol.
-   */
-  async getRemoteTools() {
-    const EXPECTED_PROVIDERS = Number.parseInt(
-      process.env.LIOP_EXPECTED_PROVIDERS ?? "1",
-      10
-    );
-    if (this.manifestCache.size < EXPECTED_PROVIDERS && this.meshNode) {
-      const initialTimeoutMs = Number.parseInt(
-        process.env.LIOP_INITIAL_DISCOVERY_TIMEOUT_MS ?? "8000",
-        10
+      log.warn(
+        `[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`
       );
-      const boundedTimeoutMs = Number.isFinite(initialTimeoutMs) && initialTimeoutMs > 0 ? initialTimeoutMs : 12e3;
-      const deadline = Date.now() + boundedTimeoutMs;
-      let stableCount = 0;
-      let lastCacheSize = -1;
-      while (Date.now() < deadline) {
-        if (this.manifestCache.size >= EXPECTED_PROVIDERS) break;
-        await Promise.race([
-          this.refreshManifestCache(true),
-          new Promise((resolve) => setTimeout(resolve, 3e3))
-        ]).catch(() => {
-        });
-        if (this.manifestCache.size >= EXPECTED_PROVIDERS) break;
-        if (this.manifestCache.size === lastCacheSize) {
-          stableCount++;
-          if (stableCount >= 3 && this.manifestCache.size > 0) {
-            log.info(
-              `[LIOP-Router] Provider count stabilized at ${this.manifestCache.size}/${EXPECTED_PROVIDERS}. Proceeding with available mesh.`
-            );
-            break;
-          }
-        } else {
-          stableCount = 0;
-          lastCacheSize = this.manifestCache.size;
-        }
-        await new Promise((r) => setTimeout(r, 1e3));
-      }
-      if (this.manifestCache.size < EXPECTED_PROVIDERS) {
-        log.info(
-          `[LIOP-Router] \u26A0\uFE0F Mesh partially available: ${this.manifestCache.size}/${EXPECTED_PROVIDERS} providers. Some tools may be unavailable. Check Docker containers.`
-        );
-        this.refreshManifestCache(true).catch(() => {
-        });
-      }
+      return grpc.ServerCredentials.createInsecure();
     }
-    const tools = [];
-    const seenNames = /* @__PURE__ */ new Set();
-    const localToolNames = new Set(
-      this.liopServer.listTools().map((t) => t.name)
-    );
-    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
-      for (const tool of manifest.tools) {
-        if (tool.name === "LiopMeshStatus") continue;
-        let finalName = tool.name;
-        if (seenNames.has(tool.name) || localToolNames.has(tool.name)) {
-          finalName = `${tool.name}_${peerId.slice(-4)}`;
-        }
-        seenNames.add(finalName);
-        const providerName = manifest.serverInfo?.name || "Unknown Provider";
-        const baseDesc = tool.description || `Remote tool from ${providerName}`;
-        const cleanTool = {
-          name: finalName,
-          description: mcpCompactToolDescriptions() ? stripVerboseLiopToolDescription(baseDesc) : baseDesc,
-          inputSchema: tool.inputSchema || {
-            type: "object",
-            properties: {}
-          }
-        };
-        if (typeof cleanTool.inputSchema === "object" && !cleanTool.inputSchema.type) {
-          cleanTool.inputSchema.type = "object";
-        }
-        if (typeof cleanTool.inputSchema === "object" && !cleanTool.inputSchema.properties) {
-          cleanTool.inputSchema.properties = {};
-        }
-        let blueprint = "";
-        if (manifest.taxonomy) {
-          blueprint = `
-[LIOP-DOMAIN: ${manifest.taxonomy.domain}]`;
-        }
-        const properties = cleanTool.inputSchema.properties || {};
-        let envelopeDoc = "";
-        if (!mcpCompactToolDescriptions() && properties.payload) {
-          envelopeDoc = `
-[REQUIRES: LIOP-PROTO-V1 ENVELOPE]`;
-        }
-        if (!mcpCompactToolDescriptions() && cleanTool.description.includes("STRICT SCHEMA ADHERENCE")) {
-          cleanTool.description = cleanTool.description.replace(
-            "STRICT SCHEMA ADHERENCE:",
-            "[INDUSTRIAL-REQUISITE] STRICT SCHEMA ADHERENCE (MANDATORY):"
-          );
-        }
-        const originStamp = mcpCompactToolDescriptions() ? `
-(Peer: ${peerId.slice(-8)})${blueprint}` : `
-(Origin: ${peerId.slice(-8)})${blueprint}${envelopeDoc}`;
-        cleanTool.description = `${cleanTool.description}${originStamp}`;
-        tools.push(cleanTool);
-      }
-    }
-    return tools;
-  }
-  /**
-   * Returns all remote resources discovered via the manifest protocol.
-   */
-  async getRemoteResources() {
-    if (!this.currentDiscovery) {
-      this.refreshManifestCache(true).catch(() => {
-      });
-    }
-    const resources = [];
-    const seenUris = new Set(this.liopServer.listResources().map((r) => r.uri));
-    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
-      for (const resource of manifest.resources) {
-        if (!seenUris.has(resource.uri)) {
-          const augmentedResource = { ...resource };
-          const providerName = manifest.serverInfo?.name || "Unknown Provider";
-          let blueprint = "";
-          if (manifest.taxonomy) {
-            blueprint = `
-
-[LIOP Zero-Trust Blueprint]
-Domain: ${manifest.taxonomy.domain}
-Clearance Tier: ${manifest.taxonomy.clearanceTier}`;
-            if (manifest.taxonomy.executionTypes && manifest.taxonomy.executionTypes.length > 0) {
-              blueprint += `
-Execution Types: ${manifest.taxonomy.executionTypes.join(", ")}`;
-            }
-          }
-          const originStamp = `
-
-[LIOP Zero-Trust Origin]
-Provider: ${providerName}
-Network ID: ${peerId}${blueprint}`;
-          if (augmentedResource.uri.startsWith("liop://schema/")) {
-            augmentedResource.name = `[SCHEMA] ${augmentedResource.name}`;
-            augmentedResource.description = `[CRITICAL SCHEMA] ${augmentedResource.description || "Data Dictionary for Zero-Shot Autonomy"}${originStamp}`;
-          } else {
-            augmentedResource.description = augmentedResource.description ? `${augmentedResource.description}${originStamp}` : originStamp.trim();
-          }
-          resources.push(augmentedResource);
-          seenUris.add(resource.uri);
-        }
-      }
-    }
-    return resources;
-  }
-  /**
-   * Resolves the gRPC target (host:port) AND the peerId for a given tool name
-   * by searching the manifest cache. Supports exact names and suffixed names.
-   */
-  resolveManifestTarget(toolName) {
-    for (const [peerId, { manifest }] of this.manifestCache.entries()) {
-      const tool = manifest.tools.find((t) => t.name === toolName);
-      if (tool) {
-        return {
-          peerId,
-          originalToolName: toolName
-        };
-      }
-    }
-    const parts = toolName.split("_");
-    if (parts.length > 1) {
-      const suffix = parts.pop();
-      const baseName = parts.join("_");
-      for (const [peerId, { manifest }] of this.manifestCache.entries()) {
-        if (peerId.endsWith(suffix || "")) {
-          const tool = manifest.tools.find((t) => t.name === baseName);
-          if (tool) {
-            return {
-              peerId,
-              originalToolName: baseName
-            };
-          }
-        }
-      }
-    }
-    return null;
   }
-  /**
-   * Redacts a PeerID for external-facing diagnostics.
-   * LIOP_DIAGNOSTIC_LEVEL controls verbosity:
-   *   - "redacted" (default): truncated to last 8 chars
-   *   - "full": complete PeerID (development only)
-   */
-  redactPeerId(peerId) {
-    const level = process.env.LIOP_DIAGNOSTIC_LEVEL || "redacted";
-    if (level === "full") return peerId;
-    return `***${peerId.slice(-8)}`;
-  }
-  async transcodeMcpToLiop(id, params, token) {
-    const toolName = params.name;
-    if (toolName === "LiopMeshStatus") {
-      this.refreshManifestCache(true).catch(() => {
-      });
-      const stats = this._discoveryStats || {
-        candidates: 0,
-        success: 0,
-        failures: 0
-      };
-      const providerCount = this.manifestCache.size;
-      const meshState = this.meshNode ? "Active" : "Offline";
-      const cachedTools = Array.from(this.manifestCache.values()).reduce(
-        (acc, { manifest }) => acc + manifest.tools.length,
-        0
+  if (!tls?.certChain || !tls?.privateKey) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true."
       );
-      const connections = this.meshNode ? (
-        // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
-        this.meshNode.node?.getConnections().length
-      ) : 0;
-      const bootstrapNodes = this.meshNode && // biome-ignore lint/suspicious/noExplicitAny: access internal config
-      this.meshNode.config?.bootstrapNodes ? (
-        // biome-ignore lint/suspicious/noExplicitAny: access internal config
-        this.meshNode.config.bootstrapNodes
-      ) : [];
-      const bootstrapCount = bootstrapNodes.length;
-      const diagLevel = process.env.LIOP_DIAGNOSTIC_LEVEL || "redacted";
-      const showBootstraps = diagLevel !== "minimal";
-      const bootstrapList = showBootstraps ? bootstrapNodes.map((addr) => {
-        const parts = addr.split("/");
-        const id2 = parts[parts.length - 1];
-        return `  \u2022 ${id2 ? id2.slice(-8) : "Unknown"} (bootstrap)`;
-      }).join("\n") : "";
-      const routingTableSize = this.meshNode ? (
-        // biome-ignore lint/suspicious/noExplicitAny: access internal nodes
-        this.meshNode.getRoutingTableSize()
-      ) : 0;
-      const rawPeerId = this.meshNode?.getPeerId() || "Offline";
-      const localPeerId = rawPeerId === "Offline" ? rawPeerId : this.redactPeerId(rawPeerId);
-      const cachedToolList = Array.from(this.manifestCache.entries()).flatMap(
-        ([peerId, { manifest }]) => manifest.tools.map(
-          (t) => `  \u2022 ${t.name} (from origin: ${this.redactPeerId(peerId)})`
-        )
-      ).join("\n");
-      const statusText = [
-        `LIOP Mesh Status: ${meshState === "Active" ? "Active" : "Offline"}`,
-        `Local Agent Identity: ${localPeerId}`,
-        `Network: ${connections} Conns | ${routingTableSize} Mesh Nodes | ${bootstrapCount} Bootstraps`,
-        showBootstraps && bootstrapCount > 0 ? `
-Active Bootstraps:
-${bootstrapList}
-` : "",
-        `Discovery: ${stats.candidates} Candidates | ${stats.success} OK | ${stats.failures} FAIL`,
-        `Tooling: ${providerCount} Providers | ${cachedTools} Total Remote Tools`,
-        cachedTools > 0 ? `
-Discovered Remote Tools (Zero-Trust Origins):
-${cachedToolList}` : "\nNo remote tools discovered yet.",
-        // [Token Economy] Telemetry block (only appears when operations exist)
-        TokenTelemetryEngine.getInstance().formatStatusBlock()
-      ].filter((line) => line !== "").join("\n");
-      const diagTelemetry = TokenTelemetryEngine.getInstance();
-      diagTelemetry.record({
-        type: "diagnostic",
-        method: "tools/call",
-        toolName: "LiopMeshStatus",
-        estimatedInputTokens: 0,
-        estimatedOutputTokens: diagTelemetry.countTokens(statusText)
-      });
-      return {
-        jsonrpc: "2.0",
-        id,
-        result: {
-          content: [
-            {
-              type: "text",
-              text: statusText
-            }
-          ]
-        }
-      };
-    }
-    const isLocal = this.liopServer.listTools().some((t) => t.name === toolName);
-    if (!isLocal && this.meshNode) {
-      let target = this.resolveManifestTarget(toolName);
-      if (!target) {
-        await this.refreshManifestCache();
-        target = this.resolveManifestTarget(toolName);
-      }
-      if (target) {
-        log.info(
-          `[LIOP-Router] Resolved ${toolName} via manifest cache (Peer: ${target.peerId}, Original: ${target.originalToolName})`
-        );
-        const manifestEntry = this.manifestCache.get(target.peerId);
-        let effectiveToken = token;
-        if (manifestEntry?.manifest.authRequired) {
-          const resolvedToken = token || await this.getOrAcquireMeshAgentToken(target.peerId);
-          if (!resolvedToken) {
-            const providerName = manifestEntry.manifest.serverInfo?.name?.toLowerCase() || "unknown";
-            const slug = manifestEntry.manifest.tokenSlug;
-            const shortId = target.peerId.slice(-8).toUpperCase();
-            const primaryVar = slug ? `LIOP_TOKEN_${slug}` : `LIOP_TOKEN_${providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
-            return {
-              jsonrpc: "2.0",
-              id,
-              result: {
-                content: [
-                  {
-                    type: "text",
-                    text: `Authentication Required: The restricted node (${providerName}) requires an access token. Please define the ${primaryVar} or LIOP_TOKEN_${shortId} environment variable on your agent/client host.`
-                  }
-                ],
-                isError: true
-              }
-            };
-          }
-          effectiveToken = resolvedToken;
-        }
-        return this.routeToRemoteProvider(
-          id,
-          target.originalToolName,
-          target.peerId,
-          params,
-          effectiveToken
-        );
-      }
-      let providers = [];
-      for (let i = 0; i < 3; i++) {
-        providers = await this.meshNode.findProviders(toolName);
-        if (providers.length > 0) break;
-        if (i < 2) await new Promise((r) => setTimeout(r, 1e3));
-      }
-      if (providers.length > 0) {
-        return this.routeToRemoteProvider(
-          id,
-          toolName,
-          providers[0],
-          params,
-          token
-        );
-      }
     }
-    if (isLocal) {
-      try {
-        const localStartTime = Date.now();
-        const result = await this.liopServer.callTool({
-          name: toolName,
-          arguments: params.arguments || {}
-        });
-        const localTelemetry = TokenTelemetryEngine.getInstance();
-        const localInputPayload = JSON.stringify(params.arguments || {});
-        const localOutputPayload = JSON.stringify(result);
-        localTelemetry.record({
-          type: "tool_call",
-          method: "tools/call",
-          toolName,
-          estimatedInputTokens: localTelemetry.countTokens(localInputPayload),
-          estimatedOutputTokens: localTelemetry.countTokens(localOutputPayload),
-          durationMs: Date.now() - localStartTime
-        });
-        return { jsonrpc: "2.0", id, result };
-      } catch (err) {
-        return {
-          jsonrpc: "2.0",
-          id,
-          error: {
-            code: -32e3,
-            message: err instanceof Error ? err.message : String(err)
-          }
-        };
-      }
+    if (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureServer) {
+      hasWarnedInsecureServer = true;
+      log.debug(
+        "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
+      );
     }
-    return {
-      jsonrpc: "2.0",
-      id,
-      error: {
-        code: -32002,
-        message: `No provider found for tool: ${toolName}. Ensure the provider node is active and connected to the mesh.`
-      }
-    };
+    return grpc.ServerCredentials.createInsecure();
   }
-  async routeToRemoteProvider(id, toolName, peerId, params, token) {
-    if (!this.meshNode)
-      return {
-        jsonrpc: "2.0",
-        id,
-        error: { code: -32603, message: "Mesh Node inactive" }
-      };
-    let manifestEntry = this.manifestCache.get(peerId);
-    let grpcPort = this.defaultRpcPort;
-    if (manifestEntry) {
-      grpcPort = manifestEntry.manifest.grpcPort;
-    } else {
-      const manifest = await this.meshNode.queryManifest(peerId);
-      if (manifest) {
-        grpcPort = manifest.grpcPort;
-        this.manifestCache.set(peerId, {
-          manifest,
-          cachedAt: Date.now()
-        });
-        manifestEntry = this.manifestCache.get(peerId);
-      }
+  try {
+    const rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;
+    const certChain = fs.readFileSync(tls.certChain);
+    const privateKey = fs.readFileSync(tls.privateKey);
+    if (tls.mutualTls && !rootCert) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
+      );
     }
-    const addrs = await this.meshNode.resolvePeer(peerId);
-    const nexusUrl = process.env.LIOP_NEXUS_URL || "";
-    const isDockerDemo = nexusUrl.includes("127.0.0.1:13000") || nexusUrl.includes("localhost:13000") || nexusUrl.includes("127.0.0.1:13001") || nexusUrl.includes("localhost:13001");
-    const isDockerPort = addrs.some(
-      (a) => a.includes("13001") || a.includes("13003") || a.includes("13004") || a.includes("13005") || a.includes("13011") || a.includes("13021") || a.includes("13031")
+    return grpc.ServerCredentials.createSsl(
+      rootCert,
+      [{ cert_chain: certChain, private_key: privateKey }],
+      Boolean(tls.mutualTls)
     );
-    const shouldRemapGrpcPorts = process.env.LIOP_USE_PUBLISHED_GRPC_PORTS === "1" || process.env.LIOP_DOCKER_MAP === "true" || process.env.LIOP_DEV_MODE === "true" || process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test" || isDockerDemo || isDockerPort;
-    if (shouldRemapGrpcPorts) {
-      const providerName = manifestEntry?.manifest?.serverInfo?.name?.toLowerCase() || "";
-      const tn = toolName.toLowerCase();
-      if (providerName.includes("vault") || tn.includes("medical")) {
-        grpcPort = 13011;
-      } else if (providerName.includes("bank") || tn.includes("bank")) {
-        grpcPort = 13021;
-      } else if (providerName.includes("oracle") || tn.includes("hft") || tn.includes("market")) {
-        grpcPort = 13031;
-      }
-    }
-    let targetAddr = null;
-    if (shouldRemapGrpcPorts) {
-      targetAddr = `127.0.0.1:${grpcPort}`;
-    } else {
-      const os = await import('os');
-      const localInterfaces = Object.values(os.networkInterfaces()).flat().filter((i) => i?.family === "IPv4").map((i) => i?.address);
-      for (const addr of addrs) {
-        const parts = addr.split("/");
-        const ipIdx = parts.indexOf("ip4");
-        if (ipIdx !== -1) {
-          const advertisedIp = parts[ipIdx + 1];
-          if (advertisedIp === "127.0.0.1" || localInterfaces.includes(advertisedIp)) {
-            targetAddr = `127.0.0.1:${grpcPort}`;
-            break;
-          }
-          if (!targetAddr) {
-            targetAddr = `${advertisedIp}:${grpcPort}`;
-          }
-        }
-      }
-    }
-    if (!targetAddr) {
-      targetAddr = `127.0.0.1:${grpcPort}`;
+  } catch (error) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
     }
-    log.info(
-      `[LIOP-Router] Dynamic route: ${toolName} -> ${targetAddr} (PeerID: ${peerId})`
-    );
-    const remoteClient = new liopV1.LogicMesh(
-      targetAddr,
-      createChannelCredentials(),
-      GRPC_CHANNEL_OPTIONS
-    );
-    return this.performTranscoding(
-      id,
-      remoteClient,
-      toolName,
-      params,
-      peerId,
-      token
+    log.warn(
+      `[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`
     );
+    return grpc.ServerCredentials.createInsecure();
   }
-  /** Cached M2M token for dynamic gateway-to-node routing */
-  meshAgentToken;
-  /**
-   * Dynamically acquires an M2M access token from the Nexus Authorization Server.
-   * If peerId is provided, checks if there are node-specific environment tokens
-   * before falling back to the global static token or Nexus acquisition.
-   */
-  async getOrAcquireMeshAgentToken(peerId) {
-    if (peerId) {
-      const manifestEntry = this.manifestCache.get(peerId);
-      const providerName = manifestEntry?.manifest.serverInfo?.name?.toLowerCase() || "";
-      let nodeToken;
-      const slug = manifestEntry?.manifest.tokenSlug;
-      if (slug) {
-        const envKey = `LIOP_TOKEN_${slug}`;
-        nodeToken = process.env[envKey] || process.env[`LIOP_OAUTH_TOKEN_${slug}`];
-        log.info(
-          `[LIOP-Router] Step0 tokenSlug=${slug} envKey=${envKey} found=${!!nodeToken} peer=${peerId.slice(-8)}`
-        );
-      } else {
-        log.info(
-          `[LIOP-Router] Step0 tokenSlug=MISSING (manifest has no tokenSlug) peer=${peerId.slice(-8)} provider=${providerName}`
-        );
-      }
-      if (!nodeToken) {
-        const shortId = peerId.slice(-8).toUpperCase();
-        nodeToken = process.env[`LIOP_TOKEN_${shortId}`] || process.env[`LIOP_OAUTH_TOKEN_${shortId}`];
-      }
-      if (!nodeToken && providerName) {
-        const cleanName = providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
-        nodeToken = process.env[`LIOP_TOKEN_${cleanName}`] || process.env[`LIOP_OAUTH_TOKEN_${cleanName}`];
-      }
-      if (nodeToken) {
-        log.info(
-          `[LIOP-Router] Resolved node-specific token for peer ${peerId.slice(-8)} (${providerName || "unknown"})`
-        );
-        return nodeToken;
-      }
-    }
-    if (this.meshAgentToken) return this.meshAgentToken;
-    const staticToken = process.env.LIOP_OAUTH_TOKEN || process.env.LIOP_TOKEN;
-    if (staticToken) {
-      this.meshAgentToken = staticToken;
-      return this.meshAgentToken;
-    }
-    const nexusUrl = process.env.LIOP_NEXUS_URL;
-    if (!nexusUrl) return void 0;
-    const clientId = process.env.LIOP_OAUTH_CLIENT_ID || process.env.LIOP_CLIENT_ID || "liop-mesh-agent";
-    const clientSecret = process.env.LIOP_OAUTH_CLIENT_SECRET || process.env.LIOP_CLIENT_SECRET || "dev-secret-change-me";
-    const audience = process.env.LIOP_OAUTH_AUDIENCE || process.env.LIOP_AUDIENCE || "urn:liop:mesh:api";
+}
+function createChannelCredentials(tls) {
+  if (tls?.certManager) {
     try {
-      const baseUrl = nexusUrl.endsWith("/oidc") ? nexusUrl : `${nexusUrl}/oidc`;
-      const tokenUrl = `${baseUrl}/token`;
-      log.info(
-        `[LIOP-Router] Proactively acquiring M2M token from Nexus: ${tokenUrl}`
-      );
-      const params = new URLSearchParams({
-        grant_type: "client_credentials",
-        scope: "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query",
-        resource: audience,
-        client_id: clientId,
-        client_secret: clientSecret
-      });
-      const response = await fetch(tokenUrl, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded"
-        },
-        body: params.toString()
-      });
-      if (!response.ok) {
-        const text = await response.text();
-        log.warn(
-          `[LIOP-Router] M2M Token acquisition failed: ${response.status} ${text}`
+      const rootCert = tls.certManager.getRootCert();
+      if (!rootCert) {
+        throw new Error(
+          "[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager."
         );
-        return void 0;
       }
-      const data = await response.json();
-      if (data.access_token) {
-        this.meshAgentToken = data.access_token;
-        log.info(
-          "[LIOP-Router] M2M Token acquired successfully for router routing."
+      const certChain = tls.certManager.getCertChain();
+      const privateKey = tls.certManager.getPrivateKey();
+      return grpc.credentials.createSsl(rootCert, privateKey, certChain);
+    } catch (error) {
+      if (isTlsEnforced()) {
+        throw new Error(
+          `[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`
         );
-        return this.meshAgentToken;
       }
-    } catch (err) {
       log.warn(
-        `[LIOP-Router] Failed to acquire M2M token: ${err instanceof Error ? err.message : String(err)}`
+        `[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`
       );
+      return grpc.credentials.createInsecure();
     }
-    return void 0;
   }
-  async performTranscoding(id, client, toolName, params, peerId, token) {
-    const capabilityHash = toolName;
-    const proofOfIntent = this.meshNode ? await this.meshNode.sign(Buffer.from(capabilityHash)) : Buffer.from([]);
-    const transcodingStartTime = Date.now();
-    let activeToken = token;
-    if (!activeToken) {
-      activeToken = await this.getOrAcquireMeshAgentToken(peerId);
-    }
-    if (peerId) {
-      const manifestEntry = this.manifestCache.get(peerId);
-      if (manifestEntry?.manifest.authRequired && !activeToken) {
-        const providerName = manifestEntry.manifest.serverInfo?.name?.toLowerCase() || "unknown";
-        const slug = manifestEntry.manifest.tokenSlug;
-        const shortId = peerId.slice(-8).toUpperCase();
-        const primaryVar = slug ? `LIOP_TOKEN_${slug}` : `LIOP_TOKEN_${providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
-        return {
-          jsonrpc: "2.0",
-          id,
-          result: {
-            content: [
-              {
-                type: "text",
-                text: `Authentication Required: The restricted node (${providerName}) requires an access token. Please define the ${primaryVar} or LIOP_TOKEN_${shortId} environment variable on your agent/client host.`
-              }
-            ],
-            isError: true
-          }
-        };
-      }
+  if (!tls?.rootCert) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true."
+      );
     }
-    return new Promise((resolve) => {
-      const metadata = new grpc.Metadata();
-      if (activeToken) {
-        metadata.add("authorization", `Bearer ${activeToken}`);
-      }
-      client.negotiateIntent(
-        {
-          agent_did: `did:liop:${this.meshNode?.getPeerId() || "mcp-proxy"}`,
-          capability_hash: capabilityHash,
-          proof_of_intent: proofOfIntent
-        },
-        metadata,
-        async (err, response) => {
-          if (err || !response.accepted) {
-            return resolve({
-              jsonrpc: "2.0",
-              id,
-              result: {
-                content: [
-                  {
-                    type: "text",
-                    text: `PQC Handshake Failed: ${err?.message || "Rejected"}`
-                  }
-                ],
-                isError: true
-              }
-            });
-          }
-          const { ciphertext, sharedSecret } = await Kyber768Wrapper.encapsulateAsymmetric(
-            response.kyber_public_key
-          );
-          const embeddedArgs = params?.arguments ?? (params?.payload !== void 0 ? params : {});
-          const embeddedArgsJson = JSON.stringify(embeddedArgs);
-          const proxyLogic = `return { "__liop_proxy_tool": "${toolName}", "__liop_proxy_args": ${embeddedArgsJson} };`;
-          const nonce = crypto2.randomBytes(12);
-          const sealedLogic = this.encryptWithNonce(
-            Buffer.from(proxyLogic),
-            sharedSecret,
-            nonce
-          );
-          const metadataCall = new grpc.Metadata();
-          if (activeToken) {
-            metadataCall.add("authorization", `Bearer ${activeToken}`);
-          }
-          const call = client.executeLogic(
-            {
-              session_token: response.session_token,
-              wasm_binary: new Uint8Array(sealedLogic),
-              inputs: {},
-              pqc_ciphertext: ciphertext,
-              aes_nonce: nonce
-            },
-            metadataCall
-          );
-          let resultBody = "";
-          let lastResponse = null;
-          call.on("data", (grpcRes) => {
-            resultBody += grpcRes.semantic_evidence;
-            lastResponse = grpcRes;
-          });
-          call.on("end", async () => {
-            try {
-              if (lastResponse) {
-                if (!lastResponse.is_error) {
-                  const proofHex = Buffer.from(
-                    lastResponse.cryptographic_proof
-                  ).toString("hex");
-                  const isValid = await this.verifier.verifyZkReceipt(
-                    Buffer.from(proxyLogic),
-                    proofHex,
-                    Buffer.from(lastResponse.zk_receipt),
-                    Buffer.from(sharedSecret),
-                    resultBody
-                  );
-                  if (!isValid) {
-                    return resolve({
-                      jsonrpc: "2.0",
-                      id,
-                      result: {
-                        content: [
-                          {
-                            type: "text",
-                            text: "SECURITY ALERT: Remote response failed cryptographic integrity audit."
-                          }
-                        ],
-                        isError: true
-                      }
-                    });
-                  }
-                }
-              }
-              const parsedResult = JSON.parse(resultBody);
-              const remoteTelemetry = TokenTelemetryEngine.getInstance();
-              remoteTelemetry.record({
-                type: "tool_call",
-                method: "tools/call",
-                toolName,
-                peerId,
-                estimatedInputTokens: remoteTelemetry.countTokens(embeddedArgsJson),
-                estimatedOutputTokens: remoteTelemetry.countTokens(resultBody),
-                durationMs: Date.now() - transcodingStartTime
-              });
-              resolve({ jsonrpc: "2.0", id, result: parsedResult });
-            } catch (_e) {
-              resolve({
-                jsonrpc: "2.0",
-                id,
-                result: { content: [{ type: "text", text: resultBody }] }
-              });
-            }
-          });
-          call.on(
-            "error",
-            (e) => resolve({
-              jsonrpc: "2.0",
-              id,
-              result: {
-                content: [
-                  { type: "text", text: `LIOP gRPC Error: ${e.message}` }
-                ],
-                isError: true
-              }
-            })
-          );
-        }
+    if (!isTlsWarningSuppressed(tls) && !hasWarnedInsecureChannel) {
+      hasWarnedInsecureChannel = true;
+      log.debug(
+        "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
       );
-    });
+    }
+    return grpc.credentials.createInsecure();
   }
-  encryptWithNonce(payload, key, nonce) {
-    const cipher = crypto2.createCipheriv("aes-256-gcm", key, nonce);
-    const encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);
-    return Buffer.concat([encrypted, cipher.getAuthTag()]);
+  try {
+    const rootCert = fs.readFileSync(tls.rootCert);
+    const certChain = tls.certChain ? fs.readFileSync(tls.certChain) : void 0;
+    const privateKey = tls.privateKey ? fs.readFileSync(tls.privateKey) : void 0;
+    return grpc.credentials.createSsl(rootCert, privateKey, certChain);
+  } catch (error) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc.credentials.createInsecure();
   }
+}
+
+// src/rpc/channel-options.ts
+var GRPC_CHANNEL_OPTIONS = {
+  "grpc.keepalive_time_ms": 3e4,
+  "grpc.keepalive_timeout_ms": 1e4,
+  "grpc.keepalive_permit_without_calls": 1,
+  "grpc.max_send_message_length": -1,
+  "grpc.max_receive_message_length": -1,
+  "grpc.enable_retries": 1
 };
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = path.dirname(__filename2);
+var PROD_PATHS = [
+  path.resolve(__dirname2, "./protocol/liop_core.proto"),
+  // Flat dist/ (tsup)
+  path.resolve(__dirname2, "../protocol/liop_core.proto")
+  // dist/rpc/ (tsc)
+];
+var DEV_PROTO_PATH = path.resolve(
+  __dirname2,
+  "../../../../protocol/proto/liop_core.proto"
+);
+var PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;
+if (!fs.existsSync(PROTO_PATH)) {
+  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
+}
+var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
+  keepCase: true,
+  longs: String,
+  enums: String,
+  defaults: true,
+  oneofs: true
+});
+var liopProto = grpc.loadPackageDefinition(packageDefinition);
+var liopV1 = liopProto.liop.v1;
 
-export { HeuristicTokenEstimator, LiopMcpRouter, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createSyncTokenEstimator, createTokenEstimator };
-//# sourceMappingURL=chunk-547TYL27.js.map
-//# sourceMappingURL=chunk-547TYL27.js.map
+export { GRPC_CHANNEL_OPTIONS, HeuristicTokenEstimator, LiopOTelBridge, RealTokenEstimator, TokenTelemetryEngine, createChannelCredentials, createServerCredentials, createSyncTokenEstimator, createTokenEstimator, liopV1 };
+//# sourceMappingURL=chunk-UJFWPRDM.js.map
+//# sourceMappingURL=chunk-UJFWPRDM.js.map