@nekzus/liop 2.6.0 → 2.7.0

package/dist/chunk-FCFTYOAS.js

@@ -1,793 +0,0 @@
-import { TokenManager } from './chunk-3QH44NKZ.js';
-import { LiopVerifier } from './chunk-2STZHJ24.js';
-import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS, TokenTelemetryEngine } from './chunk-UJFWPRDM.js';
-import { pqcHandshakesTotal, pqcHandshakeDurationMs, zkVerificationsTotal, toolCallErrorsTotal, wireEgressBytesTotal } from './chunk-PAICJCKJ.js';
-import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-2KSO3W4A.js';
-import { MeshNode } from './chunk-XRDN232O.js';
-import { log } from './chunk-K3DGJLUY.js';
-import * as grpc from '@grpc/grpc-js';
-import { createDecipheriv, randomBytes, createCipheriv } from 'crypto';
-
-var LiopRpcClient = class {
-  // biome-ignore lint/suspicious/noExplicitAny: internal gRPC client type
-  client;
-  token;
-  lastResolvedToken;
-  address;
-  constructor(address, tls, token) {
-    const credentials = createChannelCredentials(tls);
-    this.client = new liopV1.LogicMesh(
-      address,
-      credentials,
-      GRPC_CHANNEL_OPTIONS
-    );
-    this.token = token;
-    if (typeof token === "string") {
-      this.lastResolvedToken = token;
-    }
-    this.address = address;
-  }
-  setToken(token) {
-    this.token = token;
-    if (typeof token === "string") {
-      this.lastResolvedToken = token;
-    }
-  }
-  async resolveToken() {
-    if (typeof this.token === "function") {
-      this.lastResolvedToken = await this.token();
-      return this.lastResolvedToken;
-    }
-    this.lastResolvedToken = this.token;
-    return this.token;
-  }
-  /**
-   * Negotiates intent with the remote host.
-   * Returns the ephemeral Kyber public key for payload encryption.
-   */
-  async negotiateIntent(request) {
-    const activeToken = await this.resolveToken();
-    return new Promise((resolve, reject) => {
-      const metadata = new grpc.Metadata();
-      if (activeToken) {
-        metadata.add("authorization", `Bearer ${activeToken}`);
-      }
-      this.client.NegotiateIntent(
-        request,
-        metadata,
-        (error, response) => {
-          if (error) {
-            reject(error);
-          } else {
-            resolve(response);
-          }
-        }
-      );
-    });
-  }
-  /**
-   * Pushes the encrypted Logic-on-Origin payload to the origin.
-   * Returns a stream of semantic responses and ZK proofs.
-   */
-  executeLogic(request) {
-    const metadata = new grpc.Metadata();
-    const activeToken = this.lastResolvedToken || (typeof this.token === "string" ? this.token : void 0);
-    if (activeToken) {
-      metadata.add("authorization", `Bearer ${activeToken}`);
-    }
-    return this.client.ExecuteLogic(request, metadata);
-  }
-  close() {
-    this.client.close();
-  }
-};
-var AesGcmWrapper = {
-  /**
-   * Encrypts a raw WASM payload using the shared secret negotiated via Kyber768.
-   *
-   * @param payload Raw incoming WASM byte array or string.
-   * @param sharedSecret A perfectly derived 32-byte (256-bit) shared secret array
-   * @returns The encrypted buffer to push to the GRPc stream, along with the 12-byte initialization vector natively generated.
-   */
-  encryptPayload(payload, sharedSecret) {
-    if (sharedSecret.length !== 32) {
-      throw new Error("Symmetric Key must be exactly 32 bytes (256 bits).");
-    }
-    const nonce = randomBytes(12);
-    const cipher = createCipheriv("aes-256-gcm", sharedSecret, nonce);
-    const encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);
-    const authTag = cipher.getAuthTag();
-    const finalCiphertext = Buffer.concat([encrypted, authTag]);
-    return {
-      ciphertext: finalCiphertext,
-      nonce
-    };
-  },
-  /**
-   * Decrypts a remote Zero-Knowledge receipt using AES-256-GCM.
-   */
-  decryptPayload(ciphertextBuffer, nonce, sharedSecret) {
-    if (ciphertextBuffer.length < 16) {
-      throw new Error(
-        "Invalid GCM Ciphertext; missing authentication tag length"
-      );
-    }
-    const encryptedData = ciphertextBuffer.subarray(0, -16);
-    const authTag = ciphertextBuffer.subarray(-16);
-    const decipher = createDecipheriv("aes-256-gcm", sharedSecret, nonce);
-    decipher.setAuthTag(authTag);
-    return Buffer.concat([decipher.update(encryptedData), decipher.final()]);
-  }
-};
-
-// src/client/index.ts
-var LiopClient = class {
-  meshNode = null;
-  rpcClients = /* @__PURE__ */ new Map();
-  manifests = /* @__PURE__ */ new Map();
-  tlsOptions;
-  serverInfo;
-  verifier = new LiopVerifier();
-  oauthToken;
-  tokenManager;
-  /** Protocol negotiation era */
-  era = "modern";
-  /** Negotiated protocol version */
-  protocolVersion = MCP_PROTOCOL_VERSION;
-  constructor(tls) {
-    this.tlsOptions = tls;
-  }
-  /**
-   * Discovers and connects to the target server or mesh capability.
-   * If address is omitted, it sets up the MeshNode to act purely dynamically.
-   */
-  async connect(address, options) {
-    const clientId = options?.auth?.clientId || process.env.LIOP_OAUTH_CLIENT_ID || process.env.LIOP_CLIENT_ID;
-    const clientSecret = options?.auth?.clientSecret || process.env.LIOP_OAUTH_CLIENT_SECRET || process.env.LIOP_CLIENT_SECRET;
-    const nexusUrl = options?.auth?.nexusUrl || process.env.LIOP_NEXUS_URL || "http://localhost:3000";
-    const audience = options?.auth?.audience || process.env.LIOP_OAUTH_AUDIENCE || "urn:liop:mesh:api";
-    const scope = options?.auth?.scope || process.env.LIOP_OAUTH_SCOPE || "liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query";
-    this.oauthToken = options?.auth?.token || process.env.LIOP_OAUTH_TOKEN || process.env.LIOP_TOKEN;
-    if (clientId && clientSecret) {
-      const baseUrl = (nexusUrl).endsWith("/oidc") ? nexusUrl : `${nexusUrl}/oidc`;
-      const tokenEndpoint = `${baseUrl}/token`;
-      this.tokenManager = new TokenManager({
-        tokenEndpoint,
-        clientId,
-        clientSecret,
-        audience,
-        scopes: scope
-      });
-      try {
-        this.oauthToken = await this.tokenManager.getToken();
-        log.info(
-          "[LiopClient] Dynamic TokenManager configured and initial token acquired."
-        );
-      } catch (err) {
-        log.error(
-          `[LiopClient] Failed to acquire OAuth M2M Token: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-    this.meshNode = new MeshNode(options?.meshConfig);
-    await this.meshNode.start();
-    log.info(
-      `[LiopClient] Mesh Node synchronized. PeerID: ${this.meshNode.getPeerId()}`
-    );
-    if (address) {
-      const tokenResolver = async () => {
-        if (this.tokenManager) {
-          return await this.tokenManager.getToken();
-        }
-        return this.oauthToken;
-      };
-      this.rpcClients.set(
-        "static",
-        new LiopRpcClient(address, this.tlsOptions, tokenResolver)
-      );
-      this.serverInfo = { name: `LiopServer (${address})`, version: "1.0.0" };
-      log.info(`[LiopClient] Static gRPC configured for: ${address}`);
-    } else {
-      this.serverInfo = { name: "LiopServer (Mesh Alpha)", version: "1.0.0" };
-    }
-  }
-  /**
-   * Selects the optimal IP from an array of multiaddrs.
-   * Prioritizes routable non-loopback IPv4 addresses (e.g. Docker bridge, LAN, WAN)
-   * over loopback (127.0.0.1) to prevent inter-container connection failures.
-   */
-  selectOptimalIp(addrs) {
-    for (const maddr of addrs) {
-      const parts = maddr.split("/");
-      const ipIdx = parts.indexOf("ip4");
-      if (ipIdx !== -1 && ipIdx + 1 < parts.length) {
-        const ip = parts[ipIdx + 1];
-        if (ip !== "127.0.0.1" && !ip.startsWith("127.") && ip !== "0.0.0.0" && ip !== "localhost") {
-          return ip;
-        }
-      }
-    }
-    for (const maddr of addrs) {
-      const parts = maddr.split("/");
-      const ipIdx = parts.indexOf("ip4");
-      if (ipIdx !== -1 && ipIdx + 1 < parts.length) {
-        return parts[ipIdx + 1];
-      }
-    }
-    return null;
-  }
-  /**
-   * Dynamically queries Kademlia DHT to find the optimal PeerID providing the Capability
-   * and returns the physical gRPC target (host:port) resolved from the provider's manifest.
-   */
-  async resolveCapability(toolName) {
-    if (!this.meshNode)
-      throw new Error(
-        "Client must be connected to Mesh to resolve capabilities."
-      );
-    log.info(`[LiopClient] Querying Mesh DHT for Provider: ${toolName}...`);
-    const providers = await this.meshNode.findProviders(toolName);
-    if (providers.length === 0) {
-      throw new Error(
-        `Kademlia DHT found zero providers for capability: ${toolName}`
-      );
-    }
-    const providerId = providers[0];
-    log.info(`[LiopClient] Identified Alpha Provider PeerID: ${providerId}`);
-    let grpcPort = 50051;
-    const manifest = await this.meshNode.queryManifest(providerId);
-    if (manifest) {
-      grpcPort = manifest.grpcPort;
-      this.manifests.set(providerId, manifest);
-      log.info(
-        `[LiopClient] Manifest resolved: gRPC port ${grpcPort}. Cached manifest for PeerID ${providerId}`
-      );
-    }
-    const addrs = await this.meshNode.resolvePeer(providerId);
-    const optimalIp = this.selectOptimalIp(addrs);
-    if (optimalIp) {
-      const grpcHost = `${optimalIp}:${grpcPort}`;
-      log.info(
-        `[LiopClient] Translated Multiaddr to optimal gRPC Target: ${grpcHost}`
-      );
-      return grpcHost;
-    }
-    return `127.0.0.1:${grpcPort}`;
-  }
-  /**
-   * Probes a remote MCP endpoint using 'server/discover' to negotiate protocol era.
-   * Falls back to legacy initialize handshake if server/discover fails.
-   */
-  async probeServerDiscover(mcpUrl) {
-    try {
-      const headers = {
-        "Content-Type": "application/json",
-        "Mcp-Method": "server/discover"
-      };
-      if (this.oauthToken) {
-        headers.Authorization = `Bearer ${this.oauthToken}`;
-      }
-      const res = await fetch(mcpUrl, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({
-          jsonrpc: "2.0",
-          id: 1,
-          method: "server/discover",
-          params: {}
-        })
-      });
-      if (res.ok) {
-        const json = await res.json();
-        const supported = json.result?.supportedVersions || [];
-        if (supported.includes(MCP_PROTOCOL_VERSION)) {
-          this.era = "modern";
-          this.protocolVersion = MCP_PROTOCOL_VERSION;
-          return {
-            era: "modern",
-            protocolVersion: MCP_PROTOCOL_VERSION,
-            supportedVersions: supported
-          };
-        }
-      }
-    } catch (_err) {
-    }
-    if (MCP_LEGACY_SUPPORT_ENABLED) {
-      this.era = "legacy";
-      this.protocolVersion = MCP_PROTOCOL_VERSION_LEGACY;
-      return {
-        era: "legacy",
-        protocolVersion: MCP_PROTOCOL_VERSION_LEGACY,
-        supportedVersions: [MCP_PROTOCOL_VERSION_LEGACY]
-      };
-    }
-    throw new Error(
-      "Server does not support MCP 2026-07-28 and legacy support is disabled."
-    );
-  }
-  /**
-   * Discovers remote capabilities via the LIOP Manifest Protocol.
-   * Utilizes a memory cache to avoid redundant network dials against live peers.
-   */
-  async discoverTools(forceRefresh = false) {
-    if (!this.meshNode) {
-      throw new Error("Client must be connected before discovering tools.");
-    }
-    const discoveryStartTime = Date.now();
-    log.info(
-      `[LiopClient] Discovery started (forceRefresh: ${forceRefresh})...`
-    );
-    const providerIds = await this.meshNode.discoverManifestProviders();
-    const tools = [];
-    const seenNames = /* @__PURE__ */ new Set();
-    for (const peerId of providerIds) {
-      try {
-        let manifest = !forceRefresh ? this.manifests.get(peerId) : void 0;
-        if (!manifest) {
-          log.info(`[LiopClient] Querying manifest from: ${peerId}`);
-          manifest = await this.meshNode.queryManifest(peerId);
-          if (manifest) {
-            this.manifests.set(peerId, manifest);
-          }
-        } else {
-          log.info(`[LiopClient] Using cached manifest for: ${peerId}`);
-        }
-        if (manifest) {
-          for (const tool of manifest.tools) {
-            if (!seenNames.has(tool.name)) {
-              tools.push({ name: tool.name, description: tool.description });
-              seenNames.add(tool.name);
-            }
-          }
-        }
-      } catch (err) {
-        log.info(
-          `[LiopClient] Error querying manifest from ${peerId}:`,
-          err instanceof Error ? err.message : String(err)
-        );
-      }
-    }
-    log.info(
-      `[LiopClient] Discovery finished. Found ${tools.length} unique tools.`
-    );
-    try {
-      const telemetry = TokenTelemetryEngine.getInstance();
-      const toolsPayload = JSON.stringify(tools);
-      const toolsResponsePayload = JSON.stringify({ tools });
-      telemetry.record({
-        type: "tools_list",
-        method: "discoverTools",
-        estimatedInputTokens: telemetry.countTokens(toolsPayload),
-        estimatedOutputTokens: telemetry.countTokens(toolsResponsePayload),
-        durationMs: Date.now() - discoveryStartTime
-      });
-    } catch {
-    }
-    return tools;
-  }
-  /**
-   * Invokes a tool.
-   */
-  async callTool(request, _wasmPayload) {
-    if (!this.meshNode) {
-      throw new Error("Client must be connected before calling tools.");
-    }
-    const callStartTime = Date.now();
-    const toolName = request.name;
-    log.info(`[LiopClient] Resolving Tool: ${toolName}`);
-    let rpcClient = this.rpcClients.get("static");
-    let targetClientKey = toolName;
-    if (!rpcClient) {
-      if (this.rpcClients.has(toolName)) {
-        rpcClient = this.rpcClients.get(toolName);
-        targetClientKey = toolName;
-      }
-    }
-    if (!rpcClient) {
-      let resolvedHost = null;
-      for (const [peerId, manifest] of this.manifests.entries()) {
-        if (manifest.tools.some((t) => t.name === toolName)) {
-          if (this.rpcClients.has(peerId)) {
-            rpcClient = this.rpcClients.get(peerId);
-            targetClientKey = peerId;
-            break;
-          }
-          const addrs = await this.meshNode.resolvePeer(peerId);
-          const optimalIp = this.selectOptimalIp(addrs);
-          if (optimalIp) {
-            resolvedHost = `${optimalIp}:${manifest.grpcPort}`;
-            log.info(
-              `[LiopClient] Fast-path: Resolved ${toolName} from manifest cache to optimal target ${resolvedHost}`
-            );
-            targetClientKey = peerId;
-            rpcClient = this.getOrCreateRpcClient(peerId, resolvedHost);
-            break;
-          }
-        }
-      }
-      if (!rpcClient) {
-        const dynamicAddress = await this.resolveCapability(toolName);
-        targetClientKey = toolName;
-        rpcClient = this.getOrCreateRpcClient(toolName, dynamicAddress);
-      }
-    } else {
-      targetClientKey = "static";
-      log.info(
-        `[LiopClient] Using existing static gRPC connection for ${toolName}.`
-      );
-    }
-    log.info(`[LiopClient] Negotiating intent for ${toolName}...`);
-    const agentDid = this.meshNode ? `did:liop:${this.meshNode.getPeerId()}` : "did:liop:ephemeral";
-    const intentPayload = Buffer.from(`${toolName}:${Date.now()}`);
-    const proofOfIntent = this.meshNode ? await this.meshNode.sign(intentPayload) : intentPayload;
-    let intentResponse;
-    try {
-      intentResponse = await rpcClient.negotiateIntent({
-        agent_did: agentDid,
-        capability_hash: toolName,
-        proof_of_intent: proofOfIntent
-      });
-    } catch (err) {
-      const errMsg = err instanceof Error ? err.message : String(err);
-      if (this.tokenManager && (errMsg.includes("UNAUTHENTICATED") || errMsg.includes("Invalid JWT") || errMsg.includes("timestamp check failed") || errMsg.includes("expired"))) {
-        log.warn(
-          `[LiopClient] Token expired/unauthenticated for ${toolName}. Preemptively refreshing OAuth token and retrying negotiateIntent...`
-        );
-        this.tokenManager.invalidate();
-        const freshToken = await this.tokenManager.getToken();
-        this.oauthToken = freshToken;
-        rpcClient.setToken(freshToken);
-        intentResponse = await rpcClient.negotiateIntent({
-          agent_did: agentDid,
-          capability_hash: toolName,
-          proof_of_intent: proofOfIntent
-        });
-      } else {
-        throw err;
-      }
-    }
-    if (!intentResponse.accepted) {
-      if (this.tokenManager && (intentResponse.error_message?.includes("token") || intentResponse.error_message?.includes("UNAUTHENTICATED") || intentResponse.error_message?.includes("expired") || intentResponse.error_message?.includes("timestamp check failed"))) {
-        log.warn(
-          `[LiopClient] Intent rejected with auth error: "${intentResponse.error_message}". Refreshing token and retrying...`
-        );
-        this.tokenManager.invalidate();
-        const freshToken = await this.tokenManager.getToken();
-        this.oauthToken = freshToken;
-        rpcClient.setToken(freshToken);
-        intentResponse = await rpcClient.negotiateIntent({
-          agent_did: agentDid,
-          capability_hash: toolName,
-          proof_of_intent: proofOfIntent
-        });
-      }
-      if (!intentResponse.accepted) {
-        throw new Error(
-          `Intent denied by host: ${intentResponse.error_message}`
-        );
-      }
-    }
-    const publicKey = intentResponse.kyber_public_key || intentResponse.kyberPublicKey;
-    const sessionToken = intentResponse.session_token || intentResponse.sessionToken;
-    if (!publicKey) {
-      log.info(
-        "[LiopClient] Critical Error: Kyber Public Key not found in IntentResponse.",
-        intentResponse
-      );
-      try {
-        pqcHandshakesTotal.inc({
-          algorithm: "ml-kem-768",
-          status: "failure"
-        });
-      } catch {
-      }
-      throw new Error(
-        "Handshake failed: Remote host did not provide a valid Kyber Public Key."
-      );
-    }
-    log.info(
-      `[LiopClient] Encapsulating Post-Quantum Shared Secret for ${request.name}...`
-    );
-    const pqcStart = performance.now();
-    let kyberCiphertext;
-    let sharedSecret;
-    try {
-      const res = await Kyber768Wrapper.encapsulateAsymmetric(publicKey);
-      kyberCiphertext = res.ciphertext;
-      sharedSecret = res.sharedSecret;
-      const pqcDuration = performance.now() - pqcStart;
-      pqcHandshakeDurationMs.observe({ tool: request.name }, pqcDuration);
-      pqcHandshakesTotal.inc({
-        algorithm: "ml-kem-768",
-        status: "success"
-      });
-    } catch (encapError) {
-      try {
-        pqcHandshakesTotal.inc({
-          algorithm: "ml-kem-768",
-          status: "failure"
-        });
-      } catch {
-      }
-      throw encapError;
-    }
-    log.info(`[LiopClient] Sealing WASM Payload and Inputs...`);
-    const _safePayload = _wasmPayload || Buffer.from("");
-    const { ciphertext: encryptedWasm, nonce: aesNonce } = AesGcmWrapper.encryptPayload(_safePayload, sharedSecret);
-    const encryptedInputs = {};
-    const crypto = await import('crypto');
-    for (const [key, value] of Object.entries(request.arguments || {})) {
-      const inputNonce = crypto.randomBytes(12);
-      const cipher = crypto.createCipheriv(
-        "aes-256-gcm",
-        sharedSecret,
-        inputNonce
-      );
-      const encrypted = Buffer.concat([
-        cipher.update(JSON.stringify(value)),
-        cipher.final()
-      ]);
-      const authTag = cipher.getAuthTag();
-      encryptedInputs[key] = Buffer.concat([inputNonce, encrypted, authTag]);
-    }
-    const logicRequest = {
-      session_token: sessionToken,
-      wasm_binary: encryptedWasm,
-      inputs: encryptedInputs,
-      pqc_ciphertext: kyberCiphertext,
-      aes_nonce: aesNonce
-    };
-    return new Promise((resolve, reject) => {
-      const stream = rpcClient.executeLogic(logicRequest);
-      if (!stream) {
-        reject(new Error("RPC Client unavailable or failed to create stream."));
-        return;
-      }
-      let resultFulfilled = false;
-      let hasReceivedData = false;
-      stream.on("data", async (response) => {
-        if (resultFulfilled) return;
-        hasReceivedData = true;
-        log.info("[LiopClient] Logic Executed. Verification in progress...");
-        try {
-          if (!response.is_error) {
-            const isValid = await this.verifier.verifyZkReceipt(
-              _safePayload,
-              Buffer.from(response.cryptographic_proof).toString("hex"),
-              Buffer.from(response.zk_receipt),
-              Buffer.from(sharedSecret),
-              response.semantic_evidence
-            );
-            try {
-              zkVerificationsTotal.inc({
-                status: isValid ? "valid" : "invalid"
-              });
-            } catch {
-            }
-            if (!isValid) {
-              try {
-                toolCallErrorsTotal.inc({
-                  capability: toolName,
-                  error_type: "zk_verification_failed"
-                });
-              } catch {
-              }
-              reject(
-                new Error(
-                  "PROTOCOL INTEGRITY VIOLATION: ZK-Receipt verification failed."
-                )
-              );
-              return;
-            }
-          } else {
-            try {
-              toolCallErrorsTotal.inc({
-                capability: toolName,
-                error_type: "remote_execution_error"
-              });
-            } catch {
-            }
-          }
-          resultFulfilled = true;
-          try {
-            const telemetry = TokenTelemetryEngine.getInstance();
-            const inputPayload = JSON.stringify(request.arguments ?? {});
-            telemetry.record({
-              type: "tool_call",
-              method: "callTool",
-              toolName,
-              peerId: targetClientKey !== toolName ? targetClientKey : void 0,
-              estimatedInputTokens: telemetry.countTokens(inputPayload),
-              estimatedOutputTokens: telemetry.countTokens(
-                response.semantic_evidence
-              ),
-              durationMs: Date.now() - callStartTime
-            });
-            const egressBytes = Buffer.byteLength(response.semantic_evidence || "") + (response.cryptographic_proof ? response.cryptographic_proof.length : 0) + (response.zk_receipt ? response.zk_receipt.length : 0);
-            wireEgressBytesTotal.inc({ capability: toolName }, egressBytes);
-          } catch {
-          }
-          resolve({
-            content: [
-              {
-                type: "text",
-                text: response.semantic_evidence
-              }
-            ],
-            isError: response.is_error
-          });
-        } catch (err) {
-          try {
-            toolCallErrorsTotal.inc({
-              capability: toolName,
-              error_type: "verification_exception"
-            });
-          } catch {
-          }
-          reject(err);
-        }
-      });
-      stream.on("error", (err) => {
-        this.rpcClients.delete(targetClientKey);
-        this.rpcClients.delete(toolName);
-        try {
-          toolCallErrorsTotal.inc({
-            capability: toolName,
-            error_type: "stream_error"
-          });
-        } catch {
-        }
-        if (resultFulfilled) return;
-        log.error("[LiopClient] Stream Error:", err);
-        reject(err);
-      });
-      stream.on("end", () => {
-        if (!hasReceivedData && !resultFulfilled) {
-          reject(new Error("Logic-on-Origin stream closed without results."));
-        }
-      });
-    });
-  }
-  getOrCreateRpcClient(peerId, address) {
-    let client = this.rpcClients.get(peerId);
-    if (!client) {
-      let manifest = this.manifests.get(peerId);
-      let realPeerId = peerId;
-      if (!manifest) {
-        log.info(
-          `[LiopClient] PeerID "${peerId}" not found in manifest cache as PeerID. Searching tools in cached manifests...`
-        );
-        for (const [pId, m] of this.manifests.entries()) {
-          if (m.tools.some((t) => t.name === peerId)) {
-            manifest = m;
-            realPeerId = pId;
-            log.info(
-              `[LiopClient] Resolved tool "${peerId}" to provider PeerID "${pId.slice(-8)}" from manifest cache.`
-            );
-            break;
-          }
-        }
-      }
-      const providerName = manifest?.serverInfo?.name?.toLowerCase() || "";
-      let envToken;
-      const slug = manifest?.tokenSlug;
-      if (slug) {
-        envToken = process.env[`LIOP_TOKEN_${slug}`] || process.env[`LIOP_OAUTH_TOKEN_${slug}`];
-        log.info(
-          `[LiopClient] Resolved via tokenSlug "${slug}" (LIOP_TOKEN_${slug}) -> found: ${!!envToken}`
-        );
-      } else {
-        log.info(
-          `[LiopClient] No tokenSlug available for peer ${realPeerId.slice(-8)}. Available cache keys: ${Array.from(
-            this.manifests.keys()
-          ).map((k) => k.slice(-8)).join(", ")}`
-        );
-      }
-      if (!envToken && realPeerId) {
-        const shortId = realPeerId.slice(-8).toUpperCase();
-        envToken = process.env[`LIOP_TOKEN_${shortId}`] || process.env[`LIOP_OAUTH_TOKEN_${shortId}`];
-      }
-      if (!envToken && providerName) {
-        const cleanName = providerName.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
-        envToken = process.env[`LIOP_TOKEN_${cleanName}`] || process.env[`LIOP_OAUTH_TOKEN_${cleanName}`];
-      }
-      if (envToken) {
-        log.info(
-          `[LiopClient] Resolved node-specific token for peer ${realPeerId.slice(-8)} (${providerName || "unknown"})`
-        );
-      }
-      const tokenResolver = async () => {
-        if (envToken) return envToken;
-        if (this.tokenManager) {
-          return await this.tokenManager.getToken();
-        }
-        return this.oauthToken;
-      };
-      client = new LiopRpcClient(address, this.tlsOptions, tokenResolver);
-      this.rpcClients.set(peerId, client);
-    }
-    return client;
-  }
-  /**
-   * Reads a specific resource by URI.
-   * In LIOP, resources can be static definitions or dynamic streams.
-   */
-  async readResource(uri) {
-    if (!this.meshNode) {
-      throw new Error("Client must be connected before reading resources.");
-    }
-    const readStartTime = Date.now();
-    log.info(`[LiopClient] Querying Mesh for Resource: ${uri}...`);
-    const providers = await this.meshNode.findProviders(uri);
-    if (providers.length === 0) {
-      throw new Error(`No mesh providers found for resource: ${uri}`);
-    }
-    const manifest = await this.meshNode.queryManifest(providers[0]);
-    if (!manifest) {
-      throw new Error("Target peer did not return a valid LIOP Manifest.");
-    }
-    const resourceDef = manifest.resources?.find((r) => r.uri === uri);
-    if (!resourceDef) {
-      throw new Error(`Resource ${uri} not listed in remote manifest.`);
-    }
-    const result = {
-      contents: [
-        {
-          uri,
-          mimeType: resourceDef.mimeType || "application/json",
-          text: JSON.stringify(resourceDef, null, 2)
-        }
-      ]
-    };
-    try {
-      const telemetry = TokenTelemetryEngine.getInstance();
-      const outputPayload = JSON.stringify(result);
-      telemetry.record({
-        type: "resource_read",
-        method: "readResource",
-        toolName: uri,
-        peerId: providers[0],
-        estimatedInputTokens: telemetry.countTokens(uri),
-        estimatedOutputTokens: telemetry.countTokens(outputPayload),
-        durationMs: Date.now() - readStartTime
-      });
-    } catch {
-    }
-    return result;
-  }
-  /**
-   * Returns the local PeerId string if the mesh node is active, null otherwise.
-   * PeerIds are public identifiers by libp2p protocol design (Ed25519 public key hash).
-   */
-  get peerId() {
-    return this.meshNode?.getPeerId() ?? null;
-  }
-  /**
-   * Returns true if the mesh node is initialized and running.
-   */
-  get isMeshActive() {
-    return this.meshNode?.isStarted() ?? false;
-  }
-  /**
-   * Returns the number of active P2P connections, or 0 if the mesh is inactive.
-   */
-  get connectionCount() {
-    return this.meshNode?.getPeers().length ?? 0;
-  }
-  getServerInfo() {
-    return this.serverInfo;
-  }
-  /**
-   * Destroys the active Mesh Node resources.
-   */
-  async close() {
-    if (this.meshNode) {
-      await this.meshNode.stop();
-    }
-  }
-};
-
-export { AesGcmWrapper, LiopClient, LiopRpcClient };
-//# sourceMappingURL=chunk-FCFTYOAS.js.map
-//# sourceMappingURL=chunk-FCFTYOAS.js.map