@nekzus/liop 2.6.1 → 2.7.1

package/dist/chunk-EJ426URA.js

@@ -1,818 +0,0 @@
-import { LiopMcpRouter } from './chunk-VRB5HUYU.js';
-import { LIOP_SCOPES } from './chunk-WPTOJYN5.js';
-import { meshPeersConnected, manifestCacheSize, protocolMetrics } from './chunk-PAICJCKJ.js';
-import { log } from './chunk-K3DGJLUY.js';
-import * as http from 'http';
-import * as http2 from 'http2';
-import * as net from 'net';
-
-// src/security/prm.ts
-function buildProtectedResourceMetadata(issuer, audience) {
-  return {
-    resource: audience,
-    authorization_servers: [issuer],
-    scopes_supported: LIOP_SCOPES,
-    bearer_methods_supported: ["header"],
-    resource_documentation: "https://github.com/nekzus/liop"
-  };
-}
-
-// src/gateway/grpc-web.ts
-var GRPC_WEB_CONSTANTS = {
-  FLAG_DATA: 0,
-  FLAG_TRAILERS: 128,
-  HEADER_LENGTH: 5,
-  CONTENT_TYPE_PREFIX: "application/grpc-web",
-  STATUS_OK: 0,
-  STATUS_CANCELLED: 1,
-  STATUS_UNKNOWN: 2,
-  STATUS_INVALID_ARGUMENT: 3,
-  STATUS_DEADLINE_EXCEEDED: 4,
-  STATUS_NOT_FOUND: 5,
-  STATUS_PERMISSION_DENIED: 7,
-  STATUS_UNAUTHENTICATED: 16,
-  STATUS_INTERNAL: 13
-};
-function isGrpcWebRequest(contentType) {
-  if (!contentType) return false;
-  const lower = contentType.toLowerCase();
-  return lower.startsWith("application/grpc-web") || lower.startsWith("application/grpc-web+proto") || lower.startsWith("application/grpc-web+json");
-}
-function encodeDataFrame(payload) {
-  const buf = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);
-  const header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);
-  header.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_DATA, 0);
-  header.writeUInt32BE(buf.length, 1);
-  return Buffer.concat([header, buf]);
-}
-function encodeTrailerFrame(status = GRPC_WEB_CONSTANTS.STATUS_OK, message = "", customTrailers = {}) {
-  const lines = [
-    `grpc-status:${status}`,
-    `grpc-message:${encodeURIComponent(message)}`
-  ];
-  for (const [key, value] of Object.entries(customTrailers)) {
-    lines.push(`${key}:${value}`);
-  }
-  const trailerText = `${lines.join("\r\n")}\r
-`;
-  const trailerBuf = Buffer.from(trailerText, "utf-8");
-  const header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);
-  header.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_TRAILERS, 0);
-  header.writeUInt32BE(trailerBuf.length, 1);
-  return Buffer.concat([header, trailerBuf]);
-}
-function decodeFrames(buffer) {
-  const frames = [];
-  let offset = 0;
-  while (offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH <= buffer.length) {
-    const flag = buffer.readUInt8(offset);
-    const length = buffer.readUInt32BE(offset + 1);
-    const payloadStart = offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH;
-    const payloadEnd = payloadStart + length;
-    if (payloadEnd > buffer.length) {
-      break;
-    }
-    const payload = buffer.subarray(payloadStart, payloadEnd);
-    frames.push({
-      isTrailer: (flag & GRPC_WEB_CONSTANTS.FLAG_TRAILERS) === GRPC_WEB_CONSTANTS.FLAG_TRAILERS,
-      payload: Buffer.from(payload)
-    });
-    offset = payloadEnd;
-  }
-  return frames;
-}
-async function dispatchGrpcWebRequest(req, res, handler) {
-  const chunks = [];
-  req.on("data", (chunk) => {
-    chunks.push(chunk);
-  });
-  req.on("end", async () => {
-    try {
-      const fullBody = Buffer.concat(chunks);
-      const frames = decodeFrames(fullBody);
-      const dataPayload = frames.find((f) => !f.isTrailer)?.payload ?? Buffer.alloc(0);
-      const requestPath = req.url || "/";
-      log.info(
-        `[gRPC-Web] Handling request for ${requestPath} (${dataPayload.length} bytes)`
-      );
-      const result = await handler(requestPath, dataPayload);
-      res.statusCode = 200;
-      res.setHeader("content-type", "application/grpc-web+proto");
-      res.setHeader("access-control-allow-origin", "*");
-      res.setHeader(
-        "access-control-expose-headers",
-        "grpc-status, grpc-message, content-type"
-      );
-      if (result.data && result.data.length > 0) {
-        res.write(encodeDataFrame(result.data));
-      }
-      res.write(encodeTrailerFrame(result.status, result.message || ""));
-      res.end();
-    } catch (error) {
-      log.error(`[gRPC-Web] Dispatch error: ${error}`);
-      res.statusCode = 200;
-      res.setHeader("content-type", "application/grpc-web+proto");
-      res.write(
-        encodeTrailerFrame(
-          GRPC_WEB_CONSTANTS.STATUS_INTERNAL,
-          error.message || "Internal server error"
-        )
-      );
-      res.end();
-    }
-  });
-}
-
-// src/gateway/interceptor.ts
-var DEFAULT_TIMEOUT_MS = 2500;
-async function executeGatewayInterceptor(request, context, options) {
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const failMode = options.failMode ?? "closed";
-  const signal = AbortSignal.timeout(timeoutMs);
-  const frozenRequest = Object.freeze(structuredClone(request));
-  let onAbortListener;
-  const abortPromise = new Promise((_, reject) => {
-    onAbortListener = () => reject(signal.reason);
-    signal.addEventListener("abort", onAbortListener, { once: true });
-  });
-  try {
-    const result = await Promise.race([
-      Promise.resolve(
-        options.interceptor(frozenRequest, { ...context, signal })
-      ),
-      abortPromise
-    ]);
-    return result;
-  } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : String(error);
-    if (failMode === "open") {
-      log.warn(
-        `[LIOP-Gateway] Interceptor error (fail-open, allowing request): ${errorMessage}`
-      );
-      return {
-        allowed: true,
-        metadata: { interceptorError: errorMessage, failMode: "open" }
-      };
-    }
-    log.error(
-      `[LIOP-Gateway] Interceptor error (fail-closed, rejecting request): ${errorMessage}`
-    );
-    return {
-      allowed: false,
-      reason: `Interceptor unavailable: ${errorMessage}`,
-      errorCode: -32098,
-      metadata: { interceptorError: errorMessage, failMode: "closed" }
-    };
-  } finally {
-    if (onAbortListener) {
-      signal.removeEventListener("abort", onAbortListener);
-    }
-  }
-}
-
-// src/gateway/rate-limiter.ts
-var InMemoryRateLimiter = class {
-  windowMs;
-  maxRequests;
-  records = /* @__PURE__ */ new Map();
-  cleanupTimer;
-  constructor(options = {}) {
-    this.windowMs = options.windowMs ?? 6e4;
-    this.maxRequests = options.maxRequests ?? 120;
-    this.cleanupTimer = setInterval(() => this.cleanup(), 3e4);
-    if (typeof this.cleanupTimer.unref === "function") {
-      this.cleanupTimer.unref();
-    }
-  }
-  /**
-   * Evaluates whether a request from the given key (IP, token, or clientId) is permitted.
-   *
-   * @param key Identifier for the client (e.g., remote IP or OAuth client ID)
-   * @returns Status containing allowed boolean, remaining quota, and time until reset
-   */
-  check(key) {
-    const now = Date.now();
-    let record = this.records.get(key);
-    if (!record || now >= record.resetTime) {
-      record = {
-        count: 1,
-        resetTime: now + this.windowMs
-      };
-      this.records.set(key, record);
-      return {
-        allowed: true,
-        remaining: this.maxRequests - 1,
-        limit: this.maxRequests,
-        resetMs: this.windowMs
-      };
-    }
-    if (record.count >= this.maxRequests) {
-      return {
-        allowed: false,
-        remaining: 0,
-        limit: this.maxRequests,
-        resetMs: Math.max(0, record.resetTime - now)
-      };
-    }
-    record.count++;
-    return {
-      allowed: true,
-      remaining: this.maxRequests - record.count,
-      limit: this.maxRequests,
-      resetMs: Math.max(0, record.resetTime - now)
-    };
-  }
-  /**
-   * Explicitly resets the rate limit bucket for a given key.
-   */
-  reset(key) {
-    this.records.delete(key);
-  }
-  /**
-   * Cleans up expired rate-limiting buckets to prevent memory leaks.
-   */
-  cleanup() {
-    const now = Date.now();
-    for (const [key, record] of this.records.entries()) {
-      if (now >= record.resetTime) {
-        this.records.delete(key);
-      }
-    }
-  }
-  /**
-   * Destroys internal timers and clears records.
-   */
-  close() {
-    if (this.cleanupTimer) {
-      clearInterval(this.cleanupTimer);
-      this.cleanupTimer = void 0;
-    }
-    this.records.clear();
-  }
-};
-
-// src/gateway/hybrid.ts
-var LiopHybridGateway = class {
-  constructor(liopServer, meshNode = null, rpcPort = 50051, rateLimiterOptions, interceptorOptions) {
-    this.liopServer = liopServer;
-    this.meshNode = meshNode;
-    this.jwtValidator = this.liopServer.jwtValidator;
-    this.oauthProvider = this.liopServer.oauthProvider;
-    this.rateLimiter = new InMemoryRateLimiter(rateLimiterOptions);
-    this.interceptorOptions = interceptorOptions;
-    this.router = new LiopMcpRouter(this.liopServer, this.meshNode, rpcPort);
-    this.h2Server = http2.createServer();
-    this.setupH2Routes();
-    this.h1Server = http.createServer();
-    this.setupH1Routes();
-    this.netServer = net.createServer((socket) => {
-      socket.once("data", (buffer) => {
-        const isHttp2 = buffer.toString().startsWith("PRI * HTTP/2.0");
-        log.info(
-          `[LIOP-Gateway] Incoming L4 Connection. Protocol: ${isHttp2 ? "HTTP/2 (gRPC)" : "HTTP/1.1 (MCP)"}`
-        );
-        if (isHttp2) {
-          this.h2Server.emit("connection", socket);
-        } else {
-          this.h1Server.emit("connection", socket);
-        }
-        socket.unshift(buffer);
-      });
-      socket.on(
-        "error",
-        (err) => log.error(`[LIOP-Gateway] NetServer Socket Error: ${err.message}`)
-      );
-    });
-    this.h1Server.on(
-      "error",
-      (err) => log.error(`[LIOP-Gateway] H1 Server Error: ${err.message}`)
-    );
-    this.h2Server.on(
-      "error",
-      (err) => log.error(`[LIOP-Gateway] H2 Server Error: ${err.message}`)
-    );
-    log.info("[LIOP-Gateway] Hybrid adapter initialized.");
-  }
-  liopServer;
-  meshNode;
-  netServer;
-  h2Server;
-  h1Server;
-  router;
-  jwtValidator;
-  // biome-ignore lint/suspicious/noExplicitAny: oidc-provider is loaded in Phase C
-  oauthProvider;
-  rateLimiter;
-  interceptorOptions;
-  isDraining = false;
-  activeRequests = 0;
-  setupH2Routes() {
-    this.h2Server.on("stream", (stream, headers) => {
-      const contentType = headers["content-type"];
-      const path = headers[":path"];
-      if (contentType === "application/grpc") {
-        this.handleGrpcStream(stream);
-      } else if (path === "/mcp") {
-        this.handleMcpH2Stream(stream, headers);
-      }
-    });
-  }
-  setupH1Routes() {
-    this.h1Server.on("request", async (req, res) => {
-      this.activeRequests += 1;
-      const onDone = () => {
-        res.removeListener("finish", onDone);
-        res.removeListener("close", onDone);
-        this.activeRequests = Math.max(0, this.activeRequests - 1);
-      };
-      res.on("finish", onDone);
-      res.on("close", onDone);
-      const url = req.url || "";
-      const method = req.method;
-      if (method === "GET" && url === "/metrics") {
-        if (this.meshNode) {
-          meshPeersConnected.set({}, this.meshNode.getPeers().length);
-        }
-        if (this.router) {
-          manifestCacheSize.set({}, this.router.getManifestCacheSize());
-        }
-        res.writeHead(200, {
-          "Content-Type": "text/plain; version=0.0.4; charset=utf-8"
-        });
-        res.end(protocolMetrics.exportPrometheusText());
-        return;
-      }
-      if (method === "GET" && url === "/healthz") {
-        if (this.isDraining) {
-          res.writeHead(503, { "Content-Type": "application/json" });
-          res.end(
-            JSON.stringify({
-              status: "draining",
-              timestamp: (/* @__PURE__ */ new Date()).toISOString()
-            })
-          );
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(
-          JSON.stringify({
-            status: "ok",
-            uptime: Math.floor(process.uptime()),
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        );
-        return;
-      }
-      if (method === "GET" && url === "/readyz") {
-        if (this.isDraining) {
-          res.writeHead(503, { "Content-Type": "application/json" });
-          res.end(
-            JSON.stringify({
-              status: "draining",
-              timestamp: (/* @__PURE__ */ new Date()).toISOString()
-            })
-          );
-          return;
-        }
-        const meshStarted = this.meshNode ? this.meshNode.isStarted() : true;
-        if (!meshStarted) {
-          res.writeHead(503, { "Content-Type": "application/json" });
-          res.end(
-            JSON.stringify({
-              status: "unready",
-              meshStarted: false,
-              timestamp: (/* @__PURE__ */ new Date()).toISOString()
-            })
-          );
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(
-          JSON.stringify({
-            status: "ready",
-            meshStarted: true,
-            peers: this.meshNode ? this.meshNode.getPeers().length : 0,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          })
-        );
-        return;
-      }
-      if (this.isDraining && url === "/mcp") {
-        res.writeHead(503, { "Content-Type": "application/json" });
-        res.end(
-          JSON.stringify({
-            jsonrpc: "2.0",
-            error: {
-              code: -32e3,
-              message: "Gateway is draining connections for shutdown"
-            }
-          })
-        );
-        return;
-      }
-      const contentType = req.headers["content-type"];
-      if (isGrpcWebRequest(contentType)) {
-        await dispatchGrpcWebRequest(req, res, async (reqPath, payload) => {
-          log.info(
-            `[LIOP-Gateway] gRPC-Web fallback call: ${reqPath} (${payload.length} bytes)`
-          );
-          return {
-            status: GRPC_WEB_CONSTANTS.STATUS_OK,
-            message: "OK",
-            data: Buffer.from("")
-          };
-        });
-        return;
-      }
-      if (url.startsWith("/oidc") && this.oauthProvider) {
-        const callback = typeof this.oauthProvider.callback === "function" ? this.oauthProvider.callback() : this.oauthProvider;
-        const originalUrl = req.url;
-        req.url = (originalUrl || "").slice(5) || "/";
-        try {
-          return callback(req, res);
-        } finally {
-          req.url = originalUrl;
-        }
-      }
-      if (method === "GET" && url === "/.well-known/oauth-protected-resource") {
-        if (this.jwtValidator) {
-          const prm = buildProtectedResourceMetadata(
-            this.jwtValidator.getIssuer(),
-            this.jwtValidator.getAudience()
-          );
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(JSON.stringify(prm));
-          return;
-        }
-        res.writeHead(404);
-        res.end("Not Found");
-        return;
-      }
-      if (method === "GET" && (url === "/" || url === "/mcp" || url === "/health")) {
-        if (url === "/health" && req.headers.accept?.includes("application/json")) {
-          const meshInfo = this.meshNode ? {
-            peerId: this.meshNode.getPeerId()?.toString() || "",
-            multiaddrs: this.meshNode.getMultiaddrs().map((m) => m.toString())
-          } : null;
-          const issuer = this.jwtValidator?.getIssuer();
-          const baseUrl = issuer ? issuer.endsWith("/oidc") ? issuer : `${issuer}/oidc` : "";
-          const authInfoResponse = this.jwtValidator && issuer ? {
-            issuer,
-            jwks_uri: `${baseUrl}/jwks`,
-            ...this.oauthProvider ? {
-              token_endpoint: `${baseUrl}/token`
-            } : {}
-          } : void 0;
-          const topologyInfo = {
-            tier: this.meshNode?.isPrivateNetwork?.() ? 1 : 2,
-            prmEndpoint: this.jwtValidator ? "/.well-known/oauth-protected-resource" : void 0,
-            transportCapabilities: ["http-mcp", "grpc-lio", "p2p-dht"]
-          };
-          res.writeHead(200, { "Content-Type": "application/json" });
-          res.end(
-            JSON.stringify({
-              status: "healthy",
-              node: this.liopServer.getServerInfo(),
-              mesh: meshInfo,
-              tools: this.liopServer.listTools().map((t) => t.name),
-              auth: authInfoResponse,
-              topology: topologyInfo,
-              timestamp: (/* @__PURE__ */ new Date()).toISOString()
-            })
-          );
-          return;
-        }
-        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(`
-                    <body style="background:#0f172a;color:#f8fafc;font-family:sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;margin:0">
-                        <div style="background:#1e293b;padding:40px;border-radius:16px;border:1px solid #38bdf8;text-align:center;box-shadow:0 20px 25px -5px rgba(0,0,0,0.1)">
-                            <h1 style="color:#38bdf8;margin-top:0">LIOP Protocol Transformer</h1>
-                            <p style="opacity:0.8;font-weight:600">L4/L7 Transcoding: JSON-RPC &harr; gRPC</p>
-                            <p style="opacity:0.6;font-size:14px">Active Protections: Kyber768 + AES-256-GCM + ZK-Proof Ready</p>
-                            <div style="background:#0f172a;padding:15px;border-radius:8px;margin-top:20px;border:1px dashed #334155">
-                                <code style="color:#10b981">Endpoint: http://localhost:3000/mcp</code>
-                            </div>
-                        </div>
-                    </body>
-                `);
-        return;
-      }
-      if (url === "/mcp" && method === "POST") {
-        let authInfo = null;
-        if (this.jwtValidator) {
-          const authHeader = req.headers.authorization;
-          if (!authHeader?.startsWith("Bearer ")) {
-            res.writeHead(401, {
-              "WWW-Authenticate": 'Bearer error="invalid_token", error_description="Missing or malformed Authorization header"',
-              "Content-Type": "application/json"
-            });
-            res.end(JSON.stringify({ error: "Unauthorized" }));
-            return;
-          }
-          try {
-            authInfo = await this.jwtValidator.validate(authHeader.slice(7));
-          } catch (e) {
-            res.writeHead(401, {
-              "WWW-Authenticate": `Bearer error="invalid_token", error_description="${e.message}"`,
-              "Content-Type": "application/json"
-            });
-            res.end(JSON.stringify({ error: "Invalid token" }));
-            return;
-          }
-        }
-        let body = "";
-        req.on("data", (chunk) => body += chunk.toString());
-        req.on("end", async () => {
-          const clientIp = req.socket.remoteAddress || "127.0.0.1";
-          const rateLimitKey = authInfo?.clientId ? `client:${authInfo.clientId}` : `ip:${clientIp}`;
-          const rateStatus = this.rateLimiter.check(rateLimitKey);
-          if (!rateStatus.allowed) {
-            res.writeHead(429, {
-              "Content-Type": "application/json",
-              "Retry-After": Math.ceil(rateStatus.resetMs / 1e3).toString()
-            });
-            res.end(
-              JSON.stringify({
-                jsonrpc: "2.0",
-                id: null,
-                error: {
-                  code: -32029,
-                  message: "Rate limit exceeded. Too many requests."
-                }
-              })
-            );
-            return;
-          }
-          try {
-            const jsonRequest = JSON.parse(body);
-            if (this.interceptorOptions?.interceptor) {
-              const verdict = await executeGatewayInterceptor(
-                jsonRequest,
-                { clientIp, authInfo, protocol: "http1" },
-                this.interceptorOptions
-              );
-              if (!verdict.allowed) {
-                res.writeHead(403, { "Content-Type": "application/json" });
-                res.end(
-                  JSON.stringify({
-                    jsonrpc: "2.0",
-                    id: jsonRequest.id ?? null,
-                    error: {
-                      code: verdict.errorCode ?? -32099,
-                      message: verdict.reason || "Forbidden: Rejected by Gateway Interceptor"
-                    }
-                  })
-                );
-                return;
-              }
-            }
-            const mcpMethod = req.headers["mcp-method"];
-            const mcpName = req.headers["mcp-name"];
-            const mcpVersion = req.headers["mcp-protocol-version"];
-            if (mcpMethod && mcpMethod !== jsonRequest.method) {
-              res.writeHead(400, { "Content-Type": "application/json" });
-              res.end(
-                JSON.stringify({
-                  jsonrpc: "2.0",
-                  id: jsonRequest.id ?? null,
-                  error: {
-                    code: -32020,
-                    message: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`
-                  }
-                })
-              );
-              return;
-            }
-            if (mcpName && jsonRequest.params?.name && mcpName !== jsonRequest.params.name) {
-              res.writeHead(400, { "Content-Type": "application/json" });
-              res.end(
-                JSON.stringify({
-                  jsonrpc: "2.0",
-                  id: jsonRequest.id ?? null,
-                  error: {
-                    code: -32020,
-                    message: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`
-                  }
-                })
-              );
-              return;
-            }
-            if (mcpVersion && jsonRequest.params) {
-              if (!jsonRequest.params._meta) {
-                jsonRequest.params._meta = {};
-              }
-              if (!jsonRequest.params._meta["io.modelcontextprotocol/protocolVersion"]) {
-                jsonRequest.params._meta["io.modelcontextprotocol/protocolVersion"] = mcpVersion;
-              }
-            }
-            const response = await this.router.dispatch(jsonRequest, authInfo);
-            res.writeHead(200, { "Content-Type": "application/json" });
-            res.end(JSON.stringify(response));
-          } catch (e) {
-            log.info(
-              `[LIOP-Gateway] Error processing JSON-RPC payload: ${e.message}`
-            );
-            res.writeHead(400);
-            res.end(
-              JSON.stringify({
-                jsonrpc: "2.0",
-                error: { code: -32700, message: "Parse error" }
-              })
-            );
-          }
-        });
-      } else {
-        res.writeHead(404);
-        res.end("Not Found");
-      }
-    });
-  }
-  handleGrpcStream(stream) {
-    stream.on("data", (chunk) => {
-      const data = chunk;
-      if (data)
-        log.info(
-          `[LIOP-Gateway] Native gRPC Proxy passing ${data.length} bytes`
-        );
-    });
-    stream.respond({ ":status": 200, "content-type": "application/grpc" });
-    stream.end();
-  }
-  handleMcpH2Stream(stream, headers) {
-    let body = "";
-    stream.on("data", (chunk) => body += chunk.toString());
-    stream.on("end", async () => {
-      try {
-        let authInfo = null;
-        if (this.jwtValidator) {
-          const authHeader = headers.authorization;
-          if (!authHeader?.startsWith("Bearer ")) {
-            stream.respond({
-              ":status": 401,
-              "www-authenticate": 'Bearer error="invalid_token", error_description="Missing or malformed Authorization header"',
-              "content-type": "application/json"
-            });
-            stream.end(JSON.stringify({ error: "Unauthorized" }));
-            return;
-          }
-          try {
-            authInfo = await this.jwtValidator.validate(authHeader.slice(7));
-          } catch (e) {
-            stream.respond({
-              ":status": 401,
-              "www-authenticate": `Bearer error="invalid_token", error_description="${e.message}"`,
-              "content-type": "application/json"
-            });
-            stream.end(JSON.stringify({ error: "Invalid token" }));
-            return;
-          }
-        }
-        const jsonRequest = JSON.parse(body);
-        if (this.interceptorOptions?.interceptor) {
-          const h2ClientIp = stream.session?.socket?.remoteAddress || "127.0.0.1";
-          const verdict = await executeGatewayInterceptor(
-            jsonRequest,
-            { clientIp: h2ClientIp, authInfo, protocol: "http2" },
-            this.interceptorOptions
-          );
-          if (!verdict.allowed) {
-            stream.respond({
-              ":status": 403,
-              "content-type": "application/json"
-            });
-            stream.end(
-              JSON.stringify({
-                jsonrpc: "2.0",
-                id: jsonRequest.id ?? null,
-                error: {
-                  code: verdict.errorCode ?? -32099,
-                  message: verdict.reason || "Forbidden: Rejected by Gateway Interceptor"
-                }
-              })
-            );
-            return;
-          }
-        }
-        const mcpMethod = headers["mcp-method"];
-        const mcpName = headers["mcp-name"];
-        const mcpVersion = headers["mcp-protocol-version"];
-        if (mcpMethod && mcpMethod !== jsonRequest.method) {
-          stream.respond({
-            ":status": 400,
-            "content-type": "application/json"
-          });
-          stream.end(
-            JSON.stringify({
-              jsonrpc: "2.0",
-              id: jsonRequest.id ?? null,
-              error: {
-                code: -32020,
-                message: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`
-              }
-            })
-          );
-          return;
-        }
-        if (mcpName && jsonRequest.params?.name && mcpName !== jsonRequest.params.name) {
-          stream.respond({
-            ":status": 400,
-            "content-type": "application/json"
-          });
-          stream.end(
-            JSON.stringify({
-              jsonrpc: "2.0",
-              id: jsonRequest.id ?? null,
-              error: {
-                code: -32020,
-                message: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`
-              }
-            })
-          );
-          return;
-        }
-        if (mcpVersion && jsonRequest.params) {
-          if (!jsonRequest.params._meta) {
-            jsonRequest.params._meta = {};
-          }
-          if (!jsonRequest.params._meta["io.modelcontextprotocol/protocolVersion"]) {
-            jsonRequest.params._meta["io.modelcontextprotocol/protocolVersion"] = mcpVersion;
-          }
-        }
-        const response = await this.router.dispatch(jsonRequest, authInfo);
-        if (response) {
-          stream.respond({
-            ":status": 200,
-            "content-type": "application/json"
-          });
-          stream.end(JSON.stringify(response));
-        } else stream.close();
-      } catch (_e) {
-        stream.respond({ ":status": 400 });
-        stream.end();
-      }
-    });
-  }
-  async listen(port, host = "0.0.0.0") {
-    if (this.meshNode) {
-      await this.meshNode.start();
-      const tools = this.liopServer.listTools();
-      for (const tool of tools) {
-        await this.meshNode.announceCapability(tool.name);
-        log.info(
-          `[LIOP-Gateway] \u{1F4E1} Announced local tool to Mesh: ${tool.name}`
-        );
-      }
-    }
-    return new Promise((resolve, reject) => {
-      this.netServer.on("error", (err) => {
-        if (err.code === "EADDRINUSE") {
-          log.info(
-            `[LIOP-Gateway] FATAL: Port ${port} is already in use by another process.`
-          );
-        } else {
-          log.error(`[LIOP-Gateway] Binding Error: ${err.message}`);
-        }
-        reject(err);
-      });
-      this.netServer.listen(port, host, () => {
-        const addr = this.netServer.address();
-        const actualHost = typeof addr === "string" ? addr : addr?.address || host;
-        const assignedPort = typeof addr === "string" ? port : addr?.port || port;
-        log.info(
-          `[LIOP-Gateway] \u2705 Transformer Mesh Gateway READY and listening on ${actualHost}:${assignedPort}`
-        );
-        resolve(assignedPort);
-      });
-    });
-  }
-  isDrained() {
-    return this.isDraining;
-  }
-  async drain(timeoutMs = 5e3) {
-    this.isDraining = true;
-    log.info(
-      `[LIOP-Gateway] Draining gateway connections (active: ${this.activeRequests}, timeout: ${timeoutMs}ms)...`
-    );
-    const start = Date.now();
-    while (this.activeRequests > 0 && Date.now() - start < timeoutMs) {
-      await new Promise((resolve) => setTimeout(resolve, 50));
-    }
-    await this.stop();
-  }
-  async stop() {
-    if (this.meshNode) {
-      await this.meshNode.stop();
-    }
-    this.rateLimiter.close();
-    this.netServer.close();
-    this.h2Server.close();
-    this.h1Server.close();
-  }
-  getRouter() {
-    return this.router;
-  }
-};
-
-export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest };
-//# sourceMappingURL=chunk-EJ426URA.js.map
-//# sourceMappingURL=chunk-EJ426URA.js.map