@nekzus/liop 2.1.0 → 2.3.0

package/dist/chunk-JIJPZFR2.js

@@ -0,0 +1,51 @@
+// src/server/output-sanitizer.ts
+var DEFAULT_CONFIG = {
+  maxDecimalPlaces: 4,
+  clampNonNegative: true
+};
+function sanitizeOutput(output, config) {
+  const merged = { ...DEFAULT_CONFIG, ...config };
+  const seen = /* @__PURE__ */ new WeakSet();
+  function walk(node) {
+    if (node === null || node === void 0) {
+      return node;
+    }
+    if (typeof node === "number") {
+      if (!Number.isFinite(node)) {
+        return node;
+      }
+      let value = node;
+      if (merged.clampNonNegative && value < 0) {
+        value = 0;
+      }
+      const factor = 10 ** merged.maxDecimalPlaces;
+      value = Math.round(value * factor) / factor;
+      return value;
+    }
+    if (typeof node === "string" || typeof node === "boolean") {
+      return node;
+    }
+    if (typeof node === "object") {
+      if (seen.has(node)) {
+        return node;
+      }
+      seen.add(node);
+      if (Array.isArray(node)) {
+        return node.map((item) => walk(item));
+      }
+      const result = {};
+      for (const [key, val] of Object.entries(
+        node
+      )) {
+        result[key] = walk(val);
+      }
+      return result;
+    }
+    return node;
+  }
+  return walk(output);
+}
+
+export { sanitizeOutput };
+//# sourceMappingURL=chunk-JIJPZFR2.js.map
+//# sourceMappingURL=chunk-JIJPZFR2.js.map

package/dist/chunk-JIJPZFR2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/output-sanitizer.ts"],"names":[],"mappings":";AAeA,IAAM,cAAA,GAAkD;AAAA,EACvD,gBAAA,EAAkB,CAAA;AAAA,EAClB,gBAAA,EAAkB;AACnB,CAAA;AASO,SAAS,cAAA,CACf,QACA,MAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,MAAA,EAAO;AAC9C,EAAA,MAAM,IAAA,uBAAW,OAAA,EAAgB;AAEjC,EAAA,SAAS,KAAK,IAAA,EAAwB;AACrC,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACxC,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,QAAA,OAAO,IAAA;AAAA,MACR;AAEA,MAAA,IAAI,KAAA,GAAQ,IAAA;AAGZ,MAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,KAAA,GAAQ,CAAA,EAAG;AACzC,QAAA,KAAA,GAAQ,CAAA;AAAA,MACT;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,gBAAA;AAC5B,MAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA,GAAI,MAAA;AAErC,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,SAAS,SAAA,EAAW;AAC1D,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE7B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAc,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACR;AACA,MAAA,IAAA,CAAK,IAAI,IAAc,CAAA;AAEvB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,QAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MACrC;AAEA,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,QAC/B;AAAA,OACD,EAAG;AACF,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,MAAM,CAAA;AACnB","file":"chunk-JIJPZFR2.js","sourcesContent":["/**\n * LIOP Egress Shield Output Sanitizer (NIST SP 800-226 and OWASP DLP 2025 compliant)\n * Recursively sanitizes execution outputs by rounding floating-point numbers\n * and clamping negative values to zero floor where appropriate.\n *\n * Implements absolute immutability, returning a fresh copy of the data.\n */\n\nexport interface OutputSanitizerConfig {\n\t/** Maximum decimal places for floating-point values (default: 4) */\n\tmaxDecimalPlaces?: number;\n\t/** Clamp negative values to zero floor (default: true) */\n\tclampNonNegative?: boolean;\n}\n\nconst DEFAULT_CONFIG: Required<OutputSanitizerConfig> = {\n\tmaxDecimalPlaces: 4,\n\tclampNonNegative: true,\n};\n\n/**\n * Recursively walks a JSON-like tree, rounding floats and clamping negative values.\n *\n * @param output - The raw or DP-modified output object/value to sanitize\n * @param config - Sanitization parameters (rounding depth, negative clamping)\n * @returns A sanitized deep copy of the output\n */\nexport function sanitizeOutput(\n\toutput: unknown,\n\tconfig?: OutputSanitizerConfig,\n): unknown {\n\tconst merged = { ...DEFAULT_CONFIG, ...config };\n\tconst seen = new WeakSet<object>();\n\n\tfunction walk(node: unknown): unknown {\n\t\tif (node === null || node === undefined) {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"number\") {\n\t\t\tif (!Number.isFinite(node)) {\n\t\t\t\treturn node;\n\t\t\t}\n\n\t\t\tlet value = node;\n\n\t\t\t// 1. Clamp negative values to 0 if configured\n\t\t\tif (merged.clampNonNegative && value < 0) {\n\t\t\t\tvalue = 0;\n\t\t\t}\n\n\t\t\t// 2. Round to maximum decimal places\n\t\t\tconst factor = 10 ** merged.maxDecimalPlaces;\n\t\t\tvalue = Math.round(value * factor) / factor;\n\n\t\t\treturn value;\n\t\t}\n\n\t\tif (typeof node === \"string\" || typeof node === \"boolean\") {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"object\") {\n\t\t\t// Circular reference protection\n\t\t\tif (seen.has(node as object)) {\n\t\t\t\treturn node;\n\t\t\t}\n\t\t\tseen.add(node as object);\n\n\t\t\tif (Array.isArray(node)) {\n\t\t\t\treturn node.map((item) => walk(item));\n\t\t\t}\n\n\t\t\tconst result: Record<string, unknown> = {};\n\t\t\tfor (const [key, val] of Object.entries(\n\t\t\t\tnode as Record<string, unknown>,\n\t\t\t)) {\n\t\t\t\tresult[key] = walk(val);\n\t\t\t}\n\t\t\treturn result;\n\t\t}\n\n\t\treturn node;\n\t}\n\n\treturn walk(output);\n}\n"]}

package/dist/chunk-OIMJZ64E.js

@@ -0,0 +1,441 @@
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
+
+// src/observability/metrics.ts
+function formatLabels(labels) {
+  if (!labels || Object.keys(labels).length === 0) {
+    return "";
+  }
+  const entries = Object.entries(labels).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}="${String(v).replace(/"/g, '\\"')}"`);
+  return `{${entries.join(",")}}`;
+}
+function labelsToKey(labels) {
+  if (!labels) return "";
+  return Object.entries(labels).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}:${v}`).join("|");
+}
+var Counter = class {
+  constructor(name, help) {
+    this.name = name;
+    this.help = help;
+  }
+  values = /* @__PURE__ */ new Map();
+  inc(labels, value = 1) {
+    if (value < 0) {
+      throw new Error("Counter increments must be non-negative");
+    }
+    const key = labelsToKey(labels);
+    const current = this.values.get(key) || { value: 0, labels };
+    current.value += value;
+    this.values.set(key, current);
+  }
+  get(labels) {
+    const key = labelsToKey(labels);
+    return this.values.get(key)?.value || 0;
+  }
+  reset() {
+    this.values.clear();
+  }
+  toPrometheus() {
+    const lines = [
+      `# HELP ${this.name} ${this.help}`,
+      `# TYPE ${this.name} counter`
+    ];
+    if (this.values.size === 0) {
+      lines.push(`${this.name} 0`);
+      return lines;
+    }
+    for (const entry of this.values.values()) {
+      lines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);
+    }
+    return lines;
+  }
+};
+var Gauge = class {
+  constructor(name, help) {
+    this.name = name;
+    this.help = help;
+  }
+  values = /* @__PURE__ */ new Map();
+  set(labelsOrValue, maybeValue) {
+    if (typeof labelsOrValue === "number") {
+      this.values.set("", { value: labelsOrValue });
+      return;
+    }
+    const labels = labelsOrValue;
+    const val = typeof maybeValue === "number" ? maybeValue : 0;
+    const key = labelsToKey(labels);
+    this.values.set(key, { value: val, labels });
+  }
+  inc(labels, value = 1) {
+    const key = labelsToKey(labels);
+    const current = this.values.get(key) || { value: 0, labels };
+    current.value += value;
+    this.values.set(key, current);
+  }
+  dec(labels, value = 1) {
+    const key = labelsToKey(labels);
+    const current = this.values.get(key) || { value: 0, labels };
+    current.value -= value;
+    this.values.set(key, current);
+  }
+  get(labels) {
+    const key = labelsToKey(labels);
+    return this.values.get(key)?.value || 0;
+  }
+  reset() {
+    this.values.clear();
+  }
+  toPrometheus() {
+    const lines = [
+      `# HELP ${this.name} ${this.help}`,
+      `# TYPE ${this.name} gauge`
+    ];
+    if (this.values.size === 0) {
+      lines.push(`${this.name} 0`);
+      return lines;
+    }
+    for (const entry of this.values.values()) {
+      lines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);
+    }
+    return lines;
+  }
+};
+var Histogram = class {
+  constructor(name, help, buckets = [5, 10, 25, 50, 100, 250, 500, 1e3, 2500, 5e3, 1e4]) {
+    this.name = name;
+    this.help = help;
+    this.buckets = [...buckets].sort((a, b) => a - b);
+  }
+  buckets;
+  observations = /* @__PURE__ */ new Map();
+  observe(labelsOrValue, maybeValue) {
+    let labels;
+    let val;
+    if (typeof labelsOrValue === "number") {
+      val = labelsOrValue;
+    } else {
+      labels = labelsOrValue;
+      val = typeof maybeValue === "number" ? maybeValue : 0;
+    }
+    const key = labelsToKey(labels);
+    let state = this.observations.get(key);
+    if (!state) {
+      state = {
+        count: 0,
+        sum: 0,
+        bucketCounts: new Map(this.buckets.map((b) => [b, 0])),
+        labels
+      };
+      this.observations.set(key, state);
+    }
+    state.count += 1;
+    state.sum += val;
+    for (const bound of this.buckets) {
+      if (val <= bound) {
+        const cur = state.bucketCounts.get(bound) || 0;
+        state.bucketCounts.set(bound, cur + 1);
+      }
+    }
+  }
+  reset() {
+    this.observations.clear();
+  }
+  toPrometheus() {
+    const lines = [
+      `# HELP ${this.name} ${this.help}`,
+      `# TYPE ${this.name} histogram`
+    ];
+    if (this.observations.size === 0) {
+      lines.push(`${this.name}_count 0`);
+      lines.push(`${this.name}_sum 0`);
+      return lines;
+    }
+    for (const state of this.observations.values()) {
+      const baseLabels = state.labels || {};
+      for (const bound of this.buckets) {
+        const bucketLabels = { ...baseLabels, le: String(bound) };
+        lines.push(
+          `${this.name}_bucket${formatLabels(bucketLabels)} ${state.bucketCounts.get(bound) || 0}`
+        );
+      }
+      const infLabels = { ...baseLabels, le: "+Inf" };
+      lines.push(
+        `${this.name}_bucket${formatLabels(infLabels)} ${state.count}`
+      );
+      lines.push(`${this.name}_sum${formatLabels(baseLabels)} ${state.sum}`);
+      lines.push(
+        `${this.name}_count${formatLabels(baseLabels)} ${state.count}`
+      );
+    }
+    return lines;
+  }
+};
+var MetricsRegistry = class {
+  counters = /* @__PURE__ */ new Map();
+  gauges = /* @__PURE__ */ new Map();
+  histograms = /* @__PURE__ */ new Map();
+  counter(name, help) {
+    let c = this.counters.get(name);
+    if (!c) {
+      c = new Counter(name, help);
+      this.counters.set(name, c);
+    }
+    return c;
+  }
+  gauge(name, help) {
+    let g = this.gauges.get(name);
+    if (!g) {
+      g = new Gauge(name, help);
+      this.gauges.set(name, g);
+    }
+    return g;
+  }
+  histogram(name, help, buckets) {
+    let h = this.histograms.get(name);
+    if (!h) {
+      h = new Histogram(name, help, buckets);
+      this.histograms.set(name, h);
+    }
+    return h;
+  }
+  collectProcessMetrics() {
+    const uptime = this.gauge(
+      "liop_process_uptime_seconds",
+      "Process uptime in seconds"
+    );
+    uptime.set(Math.floor(process.uptime()));
+    if (typeof process.memoryUsage === "function") {
+      const mem = process.memoryUsage();
+      const rss = this.gauge(
+        "liop_process_memory_rss_bytes",
+        "Resident set size memory in bytes"
+      );
+      rss.set(mem.rss);
+      const heapUsed = this.gauge(
+        "liop_process_memory_heap_used_bytes",
+        "Heap memory used in bytes"
+      );
+      heapUsed.set(mem.heapUsed);
+    }
+  }
+  exportPrometheusText() {
+    this.collectProcessMetrics();
+    const lines = [];
+    for (const c of this.counters.values()) {
+      lines.push(...c.toPrometheus());
+    }
+    for (const g of this.gauges.values()) {
+      lines.push(...g.toPrometheus());
+    }
+    for (const h of this.histograms.values()) {
+      lines.push(...h.toPrometheus());
+    }
+    lines.push("");
+    return lines.join("\n");
+  }
+  resetAll() {
+    for (const c of this.counters.values()) c.reset();
+    for (const g of this.gauges.values()) g.reset();
+    for (const h of this.histograms.values()) h.reset();
+  }
+};
+var protocolMetrics = new MetricsRegistry();
+var toolCallsTotal = protocolMetrics.counter(
+  "liop_tool_calls_total",
+  "Total number of tool logic-injection executions"
+);
+var fuelConsumed = protocolMetrics.histogram(
+  "liop_fuel_consumed_total",
+  "Deterministic fuel units consumed by injected logic",
+  [100, 500, 1e3, 2500, 5e3, 1e4, 5e4, 1e5]
+);
+var meshPeersConnected = protocolMetrics.gauge(
+  "liop_mesh_peers_connected",
+  "Active peer connections in the P2P mesh"
+);
+var manifestCacheSize = protocolMetrics.gauge(
+  "liop_manifest_cache_size",
+  "Number of verified remote tool manifests in cache"
+);
+var egressBlocksTotal = protocolMetrics.counter(
+  "liop_egress_blocks_total",
+  "Total number of outputs blocked by Egress Shield"
+);
+var zkVerificationDurationMs = protocolMetrics.histogram(
+  "liop_zk_verification_duration_ms",
+  "Duration of ZK-Receipt and HMAC cryptographic attestation in ms",
+  [1, 2, 5, 10, 25, 50, 100]
+);
+var DILITHIUM65_CONSTANTS = {
+  PUBLIC_KEY_BYTES: 1952,
+  SECRET_KEY_BYTES: 4032,
+  SIGNATURE_BYTES: 3309,
+  DEFAULT_CONTEXT: new TextEncoder().encode("LIOP-FIPS204-ML-DSA-65")
+};
+function normalizeMessage(message) {
+  if (typeof message === "string") {
+    return new TextEncoder().encode(message);
+  }
+  return message;
+}
+function canonicalizeJson(obj) {
+  if (obj === null || typeof obj !== "object") {
+    return JSON.stringify(obj);
+  }
+  if (Array.isArray(obj)) {
+    return `[${obj.map(canonicalizeJson).join(",")}]`;
+  }
+  const sortedKeys = Object.keys(obj).sort();
+  const entries = sortedKeys.map(
+    (key) => `${JSON.stringify(key)}:${canonicalizeJson(obj[key])}`
+  );
+  return `{${entries.join(",")}}`;
+}
+var Dilithium65Wrapper = {
+  /** Constants */
+  PUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,
+  SECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,
+  SIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,
+  /**
+   * Generates a new ML-DSA-65 (FIPS 204) key pair.
+   * Optionally accepts a 32-byte seed for deterministic key generation.
+   */
+  generateKeyPair(seed) {
+    if (seed && seed.length !== 32) {
+      throw new Error(
+        `ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`
+      );
+    }
+    const keys = ml_dsa65.keygen(seed);
+    return {
+      publicKey: keys.publicKey,
+      secretKey: keys.secretKey
+    };
+  },
+  /**
+   * Validates and imports a raw ML-DSA-65 public key.
+   */
+  importPublicKey(buffer) {
+    if (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {
+      throw new Error(
+        `ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`
+      );
+    }
+    return buffer;
+  },
+  /**
+   * Signs a message using the post-quantum secret key.
+   * Supports optional domain separation context (up to 255 bytes).
+   */
+  sign(message, secretKey, context) {
+    if (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {
+      throw new Error(
+        `ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`
+      );
+    }
+    const msgBytes = normalizeMessage(message);
+    const ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;
+    return ml_dsa65.sign(msgBytes, secretKey, { context: ctx });
+  },
+  /**
+   * Verifies an ML-DSA-65 post-quantum digital signature.
+   */
+  verify(signature, message, publicKey, context) {
+    if (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {
+      return false;
+    }
+    if (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {
+      return false;
+    }
+    try {
+      const msgBytes = normalizeMessage(message);
+      const ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;
+      return ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });
+    } catch {
+      return false;
+    }
+  },
+  /**
+   * Signs a structured manifest (LiopManifest) using canonical JSON serialization.
+   * Returns base64-encoded signature and public key for transport over gRPC/MCP.
+   */
+  signManifest(manifest, secretKey, publicKey) {
+    const { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;
+    const canonicalStr = canonicalizeJson(unsigned);
+    const sig = this.sign(canonicalStr, secretKey);
+    return {
+      signature: Buffer.from(sig).toString("base64"),
+      publicKey: Buffer.from(publicKey).toString("base64")
+    };
+  },
+  /**
+   * Verifies the post-quantum signature of a structured manifest.
+   */
+  verifyManifest(manifest, signatureBase64, publicKeyBase64) {
+    try {
+      const sig = Buffer.from(signatureBase64, "base64");
+      const pub = Buffer.from(publicKeyBase64, "base64");
+      const { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;
+      const canonicalStr = canonicalizeJson(unsigned);
+      return this.verify(sig, canonicalStr, pub);
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/security/rbac.ts
+var SCOPE_MAP = {
+  // Protocol lifecycle — unauthenticated (MCP spec compliance)
+  initialize: [],
+  "notifications/initialized": [],
+  "notifications/cancelled": [],
+  ping: [],
+  // Tool operations — require explicit authorization
+  "tools/list": ["liop:tools:list"],
+  "tools/call": ["liop:tools:call"],
+  // Resource operations — read-level access
+  "resources/list": ["liop:resources:read"],
+  "resources/read": ["liop:resources:read"],
+  // Prompt/schema operations — schema-level access
+  "prompts/list": ["liop:schema:read"],
+  "prompts/get": ["liop:schema:read"]
+};
+function authorizeRequest(method, auth, additionalScopes) {
+  const methodScopes = SCOPE_MAP[method];
+  if (methodScopes !== void 0 && methodScopes.length === 0) {
+    return { allowed: true };
+  }
+  if (!auth) {
+    return {
+      allowed: false,
+      reason: `Authentication required for method: ${method}`
+    };
+  }
+  const needed = [...methodScopes ?? [], ...additionalScopes ?? []];
+  if (needed.length === 0) {
+    return {
+      allowed: false,
+      reason: `Unknown method: ${method}. Access denied (fail-closed).`
+    };
+  }
+  const clientScopes = new Set(auth.scopes);
+  const missing = needed.filter((s) => !clientScopes.has(s));
+  if (missing.length > 0) {
+    return {
+      allowed: false,
+      reason: `Insufficient scopes for ${method}. Missing: ${missing.join(", ")}`
+    };
+  }
+  return { allowed: true };
+}
+var LIOP_SCOPES = [
+  "liop:tools:list",
+  "liop:tools:call",
+  "liop:resources:read",
+  "liop:schema:read",
+  "liop:mesh:query"
+];
+
+export { Counter, DILITHIUM65_CONSTANTS, Dilithium65Wrapper, Gauge, Histogram, LIOP_SCOPES, MetricsRegistry, authorizeRequest, egressBlocksTotal, fuelConsumed, manifestCacheSize, meshPeersConnected, protocolMetrics, toolCallsTotal, zkVerificationDurationMs };
+//# sourceMappingURL=chunk-OIMJZ64E.js.map
+//# sourceMappingURL=chunk-OIMJZ64E.js.map

package/dist/chunk-OIMJZ64E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/observability/metrics.ts","../src/rpc/crypto/dilithium.ts","../src/security/rbac.ts"],"names":[],"mappings":";;;AAeA,SAAS,aAAa,MAAA,EAA+B;AACpD,EAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAChD,IAAA,OAAO,EAAA;AAAA,EACR;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,EACnC,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA;AAC5D,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEA,SAAS,YAAY,MAAA,EAA+B;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AACpB,EAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAC1B,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA,KAAM,EAAE,aAAA,CAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,CAC3B,KAAK,GAAG,CAAA;AACX;AAEO,IAAM,UAAN,MAAc;AAAA,EAGpB,WAAA,CACiB,MACA,IAAA,EACf;AAFe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EACd;AAAA,EALK,MAAA,uBAAa,GAAA,EAAsD;AAAA,EAO3E,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,IAAI,QAAQ,CAAA,EAAG;AACd,MAAA,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,IAAI,MAAA,EAA+B;AAClC,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,KAAA,IAAS,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,QAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,KAAS,CAAA,EAAG;AAC3B,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,CAAI,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,YAAA,CAAa,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA,CAAE,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,QAAN,MAAY;AAAA,EAGlB,WAAA,CACiB,MACA,IAAA,EACf;AAFe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EACd;AAAA,EALK,MAAA,uBAAa,GAAA,EAAsD;AAAA,EAO3E,GAAA,CAAI,eAAsC,UAAA,EAA2B;AACpE,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACtC,MAAA,IAAA,CAAK,OAAO,GAAA,CAAI,EAAA,EAAI,EAAE,KAAA,EAAO,eAAe,CAAA;AAC5C,MAAA;AAAA,IACD;AACA,IAAA,MAAM,MAAA,GAAS,aAAA;AACf,IAAA,MAAM,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,CAAA;AAC1D,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,OAAO,GAAA,CAAI,GAAA,EAAK,EAAE,KAAA,EAAO,GAAA,EAAK,QAAQ,CAAA;AAAA,EAC5C;AAAA,EAEA,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,IAAI,MAAA,EAA+B;AAClC,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,KAAA,IAAS,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,MAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,KAAS,CAAA,EAAG;AAC3B,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,CAAI,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,YAAA,CAAa,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA,CAAE,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,YAAN,MAAgB;AAAA,EAYtB,YACiB,IAAA,EACA,IAAA,EAChB,OAAA,GAAoB,CAAC,GAAG,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAM,IAAA,EAAM,GAAA,EAAM,GAAK,CAAA,EACzE;AAHe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAGhB,IAAA,IAAA,CAAK,OAAA,GAAU,CAAC,GAAG,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,GAAI,CAAC,CAAA;AAAA,EACjD;AAAA,EAjBgB,OAAA;AAAA,EACR,YAAA,uBAAmB,GAAA,EAQzB;AAAA,EAUF,OAAA,CAAQ,eAAsC,UAAA,EAA2B;AACxE,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACtC,MAAA,GAAA,GAAM,aAAA;AAAA,IACP,CAAA,MAAO;AACN,MAAA,MAAA,GAAS,aAAA;AACT,MAAA,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,IAAI,KAAA,GAAQ,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,KAAA,GAAQ;AAAA,QACP,KAAA,EAAO,CAAA;AAAA,QACP,GAAA,EAAK,CAAA;AAAA,QACL,YAAA,EAAc,IAAI,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,EAAG,CAAC,CAAC,CAAC,CAAA;AAAA,QACrD;AAAA,OACD;AACA,MAAA,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IACjC;AAEA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,KAAA,CAAM,GAAA,IAAO,GAAA;AAEb,IAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AACjC,MAAA,IAAI,OAAO,KAAA,EAAO;AACjB,QAAA,MAAM,GAAA,GAAM,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA,IAAK,CAAA;AAC7C,QAAA,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,GAAA,GAAM,CAAC,CAAA;AAAA,MACtC;AAAA,IACD;AAAA,EACD;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EACzB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,UAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,IAAA,KAAS,CAAA,EAAG;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,QAAA,CAAU,CAAA;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,MAAA,CAAQ,CAAA;AAC/B,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,YAAA,CAAa,MAAA,EAAO,EAAG;AAC/C,MAAA,MAAM,UAAA,GAAa,KAAA,CAAM,MAAA,IAAU,EAAC;AACpC,MAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AACjC,QAAA,MAAM,eAAe,EAAE,GAAG,YAAY,EAAA,EAAI,MAAA,CAAO,KAAK,CAAA,EAAE;AACxD,QAAA,KAAA,CAAM,IAAA;AAAA,UACL,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,OAAA,EAAU,YAAA,CAAa,YAAY,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,EAAE,GAAG,UAAA,EAAY,IAAI,MAAA,EAAO;AAC9C,MAAA,KAAA,CAAM,IAAA;AAAA,QACL,CAAA,EAAG,KAAK,IAAI,CAAA,OAAA,EAAU,aAAa,SAAS,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA;AAAA,OAC7D;AACA,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,IAAA,EAAO,YAAA,CAAa,UAAU,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAA;AACrE,MAAA,KAAA,CAAM,IAAA;AAAA,QACL,CAAA,EAAG,KAAK,IAAI,CAAA,MAAA,EAAS,aAAa,UAAU,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA;AAAA,OAC7D;AAAA,IACD;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACpB,QAAA,uBAAe,GAAA,EAAqB;AAAA,EACpC,MAAA,uBAAa,GAAA,EAAmB;AAAA,EAChC,UAAA,uBAAiB,GAAA,EAAuB;AAAA,EAEhD,OAAA,CAAQ,MAAc,IAAA,EAAuB;AAC5C,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA;AAC9B,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA;AAC1B,MAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IAC1B;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,KAAA,CAAM,MAAc,IAAA,EAAqB;AACxC,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC5B,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AACxB,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,SAAA,CAAU,IAAA,EAAc,IAAA,EAAc,OAAA,EAA+B;AACpE,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AAChC,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,OAAO,CAAA;AACrC,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,qBAAA,GAA8B;AAC7B,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MACnB,6BAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,MAAA,CAAO,IAAI,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAO,OAAA,CAAQ,WAAA,KAAgB,UAAA,EAAY;AAC9C,MAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA;AAAA,QAChB,+BAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,IAAI,GAAG,CAAA;AAEf,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AAAA,QACrB,qCAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,QAAA,CAAS,GAAA,CAAI,IAAI,QAAQ,CAAA;AAAA,IAC1B;AAAA,EACD;AAAA,EAEA,oBAAA,GAA+B;AAC9B,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAE3B,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,EAAG;AACvC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACrC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACvB;AAAA,EAEA,QAAA,GAAiB;AAChB,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,IAAK,KAAA,EAAM;AAChD,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,IAAK,KAAA,EAAM;AAC9C,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,IAAK,KAAA,EAAM;AAAA,EACnD;AACD;AAIO,IAAM,eAAA,GAAkB,IAAI,eAAA;AAE5B,IAAM,iBAAiB,eAAA,CAAgB,OAAA;AAAA,EAC7C,uBAAA;AAAA,EACA;AACD;AAEO,IAAM,eAAe,eAAA,CAAgB,SAAA;AAAA,EAC3C,0BAAA;AAAA,EACA,qDAAA;AAAA,EACA,CAAC,KAAK,GAAA,EAAK,GAAA,EAAM,MAAM,GAAA,EAAM,GAAA,EAAO,KAAO,GAAM;AAClD;AAEO,IAAM,qBAAqB,eAAA,CAAgB,KAAA;AAAA,EACjD,2BAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,KAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,OAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,2BAA2B,eAAA,CAAgB,SAAA;AAAA,EACvD,kCAAA;AAAA,EACA,iEAAA;AAAA,EACA,CAAC,CAAA,EAAG,CAAA,EAAG,GAAG,EAAA,EAAI,EAAA,EAAI,IAAI,GAAG;AAC1B;AClUO,IAAM,qBAAA,GAAwB;AAAA,EACpC,gBAAA,EAAkB,IAAA;AAAA,EAClB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB,IAAA;AAAA,EACjB,eAAA,EAAiB,IAAI,WAAA,EAAY,CAAE,OAAO,wBAAwB;AACnE;AAKA,SAAS,iBAAiB,OAAA,EAA0C;AACnE,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAChC,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,OAAA;AACR;AAMA,SAAS,iBAAiB,GAAA,EAAsB;AAC/C,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC5C,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,IAAI,GAAA,CAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,GAA8B,EAAE,IAAA,EAAK;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,GAAA;AAAA,IAC1B,CAAC,GAAA,KACA,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAkB,GAAA,CAAgC,GAAG,CAAC,CAAC,CAAA;AAAA,GACnF;AACA,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEO,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEjC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,iBAAiB,qBAAA,CAAsB,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvC,gBAAgB,IAAA,EAGd;AACD,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,mDAAA,EAAsD,KAAK,MAAM,CAAA,CAAA;AAAA,OAClE;AAAA,IACD;AACA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA;AACjC,IAAA,OAAO;AAAA,MACN,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KACjB;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAC7D,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,OAAO,MAAM,CAAA,CAAA;AAAA,OACjH;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CACC,OAAA,EACA,SAAA,EACA,OAAA,EACa;AACb,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,UAAU,MAAM,CAAA,CAAA;AAAA,OACpH;AAAA,IACD;AACA,IAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,IAAA,OAAO,SAAS,IAAA,CAAK,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,EAC3D,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,CACC,SAAA,EACA,OAAA,EACA,SAAA,EACA,OAAA,EACU;AACV,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,eAAA,EAAiB;AAC/D,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,MAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,MAAA,OAAO,QAAA,CAAS,OAAO,SAAA,EAAW,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CACC,QAAA,EACA,SAAA,EACA,SAAA,EAC2C;AAC3C,IAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,IAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAS,CAAA;AAC7C,IAAA,OAAO;AAAA,MACN,WAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,MAC7C,WAAW,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,QAAQ;AAAA,KACpD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,QAAA,EACA,eAAA,EACA,eAAA,EACU;AACV,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,MAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,MAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK,YAAA,EAAc,GAAG,CAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AACD;;;ACvJA,IAAM,SAAA,GAAyD;AAAA;AAAA,EAE9D,YAAY,EAAC;AAAA,EACb,6BAA6B,EAAC;AAAA,EAC9B,2BAA2B,EAAC;AAAA,EAC5B,MAAM,EAAC;AAAA;AAAA,EAGP,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA,EAChC,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA;AAAA,EAGhC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA;AAAA,EAGxC,cAAA,EAAgB,CAAC,kBAAkB,CAAA;AAAA,EACnC,aAAA,EAAe,CAAC,kBAAkB;AACnC,CAAA;AAuBO,SAAS,gBAAA,CACf,MAAA,EACA,IAAA,EACA,gBAAA,EACsB;AACtB,EAAA,MAAM,YAAA,GAAe,UAAU,MAAM,CAAA;AAGrC,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AAC5D,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACxB;AAGA,EAAA,IAAI,CAAC,IAAA,EAAM;AACV,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,uCAAuC,MAAM,CAAA;AAAA,KACtD;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GAAS,CAAC,GAAI,YAAA,IAAgB,EAAC,EAAI,GAAI,gBAAA,IAAoB,EAAG,CAAA;AAGpE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACxB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,mBAAmB,MAAM,CAAA,8BAAA;AAAA,KAClC;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,GAAA,CAAI,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACvB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,QAAQ,CAAA,wBAAA,EAA2B,MAAM,cAAc,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC1E;AAAA,EACD;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACxB;AAMO,IAAM,WAAA,GAAc;AAAA,EAC1B,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACD","file":"chunk-OIMJZ64E.js","sourcesContent":["/**\n * LIOP Prometheus Metrics Registry (Phase Beta-3)\n * Lightweight, zero-dependency, high-performance metrics collector\n * complying with Prometheus and OpenMetrics exposition format.\n */\n\nexport type MetricLabels = Record<string, string | number>;\n\nexport interface MetricDefinition {\n\tname: string;\n\thelp: string;\n\ttype: \"counter\" | \"gauge\" | \"histogram\";\n\tbuckets?: number[];\n}\n\nfunction formatLabels(labels?: MetricLabels): string {\n\tif (!labels || Object.keys(labels).length === 0) {\n\t\treturn \"\";\n\t}\n\tconst entries = Object.entries(labels)\n\t\t.sort(([a], [b]) => a.localeCompare(b))\n\t\t.map(([k, v]) => `${k}=\"${String(v).replace(/\"/g, '\\\\\"')}\"`);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nfunction labelsToKey(labels?: MetricLabels): string {\n\tif (!labels) return \"\";\n\treturn Object.entries(labels)\n\t\t.sort(([a], [b]) => a.localeCompare(b))\n\t\t.map(([k, v]) => `${k}:${v}`)\n\t\t.join(\"|\");\n}\n\nexport class Counter {\n\tprivate values = new Map<string, { value: number; labels?: MetricLabels }>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t) {}\n\n\tinc(labels?: MetricLabels, value = 1): void {\n\t\tif (value < 0) {\n\t\t\tthrow new Error(\"Counter increments must be non-negative\");\n\t\t}\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value += value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tget(labels?: MetricLabels): number {\n\t\tconst key = labelsToKey(labels);\n\t\treturn this.values.get(key)?.value || 0;\n\t}\n\n\treset(): void {\n\t\tthis.values.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} counter`,\n\t\t];\n\t\tif (this.values.size === 0) {\n\t\t\tlines.push(`${this.name} 0`);\n\t\t\treturn lines;\n\t\t}\n\t\tfor (const entry of this.values.values()) {\n\t\t\tlines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class Gauge {\n\tprivate values = new Map<string, { value: number; labels?: MetricLabels }>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t) {}\n\n\tset(labelsOrValue: MetricLabels | number, maybeValue?: number): void {\n\t\tif (typeof labelsOrValue === \"number\") {\n\t\t\tthis.values.set(\"\", { value: labelsOrValue });\n\t\t\treturn;\n\t\t}\n\t\tconst labels = labelsOrValue;\n\t\tconst val = typeof maybeValue === \"number\" ? maybeValue : 0;\n\t\tconst key = labelsToKey(labels);\n\t\tthis.values.set(key, { value: val, labels });\n\t}\n\n\tinc(labels?: MetricLabels, value = 1): void {\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value += value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tdec(labels?: MetricLabels, value = 1): void {\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value -= value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tget(labels?: MetricLabels): number {\n\t\tconst key = labelsToKey(labels);\n\t\treturn this.values.get(key)?.value || 0;\n\t}\n\n\treset(): void {\n\t\tthis.values.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} gauge`,\n\t\t];\n\t\tif (this.values.size === 0) {\n\t\t\tlines.push(`${this.name} 0`);\n\t\t\treturn lines;\n\t\t}\n\t\tfor (const entry of this.values.values()) {\n\t\t\tlines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class Histogram {\n\tpublic readonly buckets: number[];\n\tprivate observations = new Map<\n\t\tstring,\n\t\t{\n\t\t\tcount: number;\n\t\t\tsum: number;\n\t\t\tbucketCounts: Map<number, number>;\n\t\t\tlabels?: MetricLabels;\n\t\t}\n\t>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t\tbuckets: number[] = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 10000],\n\t) {\n\t\tthis.buckets = [...buckets].sort((a, b) => a - b);\n\t}\n\n\tobserve(labelsOrValue: MetricLabels | number, maybeValue?: number): void {\n\t\tlet labels: MetricLabels | undefined;\n\t\tlet val: number;\n\n\t\tif (typeof labelsOrValue === \"number\") {\n\t\t\tval = labelsOrValue;\n\t\t} else {\n\t\t\tlabels = labelsOrValue;\n\t\t\tval = typeof maybeValue === \"number\" ? maybeValue : 0;\n\t\t}\n\n\t\tconst key = labelsToKey(labels);\n\t\tlet state = this.observations.get(key);\n\t\tif (!state) {\n\t\t\tstate = {\n\t\t\t\tcount: 0,\n\t\t\t\tsum: 0,\n\t\t\t\tbucketCounts: new Map(this.buckets.map((b) => [b, 0])),\n\t\t\t\tlabels,\n\t\t\t};\n\t\t\tthis.observations.set(key, state);\n\t\t}\n\n\t\tstate.count += 1;\n\t\tstate.sum += val;\n\n\t\tfor (const bound of this.buckets) {\n\t\t\tif (val <= bound) {\n\t\t\t\tconst cur = state.bucketCounts.get(bound) || 0;\n\t\t\t\tstate.bucketCounts.set(bound, cur + 1);\n\t\t\t}\n\t\t}\n\t}\n\n\treset(): void {\n\t\tthis.observations.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} histogram`,\n\t\t];\n\t\tif (this.observations.size === 0) {\n\t\t\tlines.push(`${this.name}_count 0`);\n\t\t\tlines.push(`${this.name}_sum 0`);\n\t\t\treturn lines;\n\t\t}\n\n\t\tfor (const state of this.observations.values()) {\n\t\t\tconst baseLabels = state.labels || {};\n\t\t\tfor (const bound of this.buckets) {\n\t\t\t\tconst bucketLabels = { ...baseLabels, le: String(bound) };\n\t\t\t\tlines.push(\n\t\t\t\t\t`${this.name}_bucket${formatLabels(bucketLabels)} ${state.bucketCounts.get(bound) || 0}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst infLabels = { ...baseLabels, le: \"+Inf\" };\n\t\t\tlines.push(\n\t\t\t\t`${this.name}_bucket${formatLabels(infLabels)} ${state.count}`,\n\t\t\t);\n\t\t\tlines.push(`${this.name}_sum${formatLabels(baseLabels)} ${state.sum}`);\n\t\t\tlines.push(\n\t\t\t\t`${this.name}_count${formatLabels(baseLabels)} ${state.count}`,\n\t\t\t);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class MetricsRegistry {\n\tprivate counters = new Map<string, Counter>();\n\tprivate gauges = new Map<string, Gauge>();\n\tprivate histograms = new Map<string, Histogram>();\n\n\tcounter(name: string, help: string): Counter {\n\t\tlet c = this.counters.get(name);\n\t\tif (!c) {\n\t\t\tc = new Counter(name, help);\n\t\t\tthis.counters.set(name, c);\n\t\t}\n\t\treturn c;\n\t}\n\n\tgauge(name: string, help: string): Gauge {\n\t\tlet g = this.gauges.get(name);\n\t\tif (!g) {\n\t\t\tg = new Gauge(name, help);\n\t\t\tthis.gauges.set(name, g);\n\t\t}\n\t\treturn g;\n\t}\n\n\thistogram(name: string, help: string, buckets?: number[]): Histogram {\n\t\tlet h = this.histograms.get(name);\n\t\tif (!h) {\n\t\t\th = new Histogram(name, help, buckets);\n\t\t\tthis.histograms.set(name, h);\n\t\t}\n\t\treturn h;\n\t}\n\n\tcollectProcessMetrics(): void {\n\t\tconst uptime = this.gauge(\n\t\t\t\"liop_process_uptime_seconds\",\n\t\t\t\"Process uptime in seconds\",\n\t\t);\n\t\tuptime.set(Math.floor(process.uptime()));\n\n\t\tif (typeof process.memoryUsage === \"function\") {\n\t\t\tconst mem = process.memoryUsage();\n\t\t\tconst rss = this.gauge(\n\t\t\t\t\"liop_process_memory_rss_bytes\",\n\t\t\t\t\"Resident set size memory in bytes\",\n\t\t\t);\n\t\t\trss.set(mem.rss);\n\n\t\t\tconst heapUsed = this.gauge(\n\t\t\t\t\"liop_process_memory_heap_used_bytes\",\n\t\t\t\t\"Heap memory used in bytes\",\n\t\t\t);\n\t\t\theapUsed.set(mem.heapUsed);\n\t\t}\n\t}\n\n\texportPrometheusText(): string {\n\t\tthis.collectProcessMetrics();\n\n\t\tconst lines: string[] = [];\n\t\tfor (const c of this.counters.values()) {\n\t\t\tlines.push(...c.toPrometheus());\n\t\t}\n\t\tfor (const g of this.gauges.values()) {\n\t\t\tlines.push(...g.toPrometheus());\n\t\t}\n\t\tfor (const h of this.histograms.values()) {\n\t\t\tlines.push(...h.toPrometheus());\n\t\t}\n\t\tlines.push(\"\"); // Trailing newline\n\t\treturn lines.join(\"\\n\");\n\t}\n\n\tresetAll(): void {\n\t\tfor (const c of this.counters.values()) c.reset();\n\t\tfor (const g of this.gauges.values()) g.reset();\n\t\tfor (const h of this.histograms.values()) h.reset();\n\t}\n}\n\n// ── Global Standard Protocol Metrics Instance ──────────────────────────────────\n\nexport const protocolMetrics = new MetricsRegistry();\n\nexport const toolCallsTotal = protocolMetrics.counter(\n\t\"liop_tool_calls_total\",\n\t\"Total number of tool logic-injection executions\",\n);\n\nexport const fuelConsumed = protocolMetrics.histogram(\n\t\"liop_fuel_consumed_total\",\n\t\"Deterministic fuel units consumed by injected logic\",\n\t[100, 500, 1000, 2500, 5000, 10000, 50000, 100000],\n);\n\nexport const meshPeersConnected = protocolMetrics.gauge(\n\t\"liop_mesh_peers_connected\",\n\t\"Active peer connections in the P2P mesh\",\n);\n\nexport const manifestCacheSize = protocolMetrics.gauge(\n\t\"liop_manifest_cache_size\",\n\t\"Number of verified remote tool manifests in cache\",\n);\n\nexport const egressBlocksTotal = protocolMetrics.counter(\n\t\"liop_egress_blocks_total\",\n\t\"Total number of outputs blocked by Egress Shield\",\n);\n\nexport const zkVerificationDurationMs = protocolMetrics.histogram(\n\t\"liop_zk_verification_duration_ms\",\n\t\"Duration of ZK-Receipt and HMAC cryptographic attestation in ms\",\n\t[1, 2, 5, 10, 25, 50, 100],\n);\n","/**\n * LIOP Post-Quantum Digital Signature Wrapper\n * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant\n * manifest attestation, node revocation receipts, and cryptographic integrity.\n *\n * Characteristics:\n * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)\n * - Public Key Length: 1952 bytes\n * - Secret Key Length: 4032 bytes\n * - Signature Length: 3309 bytes\n * - Implementation: Pure TypeScript/JS via @noble/post-quantum\n */\n\nimport { ml_dsa65 } from \"@noble/post-quantum/ml-dsa.js\";\n\nexport const DILITHIUM65_CONSTANTS = {\n\tPUBLIC_KEY_BYTES: 1952,\n\tSECRET_KEY_BYTES: 4032,\n\tSIGNATURE_BYTES: 3309,\n\tDEFAULT_CONTEXT: new TextEncoder().encode(\"LIOP-FIPS204-ML-DSA-65\"),\n} as const;\n\n/**\n * Deterministically normalizes a message into a Uint8Array.\n */\nfunction normalizeMessage(message: Uint8Array | string): Uint8Array {\n\tif (typeof message === \"string\") {\n\t\treturn new TextEncoder().encode(message);\n\t}\n\treturn message;\n}\n\n/**\n * Deterministic canonical JSON serializer to ensure stable cryptographic hashing\n * regardless of key ordering in JavaScript objects.\n */\nfunction canonicalizeJson(obj: unknown): string {\n\tif (obj === null || typeof obj !== \"object\") {\n\t\treturn JSON.stringify(obj);\n\t}\n\tif (Array.isArray(obj)) {\n\t\treturn `[${obj.map(canonicalizeJson).join(\",\")}]`;\n\t}\n\tconst sortedKeys = Object.keys(obj as Record<string, unknown>).sort();\n\tconst entries = sortedKeys.map(\n\t\t(key) =>\n\t\t\t`${JSON.stringify(key)}:${canonicalizeJson((obj as Record<string, unknown>)[key])}`,\n\t);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nexport const Dilithium65Wrapper = {\n\t/** Constants */\n\tPUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,\n\tSECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,\n\tSIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,\n\n\t/**\n\t * Generates a new ML-DSA-65 (FIPS 204) key pair.\n\t * Optionally accepts a 32-byte seed for deterministic key generation.\n\t */\n\tgenerateKeyPair(seed?: Uint8Array): {\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t} {\n\t\tif (seed && seed.length !== 32) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`,\n\t\t\t);\n\t\t}\n\t\tconst keys = ml_dsa65.keygen(seed);\n\t\treturn {\n\t\t\tpublicKey: keys.publicKey,\n\t\t\tsecretKey: keys.secretKey,\n\t\t};\n\t},\n\n\t/**\n\t * Validates and imports a raw ML-DSA-65 public key.\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Signs a message using the post-quantum secret key.\n\t * Supports optional domain separation context (up to 255 bytes).\n\t */\n\tsign(\n\t\tmessage: Uint8Array | string,\n\t\tsecretKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): Uint8Array {\n\t\tif (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`,\n\t\t\t);\n\t\t}\n\t\tconst msgBytes = normalizeMessage(message);\n\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\treturn ml_dsa65.sign(msgBytes, secretKey, { context: ctx });\n\t},\n\n\t/**\n\t * Verifies an ML-DSA-65 post-quantum digital signature.\n\t */\n\tverify(\n\t\tsignature: Uint8Array,\n\t\tmessage: Uint8Array | string,\n\t\tpublicKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): boolean {\n\t\tif (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\tif (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\ttry {\n\t\t\tconst msgBytes = normalizeMessage(message);\n\t\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\t\treturn ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n\n\t/**\n\t * Signs a structured manifest (LiopManifest) using canonical JSON serialization.\n\t * Returns base64-encoded signature and public key for transport over gRPC/MCP.\n\t */\n\tsignManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsecretKey: Uint8Array,\n\t\tpublicKey: Uint8Array,\n\t): { signature: string; publicKey: string } {\n\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\tconst sig = this.sign(canonicalStr, secretKey);\n\t\treturn {\n\t\t\tsignature: Buffer.from(sig).toString(\"base64\"),\n\t\t\tpublicKey: Buffer.from(publicKey).toString(\"base64\"),\n\t\t};\n\t},\n\n\t/**\n\t * Verifies the post-quantum signature of a structured manifest.\n\t */\n\tverifyManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsignatureBase64: string,\n\t\tpublicKeyBase64: string,\n\t): boolean {\n\t\ttry {\n\t\t\tconst sig = Buffer.from(signatureBase64, \"base64\");\n\t\t\tconst pub = Buffer.from(publicKeyBase64, \"base64\");\n\t\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\t\treturn this.verify(sig, canonicalStr, pub);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n};\n","/**\n * LIOP RBAC Engine — Scope-Based Authorization\n *\n * Maps MCP JSON-RPC methods to required LIOP OAuth scopes.\n * Enforces least-privilege access at the router level before\n * any tool execution or resource read occurs.\n *\n * Standards: NIST SP 800-207 §4.3 (least privilege), OWASP LLM06 (Excessive Agency),\n *            OWASP API-A01 (Broken Access Control)\n */\n\nimport type { AuthInfo } from \"./jwt-validator.js\";\n\n/**\n * Maps MCP JSON-RPC methods to the LIOP scopes required to invoke them.\n * Empty array = no authentication required (public endpoints).\n */\nconst SCOPE_MAP: Readonly<Record<string, readonly string[]>> = {\n\t// Protocol lifecycle — unauthenticated (MCP spec compliance)\n\tinitialize: [],\n\t\"notifications/initialized\": [],\n\t\"notifications/cancelled\": [],\n\tping: [],\n\n\t// Tool operations — require explicit authorization\n\t\"tools/list\": [\"liop:tools:list\"],\n\t\"tools/call\": [\"liop:tools:call\"],\n\n\t// Resource operations — read-level access\n\t\"resources/list\": [\"liop:resources:read\"],\n\t\"resources/read\": [\"liop:resources:read\"],\n\n\t// Prompt/schema operations — schema-level access\n\t\"prompts/list\": [\"liop:schema:read\"],\n\t\"prompts/get\": [\"liop:schema:read\"],\n};\n\n/**\n * Authorization result with optional denial reason for audit logging.\n */\nexport interface AuthorizationResult {\n\tallowed: boolean;\n\treason?: string;\n}\n\n/**\n * Evaluates whether a request is authorized based on JWT scopes.\n *\n * Decision logic:\n * 1. Methods with no required scopes (initialize, ping) → always allowed.\n * 2. Methods with required scopes but no auth → denied.\n * 3. Methods with required scopes → all scopes must be present in the JWT.\n * 4. Unknown methods with no auth → denied (fail-closed per NIST SP 800-207).\n *\n * @param method - MCP JSON-RPC method name (e.g., \"tools/call\")\n * @param auth - Validated JWT context, or null if unauthenticated\n * @param additionalScopes - Extra scopes required by specific node configuration\n */\nexport function authorizeRequest(\n\tmethod: string,\n\tauth: AuthInfo | null,\n\tadditionalScopes?: readonly string[],\n): AuthorizationResult {\n\tconst methodScopes = SCOPE_MAP[method];\n\n\t// Methods explicitly marked as public (empty scope array) pass freely\n\tif (methodScopes !== undefined && methodScopes.length === 0) {\n\t\treturn { allowed: true };\n\t}\n\n\t// If no auth context and method requires scopes → deny\n\tif (!auth) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Authentication required for method: ${method}`,\n\t\t};\n\t}\n\n\t// Merge method-level scopes with node-level additional scopes\n\tconst needed = [...(methodScopes ?? []), ...(additionalScopes ?? [])];\n\n\t// If no scopes needed (unknown method, no additional) → fail-closed\n\tif (needed.length === 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Unknown method: ${method}. Access denied (fail-closed).`,\n\t\t};\n\t}\n\n\t// Verify all required scopes are present in the JWT\n\tconst clientScopes = new Set(auth.scopes);\n\tconst missing = needed.filter((s) => !clientScopes.has(s));\n\n\tif (missing.length > 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Insufficient scopes for ${method}. Missing: ${missing.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * All LIOP OAuth scopes supported by the protocol.\n * Used for PRM metadata and client registration.\n */\nexport const LIOP_SCOPES = [\n\t\"liop:tools:list\",\n\t\"liop:tools:call\",\n\t\"liop:resources:read\",\n\t\"liop:schema:read\",\n\t\"liop:mesh:query\",\n] as const;\n\nexport type LiopScope = (typeof LIOP_SCOPES)[number];\n"]}

package/dist/chunk-OUUTDSOW.js

@@ -0,0 +1,24 @@
+import crypto from 'crypto';
+
+// src/crypto/logic-image-id.ts
+var TOP_LEVEL_ENVELOPE = /^\s*@LIOP\{[^}]+\}\n?([\s\S]*?)\n?@END\s*$/;
+function normalizeLogicSource(logicUtf8) {
+  const match = logicUtf8.match(TOP_LEVEL_ENVELOPE);
+  if (match?.[1] !== void 0) {
+    return match[1].trim();
+  }
+  return logicUtf8.trim();
+}
+function deriveLogicImageDigest(logicPayload) {
+  const isWasm = logicPayload[0] === 0 && logicPayload[1] === 97;
+  if (isWasm) {
+    return crypto.createHash("sha256").update(logicPayload).digest();
+  }
+  const text = Buffer.from(logicPayload).toString("utf-8");
+  const normalized = normalizeLogicSource(text);
+  return crypto.createHash("sha256").update(Buffer.from(normalized, "utf-8")).digest();
+}
+
+export { deriveLogicImageDigest, normalizeLogicSource };
+//# sourceMappingURL=chunk-OUUTDSOW.js.map
+//# sourceMappingURL=chunk-OUUTDSOW.js.map

package/dist/chunk-OUUTDSOW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crypto/logic-image-id.ts"],"names":[],"mappings":";;;AAOA,IAAM,kBAAA,GAAqB,4CAAA;AAEpB,SAAS,qBAAqB,SAAA,EAA2B;AAC/D,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,kBAAkB,CAAA;AAChD,EAAA,IAAI,KAAA,GAAQ,CAAC,CAAA,KAAM,MAAA,EAAW;AAC7B,IAAA,OAAO,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,EACtB;AACA,EAAA,OAAO,UAAU,IAAA,EAAK;AACvB;AAGO,SAAS,uBAAuB,YAAA,EAAkC;AACxE,EAAA,MAAM,SAAS,YAAA,CAAa,CAAC,MAAM,CAAA,IAAQ,YAAA,CAAa,CAAC,CAAA,KAAM,EAAA;AAC/D,EAAA,IAAI,MAAA,EAAQ;AACX,IAAA,OAAO,OAAO,UAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,YAAY,EAAE,MAAA,EAAO;AAAA,EAChE;AACA,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,OAAO,CAAA;AACvD,EAAA,MAAM,UAAA,GAAa,qBAAqB,IAAI,CAAA;AAC5C,EAAA,OAAO,MAAA,CACL,UAAA,CAAW,QAAQ,CAAA,CACnB,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,UAAA,EAAY,OAAO,CAAC,CAAA,CACvC,MAAA,EAAO;AACV","file":"chunk-OUUTDSOW.js","sourcesContent":["import crypto from \"node:crypto\";\n\n/**\n * Top-level LIOP v1 envelope only. Must NOT use multiline (^/$) mode:\n * proxy logic embeds a full envelope inside JSON strings; `^` per line would\n * incorrectly treat that as the document root and desync ImageID vs the worker.\n */\nconst TOP_LEVEL_ENVELOPE = /^\\s*@LIOP\\{[^}]+\\}\\n?([\\s\\S]*?)\\n?@END\\s*$/;\n\nexport function normalizeLogicSource(logicUtf8: string): string {\n\tconst match = logicUtf8.match(TOP_LEVEL_ENVELOPE);\n\tif (match?.[1] !== undefined) {\n\t\treturn match[1].trim();\n\t}\n\treturn logicUtf8.trim();\n}\n\n/** SHA-256 digest of logic bytes (WASM raw; JS UTF-8 after top-level envelope strip). */\nexport function deriveLogicImageDigest(logicPayload: Uint8Array): Buffer {\n\tconst isWasm = logicPayload[0] === 0x00 && logicPayload[1] === 0x61;\n\tif (isWasm) {\n\t\treturn crypto.createHash(\"sha256\").update(logicPayload).digest();\n\t}\n\tconst text = Buffer.from(logicPayload).toString(\"utf-8\");\n\tconst normalized = normalizeLogicSource(text);\n\treturn crypto\n\t\t.createHash(\"sha256\")\n\t\t.update(Buffer.from(normalized, \"utf-8\"))\n\t\t.digest();\n}\n"]}