@nekzus/liop 2.1.0 → 2.3.0

package/dist/chunk-UCJEK75U.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/prm.ts","../src/gateway/grpc-web.ts","../src/gateway/rate-limiter.ts","../src/gateway/hybrid.ts"],"names":[],"mappings":";;;;;;;;AAoCO,SAAS,8BAAA,CACf,QACA,QAAA,EAC4B;AAC5B,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,QAAA;AAAA,IACV,qBAAA,EAAuB,CAAC,MAAM,CAAA;AAAA,IAC9B,gBAAA,EAAkB,WAAA;AAAA,IAClB,wBAAA,EAA0B,CAAC,QAAQ,CAAA;AAAA,IACnC,sBAAA,EAAwB;AAAA,GACzB;AACD;;;AC7BO,IAAM,kBAAA,GAAqB;AAAA,EACjC,SAAA,EAAW,CAAA;AAAA,EACX,aAAA,EAAe,GAAA;AAAA,EACf,aAAA,EAAe,CAAA;AAAA,EACf,mBAAA,EAAqB,sBAAA;AAAA,EACrB,SAAA,EAAW,CAAA;AAAA,EACX,gBAAA,EAAkB,CAAA;AAAA,EAClB,cAAA,EAAgB,CAAA;AAAA,EAChB,uBAAA,EAAyB,CAAA;AAAA,EACzB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,gBAAA,EAAkB,CAAA;AAAA,EAClB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,sBAAA,EAAwB,EAAA;AAAA,EACxB,eAAA,EAAiB;AAClB;AAUO,SAAS,iBAAiB,WAAA,EAA+B;AAC/D,EAAA,IAAI,CAAC,aAAa,OAAO,KAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,YAAY,WAAA,EAAY;AACtC,EAAA,OACC,KAAA,CAAM,UAAA,CAAW,sBAAsB,CAAA,IACvC,KAAA,CAAM,WAAW,4BAA4B,CAAA,IAC7C,KAAA,CAAM,UAAA,CAAW,2BAA2B,CAAA;AAE9C;AAKO,SAAS,gBAAgB,OAAA,EAAsC;AACrE,EAAA,MAAM,GAAA,GAAM,OAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU,MAAA,CAAO,KAAK,OAAO,CAAA;AACpE,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,SAAA,EAAW,CAAC,CAAA;AACjD,EAAA,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,MAAA,EAAQ,CAAC,CAAA;AAClC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAA;AACnC;AAKO,SAAS,kBAAA,CACf,SAAiB,kBAAA,CAAmB,SAAA,EACpC,UAAkB,EAAA,EAClB,cAAA,GAAyC,EAAC,EACjC;AACT,EAAA,MAAM,KAAA,GAAQ;AAAA,IACb,eAAe,MAAM,CAAA,CAAA;AAAA,IACrB,CAAA,aAAA,EAAgB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAAA,GAC5C;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EAAG;AAC1D,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,EAC7B;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,CAAA;AACzC,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,OAAO,CAAA;AAEnD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,aAAA,EAAe,CAAC,CAAA;AACrD,EAAA,MAAA,CAAO,aAAA,CAAc,UAAA,CAAW,MAAA,EAAQ,CAAC,CAAA;AAEzC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,MAAA,EAAgC;AAC5D,EAAA,MAAM,SAAyB,EAAC;AAChC,EAAA,IAAI,MAAA,GAAS,CAAA;AAEb,EAAA,OAAO,MAAA,GAAS,kBAAA,CAAmB,aAAA,IAAiB,MAAA,CAAO,MAAA,EAAQ;AAClE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,CAAa,MAAA,GAAS,CAAC,CAAA;AAC7C,IAAA,MAAM,YAAA,GAAe,SAAS,kBAAA,CAAmB,aAAA;AACjD,IAAA,MAAM,aAAa,YAAA,GAAe,MAAA;AAElC,IAAA,IAAI,UAAA,GAAa,OAAO,MAAA,EAAQ;AAC/B,MAAA;AAAA,IACD;AAEA,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,CAAS,YAAA,EAAc,UAAU,CAAA;AACxD,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACX,SAAA,EAAA,CACE,IAAA,GAAO,kBAAA,CAAmB,aAAA,MAC3B,kBAAA,CAAmB,aAAA;AAAA,MACpB,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAO;AAAA,KAC5B,CAAA;AAED,IAAA,MAAA,GAAS,UAAA;AAAA,EACV;AAEA,EAAA,OAAO,MAAA;AACR;AAMA,eAAsB,sBAAA,CACrB,GAAA,EACA,GAAA,EACA,OAAA,EAIgB;AAChB,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACjC,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EAClB,CAAC,CAAA;AAED,EAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AACzB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AACrC,MAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AACpC,MAAA,MAAM,WAAA,GACL,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,SAAS,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC5D,MAAA,MAAM,WAAA,GAAc,IAAI,GAAA,IAAO,GAAA;AAE/B,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,gCAAA,EAAmC,WAAW,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,CAAA,OAAA;AAAA,OACtE;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,WAAA,EAAa,WAAW,CAAA;AAErD,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,GAAG,CAAA;AAChD,MAAA,GAAA,CAAI,SAAA;AAAA,QACH,+BAAA;AAAA,QACA;AAAA,OACD;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,EAAG;AAC1C,QAAA,GAAA,CAAI,KAAA,CAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,MACvC;AAGA,MAAA,GAAA,CAAI,MAAM,kBAAA,CAAmB,MAAA,CAAO,QAAQ,MAAA,CAAO,OAAA,IAAW,EAAE,CAAC,CAAA;AACjE,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,CAAE,CAAA;AAC/C,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,KAAA;AAAA,QACH,kBAAA;AAAA,UACC,kBAAA,CAAmB,eAAA;AAAA,UAClB,MAAgB,OAAA,IAAW;AAAA;AAC7B,OACD;AACA,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT;AAAA,EACD,CAAC,CAAA;AACF;;;ACzJO,IAAM,sBAAN,MAA0B;AAAA,EACf,QAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA,uBAAyC,GAAA,EAAI;AAAA,EACtD,YAAA;AAAA,EAER,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAG;AAC7C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,GAAA;AACpC,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,GAAA;AAG1C,IAAA,IAAA,CAAK,eAAe,WAAA,CAAY,MAAM,IAAA,CAAK,OAAA,IAAW,GAAM,CAAA;AAC5D,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,KAAU,UAAA,EAAY;AAClD,MAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,IACzB;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,MAAM,GAAA,EAA8B;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAEjC,IAAA,IAAI,CAAC,MAAA,IAAU,GAAA,IAAO,MAAA,CAAO,SAAA,EAAW;AACvC,MAAA,MAAA,GAAS;AAAA,QACR,KAAA,EAAO,CAAA;AAAA,QACP,SAAA,EAAW,MAAM,IAAA,CAAK;AAAA,OACvB;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAC5B,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,KAAK,WAAA,GAAc,CAAA;AAAA,QAC9B,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK;AAAA,OACf;AAAA,IACD;AAEA,IAAA,IAAI,MAAA,CAAO,KAAA,IAAS,IAAA,CAAK,WAAA,EAAa;AACrC,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW,CAAA;AAAA,QACX,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,OAC5C;AAAA,IACD;AAEA,IAAA,MAAA,CAAO,KAAA,EAAA;AACP,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,IAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,WAAA,GAAc,MAAA,CAAO,KAAA;AAAA,MACrC,OAAO,IAAA,CAAK,WAAA;AAAA,MACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,KAC5C;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,MAAM,GAAA,EAAmB;AAC/B,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,KAAK,IAAA,CAAK,OAAA,CAAQ,SAAQ,EAAG;AACnD,MAAA,IAAI,GAAA,IAAO,OAAO,SAAA,EAAW;AAC5B,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,MACxB;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,KAAA,GAAc;AACpB,IAAA,IAAI,KAAK,YAAA,EAAc;AACtB,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,MAAA;AAAA,IACrB;AACA,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACpB;AACD;;;ACzFO,IAAM,oBAAN,MAAwB;AAAA,EAY9B,YACS,UAAA,EACA,QAAA,GAA4B,IAAA,EACpC,OAAA,GAAkB,OAClB,kBAAA,EACC;AAJO,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAIR,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,UAAA,CAAW,YAAA;AACpC,IAAA,IAAA,CAAK,aAAA,GAAgB,KAAK,UAAA,CAAW,aAAA;AACrC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAI,mBAAA,CAAoB,kBAAkB,CAAA;AAG7D,IAAA,IAAA,CAAK,SAAS,IAAI,aAAA,CAAc,KAAK,UAAA,EAAY,IAAA,CAAK,UAAU,OAAO,CAAA;AAGvE,IAAA,IAAA,CAAK,WAAiB,KAAA,CAAA,YAAA,EAAa;AACnC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,WAAgB,IAAA,CAAA,YAAA,EAAa;AAClC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,SAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,CAAC,MAAA,KAAW;AAC7C,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,CAAC,MAAA,KAAW;AAC/B,QAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,EAAS,CAAE,WAAW,gBAAgB,CAAA;AAC7D,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,iDAAA,EAAoD,OAAA,GAAU,eAAA,GAAkB,gBAAgB,CAAA;AAAA,SACjG;AACA,QAAA,IAAI,OAAA,EAAS;AACZ,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC,CAAA,MAAO;AACN,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC;AACA,QAAA,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,MACtB,CAAC,CAAA;AACD,MAAA,MAAA,CAAO,EAAA;AAAA,QAAG,OAAA;AAAA,QAAS,CAAC,GAAA,KACnB,GAAA,CAAI,MAAM,CAAA,uCAAA,EAA0C,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,OAClE;AAAA,IACD,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AACA,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AAEA,IAAA,GAAA,CAAI,KAAK,4CAA4C,CAAA;AAAA,EACtD;AAAA,EA5DQ,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAEA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA,GAAa,KAAA;AAAA,EACb,cAAA,GAAiB,CAAA;AAAA,EAqDjB,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,QAAA,EAAU,CAAC,QAAQ,OAAA,KAAY;AAC/C,MAAA,MAAM,WAAA,GAAc,QAAQ,cAAc,CAAA;AAC1C,MAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,CAAA;AAE5B,MAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACvC,QAAA,IAAA,CAAK,iBAAiB,MAAiC,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC3B,QAAA,IAAA,CAAK,iBAAA,CAAkB,QAAmC,OAAO,CAAA;AAAA,MAClE;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,SAAA,EAAW,OAAO,KAAK,GAAA,KAAQ;AAC/C,MAAA,IAAA,CAAK,cAAA,IAAkB,CAAA;AACvB,MAAA,MAAM,SAAS,MAAM;AACpB,QAAA,GAAA,CAAI,cAAA,CAAe,UAAU,MAAM,CAAA;AACnC,QAAA,GAAA,CAAI,cAAA,CAAe,SAAS,MAAM,CAAA;AAClC,QAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,MAC1D,CAAA;AACA,MAAA,GAAA,CAAI,EAAA,CAAG,UAAU,MAAM,CAAA;AACvB,MAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAEtB,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,IAAO,EAAA;AACvB,MAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AAGnB,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,QAAA,EAAU;AAClB,UAAA,kBAAA,CAAmB,IAAI,EAAC,EAAG,KAAK,QAAA,CAAS,QAAA,GAAW,MAAM,CAAA;AAAA,QAC3D;AACA,QAAA,IAAI,KAAK,MAAA,EAAQ;AAChB,UAAA,iBAAA,CAAkB,IAAI,EAAC,EAAG,IAAA,CAAK,MAAA,CAAO,sBAAsB,CAAA;AAAA,QAC7D;AACA,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,UAClB,cAAA,EAAgB;AAAA,SAChB,CAAA;AACD,QAAA,GAAA,CAAI,GAAA,CAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA;AAC9C,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,IAAA;AAAA,YACR,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA;AAAA,YACnC,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,SAAA,EAAW;AAC1C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,MAAM,cAAc,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,WAAU,GAAI,IAAA;AAChE,QAAA,IAAI,CAAC,WAAA,EAAa;AACjB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,WAAA,EAAa,KAAA;AAAA,cACb,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,OAAA;AAAA,YACR,WAAA,EAAa,IAAA;AAAA,YACb,OAAO,IAAA,CAAK,QAAA,GAAW,KAAK,QAAA,CAAS,QAAA,GAAW,MAAA,GAAS,CAAA;AAAA,YACzD,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,IAAA,CAAK,UAAA,IAAc,GAAA,KAAQ,MAAA,EAAQ;AACtC,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,OAAA,EAAS,KAAA;AAAA,YACT,KAAA,EAAO;AAAA,cACN,IAAA,EAAM,KAAA;AAAA,cACN,OAAA,EAAS;AAAA;AACV,WACA;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,cAAc,CAAA;AAC9C,MAAA,IAAI,gBAAA,CAAiB,WAAW,CAAA,EAAG;AAClC,QAAA,MAAM,sBAAA,CAAuB,GAAA,EAAK,GAAA,EAAK,OAAO,SAAS,OAAA,KAAY;AAClE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,uCAAA,EAA0C,OAAO,CAAA,EAAA,EAAK,OAAA,CAAQ,MAAM,CAAA,OAAA;AAAA,WACrE;AACA,UAAA,OAAO;AAAA,YACN,QAAQ,kBAAA,CAAmB,SAAA;AAAA,YAC3B,OAAA,EAAS,IAAA;AAAA,YACT,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,EAAE;AAAA,WACrB;AAAA,QACD,CAAC,CAAA;AACD,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,IAAK,KAAK,aAAA,EAAe;AAClD,QAAA,MAAM,QAAA,GACL,OAAO,IAAA,CAAK,aAAA,CAAc,QAAA,KAAa,aACpC,IAAA,CAAK,aAAA,CAAc,QAAA,EAAS,GAC5B,IAAA,CAAK,aAAA;AAET,QAAA,MAAM,cAAc,GAAA,CAAI,GAAA;AACxB,QAAA,GAAA,CAAI,GAAA,GAAA,CAAO,WAAA,IAAe,EAAA,EAAI,KAAA,CAAM,CAAC,CAAA,IAAK,GAAA;AAC1C,QAAA,IAAI;AACH,UAAA,OAAO,QAAA,CAAS,KAAK,GAAG,CAAA;AAAA,QACzB,CAAA,SAAE;AACD,UAAA,GAAA,CAAI,GAAA,GAAM,WAAA;AAAA,QACX;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,uCAAA,EAAyC;AACxE,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,GAAA,GAAM,8BAAA;AAAA,YACX,IAAA,CAAK,aAAa,SAAA,EAAU;AAAA,YAC5B,IAAA,CAAK,aAAa,WAAA;AAAY,WAC/B;AACA,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAC3B,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,QAAA;AAAA,MACD;AAEA,MAAA,IACC,WAAW,KAAA,KACV,GAAA,KAAQ,OAAO,GAAA,KAAQ,MAAA,IAAU,QAAQ,SAAA,CAAA,EACzC;AACD,QAAA,IACC,QAAQ,SAAA,IACR,GAAA,CAAI,QAAQ,MAAA,EAAQ,QAAA,CAAS,kBAAkB,CAAA,EAC9C;AACD,UAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB;AAAA,YACA,QAAQ,IAAA,CAAK,QAAA,CAAS,SAAA,EAAU,EAAG,UAAS,IAAK,EAAA;AAAA,YACjD,UAAA,EAAY,IAAA,CAAK,QAAA,CACf,aAAA,EAAc,CACd,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,EAAU;AAAA,WAC1B,GACC,IAAA;AACH,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,EAAc,SAAA,EAAU;AAC5C,UAAA,MAAM,OAAA,GAAU,SACb,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GACtB,MAAA,GACA,CAAA,EAAG,MAAM,CAAA,KAAA,CAAA,GACV,EAAA;AACH,UAAA,MAAM,gBAAA,GACL,IAAA,CAAK,YAAA,IAAgB,MAAA,GAClB;AAAA,YACA,MAAA;AAAA,YACA,QAAA,EAAU,GAAG,OAAO,CAAA,KAAA,CAAA;AAAA,YACpB,GAAI,KAAK,aAAA,GACN;AAAA,cACA,cAAA,EAAgB,GAAG,OAAO,CAAA,MAAA;AAAA,gBAE1B;AAAC,WACL,GACC,MAAA;AAEJ,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,IAAA,EAAM,IAAA,CAAK,UAAA,CAAW,aAAA,EAAc;AAAA,cACpC,IAAA,EAAM,QAAA;AAAA,cACN,KAAA,EAAO,KAAK,UAAA,CAAW,SAAA,GAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA;AAAA,cACpD,IAAA,EAAM,gBAAA;AAAA,cACN,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,4BAA4B,CAAA;AACjE,QAAA,GAAA,CAAI,GAAA,CAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAA,CAWK,CAAA;AACb,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,GAAA,KAAQ,MAAA,IAAU,MAAA,KAAW,MAAA,EAAQ;AACxC,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,aAAA;AAC/B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACjD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AAClD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,IAAI,IAAA,GAAO,EAAA;AACX,QAAA,GAAA,CAAI,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACpD,QAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AAEzB,UAAA,MAAM,QAAA,GAAW,GAAA,CAAI,MAAA,CAAO,aAAA,IAAiB,WAAA;AAC7C,UAAA,MAAM,YAAA,GAAe,UAAU,QAAA,GAC5B,CAAA,OAAA,EAAU,SAAS,QAAQ,CAAA,CAAA,GAC3B,MAAM,QAAQ,CAAA,CAAA;AACjB,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,KAAA,CAAM,YAAY,CAAA;AACtD,UAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACxB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,cAAA,EAAgB,kBAAA;AAAA,cAChB,eAAe,IAAA,CAAK,IAAA,CAAK,WAAW,OAAA,GAAU,GAAI,EAAE,QAAA;AAAS,aAC7D,CAAA;AACD,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,EAAA,EAAI,IAAA;AAAA,gBACJ,KAAA,EAAO;AAAA,kBACN,IAAA,EAAM,MAAA;AAAA,kBACN,OAAA,EAAS;AAAA;AACV,eACA;AAAA,aACF;AACA,YAAA;AAAA,UACD;AAEA,UAAA,IAAI;AACH,YAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAGnC,YAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA;AAC1C,YAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA;AACtC,YAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAIrD,YAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,cAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,gBAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,cAC7B;AACA,cAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CACnB,yCACD,CAAA,EACC;AACD,gBAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,cACL;AAAA,YACD;AAEA,YAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,YAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,YAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,UACjC,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,kDAAA,EAAsD,EAAY,OAAO,CAAA;AAAA,aAC1E;AACA,YAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,aAAA;AAAc,eAC9C;AAAA,aACF;AAAA,UACD;AAAA,QACD,CAAC,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AAAA,MACpB;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,iBAAiB,MAAA,EAAiC;AACzD,IAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAmB;AAErC,MAAA,MAAM,IAAA,GAAO,KAAA;AACb,MAAA,IAAI,IAAA;AACH,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,yCAAA,EAA4C,KAAK,MAAM,CAAA,MAAA;AAAA,SACxD;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,cAAA,EAAgB,oBAAoB,CAAA;AACrE,IAAA,MAAA,CAAO,GAAA,EAAI;AAAA,EACZ;AAAA,EAEQ,iBAAA,CACP,QACA,OAAA,EACC;AACD,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,MAAA,CAAO,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACvD,IAAA,MAAA,CAAO,EAAA,CAAG,OAAO,YAAY;AAC5B,MAAA,IAAI;AACH,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,aAAa,OAAA,CAAQ,aAAA;AAC3B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACpD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AACrD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAGnC,QAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,QAAA,MAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAClC,QAAA,MAAM,UAAA,GAAa,QAAQ,sBAAsB,CAAA;AAIjD,QAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,UAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,YAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,UAC7B;AACA,UAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CAAM,yCAAyC,CAAA,EAClE;AACD,YAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,UACL;AAAA,QACD;AAEA,QAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QACpC,CAAA,aAAc,KAAA,EAAM;AAAA,MACrB,SAAS,EAAA,EAAI;AACZ,QAAA,MAAA,CAAO,OAAA,CAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,CAAA;AACjC,QAAA,MAAA,CAAO,GAAA,EAAI;AAAA,MACZ;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEA,MAAa,MAAA,CAAO,IAAA,EAAc,IAAA,GAAe,SAAA,EAA4B;AAC5E,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAG1B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,SAAA,EAAU;AACxC,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,QAAA,MAAM,IAAA,CAAK,QAAA,CAAS,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAChD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,uDAAA,EAAmD,KAAK,IAAI,CAAA;AAAA,SAC7D;AAAA,MACD;AAAA,IACD;AACA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAmC;AAC9D,QAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,8BAA8B,IAAI,CAAA,sCAAA;AAAA,WACnC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,QACzD;AACA,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,MAAM;AACvC,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,EAAQ;AACpC,QAAA,MAAM,aACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,OAAA,IAAW,IAAA;AACpD,QAAA,MAAM,eACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAEjD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,sEAAA,EAAoE,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SAC/F;AACA,QAAA,OAAA,CAAQ,YAAY,CAAA;AAAA,MACrB,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEO,SAAA,GAAqB;AAC3B,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA,EAEA,MAAa,KAAA,CAAM,SAAA,GAAY,GAAA,EAAqB;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,qDAAA,EAAwD,IAAA,CAAK,cAAc,CAAA,WAAA,EAAc,SAAS,CAAA,MAAA;AAAA,KACnG;AACA,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,OAAO,KAAK,cAAA,GAAiB,CAAA,IAAK,KAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,EAAW;AACjE,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,IACvD;AACA,IAAA,MAAM,KAAK,IAAA,EAAK;AAAA,EACjB;AAAA,EAEA,MAAa,IAAA,GAAO;AACnB,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AACvB,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AAAA,EACrB;AAAA,EAEO,SAAA,GAA2B;AACjC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACb;AACD","file":"chunk-UCJEK75U.js","sourcesContent":["/**\n * LIOP Protected Resource Metadata — RFC 9728\n *\n * Builds the JSON document served at /.well-known/oauth-protected-resource.\n * This enables MCP clients to discover the authorization server and\n * required scopes for accessing LIOP tools and resources.\n *\n * Standards: RFC 9728, MCP Spec 2025-11-25\n */\n\nimport { LIOP_SCOPES } from \"./rbac.js\";\n\n/**\n * RFC 9728 Protected Resource Metadata response.\n *\n * @see https://datatracker.ietf.org/doc/rfc9728\n */\nexport interface ProtectedResourceMetadata {\n\t/** Identifier for the protected resource. */\n\tresource: string;\n\t/** Array of authorization server issuer URLs that can issue tokens for this resource. */\n\tauthorization_servers: string[];\n\t/** OAuth scopes accepted by this resource. */\n\tscopes_supported: readonly string[];\n\t/** Methods of presenting the bearer token (always \"header\" for LIOP). */\n\tbearer_methods_supported: string[];\n\t/** URL to the resource documentation. */\n\tresource_documentation: string;\n}\n\n/**\n * Builds the Protected Resource Metadata document (RFC 9728).\n *\n * @param issuer - OIDC issuer URL of the Nexus authorization server\n * @param audience - JWT audience claim (resource identifier)\n */\nexport function buildProtectedResourceMetadata(\n\tissuer: string,\n\taudience: string,\n): ProtectedResourceMetadata {\n\treturn {\n\t\tresource: audience,\n\t\tauthorization_servers: [issuer],\n\t\tscopes_supported: LIOP_SCOPES,\n\t\tbearer_methods_supported: [\"header\"],\n\t\tresource_documentation: \"https://github.com/nekzus/liop\",\n\t};\n}\n","/**\n * LIOP gRPC-Web Protocol Adapter (HTTP/1.1 Fallback)\n *\n * Implements standard gRPC-Web framing per the official gRPC-Web specification:\n * https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-WEB.md\n *\n * Allows web browsers, corporate Layer 7 HTTP/1.1 proxies, and enterprise WAFs\n * to invoke LIOP nodes over HTTP/1.1 without requiring HTTP/2 streaming or h2c.\n *\n * Frame Format:\n * - 1 byte: Frame Flag (0x00 = Data Frame, 0x80 = Trailers Frame)\n * - 4 bytes: 32-bit Big-Endian Unsigned Integer (payload length in bytes)\n * - N bytes: Message or Trailer payload\n */\n\nimport type * as http from \"node:http\";\nimport { log } from \"../utils/logger.js\";\n\nexport const GRPC_WEB_CONSTANTS = {\n\tFLAG_DATA: 0x00,\n\tFLAG_TRAILERS: 0x80,\n\tHEADER_LENGTH: 5,\n\tCONTENT_TYPE_PREFIX: \"application/grpc-web\",\n\tSTATUS_OK: 0,\n\tSTATUS_CANCELLED: 1,\n\tSTATUS_UNKNOWN: 2,\n\tSTATUS_INVALID_ARGUMENT: 3,\n\tSTATUS_DEADLINE_EXCEEDED: 4,\n\tSTATUS_NOT_FOUND: 5,\n\tSTATUS_PERMISSION_DENIED: 7,\n\tSTATUS_UNAUTHENTICATED: 16,\n\tSTATUS_INTERNAL: 13,\n} as const;\n\nexport interface GrpcWebFrame {\n\tisTrailer: boolean;\n\tpayload: Buffer;\n}\n\n/**\n * Checks if an incoming HTTP request is a gRPC-Web request.\n */\nexport function isGrpcWebRequest(contentType?: string): boolean {\n\tif (!contentType) return false;\n\tconst lower = contentType.toLowerCase();\n\treturn (\n\t\tlower.startsWith(\"application/grpc-web\") ||\n\t\tlower.startsWith(\"application/grpc-web+proto\") ||\n\t\tlower.startsWith(\"application/grpc-web+json\")\n\t);\n}\n\n/**\n * Encodes a binary payload into a standard 5-byte framed gRPC-Web Data Frame.\n */\nexport function encodeDataFrame(payload: Buffer | Uint8Array): Buffer {\n\tconst buf = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_DATA, 0);\n\theader.writeUInt32BE(buf.length, 1);\n\treturn Buffer.concat([header, buf]);\n}\n\n/**\n * Encodes gRPC status and optional message into a 5-byte framed gRPC-Web Trailer Frame.\n */\nexport function encodeTrailerFrame(\n\tstatus: number = GRPC_WEB_CONSTANTS.STATUS_OK,\n\tmessage: string = \"\",\n\tcustomTrailers: Record<string, string> = {},\n): Buffer {\n\tconst lines = [\n\t\t`grpc-status:${status}`,\n\t\t`grpc-message:${encodeURIComponent(message)}`,\n\t];\n\n\tfor (const [key, value] of Object.entries(customTrailers)) {\n\t\tlines.push(`${key}:${value}`);\n\t}\n\n\tconst trailerText = `${lines.join(\"\\r\\n\")}\\r\\n`;\n\tconst trailerBuf = Buffer.from(trailerText, \"utf-8\");\n\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_TRAILERS, 0);\n\theader.writeUInt32BE(trailerBuf.length, 1);\n\n\treturn Buffer.concat([header, trailerBuf]);\n}\n\n/**\n * Parses raw gRPC-Web byte streams into an array of frames.\n */\nexport function decodeFrames(buffer: Buffer): GrpcWebFrame[] {\n\tconst frames: GrpcWebFrame[] = [];\n\tlet offset = 0;\n\n\twhile (offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH <= buffer.length) {\n\t\tconst flag = buffer.readUInt8(offset);\n\t\tconst length = buffer.readUInt32BE(offset + 1);\n\t\tconst payloadStart = offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH;\n\t\tconst payloadEnd = payloadStart + length;\n\n\t\tif (payloadEnd > buffer.length) {\n\t\t\tbreak; // Incomplete frame\n\t\t}\n\n\t\tconst payload = buffer.subarray(payloadStart, payloadEnd);\n\t\tframes.push({\n\t\t\tisTrailer:\n\t\t\t\t(flag & GRPC_WEB_CONSTANTS.FLAG_TRAILERS) ===\n\t\t\t\tGRPC_WEB_CONSTANTS.FLAG_TRAILERS,\n\t\t\tpayload: Buffer.from(payload),\n\t\t});\n\n\t\toffset = payloadEnd;\n\t}\n\n\treturn frames;\n}\n\n/**\n * Dispatches an HTTP/1.1 gRPC-Web request to an underlying protocol handler\n * and serializes data and trailer frames back to the client.\n */\nexport async function dispatchGrpcWebRequest(\n\treq: http.IncomingMessage,\n\tres: http.ServerResponse,\n\thandler: (\n\t\tpath: string,\n\t\tpayload: Buffer,\n\t) => Promise<{ status: number; message?: string; data?: Buffer }>,\n): Promise<void> {\n\tconst chunks: Buffer[] = [];\n\n\treq.on(\"data\", (chunk: Buffer) => {\n\t\tchunks.push(chunk);\n\t});\n\n\treq.on(\"end\", async () => {\n\t\ttry {\n\t\t\tconst fullBody = Buffer.concat(chunks);\n\t\t\tconst frames = decodeFrames(fullBody);\n\t\t\tconst dataPayload =\n\t\t\t\tframes.find((f) => !f.isTrailer)?.payload ?? Buffer.alloc(0);\n\t\t\tconst requestPath = req.url || \"/\";\n\n\t\t\tlog.info(\n\t\t\t\t`[gRPC-Web] Handling request for ${requestPath} (${dataPayload.length} bytes)`,\n\t\t\t);\n\n\t\t\tconst result = await handler(requestPath, dataPayload);\n\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.setHeader(\"access-control-allow-origin\", \"*\");\n\t\t\tres.setHeader(\n\t\t\t\t\"access-control-expose-headers\",\n\t\t\t\t\"grpc-status, grpc-message, content-type\",\n\t\t\t);\n\n\t\t\t// Write Data Frame (if response payload exists)\n\t\t\tif (result.data && result.data.length > 0) {\n\t\t\t\tres.write(encodeDataFrame(result.data));\n\t\t\t}\n\n\t\t\t// Write Trailer Frame (status and message)\n\t\t\tres.write(encodeTrailerFrame(result.status, result.message || \"\"));\n\t\t\tres.end();\n\t\t} catch (error) {\n\t\t\tlog.error(`[gRPC-Web] Dispatch error: ${error}`);\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.write(\n\t\t\t\tencodeTrailerFrame(\n\t\t\t\t\tGRPC_WEB_CONSTANTS.STATUS_INTERNAL,\n\t\t\t\t\t(error as Error).message || \"Internal server error\",\n\t\t\t\t),\n\t\t\t);\n\t\t\tres.end();\n\t\t}\n\t});\n}\n","/**\n * LIOP Sliding-Window Rate Limiter\n *\n * High-performance, zero-dependency in-memory rate limiter designed\n * to protect the LIOP Hybrid Gateway and Mesh Nodes against Denial of Service (DoS),\n * worker pool exhaustion, and brute-force attacks.\n *\n * Conforms to OWASP API Security Top 10 (API4:2023 - Unrestricted Resource Consumption).\n */\n\nexport interface RateLimiterOptions {\n\t/** Window duration in milliseconds (default: 60,000ms = 1 minute) */\n\twindowMs?: number;\n\t/** Maximum number of allowed requests per window (default: 120) */\n\tmaxRequests?: number;\n}\n\nexport interface RateLimitStatus {\n\tallowed: boolean;\n\tremaining: number;\n\tlimit: number;\n\tresetMs: number;\n}\n\ninterface WindowRecord {\n\tcount: number;\n\tresetTime: number;\n}\n\nexport class InMemoryRateLimiter {\n\tprivate readonly windowMs: number;\n\tprivate readonly maxRequests: number;\n\tprivate readonly records: Map<string, WindowRecord> = new Map();\n\tprivate cleanupTimer?: NodeJS.Timeout;\n\n\tconstructor(options: RateLimiterOptions = {}) {\n\t\tthis.windowMs = options.windowMs ?? 60_000;\n\t\tthis.maxRequests = options.maxRequests ?? 120;\n\n\t\t// Clean up expired buckets periodically (every 30s)\n\t\tthis.cleanupTimer = setInterval(() => this.cleanup(), 30_000);\n\t\tif (typeof this.cleanupTimer.unref === \"function\") {\n\t\t\tthis.cleanupTimer.unref();\n\t\t}\n\t}\n\n\t/**\n\t * Evaluates whether a request from the given key (IP, token, or clientId) is permitted.\n\t *\n\t * @param key Identifier for the client (e.g., remote IP or OAuth client ID)\n\t * @returns Status containing allowed boolean, remaining quota, and time until reset\n\t */\n\tpublic check(key: string): RateLimitStatus {\n\t\tconst now = Date.now();\n\t\tlet record = this.records.get(key);\n\n\t\tif (!record || now >= record.resetTime) {\n\t\t\trecord = {\n\t\t\t\tcount: 1,\n\t\t\t\tresetTime: now + this.windowMs,\n\t\t\t};\n\t\t\tthis.records.set(key, record);\n\t\t\treturn {\n\t\t\t\tallowed: true,\n\t\t\t\tremaining: this.maxRequests - 1,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: this.windowMs,\n\t\t\t};\n\t\t}\n\n\t\tif (record.count >= this.maxRequests) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\tremaining: 0,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t\t};\n\t\t}\n\n\t\trecord.count++;\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\tremaining: this.maxRequests - record.count,\n\t\t\tlimit: this.maxRequests,\n\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t};\n\t}\n\n\t/**\n\t * Explicitly resets the rate limit bucket for a given key.\n\t */\n\tpublic reset(key: string): void {\n\t\tthis.records.delete(key);\n\t}\n\n\t/**\n\t * Cleans up expired rate-limiting buckets to prevent memory leaks.\n\t */\n\tpublic cleanup(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [key, record] of this.records.entries()) {\n\t\t\tif (now >= record.resetTime) {\n\t\t\t\tthis.records.delete(key);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Destroys internal timers and clears records.\n\t */\n\tpublic close(): void {\n\t\tif (this.cleanupTimer) {\n\t\t\tclearInterval(this.cleanupTimer);\n\t\t\tthis.cleanupTimer = undefined;\n\t\t}\n\t\tthis.records.clear();\n\t}\n}\n","import * as http from \"node:http\";\nimport * as http2 from \"node:http2\";\nimport * as net from \"node:net\";\nimport type { MeshNode } from \"../mesh/index.js\";\nimport {\n\tmanifestCacheSize,\n\tmeshPeersConnected,\n\tprotocolMetrics,\n} from \"../observability/metrics.js\";\nimport type { AuthInfo, JwtValidator } from \"../security/jwt-validator.js\";\nimport { buildProtectedResourceMetadata } from \"../security/prm.js\";\nimport type { LiopServer } from \"../server/index.js\";\nimport { log } from \"../utils/logger.js\";\nimport {\n\tdispatchGrpcWebRequest,\n\tGRPC_WEB_CONSTANTS,\n\tisGrpcWebRequest,\n} from \"./grpc-web.js\";\nimport {\n\tInMemoryRateLimiter,\n\ttype RateLimiterOptions,\n} from \"./rate-limiter.js\";\nimport { LiopMcpRouter } from \"./router.js\";\n\n/**\n * LIOP Hybrid Gateway\n * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.\n */\nexport class LiopHybridGateway {\n\tprivate netServer: net.Server;\n\tprivate h2Server: http2.Http2Server;\n\tprivate h1Server: http.Server;\n\tprivate router: LiopMcpRouter;\n\tprivate jwtValidator?: JwtValidator;\n\t// biome-ignore lint/suspicious/noExplicitAny: oidc-provider is loaded in Phase C\n\tprivate oauthProvider?: any;\n\tprivate rateLimiter: InMemoryRateLimiter;\n\tprivate isDraining = false;\n\tprivate activeRequests = 0;\n\n\tconstructor(\n\t\tprivate liopServer: LiopServer,\n\t\tprivate meshNode: MeshNode | null = null,\n\t\trpcPort: number = 50051,\n\t\trateLimiterOptions?: RateLimiterOptions,\n\t) {\n\t\tthis.jwtValidator = this.liopServer.jwtValidator;\n\t\tthis.oauthProvider = this.liopServer.oauthProvider;\n\t\tthis.rateLimiter = new InMemoryRateLimiter(rateLimiterOptions);\n\n\t\t// Initialize the Universal Router\n\t\tthis.router = new LiopMcpRouter(this.liopServer, this.meshNode, rpcPort);\n\n\t\t// Internal HTTP/2 Server (for Native gRPC Proxying)\n\t\tthis.h2Server = http2.createServer();\n\t\tthis.setupH2Routes();\n\n\t\t// Internal HTTP/1 Server (for Browser/MCP)\n\t\tthis.h1Server = http.createServer();\n\t\tthis.setupH1Routes();\n\n\t\t// Primary Multiplexer (L4)\n\t\tthis.netServer = net.createServer((socket) => {\n\t\t\tsocket.once(\"data\", (buffer) => {\n\t\t\t\tconst isHttp2 = buffer.toString().startsWith(\"PRI * HTTP/2.0\");\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Incoming L4 Connection. Protocol: ${isHttp2 ? \"HTTP/2 (gRPC)\" : \"HTTP/1.1 (MCP)\"}`,\n\t\t\t\t);\n\t\t\t\tif (isHttp2) {\n\t\t\t\t\tthis.h2Server.emit(\"connection\", socket);\n\t\t\t\t} else {\n\t\t\t\t\tthis.h1Server.emit(\"connection\", socket);\n\t\t\t\t}\n\t\t\t\tsocket.unshift(buffer);\n\t\t\t});\n\t\t\tsocket.on(\"error\", (err) =>\n\t\t\t\tlog.error(`[LIOP-Gateway] NetServer Socket Error: ${err.message}`),\n\t\t\t);\n\t\t});\n\n\t\t// Attach error listeners to sub-servers to catch silent failures\n\t\tthis.h1Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H1 Server Error: ${err.message}`),\n\t\t);\n\t\tthis.h2Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H2 Server Error: ${err.message}`),\n\t\t);\n\n\t\tlog.info(\"[LIOP-Gateway] Hybrid adapter initialized.\");\n\t}\n\n\tprivate setupH2Routes() {\n\t\tthis.h2Server.on(\"stream\", (stream, headers) => {\n\t\t\tconst contentType = headers[\"content-type\"] as string;\n\t\t\tconst path = headers[\":path\"] as string;\n\n\t\t\tif (contentType === \"application/grpc\") {\n\t\t\t\tthis.handleGrpcStream(stream as http2.ServerHttp2Stream);\n\t\t\t} else if (path === \"/mcp\") {\n\t\t\t\tthis.handleMcpH2Stream(stream as http2.ServerHttp2Stream, headers);\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate setupH1Routes() {\n\t\tthis.h1Server.on(\"request\", async (req, res) => {\n\t\t\tthis.activeRequests += 1;\n\t\t\tconst onDone = () => {\n\t\t\t\tres.removeListener(\"finish\", onDone);\n\t\t\t\tres.removeListener(\"close\", onDone);\n\t\t\t\tthis.activeRequests = Math.max(0, this.activeRequests - 1);\n\t\t\t};\n\t\t\tres.on(\"finish\", onDone);\n\t\t\tres.on(\"close\", onDone);\n\n\t\t\tconst url = req.url || \"\";\n\t\t\tconst method = req.method;\n\n\t\t\t// [Phase Beta-3] Prometheus Metrics Endpoint\n\t\t\tif (method === \"GET\" && url === \"/metrics\") {\n\t\t\t\tif (this.meshNode) {\n\t\t\t\t\tmeshPeersConnected.set({}, this.meshNode.getPeers().length);\n\t\t\t\t}\n\t\t\t\tif (this.router) {\n\t\t\t\t\tmanifestCacheSize.set({}, this.router.getManifestCacheSize());\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, {\n\t\t\t\t\t\"Content-Type\": \"text/plain; version=0.0.4; charset=utf-8\",\n\t\t\t\t});\n\t\t\t\tres.end(protocolMetrics.exportPrometheusText());\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Liveness Probe\n\t\t\tif (method === \"GET\" && url === \"/healthz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ok\",\n\t\t\t\t\t\tuptime: Math.floor(process.uptime()),\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Readiness Probe\n\t\t\tif (method === \"GET\" && url === \"/readyz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst meshStarted = this.meshNode ? this.meshNode.isStarted() : true;\n\t\t\t\tif (!meshStarted) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"unready\",\n\t\t\t\t\t\t\tmeshStarted: false,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ready\",\n\t\t\t\t\t\tmeshStarted: true,\n\t\t\t\t\t\tpeers: this.meshNode ? this.meshNode.getPeers().length : 0,\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Reject new MCP requests if draining\n\t\t\tif (this.isDraining && url === \"/mcp\") {\n\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tcode: -32000,\n\t\t\t\t\t\t\tmessage: \"Gateway is draining connections for shutdown\",\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-2] gRPC-Web HTTP/1.1 Framing Fallback\n\t\t\tconst contentType = req.headers[\"content-type\"];\n\t\t\tif (isGrpcWebRequest(contentType)) {\n\t\t\t\tawait dispatchGrpcWebRequest(req, res, async (reqPath, payload) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] gRPC-Web fallback call: ${reqPath} (${payload.length} bytes)`,\n\t\t\t\t\t);\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: GRPC_WEB_CONSTANTS.STATUS_OK,\n\t\t\t\t\t\tmessage: \"OK\",\n\t\t\t\t\t\tdata: Buffer.from(\"\"),\n\t\t\t\t\t};\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [SEC] M2M OAuth 2.1 OIDC Authorization Server Router (Phase C proxy)\n\t\t\tif (url.startsWith(\"/oidc\") && this.oauthProvider) {\n\t\t\t\tconst callback =\n\t\t\t\t\ttypeof this.oauthProvider.callback === \"function\"\n\t\t\t\t\t\t? this.oauthProvider.callback()\n\t\t\t\t\t\t: this.oauthProvider;\n\t\t\t\t// Rewrite req.url to strip the '/oidc' prefix before delegating to oidc-provider\n\t\t\t\tconst originalUrl = req.url;\n\t\t\t\treq.url = (originalUrl || \"\").slice(5) || \"/\";\n\t\t\t\ttry {\n\t\t\t\t\treturn callback(req, res);\n\t\t\t\t} finally {\n\t\t\t\t\treq.url = originalUrl;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// [SEC] RFC 9728 Protected Resource Metadata (PRM) Endpoint\n\t\t\tif (method === \"GET\" && url === \"/.well-known/oauth-protected-resource\") {\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst prm = buildProtectedResourceMetadata(\n\t\t\t\t\t\tthis.jwtValidator.getIssuer(),\n\t\t\t\t\t\tthis.jwtValidator.getAudience(),\n\t\t\t\t\t);\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(JSON.stringify(prm));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\tmethod === \"GET\" &&\n\t\t\t\t(url === \"/\" || url === \"/mcp\" || url === \"/health\")\n\t\t\t) {\n\t\t\t\tif (\n\t\t\t\t\turl === \"/health\" &&\n\t\t\t\t\treq.headers.accept?.includes(\"application/json\")\n\t\t\t\t) {\n\t\t\t\t\tconst meshInfo = this.meshNode\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\tpeerId: this.meshNode.getPeerId()?.toString() || \"\",\n\t\t\t\t\t\t\t\tmultiaddrs: this.meshNode\n\t\t\t\t\t\t\t\t\t.getMultiaddrs()\n\t\t\t\t\t\t\t\t\t.map((m) => m.toString()),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: null;\n\t\t\t\t\tconst issuer = this.jwtValidator?.getIssuer();\n\t\t\t\t\tconst baseUrl = issuer\n\t\t\t\t\t\t? issuer.endsWith(\"/oidc\")\n\t\t\t\t\t\t\t? issuer\n\t\t\t\t\t\t\t: `${issuer}/oidc`\n\t\t\t\t\t\t: \"\";\n\t\t\t\t\tconst authInfoResponse =\n\t\t\t\t\t\tthis.jwtValidator && issuer\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tissuer,\n\t\t\t\t\t\t\t\t\tjwks_uri: `${baseUrl}/jwks`,\n\t\t\t\t\t\t\t\t\t...(this.oauthProvider\n\t\t\t\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\t\t\t\ttoken_endpoint: `${baseUrl}/token`,\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: undefined;\n\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"healthy\",\n\t\t\t\t\t\t\tnode: this.liopServer.getServerInfo(),\n\t\t\t\t\t\t\tmesh: meshInfo,\n\t\t\t\t\t\t\ttools: this.liopServer.listTools().map((t) => t.name),\n\t\t\t\t\t\t\tauth: authInfoResponse,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(`\n                    <body style=\"background:#0f172a;color:#f8fafc;font-family:sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;margin:0\">\n                        <div style=\"background:#1e293b;padding:40px;border-radius:16px;border:1px solid #38bdf8;text-align:center;box-shadow:0 20px 25px -5px rgba(0,0,0,0.1)\">\n                            <h1 style=\"color:#38bdf8;margin-top:0\">LIOP Protocol Transformer</h1>\n                            <p style=\"opacity:0.8;font-weight:600\">L4/L7 Transcoding: JSON-RPC &harr; gRPC</p>\n                            <p style=\"opacity:0.6;font-size:14px\">Active Protections: Kyber768 + AES-256-GCM + ZK-Proof Ready</p>\n                            <div style=\"background:#0f172a;padding:15px;border-radius:8px;margin-top:20px;border:1px dashed #334155\">\n                                <code style=\"color:#10b981\">Endpoint: http://localhost:3000/mcp</code>\n                            </div>\n                        </div>\n                    </body>\n                `);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (url === \"/mcp\" && method === \"POST\") {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = req.headers.authorization;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tlet body = \"\";\n\t\t\t\treq.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\t\t\treq.on(\"end\", async () => {\n\t\t\t\t\t// [SEC] Rate limiting per IP or authenticated client (OWASP API4:2023)\n\t\t\t\t\tconst clientIp = req.socket.remoteAddress || \"127.0.0.1\";\n\t\t\t\t\tconst rateLimitKey = authInfo?.clientId\n\t\t\t\t\t\t? `client:${authInfo.clientId}`\n\t\t\t\t\t\t: `ip:${clientIp}`;\n\t\t\t\t\tconst rateStatus = this.rateLimiter.check(rateLimitKey);\n\t\t\t\t\tif (!rateStatus.allowed) {\n\t\t\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t\t\"Retry-After\": Math.ceil(rateStatus.resetMs / 1000).toString(),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\tid: null,\n\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\tcode: -32029,\n\t\t\t\t\t\t\t\t\tmessage: \"Rate limit exceeded. Too many requests.\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t\t\t// [SEP-2243] Header-based routing validation\n\t\t\t\t\t\tconst mcpMethod = req.headers[\"mcp-method\"] as string | undefined;\n\t\t\t\t\t\tconst mcpName = req.headers[\"mcp-name\"] as string | undefined;\n\t\t\t\t\t\tconst mcpVersion = req.headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t\t\t| string\n\t\t\t\t\t\t\t| undefined;\n\n\t\t\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\tmcpName &&\n\t\t\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\t!jsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\tres.end(JSON.stringify(response));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Gateway] Error processing JSON-RPC payload: ${(e as Error).message}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tres.writeHead(400);\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\terror: { code: -32700, message: \"Parse error\" },\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate handleGrpcStream(stream: http2.ServerHttp2Stream) {\n\t\tstream.on(\"data\", (chunk: unknown) => {\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Standard gRPC stream data is Buffer\n\t\t\tconst data = chunk as any;\n\t\t\tif (data)\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Native gRPC Proxy passing ${data.length} bytes`,\n\t\t\t\t);\n\t\t});\n\t\tstream.respond({ \":status\": 200, \"content-type\": \"application/grpc\" });\n\t\tstream.end();\n\t}\n\n\tprivate handleMcpH2Stream(\n\t\tstream: http2.ServerHttp2Stream,\n\t\theaders: http2.IncomingHttpHeaders,\n\t) {\n\t\tlet body = \"\";\n\t\tstream.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\tstream.on(\"end\", async () => {\n\t\t\ttry {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token over HTTP/2 (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = headers.authorization as string;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t// [SEP-2243] Header-based routing validation in HTTP/2\n\t\t\t\tconst mcpMethod = headers[\"mcp-method\"] as string | undefined;\n\t\t\t\tconst mcpName = headers[\"mcp-name\"] as string | undefined;\n\t\t\t\tconst mcpVersion = headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t| string\n\t\t\t\t\t| undefined;\n\n\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (\n\t\t\t\t\tmcpName &&\n\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t}\n\t\t\t\t\tif (\n\t\t\t\t\t\t!jsonRequest.params._meta[\"io.modelcontextprotocol/protocolVersion\"]\n\t\t\t\t\t) {\n\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\tif (response) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 200,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(JSON.stringify(response));\n\t\t\t\t} else stream.close();\n\t\t\t} catch (_e) {\n\t\t\t\tstream.respond({ \":status\": 400 });\n\t\t\t\tstream.end();\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic async listen(port: number, host: string = \"0.0.0.0\"): Promise<number> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.start();\n\n\t\t\t// Announce all local tools to the DHT\n\t\t\tconst tools = this.liopServer.listTools();\n\t\t\tfor (const tool of tools) {\n\t\t\t\tawait this.meshNode.announceCapability(tool.name);\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] 📡 Announced local tool to Mesh: ${tool.name}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tthis.netServer.on(\"error\", (err: Error & { code?: string }) => {\n\t\t\t\tif (err.code === \"EADDRINUSE\") {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] FATAL: Port ${port} is already in use by another process.`,\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\tlog.error(`[LIOP-Gateway] Binding Error: ${err.message}`);\n\t\t\t\t}\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tthis.netServer.listen(port, host, () => {\n\t\t\t\tconst addr = this.netServer.address();\n\t\t\t\tconst actualHost =\n\t\t\t\t\ttypeof addr === \"string\" ? addr : addr?.address || host;\n\t\t\t\tconst assignedPort =\n\t\t\t\t\ttypeof addr === \"string\" ? port : addr?.port || port;\n\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] ✅ Transformer Mesh Gateway READY and listening on ${actualHost}:${assignedPort}`,\n\t\t\t\t);\n\t\t\t\tresolve(assignedPort);\n\t\t\t});\n\t\t});\n\t}\n\n\tpublic isDrained(): boolean {\n\t\treturn this.isDraining;\n\t}\n\n\tpublic async drain(timeoutMs = 5000): Promise<void> {\n\t\tthis.isDraining = true;\n\t\tlog.info(\n\t\t\t`[LIOP-Gateway] Draining gateway connections (active: ${this.activeRequests}, timeout: ${timeoutMs}ms)...`,\n\t\t);\n\t\tconst start = Date.now();\n\t\twhile (this.activeRequests > 0 && Date.now() - start < timeoutMs) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, 50));\n\t\t}\n\t\tawait this.stop();\n\t}\n\n\tpublic async stop() {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t\tthis.rateLimiter.close();\n\t\tthis.netServer.close();\n\t\tthis.h2Server.close();\n\t\tthis.h1Server.close();\n\t}\n\n\tpublic getRouter(): LiopMcpRouter {\n\t\treturn this.router;\n\t}\n}\n"]}

package/dist/chunk-WSW6YJNY.js

@@ -0,0 +1,168 @@
+import { log } from './chunk-72MNYFR6.js';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import * as grpc2 from '@grpc/grpc-js';
+import * as protoLoader from '@grpc/proto-loader';
+import * as fs2 from 'fs';
+
+// src/rpc/channel-options.ts
+var GRPC_CHANNEL_OPTIONS = {
+  "grpc.keepalive_time_ms": 3e4,
+  "grpc.keepalive_timeout_ms": 1e4,
+  "grpc.keepalive_permit_without_calls": 1,
+  "grpc.max_send_message_length": -1,
+  "grpc.max_receive_message_length": -1,
+  "grpc.enable_retries": 1
+};
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = path.dirname(__filename2);
+var PROD_PATHS = [
+  path.resolve(__dirname2, "./protocol/liop_core.proto"),
+  // Flat dist/ (tsup)
+  path.resolve(__dirname2, "../protocol/liop_core.proto")
+  // dist/rpc/ (tsc)
+];
+var DEV_PROTO_PATH = path.resolve(
+  __dirname2,
+  "../../../../protocol/proto/liop_core.proto"
+);
+var PROTO_PATH = PROD_PATHS.find((p) => fs2.existsSync(p)) || DEV_PROTO_PATH;
+if (!fs2.existsSync(PROTO_PATH)) {
+  log.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);
+}
+var packageDefinition = protoLoader.loadSync(PROTO_PATH, {
+  keepCase: true,
+  longs: String,
+  enums: String,
+  defaults: true,
+  oneofs: true
+});
+var liopProto = grpc2.loadPackageDefinition(packageDefinition);
+var liopV1 = liopProto.liop.v1;
+var isTlsEnforced = () => process.env.NODE_ENV === "production" || process.env.LIOP_ENFORCE_TLS === "true";
+function createServerCredentials(tls) {
+  if (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {
+    throw new Error(
+      "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
+    );
+  }
+  if (tls?.certManager) {
+    try {
+      const certChain = tls.certManager.getCertChain();
+      const privateKey = tls.certManager.getPrivateKey();
+      const rootCert = tls.certManager.getRootCert();
+      if (tls.mutualTls && !rootCert) {
+        throw new Error(
+          "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded."
+        );
+      }
+      return grpc2.ServerCredentials.createSsl(
+        rootCert,
+        [{ cert_chain: certChain, private_key: privateKey }],
+        Boolean(tls.mutualTls)
+      );
+    } catch (error) {
+      if (isTlsEnforced()) {
+        throw new Error(
+          `[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`
+        );
+      }
+      log.warn(
+        `[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`
+      );
+      return grpc2.ServerCredentials.createInsecure();
+    }
+  }
+  if (!tls?.certChain || !tls?.privateKey) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true."
+      );
+    }
+    log.warn(
+      "[LIOP-TLS] No TLS certificates configured \u2014 using insecure server credentials"
+    );
+    return grpc2.ServerCredentials.createInsecure();
+  }
+  try {
+    const rootCert = tls.rootCert ? fs2.readFileSync(tls.rootCert) : null;
+    const certChain = fs2.readFileSync(tls.certChain);
+    const privateKey = fs2.readFileSync(tls.privateKey);
+    if (tls.mutualTls && !rootCert) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates."
+      );
+    }
+    return grpc2.ServerCredentials.createSsl(
+      rootCert,
+      [{ cert_chain: certChain, private_key: privateKey }],
+      Boolean(tls.mutualTls)
+    );
+  } catch (error) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc2.ServerCredentials.createInsecure();
+  }
+}
+function createChannelCredentials(tls) {
+  if (tls?.certManager) {
+    try {
+      const rootCert = tls.certManager.getRootCert();
+      if (!rootCert) {
+        throw new Error(
+          "[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager."
+        );
+      }
+      const certChain = tls.certManager.getCertChain();
+      const privateKey = tls.certManager.getPrivateKey();
+      return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
+    } catch (error) {
+      if (isTlsEnforced()) {
+        throw new Error(
+          `[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`
+        );
+      }
+      log.warn(
+        `[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`
+      );
+      return grpc2.credentials.createInsecure();
+    }
+  }
+  if (!tls?.rootCert) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        "[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true."
+      );
+    }
+    log.warn(
+      "[LIOP-TLS] No TLS root certificate configured \u2014 using insecure channel credentials"
+    );
+    return grpc2.credentials.createInsecure();
+  }
+  try {
+    const rootCert = fs2.readFileSync(tls.rootCert);
+    const certChain = tls.certChain ? fs2.readFileSync(tls.certChain) : void 0;
+    const privateKey = tls.privateKey ? fs2.readFileSync(tls.privateKey) : void 0;
+    return grpc2.credentials.createSsl(rootCert, privateKey, certChain);
+  } catch (error) {
+    if (isTlsEnforced()) {
+      throw new Error(
+        `[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`
+      );
+    }
+    log.warn(
+      `[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`
+    );
+    return grpc2.credentials.createInsecure();
+  }
+}
+
+export { GRPC_CHANNEL_OPTIONS, createChannelCredentials, createServerCredentials, liopV1 };
+//# sourceMappingURL=chunk-WSW6YJNY.js.map
+//# sourceMappingURL=chunk-WSW6YJNY.js.map

package/dist/chunk-WSW6YJNY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/channel-options.ts","../src/rpc/proto.ts","../src/rpc/tls.ts"],"names":["__filename","__dirname","fs","grpc"],"mappings":";;;;;;;;AAOO,IAAM,oBAAA,GAAkE;AAAA,EAC9E,wBAAA,EAA0B,GAAA;AAAA,EAC1B,2BAAA,EAA6B,GAAA;AAAA,EAC7B,qCAAA,EAAuC,CAAA;AAAA,EACvC,8BAAA,EAAgC,EAAA;AAAA,EAChC,iCAAA,EAAmC,EAAA;AAAA,EACnC,qBAAA,EAAuB;AACxB;ACTA,IAAMA,WAAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,UAAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,WAAU,CAAA;AAMzC,IAAM,UAAA,GAAa;AAAA,EAClB,IAAA,CAAK,OAAA,CAAQC,UAAAA,EAAW,4BAA4B,CAAA;AAAA;AAAA,EACpD,IAAA,CAAK,OAAA,CAAQA,UAAAA,EAAW,6BAA6B;AAAA;AACtD,CAAA;AAEA,IAAM,iBAAiB,IAAA,CAAK,OAAA;AAAA,EAC3BA,UAAAA;AAAA,EACA;AACD,CAAA;AAGA,IAAM,UAAA,GAAa,WAAW,IAAA,CAAK,CAAC,MAASC,GAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAA,IAAK,cAAA;AAE/D,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,UAAU,CAAA,EAAG;AAC/B,EAAA,GAAA,CAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AACzE;AAMA,IAAM,iBAAA,GAAgC,qBAAS,UAAA,EAAY;AAAA,EAC1D,QAAA,EAAU,IAAA;AAAA,EACV,KAAA,EAAO,MAAA;AAAA,EACP,KAAA,EAAO,MAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACT,CAAC,CAAA;AAGM,IAAM,SAAA,GAAiBC,4BAAsB,iBAAiB,CAAA;AAC9D,IAAM,MAAA,GAAS,UAAU,IAAA,CAAK;ACRrC,IAAM,aAAA,GAAgB,MACrB,OAAA,CAAQ,GAAA,CAAI,aAAa,YAAA,IACzB,OAAA,CAAQ,IAAI,gBAAA,KAAqB,MAAA;AAO3B,SAAS,wBACf,GAAA,EACyB;AAEzB,EAAA,IAAI,GAAA,EAAK,aAAa,CAAC,GAAA,CAAI,YAAY,CAAC,GAAA,CAAI,WAAA,EAAa,WAAA,EAAY,EAAG;AACvE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAGA,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAE7C,MAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,OAAY,KAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,QAC7B,QAAA;AAAA,QACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,QACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,OACtB;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,qFAAqF,KAAK,CAAA;AAAA,SAC3F;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4DAA4D,KAAK,CAAA;AAAA,OAClE;AACA,MAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,GAAA,EAAK,SAAA,IAAa,CAAC,KAAK,UAAA,EAAY;AACxC,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH;AAAA,KACD;AACA,IAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,EAC9C;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,WAAW,GAAA,CAAI,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA,GAAI,IAAA;AAChE,IAAA,MAAM,SAAA,GAAe,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA;AAC/C,IAAA,MAAM,UAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA;AAEjD,IAAA,IAAI,GAAA,CAAI,SAAA,IAAa,CAAC,QAAA,EAAU;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,OAAY,KAAA,CAAA,iBAAA,CAAkB,SAAA;AAAA,MAC7B,QAAA;AAAA,MACA,CAAC,EAAE,UAAA,EAAY,SAAA,EAAW,WAAA,EAAa,YAAY,CAAA;AAAA,MACnD,OAAA,CAAQ,IAAI,SAAS;AAAA,KACtB;AAAA,EACD,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,iJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,sFAAsF,KAAK,CAAA;AAAA,KAC5F;AACA,IAAA,OAAY,wBAAkB,cAAA,EAAe;AAAA,EAC9C;AACD;AAMO,SAAS,yBACf,GAAA,EAC0B;AAE1B,EAAA,IAAI,KAAK,WAAA,EAAa;AACrB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,GAAA,CAAI,WAAA,CAAY,WAAA,EAAY;AAC7C,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,IAAI,KAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,WAAA,CAAY,YAAA,EAAa;AAC/C,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,WAAA,CAAY,aAAA,EAAc;AACjD,MAAA,OAAY,KAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AACf,MAAA,IAAI,eAAc,EAAG;AACpB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,0EAA0E,KAAK,CAAA;AAAA,SAChF;AAAA,MACD;AACA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oEAAoE,KAAK,CAAA;AAAA,OAC1E;AACA,MAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,IACxC;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH;AAAA,KACD;AACA,IAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,EACxC;AAEA,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AAC7C,IAAA,MAAM,YAAY,GAAA,CAAI,SAAA,GAChB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,SAAS,CAAA,GAC7B,KAAA,CAAA;AACH,IAAA,MAAM,aAAa,GAAA,CAAI,UAAA,GACjB,GAAA,CAAA,YAAA,CAAa,GAAA,CAAI,UAAU,CAAA,GAC9B,KAAA,CAAA;AAEH,IAAA,OAAY,KAAA,CAAA,WAAA,CAAY,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,SAAS,CAAA;AAAA,EAClE,SAAS,KAAA,EAAO;AACf,IAAA,IAAI,eAAc,EAAG;AACpB,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,kJAC8D,KAAK,CAAA;AAAA,OACpE;AAAA,IACD;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,uFAAuF,KAAK,CAAA;AAAA,KAC7F;AACA,IAAA,OAAY,kBAAY,cAAA,EAAe;AAAA,EACxC;AACD","file":"chunk-WSW6YJNY.js","sourcesContent":["/**\n * LIOP Production-Grade gRPC Channel Options\n *\n * Enforces bidirectional symmetry between LiopRpcServer, LiopRpcClient,\n * and gateway proxy channels per NIST SP 800-207 continuous verification.\n * Prevents silent disconnections behind corporate stateful firewalls and NAT gateways.\n */\nexport const GRPC_CHANNEL_OPTIONS: Readonly<Record<string, string | number>> = {\n\t\"grpc.keepalive_time_ms\": 30_000,\n\t\"grpc.keepalive_timeout_ms\": 10_000,\n\t\"grpc.keepalive_permit_without_calls\": 1,\n\t\"grpc.max_send_message_length\": -1,\n\t\"grpc.max_receive_message_length\": -1,\n\t\"grpc.enable_retries\": 1,\n};\n","import path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport * as protoLoader from \"@grpc/proto-loader\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\n// Selection logic: support both flat dist/ and original src/ structure\nconst PROD_PATHS = [\n\tpath.resolve(__dirname, \"./protocol/liop_core.proto\"), // Flat dist/ (tsup)\n\tpath.resolve(__dirname, \"../protocol/liop_core.proto\"), // dist/rpc/ (tsc)\n];\n\nconst DEV_PROTO_PATH = path.resolve(\n\t__dirname,\n\t\"../../../../protocol/proto/liop_core.proto\",\n);\n\n// Selection logic\nconst PROTO_PATH = PROD_PATHS.find((p) => fs.existsSync(p)) || DEV_PROTO_PATH;\n\nif (!fs.existsSync(PROTO_PATH)) {\n\tlog.error(`[LIOP-Proto] CRITICAL: Proto file not found at ${PROTO_PATH}`);\n}\n\n/**\n * LIOP Proto Loader\n * Loads the core gRPC definitions for the Logic-Injection-on-Origin Protocol.\n */\nconst packageDefinition = protoLoader.loadSync(PROTO_PATH, {\n\tkeepCase: true,\n\tlongs: String,\n\tenums: String,\n\tdefaults: true,\n\toneofs: true,\n});\n\n// biome-ignore lint/suspicious/noExplicitAny: gRPC dynamic loading requires any for the service definition map\nexport const liopProto = grpc.loadPackageDefinition(packageDefinition) as any;\nexport const liopV1 = liopProto.liop.v1;\n","/**\n * LIOP TLS Configuration\n *\n * Provides conditional TLS credential factories for gRPC connections.\n * When TLS options are provided, connections are secured with mutual TLS.\n * Otherwise, falls back to insecure credentials (alpha/development mode).\n *\n * Production Hardening (Phase 128):\n * - When NODE_ENV=production and TLS is configured but certificate loading\n *   fails, the system throws a fatal error instead of silently degrading\n *   to insecure credentials. This prevents MITM/eavesdropping attacks\n *   caused by misconfigured certificate paths going unnoticed.\n * - Reference: gRPC-node official docs — \"Using insecure credentials in\n *   production poses significant security risks including eavesdropping,\n *   MITM attacks, and lack of authentication.\"\n */\n\nimport * as fs from \"node:fs\";\nimport * as grpc from \"@grpc/grpc-js\";\nimport type { CertManager } from \"../security/cert-manager.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopTlsOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCert?: string;\n\t/** Path to the server/client certificate (PEM format) */\n\tcertChain?: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKey?: string;\n\t/** Require mutual TLS (mTLS): verify client certificate against root CA */\n\tmutualTls?: boolean;\n\t/** Optional CertManager instance for automated certificate management and hot reloading */\n\tcertManager?: CertManager;\n}\n\nconst isTlsEnforced = () =>\n\tprocess.env.NODE_ENV === \"production\" ||\n\tprocess.env.LIOP_ENFORCE_TLS === \"true\";\n\n/**\n * Creates gRPC server credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n * When mutualTls=true, enforces client certificate authentication against root CA.\n */\nexport function createServerCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ServerCredentials {\n\t// Mutual TLS requires a root CA certificate to authenticate clients\n\tif (tls?.mutualTls && !tls.rootCert && !tls.certManager?.getRootCert()) {\n\t\tthrow new Error(\n\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t);\n\t}\n\n\t// If CertManager is provided, use its in-memory cached buffers\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\n\t\t\tif (tls.mutualTls && !rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but CertManager has no root CA certificate loaded.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\t\trootCert,\n\t\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\t\tBoolean(tls.mutualTls),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: CertManager server credential creation failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.ServerCredentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.certChain || !tls?.privateKey) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS certificates required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t\"[LIOP-TLS] No TLS certificates configured — using insecure server credentials\",\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = tls.rootCert ? fs.readFileSync(tls.rootCert) : null;\n\t\tconst certChain = fs.readFileSync(tls.certChain);\n\t\tconst privateKey = fs.readFileSync(tls.privateKey);\n\n\t\tif (tls.mutualTls && !rootCert) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: Mutual TLS (mTLS) enabled but no root CA certificate (rootCert) provided to verify client certificates.\",\n\t\t\t);\n\t\t}\n\n\t\treturn grpc.ServerCredentials.createSsl(\n\t\t\trootCert,\n\t\t\t[{ cert_chain: certChain, private_key: privateKey }],\n\t\t\tBoolean(tls.mutualTls),\n\t\t);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Server certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Server certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.ServerCredentials.createInsecure();\n\t}\n}\n\n/**\n * Creates gRPC channel credentials from TLS options.\n * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.\n */\nexport function createChannelCredentials(\n\ttls?: LiopTlsOptions,\n): grpc.ChannelCredentials {\n\t// If CertManager is provided, use its in-memory cached credentials\n\tif (tls?.certManager) {\n\t\ttry {\n\t\t\tconst rootCert = tls.certManager.getRootCert();\n\t\t\tif (!rootCert) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"[LIOP-TLS] FATAL: Channel TLS requires a root CA certificate in CertManager.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst certChain = tls.certManager.getCertChain();\n\t\t\tconst privateKey = tls.certManager.getPrivateKey();\n\t\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t\t} catch (error) {\n\t\t\tif (isTlsEnforced()) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in enforced mode: ${error}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-TLS] Channel CertManager failed, falling back to insecure: ${error}`,\n\t\t\t);\n\t\t\treturn grpc.credentials.createInsecure();\n\t\t}\n\t}\n\n\tif (!tls?.rootCert) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-TLS] FATAL: TLS root certificate required in production or when LIOP_ENFORCE_TLS=true.\",\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t\"[LIOP-TLS] No TLS root certificate configured — using insecure channel credentials\",\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n\n\ttry {\n\t\tconst rootCert = fs.readFileSync(tls.rootCert);\n\t\tconst certChain = tls.certChain\n\t\t\t? fs.readFileSync(tls.certChain)\n\t\t\t: undefined;\n\t\tconst privateKey = tls.privateKey\n\t\t\t? fs.readFileSync(tls.privateKey)\n\t\t\t: undefined;\n\n\t\treturn grpc.credentials.createSsl(rootCert, privateKey, certChain);\n\t} catch (error) {\n\t\tif (isTlsEnforced()) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-TLS] FATAL: Channel certificate loading failed in production or enforced mode. ` +\n\t\t\t\t\t`Refusing insecure fallback to prevent MITM/eavesdropping: ${error}`,\n\t\t\t);\n\t\t}\n\t\tlog.warn(\n\t\t\t`[LIOP-TLS] Channel certificate loading failed, falling back to insecure (dev mode): ${error}`,\n\t\t);\n\t\treturn grpc.credentials.createInsecure();\n\t}\n}\n"]}

package/dist/client.d.ts

@@ -1,6 +1,7 @@
 import './verifier-COnid_dg.js';
 import './mesh.js';
-export { a as LiopClient } from './index-Brfvxmdt.js';
-import './types-DzEXgi4s.js';
+export { c as LiopClient } from './index-cMV0_yD9.js';
+import './types-lJIxBlWF.js';
+import 'node:events';
 import 'zod';
 import 'jose';

package/dist/client.js

@@ -1,2 +1,10 @@
-export{b as LiopClient}from'./chunk-T3L6OCM3.js';import'./chunk-PWCXZWSE.js';import'./chunk-ANFXJGMP.js';import'./chunk-DBXGYHKY.js';import'./chunk-V5MKJT6S.js';import'./chunk-DQ6UW6L7.js';import'./chunk-S6RJHZV2.js';import'./chunk-4C666HHU.js';//# sourceMappingURL=client.js.map
+export { LiopClient } from './chunk-CRZBVFDV.js';
+import './chunk-32ADSAJS.js';
+import './chunk-OUUTDSOW.js';
+import './chunk-QLCOEP5J.js';
+import './chunk-WSW6YJNY.js';
+import './chunk-PYKRQAER.js';
+import './chunk-74CISO2I.js';
+import './chunk-72MNYFR6.js';
+//# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,112 +1,7 @@
-import { MeshNode } from './mesh.js';
-import { L as LiopServer } from './index-DO97j6hP.js';
-import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { M as McpRequest, A as AuthInfo, b as McpResponse } from './types-DzEXgi4s.js';
+import './mesh.js';
+import './index-BW95kAL4.js';
+export { L as LiopHybridGateway } from './hybrid-CF__0YnC.js';
 import 'zod';
+import './types-lJIxBlWF.js';
 import 'jose';
-
-/**
- * LIOP MCP Router
- *
- * Core logic for routing MCP requests to local or remote LIOP providers.
- * Decoupled from transport (HTTP/Stdio).
- *
- * All tool discovery and port resolution is DYNAMIC via the
- * /liop/manifest/1.0.0 protocol stream over Kademlia DHT.
- */
-declare class LiopMcpRouter {
-    private liopServer;
-    private meshNode;
-    private defaultRpcPort;
-    /** Cached manifests from remote peers. Key = PeerID */
-    private manifestCache;
-    /** Guards against concurrent discovery storms */
-    private currentDiscovery;
-    /** Verifier for Tier-0 integrity checks */
-    verifier: LiopVerifier;
-    /** Callback when new remote tools are discovered */
-    onToolsChanged?: () => void;
-    /** Circuit-breaker state for peers that repeatedly fail manifest queries. */
-    private manifestFailureState;
-    private static readonly MANIFEST_FAILURE_BASE_COOLDOWN_MS;
-    private static readonly MANIFEST_FAILURE_MAX_COOLDOWN_MS;
-    private static readonly MANIFEST_SKIP_LOG_THROTTLE_MS;
-    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, defaultRpcPort?: number);
-    private shouldSkipManifestQuery;
-    private recordManifestQuerySuccess;
-    private recordManifestQueryFailure;
-    dispatch(request: McpRequest, authInfo?: AuthInfo | null): Promise<McpResponse | null>;
-    /**
-     * MCP clients often send notifications/initialized then immediately tools/list.
-     * Start manifest discovery without blocking the notification handler.
-     */
-    private kickDiscoveryAfterInitialized;
-    /**
-     * Discovers and caches manifests from all remote LIOP providers in the mesh.
-     * Uses Kademlia DHT to find "liop:manifest" providers, then opens
-     * /liop/manifest/1.0.0 protocol streams to retrieve their full metadata.
-     */
-    refreshManifestCache(silent?: boolean): Promise<void>;
-    /**
-     * Returns the current manifest cache size for external telemetry.
-     * Used by the adaptive polling system to detect topology stabilization.
-     */
-    getCacheSize(): number;
-    /**
-     * Returns all remote tools discovered via the manifest protocol.
-     */
-    private getRemoteTools;
-    /**
-     * Returns all remote resources discovered via the manifest protocol.
-     */
-    private getRemoteResources;
-    /**
-     * Resolves the gRPC target (host:port) AND the peerId for a given tool name
-     * by searching the manifest cache. Supports exact names and suffixed names.
-     */
-    private resolveManifestTarget;
-    /**
-     * Redacts a PeerID for external-facing diagnostics.
-     * LIOP_DIAGNOSTIC_LEVEL controls verbosity:
-     *   - "redacted" (default): truncated to last 8 chars
-     *   - "full": complete PeerID (development only)
-     */
-    private redactPeerId;
-    private transcodeMcpToLiop;
-    private routeToRemoteProvider;
-    /** Cached M2M token for dynamic gateway-to-node routing */
-    private meshAgentToken?;
-    /**
-     * Dynamically acquires an M2M access token from the Nexus Authorization Server.
-     * If peerId is provided, checks if there are node-specific environment tokens
-     * before falling back to the global static token or Nexus acquisition.
-     */
-    private getOrAcquireMeshAgentToken;
-    private performTranscoding;
-    private encryptWithNonce;
-}
-
-/**
- * LIOP Hybrid Gateway
- * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.
- */
-declare class LiopHybridGateway {
-    private liopServer;
-    private meshNode;
-    private netServer;
-    private h2Server;
-    private h1Server;
-    private router;
-    private jwtValidator?;
-    private oauthProvider?;
-    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number);
-    private setupH2Routes;
-    private setupH1Routes;
-    private handleGrpcStream;
-    private handleMcpH2Stream;
-    listen(port: number, host?: string): Promise<number>;
-    stop(): Promise<void>;
-    getRouter(): LiopMcpRouter;
-}
-
-export { LiopHybridGateway };
+import './verifier-COnid_dg.js';

package/dist/gateway.js

@@ -1,2 +1,11 @@
-export{b as LiopHybridGateway}from'./chunk-GI2LSJYZ.js';import'./chunk-I46YEWND.js';import'./chunk-PWCXZWSE.js';import'./chunk-ANFXJGMP.js';import'./chunk-DBXGYHKY.js';import'./chunk-SB5XJXKV.js';import'./chunk-V5MKJT6S.js';import'./chunk-S6RJHZV2.js';import'./chunk-4C666HHU.js';//# sourceMappingURL=gateway.js.map
+export { LiopHybridGateway } from './chunk-UCJEK75U.js';
+import './chunk-GKV6M2PQ.js';
+import './chunk-32ADSAJS.js';
+import './chunk-OUUTDSOW.js';
+import './chunk-QLCOEP5J.js';
+import './chunk-OIMJZ64E.js';
+import './chunk-WSW6YJNY.js';
+import './chunk-PYKRQAER.js';
+import './chunk-72MNYFR6.js';
+//# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map