@nekzus/liop 2.4.0-alpha.1 → 2.4.0-alpha.11

package/dist/chunk-JIJPZFR2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/output-sanitizer.ts"],"names":[],"mappings":";AAeA,IAAM,cAAA,GAAkD;AAAA,EACvD,gBAAA,EAAkB,CAAA;AAAA,EAClB,gBAAA,EAAkB;AACnB,CAAA;AASO,SAAS,cAAA,CACf,QACA,MAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,MAAA,EAAO;AAC9C,EAAA,MAAM,IAAA,uBAAW,OAAA,EAAgB;AAEjC,EAAA,SAAS,KAAK,IAAA,EAAwB;AACrC,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACxC,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,QAAA,OAAO,IAAA;AAAA,MACR;AAEA,MAAA,IAAI,KAAA,GAAQ,IAAA;AAGZ,MAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,KAAA,GAAQ,CAAA,EAAG;AACzC,QAAA,KAAA,GAAQ,CAAA;AAAA,MACT;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,gBAAA;AAC5B,MAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA,GAAI,MAAA;AAErC,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,SAAS,SAAA,EAAW;AAC1D,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE7B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAc,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACR;AACA,MAAA,IAAA,CAAK,IAAI,IAAc,CAAA;AAEvB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,QAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MACrC;AAEA,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,QAC/B;AAAA,OACD,EAAG;AACF,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,MAAM,CAAA;AACnB","file":"chunk-JIJPZFR2.js","sourcesContent":["/**\n * LIOP Egress Shield Output Sanitizer (NIST SP 800-226 and OWASP DLP 2025 compliant)\n * Recursively sanitizes execution outputs by rounding floating-point numbers\n * and clamping negative values to zero floor where appropriate.\n *\n * Implements absolute immutability, returning a fresh copy of the data.\n */\n\nexport interface OutputSanitizerConfig {\n\t/** Maximum decimal places for floating-point values (default: 4) */\n\tmaxDecimalPlaces?: number;\n\t/** Clamp negative values to zero floor (default: true) */\n\tclampNonNegative?: boolean;\n}\n\nconst DEFAULT_CONFIG: Required<OutputSanitizerConfig> = {\n\tmaxDecimalPlaces: 4,\n\tclampNonNegative: true,\n};\n\n/**\n * Recursively walks a JSON-like tree, rounding floats and clamping negative values.\n *\n * @param output - The raw or DP-modified output object/value to sanitize\n * @param config - Sanitization parameters (rounding depth, negative clamping)\n * @returns A sanitized deep copy of the output\n */\nexport function sanitizeOutput(\n\toutput: unknown,\n\tconfig?: OutputSanitizerConfig,\n): unknown {\n\tconst merged = { ...DEFAULT_CONFIG, ...config };\n\tconst seen = new WeakSet<object>();\n\n\tfunction walk(node: unknown): unknown {\n\t\tif (node === null || node === undefined) {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"number\") {\n\t\t\tif (!Number.isFinite(node)) {\n\t\t\t\treturn node;\n\t\t\t}\n\n\t\t\tlet value = node;\n\n\t\t\t// 1. Clamp negative values to 0 if configured\n\t\t\tif (merged.clampNonNegative && value < 0) {\n\t\t\t\tvalue = 0;\n\t\t\t}\n\n\t\t\t// 2. Round to maximum decimal places\n\t\t\tconst factor = 10 ** merged.maxDecimalPlaces;\n\t\t\tvalue = Math.round(value * factor) / factor;\n\n\t\t\treturn value;\n\t\t}\n\n\t\tif (typeof node === \"string\" || typeof node === \"boolean\") {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"object\") {\n\t\t\t// Circular reference protection\n\t\t\tif (seen.has(node as object)) {\n\t\t\t\treturn node;\n\t\t\t}\n\t\t\tseen.add(node as object);\n\n\t\t\tif (Array.isArray(node)) {\n\t\t\t\treturn node.map((item) => walk(item));\n\t\t\t}\n\n\t\t\tconst result: Record<string, unknown> = {};\n\t\t\tfor (const [key, val] of Object.entries(\n\t\t\t\tnode as Record<string, unknown>,\n\t\t\t)) {\n\t\t\t\tresult[key] = walk(val);\n\t\t\t}\n\t\t\treturn result;\n\t\t}\n\n\t\treturn node;\n\t}\n\n\treturn walk(output);\n}\n"]}

package/dist/chunk-OIMJZ64E.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/observability/metrics.ts","../src/rpc/crypto/dilithium.ts","../src/security/rbac.ts"],"names":[],"mappings":";;;AAeA,SAAS,aAAa,MAAA,EAA+B;AACpD,EAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAChD,IAAA,OAAO,EAAA;AAAA,EACR;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,EACnC,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA;AAC5D,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEA,SAAS,YAAY,MAAA,EAA+B;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AACpB,EAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAC1B,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA,KAAM,EAAE,aAAA,CAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,CAC3B,KAAK,GAAG,CAAA;AACX;AAEO,IAAM,UAAN,MAAc;AAAA,EAGpB,WAAA,CACiB,MACA,IAAA,EACf;AAFe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EACd;AAAA,EALK,MAAA,uBAAa,GAAA,EAAsD;AAAA,EAO3E,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,IAAI,QAAQ,CAAA,EAAG;AACd,MAAA,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,IAAI,MAAA,EAA+B;AAClC,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,KAAA,IAAS,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,QAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,KAAS,CAAA,EAAG;AAC3B,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,CAAI,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,YAAA,CAAa,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA,CAAE,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,QAAN,MAAY;AAAA,EAGlB,WAAA,CACiB,MACA,IAAA,EACf;AAFe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EACd;AAAA,EALK,MAAA,uBAAa,GAAA,EAAsD;AAAA,EAO3E,GAAA,CAAI,eAAsC,UAAA,EAA2B;AACpE,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACtC,MAAA,IAAA,CAAK,OAAO,GAAA,CAAI,EAAA,EAAI,EAAE,KAAA,EAAO,eAAe,CAAA;AAC5C,MAAA;AAAA,IACD;AACA,IAAA,MAAM,MAAA,GAAS,aAAA;AACf,IAAA,MAAM,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,CAAA;AAC1D,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,OAAO,GAAA,CAAI,GAAA,EAAK,EAAE,KAAA,EAAO,GAAA,EAAK,QAAQ,CAAA;AAAA,EAC5C;AAAA,EAEA,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,IAAI,MAAA,EAA+B;AAClC,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,KAAA,IAAS,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,MAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,KAAS,CAAA,EAAG;AAC3B,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,CAAI,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,YAAA,CAAa,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA,CAAE,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,YAAN,MAAgB;AAAA,EAYtB,YACiB,IAAA,EACA,IAAA,EAChB,OAAA,GAAoB,CAAC,GAAG,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAM,IAAA,EAAM,GAAA,EAAM,GAAK,CAAA,EACzE;AAHe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAGhB,IAAA,IAAA,CAAK,OAAA,GAAU,CAAC,GAAG,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,GAAI,CAAC,CAAA;AAAA,EACjD;AAAA,EAjBgB,OAAA;AAAA,EACR,YAAA,uBAAmB,GAAA,EAQzB;AAAA,EAUF,OAAA,CAAQ,eAAsC,UAAA,EAA2B;AACxE,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACtC,MAAA,GAAA,GAAM,aAAA;AAAA,IACP,CAAA,MAAO;AACN,MAAA,MAAA,GAAS,aAAA;AACT,MAAA,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,IAAI,KAAA,GAAQ,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,KAAA,GAAQ;AAAA,QACP,KAAA,EAAO,CAAA;AAAA,QACP,GAAA,EAAK,CAAA;AAAA,QACL,YAAA,EAAc,IAAI,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,EAAG,CAAC,CAAC,CAAC,CAAA;AAAA,QACrD;AAAA,OACD;AACA,MAAA,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IACjC;AAEA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,KAAA,CAAM,GAAA,IAAO,GAAA;AAEb,IAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AACjC,MAAA,IAAI,OAAO,KAAA,EAAO;AACjB,QAAA,MAAM,GAAA,GAAM,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA,IAAK,CAAA;AAC7C,QAAA,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,GAAA,GAAM,CAAC,CAAA;AAAA,MACtC;AAAA,IACD;AAAA,EACD;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EACzB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,UAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,IAAA,KAAS,CAAA,EAAG;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,QAAA,CAAU,CAAA;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,MAAA,CAAQ,CAAA;AAC/B,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,YAAA,CAAa,MAAA,EAAO,EAAG;AAC/C,MAAA,MAAM,UAAA,GAAa,KAAA,CAAM,MAAA,IAAU,EAAC;AACpC,MAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AACjC,QAAA,MAAM,eAAe,EAAE,GAAG,YAAY,EAAA,EAAI,MAAA,CAAO,KAAK,CAAA,EAAE;AACxD,QAAA,KAAA,CAAM,IAAA;AAAA,UACL,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,OAAA,EAAU,YAAA,CAAa,YAAY,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,EAAE,GAAG,UAAA,EAAY,IAAI,MAAA,EAAO;AAC9C,MAAA,KAAA,CAAM,IAAA;AAAA,QACL,CAAA,EAAG,KAAK,IAAI,CAAA,OAAA,EAAU,aAAa,SAAS,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA;AAAA,OAC7D;AACA,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,IAAA,EAAO,YAAA,CAAa,UAAU,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAA;AACrE,MAAA,KAAA,CAAM,IAAA;AAAA,QACL,CAAA,EAAG,KAAK,IAAI,CAAA,MAAA,EAAS,aAAa,UAAU,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA;AAAA,OAC7D;AAAA,IACD;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACpB,QAAA,uBAAe,GAAA,EAAqB;AAAA,EACpC,MAAA,uBAAa,GAAA,EAAmB;AAAA,EAChC,UAAA,uBAAiB,GAAA,EAAuB;AAAA,EAEhD,OAAA,CAAQ,MAAc,IAAA,EAAuB;AAC5C,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA;AAC9B,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA;AAC1B,MAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IAC1B;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,KAAA,CAAM,MAAc,IAAA,EAAqB;AACxC,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC5B,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AACxB,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,SAAA,CAAU,IAAA,EAAc,IAAA,EAAc,OAAA,EAA+B;AACpE,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AAChC,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,OAAO,CAAA;AACrC,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,qBAAA,GAA8B;AAC7B,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MACnB,6BAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,MAAA,CAAO,IAAI,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAO,OAAA,CAAQ,WAAA,KAAgB,UAAA,EAAY;AAC9C,MAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA;AAAA,QAChB,+BAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,IAAI,GAAG,CAAA;AAEf,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AAAA,QACrB,qCAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,QAAA,CAAS,GAAA,CAAI,IAAI,QAAQ,CAAA;AAAA,IAC1B;AAAA,EACD;AAAA,EAEA,oBAAA,GAA+B;AAC9B,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAE3B,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,EAAG;AACvC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACrC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACvB;AAAA,EAEA,QAAA,GAAiB;AAChB,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,IAAK,KAAA,EAAM;AAChD,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,IAAK,KAAA,EAAM;AAC9C,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,IAAK,KAAA,EAAM;AAAA,EACnD;AACD;AAIO,IAAM,eAAA,GAAkB,IAAI,eAAA;AAE5B,IAAM,iBAAiB,eAAA,CAAgB,OAAA;AAAA,EAC7C,uBAAA;AAAA,EACA;AACD;AAEO,IAAM,eAAe,eAAA,CAAgB,SAAA;AAAA,EAC3C,0BAAA;AAAA,EACA,qDAAA;AAAA,EACA,CAAC,KAAK,GAAA,EAAK,GAAA,EAAM,MAAM,GAAA,EAAM,GAAA,EAAO,KAAO,GAAM;AAClD;AAEO,IAAM,qBAAqB,eAAA,CAAgB,KAAA;AAAA,EACjD,2BAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,KAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,OAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,2BAA2B,eAAA,CAAgB,SAAA;AAAA,EACvD,kCAAA;AAAA,EACA,iEAAA;AAAA,EACA,CAAC,CAAA,EAAG,CAAA,EAAG,GAAG,EAAA,EAAI,EAAA,EAAI,IAAI,GAAG;AAC1B;AClUO,IAAM,qBAAA,GAAwB;AAAA,EACpC,gBAAA,EAAkB,IAAA;AAAA,EAClB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB,IAAA;AAAA,EACjB,eAAA,EAAiB,IAAI,WAAA,EAAY,CAAE,OAAO,wBAAwB;AACnE;AAKA,SAAS,iBAAiB,OAAA,EAA0C;AACnE,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAChC,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,OAAA;AACR;AAMA,SAAS,iBAAiB,GAAA,EAAsB;AAC/C,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC5C,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,IAAI,GAAA,CAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,GAA8B,EAAE,IAAA,EAAK;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,GAAA;AAAA,IAC1B,CAAC,GAAA,KACA,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAkB,GAAA,CAAgC,GAAG,CAAC,CAAC,CAAA;AAAA,GACnF;AACA,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEO,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEjC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,iBAAiB,qBAAA,CAAsB,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvC,gBAAgB,IAAA,EAGd;AACD,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,mDAAA,EAAsD,KAAK,MAAM,CAAA,CAAA;AAAA,OAClE;AAAA,IACD;AACA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA;AACjC,IAAA,OAAO;AAAA,MACN,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KACjB;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAC7D,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,OAAO,MAAM,CAAA,CAAA;AAAA,OACjH;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CACC,OAAA,EACA,SAAA,EACA,OAAA,EACa;AACb,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,UAAU,MAAM,CAAA,CAAA;AAAA,OACpH;AAAA,IACD;AACA,IAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,IAAA,OAAO,SAAS,IAAA,CAAK,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,EAC3D,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,CACC,SAAA,EACA,OAAA,EACA,SAAA,EACA,OAAA,EACU;AACV,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,eAAA,EAAiB;AAC/D,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,MAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,MAAA,OAAO,QAAA,CAAS,OAAO,SAAA,EAAW,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CACC,QAAA,EACA,SAAA,EACA,SAAA,EAC2C;AAC3C,IAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,IAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAS,CAAA;AAC7C,IAAA,OAAO;AAAA,MACN,WAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,MAC7C,WAAW,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,QAAQ;AAAA,KACpD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,QAAA,EACA,eAAA,EACA,eAAA,EACU;AACV,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,MAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,MAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK,YAAA,EAAc,GAAG,CAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AACD;;;ACvJA,IAAM,SAAA,GAAyD;AAAA;AAAA,EAE9D,YAAY,EAAC;AAAA,EACb,6BAA6B,EAAC;AAAA,EAC9B,2BAA2B,EAAC;AAAA,EAC5B,MAAM,EAAC;AAAA;AAAA,EAGP,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA,EAChC,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA;AAAA,EAGhC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA;AAAA,EAGxC,cAAA,EAAgB,CAAC,kBAAkB,CAAA;AAAA,EACnC,aAAA,EAAe,CAAC,kBAAkB;AACnC,CAAA;AAuBO,SAAS,gBAAA,CACf,MAAA,EACA,IAAA,EACA,gBAAA,EACsB;AACtB,EAAA,MAAM,YAAA,GAAe,UAAU,MAAM,CAAA;AAGrC,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AAC5D,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACxB;AAGA,EAAA,IAAI,CAAC,IAAA,EAAM;AACV,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,uCAAuC,MAAM,CAAA;AAAA,KACtD;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GAAS,CAAC,GAAI,YAAA,IAAgB,EAAC,EAAI,GAAI,gBAAA,IAAoB,EAAG,CAAA;AAGpE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACxB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,mBAAmB,MAAM,CAAA,8BAAA;AAAA,KAClC;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,GAAA,CAAI,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACvB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,QAAQ,CAAA,wBAAA,EAA2B,MAAM,cAAc,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC1E;AAAA,EACD;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACxB;AAMO,IAAM,WAAA,GAAc;AAAA,EAC1B,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACD","file":"chunk-OIMJZ64E.js","sourcesContent":["/**\n * LIOP Prometheus Metrics Registry (Phase Beta-3)\n * Lightweight, zero-dependency, high-performance metrics collector\n * complying with Prometheus and OpenMetrics exposition format.\n */\n\nexport type MetricLabels = Record<string, string | number>;\n\nexport interface MetricDefinition {\n\tname: string;\n\thelp: string;\n\ttype: \"counter\" | \"gauge\" | \"histogram\";\n\tbuckets?: number[];\n}\n\nfunction formatLabels(labels?: MetricLabels): string {\n\tif (!labels || Object.keys(labels).length === 0) {\n\t\treturn \"\";\n\t}\n\tconst entries = Object.entries(labels)\n\t\t.sort(([a], [b]) => a.localeCompare(b))\n\t\t.map(([k, v]) => `${k}=\"${String(v).replace(/\"/g, '\\\\\"')}\"`);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nfunction labelsToKey(labels?: MetricLabels): string {\n\tif (!labels) return \"\";\n\treturn Object.entries(labels)\n\t\t.sort(([a], [b]) => a.localeCompare(b))\n\t\t.map(([k, v]) => `${k}:${v}`)\n\t\t.join(\"|\");\n}\n\nexport class Counter {\n\tprivate values = new Map<string, { value: number; labels?: MetricLabels }>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t) {}\n\n\tinc(labels?: MetricLabels, value = 1): void {\n\t\tif (value < 0) {\n\t\t\tthrow new Error(\"Counter increments must be non-negative\");\n\t\t}\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value += value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tget(labels?: MetricLabels): number {\n\t\tconst key = labelsToKey(labels);\n\t\treturn this.values.get(key)?.value || 0;\n\t}\n\n\treset(): void {\n\t\tthis.values.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} counter`,\n\t\t];\n\t\tif (this.values.size === 0) {\n\t\t\tlines.push(`${this.name} 0`);\n\t\t\treturn lines;\n\t\t}\n\t\tfor (const entry of this.values.values()) {\n\t\t\tlines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class Gauge {\n\tprivate values = new Map<string, { value: number; labels?: MetricLabels }>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t) {}\n\n\tset(labelsOrValue: MetricLabels | number, maybeValue?: number): void {\n\t\tif (typeof labelsOrValue === \"number\") {\n\t\t\tthis.values.set(\"\", { value: labelsOrValue });\n\t\t\treturn;\n\t\t}\n\t\tconst labels = labelsOrValue;\n\t\tconst val = typeof maybeValue === \"number\" ? maybeValue : 0;\n\t\tconst key = labelsToKey(labels);\n\t\tthis.values.set(key, { value: val, labels });\n\t}\n\n\tinc(labels?: MetricLabels, value = 1): void {\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value += value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tdec(labels?: MetricLabels, value = 1): void {\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value -= value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tget(labels?: MetricLabels): number {\n\t\tconst key = labelsToKey(labels);\n\t\treturn this.values.get(key)?.value || 0;\n\t}\n\n\treset(): void {\n\t\tthis.values.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} gauge`,\n\t\t];\n\t\tif (this.values.size === 0) {\n\t\t\tlines.push(`${this.name} 0`);\n\t\t\treturn lines;\n\t\t}\n\t\tfor (const entry of this.values.values()) {\n\t\t\tlines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class Histogram {\n\tpublic readonly buckets: number[];\n\tprivate observations = new Map<\n\t\tstring,\n\t\t{\n\t\t\tcount: number;\n\t\t\tsum: number;\n\t\t\tbucketCounts: Map<number, number>;\n\t\t\tlabels?: MetricLabels;\n\t\t}\n\t>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t\tbuckets: number[] = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 10000],\n\t) {\n\t\tthis.buckets = [...buckets].sort((a, b) => a - b);\n\t}\n\n\tobserve(labelsOrValue: MetricLabels | number, maybeValue?: number): void {\n\t\tlet labels: MetricLabels | undefined;\n\t\tlet val: number;\n\n\t\tif (typeof labelsOrValue === \"number\") {\n\t\t\tval = labelsOrValue;\n\t\t} else {\n\t\t\tlabels = labelsOrValue;\n\t\t\tval = typeof maybeValue === \"number\" ? maybeValue : 0;\n\t\t}\n\n\t\tconst key = labelsToKey(labels);\n\t\tlet state = this.observations.get(key);\n\t\tif (!state) {\n\t\t\tstate = {\n\t\t\t\tcount: 0,\n\t\t\t\tsum: 0,\n\t\t\t\tbucketCounts: new Map(this.buckets.map((b) => [b, 0])),\n\t\t\t\tlabels,\n\t\t\t};\n\t\t\tthis.observations.set(key, state);\n\t\t}\n\n\t\tstate.count += 1;\n\t\tstate.sum += val;\n\n\t\tfor (const bound of this.buckets) {\n\t\t\tif (val <= bound) {\n\t\t\t\tconst cur = state.bucketCounts.get(bound) || 0;\n\t\t\t\tstate.bucketCounts.set(bound, cur + 1);\n\t\t\t}\n\t\t}\n\t}\n\n\treset(): void {\n\t\tthis.observations.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} histogram`,\n\t\t];\n\t\tif (this.observations.size === 0) {\n\t\t\tlines.push(`${this.name}_count 0`);\n\t\t\tlines.push(`${this.name}_sum 0`);\n\t\t\treturn lines;\n\t\t}\n\n\t\tfor (const state of this.observations.values()) {\n\t\t\tconst baseLabels = state.labels || {};\n\t\t\tfor (const bound of this.buckets) {\n\t\t\t\tconst bucketLabels = { ...baseLabels, le: String(bound) };\n\t\t\t\tlines.push(\n\t\t\t\t\t`${this.name}_bucket${formatLabels(bucketLabels)} ${state.bucketCounts.get(bound) || 0}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst infLabels = { ...baseLabels, le: \"+Inf\" };\n\t\t\tlines.push(\n\t\t\t\t`${this.name}_bucket${formatLabels(infLabels)} ${state.count}`,\n\t\t\t);\n\t\t\tlines.push(`${this.name}_sum${formatLabels(baseLabels)} ${state.sum}`);\n\t\t\tlines.push(\n\t\t\t\t`${this.name}_count${formatLabels(baseLabels)} ${state.count}`,\n\t\t\t);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class MetricsRegistry {\n\tprivate counters = new Map<string, Counter>();\n\tprivate gauges = new Map<string, Gauge>();\n\tprivate histograms = new Map<string, Histogram>();\n\n\tcounter(name: string, help: string): Counter {\n\t\tlet c = this.counters.get(name);\n\t\tif (!c) {\n\t\t\tc = new Counter(name, help);\n\t\t\tthis.counters.set(name, c);\n\t\t}\n\t\treturn c;\n\t}\n\n\tgauge(name: string, help: string): Gauge {\n\t\tlet g = this.gauges.get(name);\n\t\tif (!g) {\n\t\t\tg = new Gauge(name, help);\n\t\t\tthis.gauges.set(name, g);\n\t\t}\n\t\treturn g;\n\t}\n\n\thistogram(name: string, help: string, buckets?: number[]): Histogram {\n\t\tlet h = this.histograms.get(name);\n\t\tif (!h) {\n\t\t\th = new Histogram(name, help, buckets);\n\t\t\tthis.histograms.set(name, h);\n\t\t}\n\t\treturn h;\n\t}\n\n\tcollectProcessMetrics(): void {\n\t\tconst uptime = this.gauge(\n\t\t\t\"liop_process_uptime_seconds\",\n\t\t\t\"Process uptime in seconds\",\n\t\t);\n\t\tuptime.set(Math.floor(process.uptime()));\n\n\t\tif (typeof process.memoryUsage === \"function\") {\n\t\t\tconst mem = process.memoryUsage();\n\t\t\tconst rss = this.gauge(\n\t\t\t\t\"liop_process_memory_rss_bytes\",\n\t\t\t\t\"Resident set size memory in bytes\",\n\t\t\t);\n\t\t\trss.set(mem.rss);\n\n\t\t\tconst heapUsed = this.gauge(\n\t\t\t\t\"liop_process_memory_heap_used_bytes\",\n\t\t\t\t\"Heap memory used in bytes\",\n\t\t\t);\n\t\t\theapUsed.set(mem.heapUsed);\n\t\t}\n\t}\n\n\texportPrometheusText(): string {\n\t\tthis.collectProcessMetrics();\n\n\t\tconst lines: string[] = [];\n\t\tfor (const c of this.counters.values()) {\n\t\t\tlines.push(...c.toPrometheus());\n\t\t}\n\t\tfor (const g of this.gauges.values()) {\n\t\t\tlines.push(...g.toPrometheus());\n\t\t}\n\t\tfor (const h of this.histograms.values()) {\n\t\t\tlines.push(...h.toPrometheus());\n\t\t}\n\t\tlines.push(\"\"); // Trailing newline\n\t\treturn lines.join(\"\\n\");\n\t}\n\n\tresetAll(): void {\n\t\tfor (const c of this.counters.values()) c.reset();\n\t\tfor (const g of this.gauges.values()) g.reset();\n\t\tfor (const h of this.histograms.values()) h.reset();\n\t}\n}\n\n// ── Global Standard Protocol Metrics Instance ──────────────────────────────────\n\nexport const protocolMetrics = new MetricsRegistry();\n\nexport const toolCallsTotal = protocolMetrics.counter(\n\t\"liop_tool_calls_total\",\n\t\"Total number of tool logic-injection executions\",\n);\n\nexport const fuelConsumed = protocolMetrics.histogram(\n\t\"liop_fuel_consumed_total\",\n\t\"Deterministic fuel units consumed by injected logic\",\n\t[100, 500, 1000, 2500, 5000, 10000, 50000, 100000],\n);\n\nexport const meshPeersConnected = protocolMetrics.gauge(\n\t\"liop_mesh_peers_connected\",\n\t\"Active peer connections in the P2P mesh\",\n);\n\nexport const manifestCacheSize = protocolMetrics.gauge(\n\t\"liop_manifest_cache_size\",\n\t\"Number of verified remote tool manifests in cache\",\n);\n\nexport const egressBlocksTotal = protocolMetrics.counter(\n\t\"liop_egress_blocks_total\",\n\t\"Total number of outputs blocked by Egress Shield\",\n);\n\nexport const zkVerificationDurationMs = protocolMetrics.histogram(\n\t\"liop_zk_verification_duration_ms\",\n\t\"Duration of ZK-Receipt and HMAC cryptographic attestation in ms\",\n\t[1, 2, 5, 10, 25, 50, 100],\n);\n","/**\n * LIOP Post-Quantum Digital Signature Wrapper\n * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant\n * manifest attestation, node revocation receipts, and cryptographic integrity.\n *\n * Characteristics:\n * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)\n * - Public Key Length: 1952 bytes\n * - Secret Key Length: 4032 bytes\n * - Signature Length: 3309 bytes\n * - Implementation: Pure TypeScript/JS via @noble/post-quantum\n */\n\nimport { ml_dsa65 } from \"@noble/post-quantum/ml-dsa.js\";\n\nexport const DILITHIUM65_CONSTANTS = {\n\tPUBLIC_KEY_BYTES: 1952,\n\tSECRET_KEY_BYTES: 4032,\n\tSIGNATURE_BYTES: 3309,\n\tDEFAULT_CONTEXT: new TextEncoder().encode(\"LIOP-FIPS204-ML-DSA-65\"),\n} as const;\n\n/**\n * Deterministically normalizes a message into a Uint8Array.\n */\nfunction normalizeMessage(message: Uint8Array | string): Uint8Array {\n\tif (typeof message === \"string\") {\n\t\treturn new TextEncoder().encode(message);\n\t}\n\treturn message;\n}\n\n/**\n * Deterministic canonical JSON serializer to ensure stable cryptographic hashing\n * regardless of key ordering in JavaScript objects.\n */\nfunction canonicalizeJson(obj: unknown): string {\n\tif (obj === null || typeof obj !== \"object\") {\n\t\treturn JSON.stringify(obj);\n\t}\n\tif (Array.isArray(obj)) {\n\t\treturn `[${obj.map(canonicalizeJson).join(\",\")}]`;\n\t}\n\tconst sortedKeys = Object.keys(obj as Record<string, unknown>).sort();\n\tconst entries = sortedKeys.map(\n\t\t(key) =>\n\t\t\t`${JSON.stringify(key)}:${canonicalizeJson((obj as Record<string, unknown>)[key])}`,\n\t);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nexport const Dilithium65Wrapper = {\n\t/** Constants */\n\tPUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,\n\tSECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,\n\tSIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,\n\n\t/**\n\t * Generates a new ML-DSA-65 (FIPS 204) key pair.\n\t * Optionally accepts a 32-byte seed for deterministic key generation.\n\t */\n\tgenerateKeyPair(seed?: Uint8Array): {\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t} {\n\t\tif (seed && seed.length !== 32) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`,\n\t\t\t);\n\t\t}\n\t\tconst keys = ml_dsa65.keygen(seed);\n\t\treturn {\n\t\t\tpublicKey: keys.publicKey,\n\t\t\tsecretKey: keys.secretKey,\n\t\t};\n\t},\n\n\t/**\n\t * Validates and imports a raw ML-DSA-65 public key.\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Signs a message using the post-quantum secret key.\n\t * Supports optional domain separation context (up to 255 bytes).\n\t */\n\tsign(\n\t\tmessage: Uint8Array | string,\n\t\tsecretKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): Uint8Array {\n\t\tif (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`,\n\t\t\t);\n\t\t}\n\t\tconst msgBytes = normalizeMessage(message);\n\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\treturn ml_dsa65.sign(msgBytes, secretKey, { context: ctx });\n\t},\n\n\t/**\n\t * Verifies an ML-DSA-65 post-quantum digital signature.\n\t */\n\tverify(\n\t\tsignature: Uint8Array,\n\t\tmessage: Uint8Array | string,\n\t\tpublicKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): boolean {\n\t\tif (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\tif (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\ttry {\n\t\t\tconst msgBytes = normalizeMessage(message);\n\t\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\t\treturn ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n\n\t/**\n\t * Signs a structured manifest (LiopManifest) using canonical JSON serialization.\n\t * Returns base64-encoded signature and public key for transport over gRPC/MCP.\n\t */\n\tsignManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsecretKey: Uint8Array,\n\t\tpublicKey: Uint8Array,\n\t): { signature: string; publicKey: string } {\n\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\tconst sig = this.sign(canonicalStr, secretKey);\n\t\treturn {\n\t\t\tsignature: Buffer.from(sig).toString(\"base64\"),\n\t\t\tpublicKey: Buffer.from(publicKey).toString(\"base64\"),\n\t\t};\n\t},\n\n\t/**\n\t * Verifies the post-quantum signature of a structured manifest.\n\t */\n\tverifyManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsignatureBase64: string,\n\t\tpublicKeyBase64: string,\n\t): boolean {\n\t\ttry {\n\t\t\tconst sig = Buffer.from(signatureBase64, \"base64\");\n\t\t\tconst pub = Buffer.from(publicKeyBase64, \"base64\");\n\t\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\t\treturn this.verify(sig, canonicalStr, pub);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n};\n","/**\n * LIOP RBAC Engine — Scope-Based Authorization\n *\n * Maps MCP JSON-RPC methods to required LIOP OAuth scopes.\n * Enforces least-privilege access at the router level before\n * any tool execution or resource read occurs.\n *\n * Standards: NIST SP 800-207 §4.3 (least privilege), OWASP LLM06 (Excessive Agency),\n *            OWASP API-A01 (Broken Access Control)\n */\n\nimport type { AuthInfo } from \"./jwt-validator.js\";\n\n/**\n * Maps MCP JSON-RPC methods to the LIOP scopes required to invoke them.\n * Empty array = no authentication required (public endpoints).\n */\nconst SCOPE_MAP: Readonly<Record<string, readonly string[]>> = {\n\t// Protocol lifecycle — unauthenticated (MCP spec compliance)\n\tinitialize: [],\n\t\"notifications/initialized\": [],\n\t\"notifications/cancelled\": [],\n\tping: [],\n\n\t// Tool operations — require explicit authorization\n\t\"tools/list\": [\"liop:tools:list\"],\n\t\"tools/call\": [\"liop:tools:call\"],\n\n\t// Resource operations — read-level access\n\t\"resources/list\": [\"liop:resources:read\"],\n\t\"resources/read\": [\"liop:resources:read\"],\n\n\t// Prompt/schema operations — schema-level access\n\t\"prompts/list\": [\"liop:schema:read\"],\n\t\"prompts/get\": [\"liop:schema:read\"],\n};\n\n/**\n * Authorization result with optional denial reason for audit logging.\n */\nexport interface AuthorizationResult {\n\tallowed: boolean;\n\treason?: string;\n}\n\n/**\n * Evaluates whether a request is authorized based on JWT scopes.\n *\n * Decision logic:\n * 1. Methods with no required scopes (initialize, ping) → always allowed.\n * 2. Methods with required scopes but no auth → denied.\n * 3. Methods with required scopes → all scopes must be present in the JWT.\n * 4. Unknown methods with no auth → denied (fail-closed per NIST SP 800-207).\n *\n * @param method - MCP JSON-RPC method name (e.g., \"tools/call\")\n * @param auth - Validated JWT context, or null if unauthenticated\n * @param additionalScopes - Extra scopes required by specific node configuration\n */\nexport function authorizeRequest(\n\tmethod: string,\n\tauth: AuthInfo | null,\n\tadditionalScopes?: readonly string[],\n): AuthorizationResult {\n\tconst methodScopes = SCOPE_MAP[method];\n\n\t// Methods explicitly marked as public (empty scope array) pass freely\n\tif (methodScopes !== undefined && methodScopes.length === 0) {\n\t\treturn { allowed: true };\n\t}\n\n\t// If no auth context and method requires scopes → deny\n\tif (!auth) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Authentication required for method: ${method}`,\n\t\t};\n\t}\n\n\t// Merge method-level scopes with node-level additional scopes\n\tconst needed = [...(methodScopes ?? []), ...(additionalScopes ?? [])];\n\n\t// If no scopes needed (unknown method, no additional) → fail-closed\n\tif (needed.length === 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Unknown method: ${method}. Access denied (fail-closed).`,\n\t\t};\n\t}\n\n\t// Verify all required scopes are present in the JWT\n\tconst clientScopes = new Set(auth.scopes);\n\tconst missing = needed.filter((s) => !clientScopes.has(s));\n\n\tif (missing.length > 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Insufficient scopes for ${method}. Missing: ${missing.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * All LIOP OAuth scopes supported by the protocol.\n * Used for PRM metadata and client registration.\n */\nexport const LIOP_SCOPES = [\n\t\"liop:tools:list\",\n\t\"liop:tools:call\",\n\t\"liop:resources:read\",\n\t\"liop:schema:read\",\n\t\"liop:mesh:query\",\n] as const;\n\nexport type LiopScope = (typeof LIOP_SCOPES)[number];\n"]}

package/dist/chunk-OUUTDSOW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/crypto/logic-image-id.ts"],"names":[],"mappings":";;;AAOA,IAAM,kBAAA,GAAqB,4CAAA;AAEpB,SAAS,qBAAqB,SAAA,EAA2B;AAC/D,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,kBAAkB,CAAA;AAChD,EAAA,IAAI,KAAA,GAAQ,CAAC,CAAA,KAAM,MAAA,EAAW;AAC7B,IAAA,OAAO,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,EACtB;AACA,EAAA,OAAO,UAAU,IAAA,EAAK;AACvB;AAGO,SAAS,uBAAuB,YAAA,EAAkC;AACxE,EAAA,MAAM,SAAS,YAAA,CAAa,CAAC,MAAM,CAAA,IAAQ,YAAA,CAAa,CAAC,CAAA,KAAM,EAAA;AAC/D,EAAA,IAAI,MAAA,EAAQ;AACX,IAAA,OAAO,OAAO,UAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,YAAY,EAAE,MAAA,EAAO;AAAA,EAChE;AACA,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,OAAO,CAAA;AACvD,EAAA,MAAM,UAAA,GAAa,qBAAqB,IAAI,CAAA;AAC5C,EAAA,OAAO,MAAA,CACL,UAAA,CAAW,QAAQ,CAAA,CACnB,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,UAAA,EAAY,OAAO,CAAC,CAAA,CACvC,MAAA,EAAO;AACV","file":"chunk-OUUTDSOW.js","sourcesContent":["import crypto from \"node:crypto\";\n\n/**\n * Top-level LIOP v1 envelope only. Must NOT use multiline (^/$) mode:\n * proxy logic embeds a full envelope inside JSON strings; `^` per line would\n * incorrectly treat that as the document root and desync ImageID vs the worker.\n */\nconst TOP_LEVEL_ENVELOPE = /^\\s*@LIOP\\{[^}]+\\}\\n?([\\s\\S]*?)\\n?@END\\s*$/;\n\nexport function normalizeLogicSource(logicUtf8: string): string {\n\tconst match = logicUtf8.match(TOP_LEVEL_ENVELOPE);\n\tif (match?.[1] !== undefined) {\n\t\treturn match[1].trim();\n\t}\n\treturn logicUtf8.trim();\n}\n\n/** SHA-256 digest of logic bytes (WASM raw; JS UTF-8 after top-level envelope strip). */\nexport function deriveLogicImageDigest(logicPayload: Uint8Array): Buffer {\n\tconst isWasm = logicPayload[0] === 0x00 && logicPayload[1] === 0x61;\n\tif (isWasm) {\n\t\treturn crypto.createHash(\"sha256\").update(logicPayload).digest();\n\t}\n\tconst text = Buffer.from(logicPayload).toString(\"utf-8\");\n\tconst normalized = normalizeLogicSource(text);\n\treturn crypto\n\t\t.createHash(\"sha256\")\n\t\t.update(Buffer.from(normalized, \"utf-8\"))\n\t\t.digest();\n}\n"]}

package/dist/chunk-PYKRQAER.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/gateway/mcp-compat.ts","../src/types.ts"],"names":[],"mappings":";;;;;AAcO,IAAM,0BAAA,GAA6B;AAKnC,IAAM,2BAAA,GAA8B;AAKpC,SAAS,6BAAA,CACf,YACA,EAAA,EACc;AACd,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,IAAI,EAAA,IAAM,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,MACP,eAAA,EAAiB,2BAAA;AAAA,MACjB,YAAA,EAAc;AAAA,QACb,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC3B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC/B,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA;AAAK,OAC9B;AAAA,MACA;AAAA;AACD,GACD;AACD;AAOO,SAAS,gBAAgB,OAAA,EAA8B;AAC7D,EAAA,IACC,OAAA,CAAQ,MAAA,KAAW,YAAA,IACnB,OAAA,CAAQ,WAAW,2BAAA,EAClB;AACD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,EAAA,MAAM,OAAO,MAAA,EAAQ,KAAA;AACrB,EAAA,MAAM,OAAA,GAAU,OAAO,yCAAyC,CAAA;AAEhE,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,2BAAA,EAA6B;AACxD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAA;AACR;AAMO,SAAS,6BACf,QAAA,EACc;AACd,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,IAAU,OAAO,QAAA,CAAS,WAAW,QAAA,EAAU;AAC5D,IAAA,OAAO,QAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAA,GAAY,EAAE,GAAI,QAAA,CAAS,MAAA,EAAmC;AAGpE,EAAA,OAAO,SAAA,CAAU,UAAA;AACjB,EAAA,OAAO,SAAA,CAAU,KAAA;AACjB,EAAA,OAAO,SAAA,CAAU,UAAA;AAEjB,EAAA,OAAO;AAAA,IACN,GAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT;AACD;;;ACpFO,IAAM,oBAAA,GAAuB;AAyD7B,IAAM,UAAA,GAAa,EAAE,MAAA,CAAO;AAAA,EAClC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,CAAA,CAAE,SAAS;AAAA;AAC9C,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,EAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EACpC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAW,CAAA,CACT,KAAA;AAAA,IACA,EAAE,MAAA,CAAO;AAAA,MACR,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,MACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAC/B;AAAA,IAED,QAAA;AACH,CAAC","file":"chunk-PYKRQAER.js","sourcesContent":["import type { McpRequest, McpResponse, ServerInfo } from \"../types.js\";\n\n/**\n * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.\n * Remove this file when MCP v1 (2025-11-25) reaches EOL.\n *\n * SUNSET INSTRUCTION: Delete this file, then grep for \"@mcp-legacy\" in the\n * codebase to find and remove all remaining legacy seams.\n */\n\n/**\n * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.\n * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.\n */\nexport const MCP_LEGACY_SUPPORT_ENABLED = true;\n\n/**\n * @mcp-legacy Legacy protocol version constant.\n */\nexport const MCP_PROTOCOL_VERSION_LEGACY = \"2025-11-25\" as const;\n\n/**\n * @mcp-legacy Build the legacy initialize handshake response.\n */\nexport function buildLegacyInitializeResponse(\n\tserverInfo: ServerInfo,\n\tid?: string | number | null,\n): McpResponse {\n\treturn {\n\t\tjsonrpc: \"2.0\",\n\t\tid: id ?? null,\n\t\tresult: {\n\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\tcapabilities: {\n\t\t\t\ttools: { listChanged: true },\n\t\t\t\tresources: { listChanged: true },\n\t\t\t\tprompts: { listChanged: true },\n\t\t\t},\n\t\t\tserverInfo,\n\t\t},\n\t};\n}\n\n/**\n * @mcp-legacy Detect if a request is strictly from a 2025-era legacy client.\n * Legacy requests either invoke 'initialize', 'notifications/initialized',\n * or lack modern '_meta' protocol envelopes.\n */\nexport function isLegacyRequest(request: McpRequest): boolean {\n\tif (\n\t\trequest.method === \"initialize\" ||\n\t\trequest.method === \"notifications/initialized\"\n\t) {\n\t\treturn true;\n\t}\n\n\tconst params = request.params as Record<string, unknown> | undefined;\n\tconst meta = params?._meta as Record<string, unknown> | undefined;\n\tconst version = meta?.[\"io.modelcontextprotocol/protocolVersion\"];\n\n\tif (!version || version === MCP_PROTOCOL_VERSION_LEGACY) {\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * @mcp-legacy Wrap and strip modern-era fields (resultType, ttlMs, cacheScope, etc.)\n * from a response to ensure 100% wire-compatibility with strict 2025 MCP clients.\n */\nexport function adaptResponseForLegacyClient(\n\tresponse: McpResponse,\n): McpResponse {\n\tif (!response.result || typeof response.result !== \"object\") {\n\t\treturn response;\n\t}\n\n\tconst rawResult = { ...(response.result as Record<string, unknown>) };\n\n\t// Strip modern-only envelope tags\n\tdelete rawResult.resultType;\n\tdelete rawResult.ttlMs;\n\tdelete rawResult.cacheScope;\n\n\treturn {\n\t\t...response,\n\t\tresult: rawResult,\n\t};\n}\n","import { z } from \"zod\";\n\n/**\n * Protocol Version Identifiers\n */\nexport const MCP_PROTOCOL_VERSION = \"2026-07-28\" as const;\n\nexport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"./gateway/mcp-compat.js\";\n\n/**\n * Protocol Era Classification\n */\nexport type McpEra = \"legacy\" | \"modern\";\n\n/**\n * Caching Hints for MCP 2026-07-28 Spec\n */\nexport interface CacheableResult {\n\tttlMs?: number;\n\tcacheScope?: \"public\" | \"private\";\n}\n\n/**\n * Multi-Round-Trip Requests (MRTR) Specification Types\n */\nexport interface InputRequest {\n\tid: string;\n\tmessage: string;\n\tschema?: Record<string, unknown>;\n}\n\nexport interface InputResponse {\n\tid: string;\n\tvalue: unknown;\n}\n\nexport interface InputRequiredResult {\n\tresultType: \"input_required\";\n\tinputRequests: InputRequest[];\n\trequestState?: string;\n}\n\n/**\n * Modern Envelope Metadata (_meta)\n */\nexport interface McpRequestMeta {\n\t\"io.modelcontextprotocol/protocolVersion\"?: string;\n\t\"io.modelcontextprotocol/clientInfo\"?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\t\"io.modelcontextprotocol/clientCapabilities\"?: Record<string, unknown>;\n\t[key: string]: unknown;\n}\n\n/**\n * Base Protocol Types representing parity with Model Context Protocol\n */\n\nexport const ToolSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tinputSchema: z.record(z.string(), z.unknown()), // Represents a JSON Schema\n});\n\nexport type Tool = z.infer<typeof ToolSchema>;\n\nexport const ResourceSchema = z.object({\n\turi: z.string(),\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tmimeType: z.string().optional(),\n});\n\nexport type Resource = z.infer<typeof ResourceSchema>;\n\nexport const PromptSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\targuments: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tdescription: z.string().optional(),\n\t\t\t\trequired: z.boolean().optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\nexport type Prompt = z.infer<typeof PromptSchema>;\n\nexport interface CallToolRequest {\n\tname: string;\n\targuments?: Record<string, unknown>;\n}\n\nexport interface CallToolResult {\n\tcontent: Array<{\n\t\ttype: \"text\" | \"image\" | \"resource\";\n\t\ttext?: string;\n\t\tdata?: string;\n\t\tmimeType?: string;\n\t\tresource?: {\n\t\t\turi: string;\n\t\t\ttext?: string;\n\t\t\tblob?: string;\n\t\t};\n\t}>;\n\tisError?: boolean;\n}\n\nexport interface GetPromptRequest {\n\tname: string;\n\targuments?: Record<string, string>;\n}\n\nexport interface GetPromptResult {\n\tdescription?: string;\n\tmessages: Array<{\n\t\trole: \"user\" | \"assistant\";\n\t\tcontent:\n\t\t\t| { type: \"text\"; text: string }\n\t\t\t| { type: \"image\"; data: string; mimeType: string }\n\t\t\t| {\n\t\t\t\t\ttype: \"resource\";\n\t\t\t\t\tresource: { uri: string; text?: string; blob?: string };\n\t\t\t  };\n\t}>;\n}\n\nexport interface ServerInfo {\n\tname: string;\n\tversion: string;\n\tcapabilities?: {\n\t\tprompts?: { listChanged?: boolean };\n\t\tresources?: { subscribe?: boolean; listChanged?: boolean };\n\t\ttools?: { listChanged?: boolean };\n\t\t/** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */\n\t\tlogging?: Record<string, unknown>;\n\t};\n}\n\nexport interface DiscoverResult {\n\tresultType: \"complete\";\n\tsupportedVersions: string[];\n\tcapabilities: ServerInfo[\"capabilities\"];\n\tserverInfo: ServerInfo;\n\tinstructions?: string;\n}\n\nexport interface McpRequest {\n\tmethod: string;\n\tparams?: unknown;\n\tid?: string | number | null;\n\tjsonrpc?: \"2.0\";\n}\n\nexport interface McpResponse {\n\tjsonrpc: \"2.0\";\n\tid?: string | number | null;\n\tresult?: unknown;\n\terror?: {\n\t\tcode: number;\n\t\tmessage: string;\n\t\tdata?: unknown;\n\t};\n}\n\n/**\n * Re-export AuthInfo from the security module for convenience.\n * Compatible with MCP TypeScript SDK AuthInfo interface shape.\n */\nexport type { AuthInfo } from \"./security/jwt-validator.js\";\n"]}

package/dist/chunk-QLCOEP5J.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rpc/crypto/kyber.ts"],"names":[],"mappings":";;;AAcA,IAAI,WAAA,GAAiE,IAAA;AAErE,eAAe,cAAA,GAAiB;AAC/B,EAAA,IAAI,CAAC,WAAA,EAAa;AACjB,IAAA,WAAA,GAAc,MAAM,cAAA,EAAe;AAAA,EACpC;AACA,EAAA,OAAO,WAAA;AACR;AAEO,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,WAAW,IAAA,EAAM;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,0DAAA,EAA6D,OAAO,MAAM,CAAA,CAAA;AAAA,OAC3E;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,sBAAsB,SAAA,EAGzB;AACF,IAAA,IAAI;AACH,MAAA,IAAI,SAAA,CAAU,WAAW,IAAA,EAAM;AAC9B,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MAClE;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,MAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,GAAA,CAAI,MAAM,SAAS,CAAA;AAEpC,MAAA,OAAO;AAAA,QACN,UAAA,EAAY,EAAA;AAAA,QACZ,YAAA,EAAc;AAAA,OACf;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAyC,MAAgB,OAAO,CAAA;AAAA,OACjE;AAAA,IACD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAA,GAGH;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,IAAI,eAAA,EAAgB;AACrC,IAAA,OAAO;AAAA,MACN,SAAA,EAAW,EAAA;AAAA,MACX,SAAA,EAAW;AAAA,KACZ;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CACL,UAAA,EACA,SAAA,EACsB;AACtB,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,EAAY,SAAS,CAAA;AAAA,EACvC;AACD","file":"chunk-QLCOEP5J.js","sourcesContent":["import { createMlKem768 } from \"mlkem\";\n\n/**\n * LIOP Post-Quantum Cryptography Wrapper\n * Implements ML-KEM-768 (NIST FIPS 203) for Zero-Trust secure key encapsulation\n * directly compatible with `pqcrypto-kyber` on the Mesh-Node Backend.\n *\n * Uses the `mlkem` package which provides:\n * - FIPS 203 compliance (ML-KEM standard)\n * - Constant-time validation (KyberSlash patched)\n * - ~3.5x performance improvement over legacy crystals-kyber\n */\n\n/** Lazy-initialized singleton for the ML-KEM-768 engine */\nlet kemInstance: Awaited<ReturnType<typeof createMlKem768>> | null = null;\n\nasync function getKemInstance() {\n\tif (!kemInstance) {\n\t\tkemInstance = await createMlKem768();\n\t}\n\treturn kemInstance;\n}\n\nexport const Kyber768Wrapper = {\n\t/**\n\t * Extracts and validates the 1184-byte Public Key from the Rust LIOP Data Node\n\t * @param buffer Raw buffer sent via gRPC IntentResponse\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== 1184) {\n\t\t\tthrow new Error(\n\t\t\t\t`Kyber768 Public Key must be exactly 1184 bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Encapsulates a shared secret using the server's public key.\n\t * Returns the 1088-byte ciphertext to be sent back, and the 32-byte shared AES secret.\n\t */\n\tasync encapsulateAsymmetric(publicKey: Uint8Array): Promise<{\n\t\tciphertext: Uint8Array;\n\t\tsharedSecret: Uint8Array;\n\t}> {\n\t\ttry {\n\t\t\tif (publicKey.length !== 1184) {\n\t\t\t\tthrow new Error(\"Kyber768 Public Key must be exactly 1184 bytes.\");\n\t\t\t}\n\n\t\t\tconst kem = await getKemInstance();\n\t\t\tconst [ct, ss] = kem.encap(publicKey);\n\n\t\t\treturn {\n\t\t\t\tciphertext: ct,\n\t\t\t\tsharedSecret: ss,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to perform PQC encapsulation: ${(error as Error).message}`,\n\t\t\t);\n\t\t}\n\t},\n\n\t/**\n\t * Generates a Kyber768 KeyPair for the server to accept intents.\n\t */\n\tasync generateKeyPair(): Promise<{\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t}> {\n\t\tconst kem = await getKemInstance();\n\t\tconst [pk, sk] = kem.generateKeyPair();\n\t\treturn {\n\t\t\tpublicKey: pk,\n\t\t\tsecretKey: sk,\n\t\t};\n\t},\n\n\t/**\n\t * Decapsulates the shared secret using the server's secret key.\n\t * Zero-fills the shared secret buffer after extraction for side-channel protection.\n\t */\n\tasync decapsulateSymmetric(\n\t\tciphertext: Uint8Array,\n\t\tsecretKey: Uint8Array,\n\t): Promise<Uint8Array> {\n\t\tconst kem = await getKemInstance();\n\t\treturn kem.decap(ciphertext, secretKey);\n\t},\n};\n"]}

package/dist/chunk-RWRRBYG4.js

@@ -1,3 +0,0 @@
-
-//# sourceMappingURL=chunk-RWRRBYG4.js.map
-//# sourceMappingURL=chunk-RWRRBYG4.js.map

package/dist/chunk-SONUORBT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sandbox/guardian.ts","../src/sandbox/wasi.ts"],"names":[],"mappings":";;;;;;;;;;AAAO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACxC,YAAY,OAAA,EAAiB;AAC5B,IAAA,KAAA,CAAM,CAAA,0BAAA,EAA6B,OAAO,CAAA,CAAE,CAAA;AAC5C,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACb;AACD,CAAA;AAQO,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1B,QAAQ,MAAA,EAAkC;AACzC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACjD,IAAA,IAAI,YAAA,GAAe,CAAA;AAEnB,IAAA,MAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,MACtC,UAAA;AAAA,MACA,SAAA;AAAA,MACA,UAAA;AAAA,MACA,SAAA;AAAA,MACA,aAAA;AAAA,MACA,mBAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA;AAAA,MACA,gBAAA;AAAA,MACA,YAAA;AAAA,MACA,WAAA;AAAA,MACA,gBAAA;AAAA,MACA,qBAAA;AAAA,MACA;AAAA,KACA,CAAA;AAED,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AAE1B,MAAA,IAAI,GAAA,CAAI,WAAW,wBAAA,EAA0B;AAC5C,QAAA,IAAI,CAAC,sBAAA,CAAuB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1C,UAAA,MAAM,IAAI,aAAA;AAAA,YACT,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,IAAI,CAAA;AAAA,WACvD;AAAA,QACD;AAAA,MACD,CAAA,MAAO;AACN,QAAA,MAAM,IAAI,aAAA;AAAA,UACT,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,SAClD;AAAA,MACD;AACA,MAAA,YAAA,EAAA;AAEA,MAAA,IAAI,eAAe,GAAA,EAAK;AACvB,QAAA,MAAM,IAAI,aAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAAA,IACD;AAAA,EAKD;AACD;ACxDA,IAAM,eAAe,OAAA,CAAQ,IAAA;AAE7B,OAAA,CAAQ,IAAA,GAAO,CAAC,IAAA,EAAM,IAAA,EAAA,GAAS,IAAA,KAAS;AACvC,EAAA,IACE,IAAA,KAAS,aACT,OAAO,IAAA,KAAS,YACf,IAAA,CAAiC,IAAA,KAAS,yBAC3C,MAAA,CAAQ,IAAA,CAAiC,OAAO,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,IAClE,MAAA,CAAQ,KAAiC,OAAO,CAAA,CAAE,QAAA,CAAS,gBAAgB,CAAA,EAC1E;AACD,IAAA,OAAO,KAAA;AAAA,EACR;AACA,EAAA,OAAO,aAAa,IAAA,CAAK,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM,GAAG,IAAI,CAAA;AACtD,CAAA;AAMO,SAAS,qBAAA,GAAgD;AAC/D,EAAA,MAAM,SAAA,GAAY,QAAQ,QAAA,KAAa,OAAA;AACvC,EAAA,MAAM,WAAW,SAAA,GACd;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,cAAA;AAAA,IACA,MAAA;AAAA,IACA,wBAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,MAEA,CAAC,MAAA,EAAQ,WAAW,MAAA,EAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAEtD,EAAA,MAAM,GAAA,GAA8B;AAAA,IACnC,QAAA,EAAU,YAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACZ;AAEA,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC3B,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,IAAI,QAAQ,MAAA,IAAa,CAAC,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AAC/C,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AAAA,IACZ;AAAA,EACD;AAEA,EAAA,OAAO,GAAA;AACR;AAMO,SAAS,4BAA4B,IAAA,EAAsB;AACjE,EAAA,IAAI;AACH,IAAA,MAAM,GAAA,GAAY,YAAM,IAAA,EAAM;AAAA,MAC7B,WAAA,EAAa,IAAA;AAAA,MACb,UAAA,EAAY,QAAA;AAAA,MACZ,0BAAA,EAA4B;AAAA,KAC5B,CAAA;AAED,IAAA,IAAI,KAAA,GAAQ,GAAA;AAEZ,IAAA,MAAA,CAAO,GAAA,EAAK;AAAA,MACX,UAAA,GAAa;AACZ,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,OAAA,GAAU;AACT,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,iBAAA,GAAoB;AACnB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA;AAAA,MAEA,oBAAoB,IAAA,EAAW;AAC9B,QAAA,KAAA,IAAS,CAAA,IAAK,IAAA,CAAK,YAAA,EAAc,MAAA,IAAU,CAAA,CAAA;AAAA,MAC5C,CAAA;AAAA,MACA,oBAAA,GAAuB;AACtB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA;AAAA,MAEA,iBAAiB,IAAA,EAAW;AAC3B,QAAA,KAAA,IAAS,CAAA,GAAA,CAAK,IAAA,CAAK,UAAA,EAAY,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC/C,CAAA;AAAA;AAAA,MAEA,gBAAgB,IAAA,EAAW;AAC1B,QAAA,KAAA,IAAS,CAAA,GAAA,CAAK,IAAA,CAAK,QAAA,EAAU,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC7C,CAAA;AAAA;AAAA,MAEA,eAAe,IAAA,EAAW;AACzB,QAAA,KAAA,IAAS,EAAA,GAAA,CAAM,IAAA,CAAK,SAAA,EAAW,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC/C,CAAA;AAAA,MACA,mBAAA,GAAsB;AACrB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,kBAAA,GAAqB;AACpB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,uBAAA,GAA0B;AACzB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,WAAA,GAAc;AACb,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,YAAA,GAAe;AACd,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,YAAA,GAAe;AACd,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV;AAAA,KACA,CAAA;AAGD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,GAAG,CAAA,GAAI,GAAA;AAAA,EACjC,SAAS,EAAA,EAAI;AAEZ,IAAA,OAAO,GAAA;AAAA,EACR;AACD;AAeO,IAAM,cAAN,MAAkB;AAAA,EAChB,IAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA,GAAqC,IAAA;AAAA,EACrC,YAAA,GAAqC,IAAA;AAAA,EAE7C,WAAA,CAAY,MAAA,GAAwB,EAAC,EAAG;AACvC,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,UAAA,EAAW;AAEnC,IAAA,IAAA,CAAK,UAAA,GAAkB,IAAA,CAAA,IAAA;AAAA,MACnB,EAAA,CAAA,MAAA,EAAO;AAAA,MACV,WAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACN;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,IAAA,GAAsB;AAClC,IAAA,IAAI;AACH,MAAA,MAAS,SAAM,IAAA,CAAK,UAAA,EAAY,EAAE,SAAA,EAAW,MAAM,CAAA;AAGnD,MAAA,IAAA,CAAK,eAAe,MAAS,EAAA,CAAA,IAAA;AAAA,QACvB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAAA,QACvC;AAAA,OACD;AACA,MAAA,IAAA,CAAK,eAAe,MAAS,EAAA,CAAA,IAAA;AAAA,QACvB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAAA,QACvC;AAAA,OACD;AAEA,MAAA,IAAA,CAAK,IAAA,GAAO,IAAI,IAAA,CAAK;AAAA,QACpB,OAAA,EAAS,UAAA;AAAA,QACT,IAAA,EAAM,CAAC,cAAc,CAAA;AAAA,QACrB,GAAA,EAAK,IAAA,CAAK,MAAA,CAAO,QAAA,GACd,EAAE,GAAG,qBAAA,EAAsB,EAAG,UAAA,EAAY,IAAA,CAAK,SAAA,EAAU,GACzD;AAAA,UACA,QAAA,EAAU,YAAA;AAAA,UACV,SAAA,EAAW,MAAA;AAAA,UACX,YAAY,IAAA,CAAK;AAAA,SAClB;AAAA,QACF,QAAA,EAAU;AAAA,UACT,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,GAAG,KAAK,MAAA,CAAO;AAAA,SAChB;AAAA,QACA,MAAA,EAAQ,KAAK,YAAA,CAAa,EAAA;AAAA,QAC1B,MAAA,EAAQ,KAAK,YAAA,CAAa;AAAA,OAC1B,CAAA;AAAA,IACF,SAAS,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,+BAAA,EAAkC,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,UAAU,CAAA;AAAA,OACtF;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QACZ,aAAA,EACA,OAAA,GAAqC,EAAC,EACtC,MAAA,GAAkC,EAAC,EACkB;AACrD,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAElC,IAAA,IAAI,yBAAyB,MAAA,EAAQ;AAEpC,MAAA,IAAI;AACH,QAAA,MAAM,SAAS,MAAM,WAAA,CAAY,QAAQ,IAAI,UAAA,CAAW,aAAa,CAAC,CAAA;AAGtE,QAAA,WAAA,CAAY,QAAQ,MAAM,CAAA;AAE1B,QAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,WAAA;AAAA,UAClC,MAAA;AAAA,UACA,IAAA,CAAK,KAAK,eAAA;AAAgB,SAC3B;AAGA,QAAA,IAAA,CAAK,IAAA,CAAK,MAAM,QAAQ,CAAA;AAGxB,QAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAC1D,QAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAC1D,QAAA,MAAM,MAAA,GAAS,MAAS,EAAA,CAAA,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AACpD,QAAA,MAAM,MAAA,GAAS,MAAS,EAAA,CAAA,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AAEpD,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACrC,QAAA,OAAO;AAAA,UACN,MAAA,EACC,MAAA,KAAW,MAAA,GAAS,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,GAAK,wBAAA,CAAA;AAAA,UAC1C,YAAA,EAAc,IAAA,CAAK,KAAA,CAAM,QAAA,GAAW,GAAI;AAAA,SACzC;AAAA,MACD,SAAS,KAAA,EAAgB;AACxB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,uBAAuB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC9E;AAAA,MACD;AAAA,IACD,CAAA,MAAO;AAKN,MAAA,MAAM,UAAA,mBAAkB,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAC1C,MAAA,MAAM,GAAA,GAAM,EAAE,OAAA,EAAS,GAAG,MAAA,EAAO;AAGjC,MAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,MAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,MAAA,UAAA,CAAW,MAAA,GAAS,MAAA;AACpB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,MAAA,GAAS,MAAA;AACpB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,cAAA,GAAiB,MAAA;AAC5B,MAAA,UAAA,CAAW,IAAA,GAAO,MAAA;AAClB,MAAA,UAAA,CAAW,QAAA,GAAW,MAAA;AACtB,MAAA,UAAA,CAAW,iBAAA,GAAoB,MAAA;AAC/B,MAAA,UAAA,CAAW,IAAA,GAAO,MAAA;AAMlB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,SAAA,GAAY,MAAA;AACvB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,aAAA,GAAgB,MAAA;AAC3B,MAAA,UAAA,CAAW,cAAA,GAAiB,MAAA;AAC5B,MAAA,UAAA,CAAW,QAAA,GAAW,MAAA;AAItB,MAAA,MAAM,eAAA,GAAkB,CAAC,GAAA,KAAkB;AAC1C,QAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AACpC,UAAA,OAAO,GAAA;AAAA,QACR;AACA,QAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,UAAA,OAAO,GAAA,CAAI,IAAI,eAAe,CAAA;AAAA,QAC/B;AACA,QAAA,MAAM,KAAA,mBAAQ,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAChC,QAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC7C,UAAA,KAAA,CAAM,GAAG,CAAA,GAAI,eAAA,CAAgB,GAAG,CAAA;AAAA,QACjC;AACA,QAAA,OAAO,KAAA;AAAA,MACR,CAAA;AAGA,MAAA,UAAA,CAAW,OAAA,GAAU,gBAAgB,IAAA,CAAK,KAAA,CAAM,KAAK,SAAA,CAAU,OAAO,CAAC,CAAC,CAAA;AACxE,MAAA,UAAA,CAAW,GAAA,GAAM,gBAAgB,IAAA,CAAK,KAAA,CAAM,KAAK,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AAEhE,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClD,QAAA,UAAA,CAAW,GAAG,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AAAA,MACpE;AAIA,MAAA,MAAM,UAAA,GAAa,CAAC,GAAA,KAAa;AAChC,QAAA,IAAI,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,EAAG;AAC5D,UAAA,MAAA,CAAO,OAAO,GAAG,CAAA;AACjB,UAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AACnC,YAAA,UAAA,CAAW,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,UACpB;AAAA,QACD;AACA,QAAA,OAAO,GAAA;AAAA,MACR,CAAA;AAEA,MAAA,UAAA,CAAW,WAAW,OAAO,CAAA;AAC7B,MAAA,UAAA,CAAW,WAAW,GAAG,CAAA;AAGzB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1C,QAAA,MAAA,CAAO,cAAA,CAAe,YAAY,GAAA,EAAK;AAAA,UACtC,QAAA,EAAU,KAAA;AAAA,UACV,YAAA,EAAc;AAAA,SACd,CAAA;AAAA,MACF;AAIA,MAAA,IAAI,cAAA,GAAiB,OAAO,aAAa,CAAA;AACzC,MAAA,IACC,eAAA,CAAgB,KAAK,cAAc,CAAA,IACnC,CAAC,cAAA,CAAe,QAAA,CAAS,oBAAoB,CAAA,EAC5C;AACD,QAAA,IAAI,CAAC,cAAA,CAAe,QAAA,CAAS,oBAAoB,CAAA,EAAG;AACnD,UAAA,cAAA,GAAiB,CAAA;AAAA,EAA8B,cAAc;AAAA,CAAA,CAAA;AAAA,QAC9D;AAAA,MACD;AAEA,MAAA,MAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA,MAAA,EAiBd,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAAA,CAAA;AAWnB,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,IAAI,EAAA,CAAG,MAAA,CAAO,UAAA,EAAY;AAAA,UACxC,UAAU,CAAA,aAAA,EAAgB,IAAA,CAAK,UAAU,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA;AAAA,SACpD,CAAA;AAGD,QAAA,IACC,CAAC,OAAA,CAAQ,GAAA,CAAI,MAAA,IACb,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,IAC5B,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAChC;AACD,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAC7B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,UAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,UAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,UAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,QAC9B;AAKA,QAAA,MAAM,OAAA,GAAU,EAAA,CAAG,aAAA,CAAc,UAAA,EAAY;AAAA,UAC5C,IAAA,EAAM,cAAA;AAAA,UACN,MAAA,EAAQ,gBAAA;AAAA,UACR,aAAA,EAAe;AAAA,SACf,CAAA;AAGD,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,CAAa,OAAA,EAAS;AAAA,UAC3C,OAAA,EAAS,GAAA;AAAA,UACT,aAAA,EAAe,IAAA;AAAA,UACf,aAAA,EAAe;AAAA,SACf,CAAA;AAGD,QAAA,MAAM,WACL,OAAO,aAAA,KAAkB,WACtB,aAAA,GACA,aAAA,CAAc,SAAS,OAAO,CAAA;AAClC,QAAA,MAAM,QAAA,GAAW,4BAA4B,QAAQ,CAAA;AAErD,QAAA,IAAI,WAAW,GAAA,EAAS;AACvB,UAAA,MAAM,IAAI,KAAA;AAAA,YACT;AAAA,WACD;AAAA,QACD;AAEA,QAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,QAAA,EAAS;AAAA,MACzC,SAAS,KAAA,EAAO;AACf,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kBAAA,EAAqB,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,mBAAmB,CAAA;AAAA,SAClF;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QAAA,GAA0B;AACtC,IAAA,IAAI;AACH,MAAA,IAAI,IAAA,CAAK,YAAA,EAAc,MAAM,IAAA,CAAK,aAAa,KAAA,EAAM;AACrD,MAAA,IAAI,IAAA,CAAK,YAAA,EAAc,MAAM,IAAA,CAAK,aAAa,KAAA,EAAM;AACrD,MAAA,MAAS,EAAA,CAAA,EAAA,CAAG,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IAC9D,SAAS,EAAA,EAAI;AAAA,IAEb;AAAA,EACD;AACD","file":"chunk-SONUORBT.js","sourcesContent":["export class GuardianError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(`AST Sec-Policy Violation: ${message}`);\n\t\tthis.name = \"GuardianError\";\n\t}\n}\n\n/**\n * The Guardian-TS Module\n * Scans the Abstract Syntax Tree (AST) imports of incoming WASM\n * before it reaches the V8 Wasmtime engine to prevent sandbox-escape\n * zero-days, resource exhaustion bombs, and evasive execution.\n */\nexport const ASTGuardian = {\n\t/**\n\t * Analyzes the WebAssembly Module interface proactively.\n\t *\n\t * @param module - The compiled WebAssembly.Module to inspect\n\t * @throws {GuardianError} If illegal imports or capabilities are detected\n\t */\n\tanalyze(module: WebAssembly.Module): void {\n\t\tconst imports = WebAssembly.Module.imports(module);\n\t\tlet _importCount = 0;\n\n\t\tconst ALLOWED_WASI_FUNCTIONS = new Set([\n\t\t\t\"fd_write\",\n\t\t\t\"fd_read\",\n\t\t\t\"fd_close\",\n\t\t\t\"fd_seek\",\n\t\t\t\"environ_get\",\n\t\t\t\"environ_sizes_get\",\n\t\t\t\"args_get\",\n\t\t\t\"args_sizes_get\",\n\t\t\t\"clock_time_get\",\n\t\t\t\"random_get\",\n\t\t\t\"proc_exit\",\n\t\t\t\"fd_prestat_get\",\n\t\t\t\"fd_prestat_dir_name\",\n\t\t\t\"fd_fdstat_get\",\n\t\t]);\n\n\t\tfor (const imp of imports) {\n\t\t\t// Strict Sandbox Validation: Only allow WASI preview 1 specific whitelisted functions.\n\t\t\tif (imp.module === \"wasi_snapshot_preview1\") {\n\t\t\t\tif (!ALLOWED_WASI_FUNCTIONS.has(imp.name)) {\n\t\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t\t`Banned WASI Import Detected: ${imp.module}/${imp.name}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t`Banned Host Import Module Detected: ${imp.module}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\t_importCount++;\n\n\t\t\tif (_importCount > 128) {\n\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t\"Import limit exceeded. Possible resource exhaustion attack.\",\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// In Node.js / V8, the maximum module size and function limits\n\t\t// are natively enforced by the engine during compilation.\n\t\t// A successfully compiled WebAssembly.Module already passed structural checks.\n\t},\n};\n","import crypto from \"node:crypto\";\nimport * as fs from \"node:fs/promises\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport vm from \"node:vm\";\nimport { WASI } from \"node:wasi\";\nimport * as acorn from \"acorn\";\nimport { simple } from \"acorn-walk\";\nimport { ASTGuardian } from \"./guardian.js\";\n\n// Silence Node.js ExperimentalWarning for WASI (Industrial console parity)\nconst originalEmit = process.emit;\n// @ts-expect-error\nprocess.emit = (name, data, ...args) => {\n\tif (\n\t\t(name === \"warning\" &&\n\t\t\ttypeof data === \"object\" &&\n\t\t\t(data as Record<string, unknown>).name === \"ExperimentalWarning\" &&\n\t\t\tString((data as Record<string, unknown>).message).includes(\"WASI\")) ||\n\t\tString((data as Record<string, unknown>).message).includes(\"importing WASI\")\n\t) {\n\t\treturn false;\n\t}\n\treturn originalEmit.call(process, name, data, ...args);\n};\n\n/**\n * Returns a filtered environment object containing only safe system variables,\n * preventing exposure of sensitive credentials and shell function injection.\n */\nexport function getDefaultEnvironment(): Record<string, string> {\n\tconst isWindows = process.platform === \"win32\";\n\tconst safeKeys = isWindows\n\t\t? [\n\t\t\t\t\"APPDATA\",\n\t\t\t\t\"HOMEDRIVE\",\n\t\t\t\t\"HOMEPATH\",\n\t\t\t\t\"LOCALAPPDATA\",\n\t\t\t\t\"PATH\",\n\t\t\t\t\"PROCESSOR_ARCHITECTURE\",\n\t\t\t\t\"SYSTEMDRIVE\",\n\t\t\t\t\"SYSTEMROOT\",\n\t\t\t\t\"TEMP\",\n\t\t\t\t\"USERNAME\",\n\t\t\t\t\"USERPROFILE\",\n\t\t\t\t\"PROGRAMFILES\",\n\t\t\t]\n\t\t: [\"HOME\", \"LOGNAME\", \"PATH\", \"SHELL\", \"TERM\", \"USER\"];\n\n\tconst env: Record<string, string> = {\n\t\tNODE_ENV: \"production\",\n\t\tLIOP_NODE: \"true\",\n\t};\n\n\tfor (const key of safeKeys) {\n\t\tconst val = process.env[key];\n\t\tif (val !== undefined && !val.startsWith(\"()\")) {\n\t\t\tenv[key] = val;\n\t\t}\n\t}\n\n\treturn env;\n}\n\n/**\n * Calculates deterministic execution fuel units based on AST instruction complexity.\n * Guarantees identical fuel consumption for the same logic across different hardware.\n */\nexport function calculateAstInstructionFuel(code: string): number {\n\ttry {\n\t\tconst ast = acorn.parse(code, {\n\t\t\tecmaVersion: 2022,\n\t\t\tsourceType: \"script\",\n\t\t\tallowReturnOutsideFunction: true,\n\t\t});\n\n\t\tlet score = 100; // Base fuel for VM initialization & envelope parsing\n\n\t\tsimple(ast, {\n\t\t\tIdentifier() {\n\t\t\t\tscore += 1;\n\t\t\t},\n\t\t\tLiteral() {\n\t\t\t\tscore += 1;\n\t\t\t},\n\t\t\tBinaryExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\tUnaryExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\tLogicalExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tVariableDeclaration(node: any) {\n\t\t\t\tscore += 5 * (node.declarations?.length || 1);\n\t\t\t},\n\t\t\tAssignmentExpression() {\n\t\t\t\tscore += 3;\n\t\t\t},\n\t\t\tMemberExpression() {\n\t\t\t\tscore += 3;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tObjectExpression(node: any) {\n\t\t\t\tscore += 5 + (node.properties?.length || 0) * 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tArrayExpression(node: any) {\n\t\t\t\tscore += 5 + (node.elements?.length || 0) * 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tCallExpression(node: any) {\n\t\t\t\tscore += 10 + (node.arguments?.length || 0) * 2;\n\t\t\t},\n\t\t\tFunctionDeclaration() {\n\t\t\t\tscore += 20;\n\t\t\t},\n\t\t\tFunctionExpression() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tArrowFunctionExpression() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tIfStatement() {\n\t\t\t\tscore += 5;\n\t\t\t},\n\t\t\tSwitchStatement() {\n\t\t\t\tscore += 10;\n\t\t\t},\n\t\t\tForStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tForInStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tForOfStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tWhileStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tDoWhileStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tTryStatement() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tReturnStatement() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t});\n\n\t\t// Normalize to buckets of 100 to prevent timing side-channel inference\n\t\treturn Math.ceil(score / 100) * 100;\n\t} catch (_e) {\n\t\t// Fallback for non-JS or unparseable code\n\t\treturn 500;\n\t}\n}\n\nexport interface SandboxConfig {\n\tallowEnv?: boolean;\n\tallowedDirectories?: Record<string, string>; // guestPath -> hostPath\n\tmemoryLimitMb?: number;\n}\n\n/**\n * LIOP WasiSandbox (Industrial Grade)\n *\n * Provides a production-grade isolated environment for executing untrusted logic.\n * Primarily uses WebAssembly (WASI) for byte-code isolation, with a hardened\n * V8 Isolate fallback for dynamic JS-to-WASM logic injection.\n */\nexport class WasiSandbox {\n\tprivate wasi!: WASI;\n\tprivate sandboxId: string;\n\tprivate workingDir: string;\n\tprivate config: SandboxConfig;\n\tprivate stdoutHandle: fs.FileHandle | null = null;\n\tprivate stderrHandle: fs.FileHandle | null = null;\n\n\tconstructor(config: SandboxConfig = {}) {\n\t\tthis.sandboxId = crypto.randomUUID();\n\t\t// Use a dedicated LIOP directory in the OS temp folder\n\t\tthis.workingDir = path.join(\n\t\t\tos.tmpdir(),\n\t\t\t\"liop-mesh\",\n\t\t\t\"sandboxes\",\n\t\t\tthis.sandboxId,\n\t\t);\n\t\tthis.config = config;\n\t}\n\n\t/**\n\t * Initializes the physical sandbox environment with strict directory lockdown.\n\t */\n\tpublic async init(): Promise<void> {\n\t\ttry {\n\t\t\tawait fs.mkdir(this.workingDir, { recursive: true });\n\n\t\t\t// Initialize WASI with explicit limits\n\t\t\tthis.stdoutHandle = await fs.open(\n\t\t\t\tpath.join(this.workingDir, \"stdout.log\"),\n\t\t\t\t\"w+\",\n\t\t\t);\n\t\t\tthis.stderrHandle = await fs.open(\n\t\t\t\tpath.join(this.workingDir, \"stderr.log\"),\n\t\t\t\t\"w+\",\n\t\t\t);\n\n\t\t\tthis.wasi = new WASI({\n\t\t\t\tversion: \"preview1\",\n\t\t\t\targs: [\"liop_runtime\"],\n\t\t\t\tenv: this.config.allowEnv\n\t\t\t\t\t? { ...getDefaultEnvironment(), RUNTIME_ID: this.sandboxId }\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tNODE_ENV: \"production\",\n\t\t\t\t\t\t\tLIOP_NODE: \"true\",\n\t\t\t\t\t\t\tRUNTIME_ID: this.sandboxId,\n\t\t\t\t\t\t},\n\t\t\t\tpreopens: {\n\t\t\t\t\t\"/sandbox\": this.workingDir,\n\t\t\t\t\t...this.config.allowedDirectories,\n\t\t\t\t},\n\t\t\t\tstdout: this.stdoutHandle.fd,\n\t\t\t\tstderr: this.stderrHandle.fd,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Sandbox Initialization Failed: ${error instanceof Error ? error.message : \"FS Error\"}`,\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Executes logic (WASM or JS-Wrapped) with hard resource limits.\n\t */\n\tpublic async execute(\n\t\tcompiledLogic: Buffer | string,\n\t\trecords: Record<string, unknown>[] = [],\n\t\tinputs: Record<string, unknown> = {},\n\t): Promise<{ output: unknown; fuelConsumed: number }> {\n\t\tconst startTime = performance.now();\n\n\t\tif (compiledLogic instanceof Buffer) {\n\t\t\t// Path A: Native WebAssembly Isolation\n\t\t\ttry {\n\t\t\t\tconst module = await WebAssembly.compile(new Uint8Array(compiledLogic));\n\n\t\t\t\t// Tier-0 Guardian: Static analysis to prevent sandbox escapes\n\t\t\t\tASTGuardian.analyze(module);\n\n\t\t\t\tconst instance = await WebAssembly.instantiate(\n\t\t\t\t\tmodule,\n\t\t\t\t\tthis.wasi.getImportObject() as WebAssembly.Imports,\n\t\t\t\t);\n\n\t\t\t\t// Standard entry point\n\t\t\t\tthis.wasi.start(instance);\n\n\t\t\t\t// Capture output from the sandbox\n\t\t\t\tconst stdoutPath = path.join(this.workingDir, \"stdout.log\");\n\t\t\t\tconst stderrPath = path.join(this.workingDir, \"stderr.log\");\n\t\t\t\tconst stdout = await fs.readFile(stdoutPath, \"utf-8\");\n\t\t\t\tconst stderr = await fs.readFile(stderrPath, \"utf-8\");\n\n\t\t\t\tconst duration = performance.now() - startTime;\n\t\t\t\treturn {\n\t\t\t\t\toutput:\n\t\t\t\t\t\tstdout || (stderr ? `Error: ${stderr}` : \"WASM_EXECUTION_SUCCESS\"),\n\t\t\t\t\tfuelConsumed: Math.floor(duration * 1000),\n\t\t\t\t};\n\t\t\t} catch (error: unknown) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`WASM Runtime Error: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\t);\n\t\t\t}\n\t\t} else {\n\t\t\t// Path B: Hardened V8 Isolate Fallback\n\t\t\t// Uses node:vm with zero-prototype objects to prevent prototype pollution escapes.\n\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for Sandbox global poisoning\n\t\t\tconst sandboxEnv: any = Object.create(null); // Isolated global object\n\t\t\tconst env = { records, ...inputs };\n\n\t\t\t// Explicitly poison Node.js escape vectors in the context\n\t\t\tsandboxEnv.require = undefined;\n\t\t\tsandboxEnv.process = undefined;\n\t\t\tsandboxEnv.global = undefined;\n\t\t\tsandboxEnv.globalThis = undefined;\n\t\t\tsandboxEnv.Buffer = undefined;\n\t\t\tsandboxEnv.setTimeout = undefined;\n\t\t\tsandboxEnv.setInterval = undefined;\n\t\t\tsandboxEnv.setImmediate = undefined;\n\t\t\tsandboxEnv.queueMicrotask = undefined;\n\t\t\tsandboxEnv.eval = undefined;\n\t\t\tsandboxEnv.Function = undefined;\n\t\t\tsandboxEnv.SharedArrayBuffer = undefined;\n\t\t\tsandboxEnv.Date = undefined;\n\n\t\t\t// [DoS Defense] Block off-heap memory allocation vectors.\n\t\t\t// Logic-on-Origin operates on JSON data (env.records) — binary buffers\n\t\t\t// serve no legitimate purpose and enable memory exhaustion DoS.\n\t\t\t// (Uint8Array(2GB) bypassed Piscina's maxOldGenerationSizeMb limit)\n\t\t\tsandboxEnv.ArrayBuffer = undefined;\n\t\t\tsandboxEnv.Uint8Array = undefined;\n\t\t\tsandboxEnv.Int8Array = undefined;\n\t\t\tsandboxEnv.Uint16Array = undefined;\n\t\t\tsandboxEnv.Int16Array = undefined;\n\t\t\tsandboxEnv.Uint32Array = undefined;\n\t\t\tsandboxEnv.Int32Array = undefined;\n\t\t\tsandboxEnv.Float32Array = undefined;\n\t\t\tsandboxEnv.Float64Array = undefined;\n\t\t\tsandboxEnv.BigInt64Array = undefined;\n\t\t\tsandboxEnv.BigUint64Array = undefined;\n\t\t\tsandboxEnv.DataView = undefined;\n\n\t\t\t// Recurse and strip prototype chain from host-passed objects to prevent escaping via constructor\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for recursive null prototype mapping\n\t\t\tconst toNullPrototype = (obj: any): any => {\n\t\t\t\tif (!obj || typeof obj !== \"object\") {\n\t\t\t\t\treturn obj;\n\t\t\t\t}\n\t\t\t\tif (Array.isArray(obj)) {\n\t\t\t\t\treturn obj.map(toNullPrototype);\n\t\t\t\t}\n\t\t\t\tconst clone = Object.create(null);\n\t\t\t\tfor (const [key, val] of Object.entries(obj)) {\n\t\t\t\t\tclone[key] = toNullPrototype(val);\n\t\t\t\t}\n\t\t\t\treturn clone;\n\t\t\t};\n\n\t\t\t// Inject strictly monitored globals\n\t\t\tsandboxEnv.records = toNullPrototype(JSON.parse(JSON.stringify(records))); // Deep copy safety + null prototype\n\t\t\tsandboxEnv.env = toNullPrototype(JSON.parse(JSON.stringify(env)));\n\n\t\t\tfor (const [key, value] of Object.entries(inputs)) {\n\t\t\t\tsandboxEnv[key] = toNullPrototype(JSON.parse(JSON.stringify(value)));\n\t\t\t}\n\n\t\t\t// Freeze the sandbox context to prevent mutation (SEC-GAP-1)\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for recursive deep freeze of unknown data\n\t\t\tconst deepFreeze = (obj: any) => {\n\t\t\t\tif (obj && typeof obj === \"object\" && !Object.isFrozen(obj)) {\n\t\t\t\t\tObject.freeze(obj);\n\t\t\t\t\tfor (const key of Object.keys(obj)) {\n\t\t\t\t\t\tdeepFreeze(obj[key]);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn obj;\n\t\t\t};\n\n\t\t\tdeepFreeze(sandboxEnv.records);\n\t\t\tdeepFreeze(sandboxEnv.env);\n\n\t\t\t// Prevent property addition/modification on global scope\n\t\t\tfor (const key of Object.keys(sandboxEnv)) {\n\t\t\t\tObject.defineProperty(sandboxEnv, key, {\n\t\t\t\t\twritable: false,\n\t\t\t\t\tconfigurable: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// LIOP Execution Wrapper\n\t\t\t// Host-side logic transformation to avoid 'new Function' in sandbox\n\t\t\tlet processedLogic = String(compiledLogic);\n\t\t\tif (\n\t\t\t\t/^\\s*return\\s/m.test(processedLogic) ||\n\t\t\t\t!processedLogic.includes(\"function liop_main\")\n\t\t\t) {\n\t\t\t\tif (!processedLogic.includes(\"function liop_main\")) {\n\t\t\t\t\tprocessedLogic = `function liop_main(env) {\\n${processedLogic}\\n}`;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst scriptCode = `\n\t\t\t\t(function() {\n\t\t\t\t\t\"use strict\";\n\t\t\t\t\ttry {\n\t\t\t\t\t\t// Pre-execution prototype freezing (PCI-DSS Compliance)\n\t\t\t\t\t\tObject.freeze(Object.prototype);\n\t\t\t\t\t\tObject.freeze(Array.prototype);\n\t\t\t\t\t\tObject.freeze(String.prototype);\n\t\t\t\t\t\tObject.freeze(Number.prototype);\n\t\t\t\t\t\tObject.freeze(Boolean.prototype);\n\t\t\t\t\t\tObject.freeze(RegExp.prototype);\n\t\t\t\t\t\tObject.freeze(Map.prototype);\n\t\t\t\t\t\tObject.freeze(Set.prototype);\n\t\t\t\t\t\tObject.freeze(Promise.prototype);\n\t\t\t\t\t\tObject.freeze(Error.prototype);\n\t\t\t\t\t\tObject.freeze(Object.getPrototypeOf(function(){}));\n\n\t\t\t\t\t\t${processedLogic}\n\t\t\t\t\t\tif (typeof liop_main === 'function') {\n\t\t\t\t\t\t\treturn liop_main(env);\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn \"ERR_NO_ENTRY_POINT\";\n\t\t\t\t\t} catch(e) {\n\t\t\t\t\t\treturn \"LogicError: \" + e.message;\n\t\t\t\t\t}\n\t\t\t\t})();\n\t\t\t`;\n\n\t\t\ttry {\n\t\t\t\tconst script = new vm.Script(scriptCode, {\n\t\t\t\t\tfilename: `liop-sandbox-${this.sandboxId.slice(0, 8)}.js`,\n\t\t\t\t});\n\n\t\t\t\t// Freeze Host prototypes in production (non-test environments) to completely block Prototype Pollution\n\t\t\t\tif (\n\t\t\t\t\t!process.env.VITEST &&\n\t\t\t\t\ttypeof Object.prototype === \"object\" &&\n\t\t\t\t\t!Object.isFrozen(Object.prototype)\n\t\t\t\t) {\n\t\t\t\t\tObject.freeze(Object.prototype);\n\t\t\t\t\tObject.freeze(Array.prototype);\n\t\t\t\t\tObject.freeze(String.prototype);\n\t\t\t\t\tObject.freeze(Number.prototype);\n\t\t\t\t\tObject.freeze(Boolean.prototype);\n\t\t\t\t\tObject.freeze(RegExp.prototype);\n\t\t\t\t\tObject.freeze(Map.prototype);\n\t\t\t\t\tObject.freeze(Set.prototype);\n\t\t\t\t\tObject.freeze(Promise.prototype);\n\t\t\t\t\tObject.freeze(Error.prototype);\n\t\t\t\t}\n\n\t\t\t\t// microtaskMode: Ensures Promises created inside the sandbox are\n\t\t\t\t// resolved within the timeout/breakOnSigint scope (Node.js ≥14.6).\n\t\t\t\t// Without this, async microtasks could escape the 5s CPU limit.\n\t\t\t\tconst context = vm.createContext(sandboxEnv, {\n\t\t\t\t\tname: \"LIOP Isolate\",\n\t\t\t\t\torigin: \"liop://sandbox\",\n\t\t\t\t\tmicrotaskMode: \"afterEvaluate\",\n\t\t\t\t});\n\n\t\t\t\t// Execution with hard CPU and Memory limits (Fuel)\n\t\t\t\tconst output = script.runInContext(context, {\n\t\t\t\t\ttimeout: 5000,\n\t\t\t\t\tbreakOnSigint: true,\n\t\t\t\t\tdisplayErrors: true,\n\t\t\t\t});\n\n\t\t\t\t// [Phase Beta-3] Deterministic AST Instruction Fuel Metering (SOC 2 / Zero Hardware Drift)\n\t\t\t\tconst logicStr =\n\t\t\t\t\ttypeof compiledLogic === \"string\"\n\t\t\t\t\t\t? compiledLogic\n\t\t\t\t\t\t: compiledLogic.toString(\"utf-8\");\n\t\t\t\tconst fuelUsed = calculateAstInstructionFuel(logicStr);\n\n\t\t\t\tif (fuelUsed > 1000000) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\"LIOP_RESOURCE_EXHAUSTED: Execution fuel limit exceeded.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\treturn { output, fuelConsumed: fuelUsed };\n\t\t\t} catch (error) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`V8 Isolate Fault: ${error instanceof Error ? error.message : \"Execution Timeout\"}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Physically cleans up the sandbox and releases resources.\n\t */\n\tpublic async teardown(): Promise<void> {\n\t\ttry {\n\t\t\tif (this.stdoutHandle) await this.stdoutHandle.close();\n\t\t\tif (this.stderrHandle) await this.stderrHandle.close();\n\t\t\tawait fs.rm(this.workingDir, { recursive: true, force: true });\n\t\t} catch (_e) {\n\t\t\t// Silent fail on teardown to prevent process crashes\n\t\t}\n\t}\n}\n"]}