@nekzus/liop 2.4.0-alpha.17 → 2.4.0-alpha.19

package/dist/{chunk-OBFNAQAU.js → chunk-EJ426URA.js}

@@ -1,4 +1,4 @@
-import { LiopMcpRouter } from './chunk-TBEZMRDI.js';
+import { LiopMcpRouter } from './chunk-VRB5HUYU.js';
 import { LIOP_SCOPES } from './chunk-WPTOJYN5.js';
 import { meshPeersConnected, manifestCacheSize, protocolMetrics } from './chunk-PAICJCKJ.js';
 import { log } from './chunk-K3DGJLUY.js';
@@ -814,5 +814,5 @@ var LiopHybridGateway = class {
 };
 
 export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest };
-//# sourceMappingURL=chunk-OBFNAQAU.js.map
-//# sourceMappingURL=chunk-OBFNAQAU.js.map
+//# sourceMappingURL=chunk-EJ426URA.js.map
+//# sourceMappingURL=chunk-EJ426URA.js.map

package/dist/{chunk-OBFNAQAU.js.map → chunk-EJ426URA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/security/prm.ts","../src/gateway/grpc-web.ts","../src/gateway/interceptor.ts","../src/gateway/rate-limiter.ts","../src/gateway/hybrid.ts"],"names":[],"mappings":";;;;;;;;;AAuCO,SAAS,8BAAA,CACf,QACA,QAAA,EAC4B;AAC5B,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,QAAA;AAAA,IACV,qBAAA,EAAuB,CAAC,MAAM,CAAA;AAAA,IAC9B,gBAAA,EAAkB,WAAA;AAAA,IAClB,wBAAA,EAA0B,CAAC,QAAQ,CAAA;AAAA,IACnC,sBAAA,EAAwB;AAAA,GACzB;AACD;;;AC7BO,IAAM,kBAAA,GAAqB;AAAA,EACjC,SAAA,EAAW,CAAA;AAAA,EACX,aAAA,EAAe,GAAA;AAAA,EACf,aAAA,EAAe,CAAA;AAAA,EACf,mBAAA,EAAqB,sBAAA;AAAA,EACrB,SAAA,EAAW,CAAA;AAAA,EACX,gBAAA,EAAkB,CAAA;AAAA,EAClB,cAAA,EAAgB,CAAA;AAAA,EAChB,uBAAA,EAAyB,CAAA;AAAA,EACzB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,gBAAA,EAAkB,CAAA;AAAA,EAClB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,sBAAA,EAAwB,EAAA;AAAA,EACxB,eAAA,EAAiB;AAClB;AAUO,SAAS,iBAAiB,WAAA,EAA+B;AAC/D,EAAA,IAAI,CAAC,aAAa,OAAO,KAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,YAAY,WAAA,EAAY;AACtC,EAAA,OACC,KAAA,CAAM,UAAA,CAAW,sBAAsB,CAAA,IACvC,KAAA,CAAM,WAAW,4BAA4B,CAAA,IAC7C,KAAA,CAAM,UAAA,CAAW,2BAA2B,CAAA;AAE9C;AAKO,SAAS,gBAAgB,OAAA,EAAsC;AACrE,EAAA,MAAM,GAAA,GAAM,OAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU,MAAA,CAAO,KAAK,OAAO,CAAA;AACpE,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,SAAA,EAAW,CAAC,CAAA;AACjD,EAAA,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,MAAA,EAAQ,CAAC,CAAA;AAClC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAA;AACnC;AAKO,SAAS,kBAAA,CACf,SAAiB,kBAAA,CAAmB,SAAA,EACpC,UAAkB,EAAA,EAClB,cAAA,GAAyC,EAAC,EACjC;AACT,EAAA,MAAM,KAAA,GAAQ;AAAA,IACb,eAAe,MAAM,CAAA,CAAA;AAAA,IACrB,CAAA,aAAA,EAAgB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAAA,GAC5C;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EAAG;AAC1D,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,EAC7B;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,CAAA;AACzC,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,OAAO,CAAA;AAEnD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,aAAA,EAAe,CAAC,CAAA;AACrD,EAAA,MAAA,CAAO,aAAA,CAAc,UAAA,CAAW,MAAA,EAAQ,CAAC,CAAA;AAEzC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,MAAA,EAAgC;AAC5D,EAAA,MAAM,SAAyB,EAAC;AAChC,EAAA,IAAI,MAAA,GAAS,CAAA;AAEb,EAAA,OAAO,MAAA,GAAS,kBAAA,CAAmB,aAAA,IAAiB,MAAA,CAAO,MAAA,EAAQ;AAClE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,CAAa,MAAA,GAAS,CAAC,CAAA;AAC7C,IAAA,MAAM,YAAA,GAAe,SAAS,kBAAA,CAAmB,aAAA;AACjD,IAAA,MAAM,aAAa,YAAA,GAAe,MAAA;AAElC,IAAA,IAAI,UAAA,GAAa,OAAO,MAAA,EAAQ;AAC/B,MAAA;AAAA,IACD;AAEA,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,CAAS,YAAA,EAAc,UAAU,CAAA;AACxD,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACX,SAAA,EAAA,CACE,IAAA,GAAO,kBAAA,CAAmB,aAAA,MAC3B,kBAAA,CAAmB,aAAA;AAAA,MACpB,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAO;AAAA,KAC5B,CAAA;AAED,IAAA,MAAA,GAAS,UAAA;AAAA,EACV;AAEA,EAAA,OAAO,MAAA;AACR;AAMA,eAAsB,sBAAA,CACrB,GAAA,EACA,GAAA,EACA,OAAA,EAIgB;AAChB,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACjC,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EAClB,CAAC,CAAA;AAED,EAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AACzB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AACrC,MAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AACpC,MAAA,MAAM,WAAA,GACL,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,SAAS,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC5D,MAAA,MAAM,WAAA,GAAc,IAAI,GAAA,IAAO,GAAA;AAE/B,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,gCAAA,EAAmC,WAAW,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,CAAA,OAAA;AAAA,OACtE;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,WAAA,EAAa,WAAW,CAAA;AAErD,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,GAAG,CAAA;AAChD,MAAA,GAAA,CAAI,SAAA;AAAA,QACH,+BAAA;AAAA,QACA;AAAA,OACD;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,EAAG;AAC1C,QAAA,GAAA,CAAI,KAAA,CAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,MACvC;AAGA,MAAA,GAAA,CAAI,MAAM,kBAAA,CAAmB,MAAA,CAAO,QAAQ,MAAA,CAAO,OAAA,IAAW,EAAE,CAAC,CAAA;AACjE,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,CAAE,CAAA;AAC/C,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,KAAA;AAAA,QACH,kBAAA;AAAA,UACC,kBAAA,CAAmB,eAAA;AAAA,UAClB,MAAgB,OAAA,IAAW;AAAA;AAC7B,OACD;AACA,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT;AAAA,EACD,CAAC,CAAA;AACF;;;AC3HA,IAAM,kBAAA,GAAqB,IAAA;AAW3B,eAAsB,yBAAA,CACrB,OAAA,EACA,OAAA,EACA,OAAA,EAEkC;AAClC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,QAAA;AACrC,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAM5C,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,OAAO,CAAC,CAAA;AAE5D,EAAA,IAAI,eAAA;AACJ,EAAA,MAAM,YAAA,GAAe,IAAI,OAAA,CAAe,CAAC,GAAG,MAAA,KAAW;AACtD,IAAA,eAAA,GAAkB,MAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,eAAA,EAAiB,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EACjE,CAAC,CAAA;AAED,EAAA,IAAI;AACH,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,MACjC,OAAA,CAAQ,OAAA;AAAA,QACP,QAAQ,WAAA,CAAY,aAAA,EAAe,EAAE,GAAG,OAAA,EAAS,QAAQ;AAAA,OAC1D;AAAA,MACA;AAAA,KACA,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACR,SAAS,KAAA,EAAgB;AACxB,IAAA,MAAM,eAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAE1E,IAAA,IAAI,aAAa,MAAA,EAAQ;AACxB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,mEAAmE,YAAY,CAAA;AAAA,OAChF;AACA,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,QAAA,EAAU,EAAE,gBAAA,EAAkB,YAAA,EAAc,UAAU,MAAA;AAAO,OAC9D;AAAA,IACD;AAGA,IAAA,GAAA,CAAI,KAAA;AAAA,MACH,sEAAsE,YAAY,CAAA;AAAA,KACnF;AACA,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,4BAA4B,YAAY,CAAA,CAAA;AAAA,MAChD,SAAA,EAAW,MAAA;AAAA,MACX,QAAA,EAAU,EAAE,gBAAA,EAAkB,YAAA,EAAc,UAAU,QAAA;AAAS,KAChE;AAAA,EACD,CAAA,SAAE;AACD,IAAA,IAAI,eAAA,EAAiB;AACpB,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,eAAe,CAAA;AAAA,IACpD;AAAA,EACD;AACD;;;ACnGO,IAAM,sBAAN,MAA0B;AAAA,EACf,QAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA,uBAAyC,GAAA,EAAI;AAAA,EACtD,YAAA;AAAA,EAER,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAG;AAC7C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,GAAA;AACpC,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,GAAA;AAG1C,IAAA,IAAA,CAAK,eAAe,WAAA,CAAY,MAAM,IAAA,CAAK,OAAA,IAAW,GAAM,CAAA;AAC5D,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,KAAU,UAAA,EAAY;AAClD,MAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,IACzB;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,MAAM,GAAA,EAA8B;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAEjC,IAAA,IAAI,CAAC,MAAA,IAAU,GAAA,IAAO,MAAA,CAAO,SAAA,EAAW;AACvC,MAAA,MAAA,GAAS;AAAA,QACR,KAAA,EAAO,CAAA;AAAA,QACP,SAAA,EAAW,MAAM,IAAA,CAAK;AAAA,OACvB;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAC5B,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,KAAK,WAAA,GAAc,CAAA;AAAA,QAC9B,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK;AAAA,OACf;AAAA,IACD;AAEA,IAAA,IAAI,MAAA,CAAO,KAAA,IAAS,IAAA,CAAK,WAAA,EAAa;AACrC,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW,CAAA;AAAA,QACX,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,OAC5C;AAAA,IACD;AAEA,IAAA,MAAA,CAAO,KAAA,EAAA;AACP,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,IAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,WAAA,GAAc,MAAA,CAAO,KAAA;AAAA,MACrC,OAAO,IAAA,CAAK,WAAA;AAAA,MACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,KAC5C;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,MAAM,GAAA,EAAmB;AAC/B,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,KAAK,IAAA,CAAK,OAAA,CAAQ,SAAQ,EAAG;AACnD,MAAA,IAAI,GAAA,IAAO,OAAO,SAAA,EAAW;AAC5B,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,MACxB;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,KAAA,GAAc;AACpB,IAAA,IAAI,KAAK,YAAA,EAAc;AACtB,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,MAAA;AAAA,IACrB;AACA,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACpB;AACD;;;ACrFO,IAAM,oBAAN,MAAwB;AAAA,EAa9B,YACS,UAAA,EACA,QAAA,GAA4B,MACpC,OAAA,GAAkB,KAAA,EAClB,oBACA,kBAAA,EACC;AALO,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAKR,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,UAAA,CAAW,YAAA;AACpC,IAAA,IAAA,CAAK,aAAA,GAAgB,KAAK,UAAA,CAAW,aAAA;AACrC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAI,mBAAA,CAAoB,kBAAkB,CAAA;AAC7D,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAG1B,IAAA,IAAA,CAAK,SAAS,IAAI,aAAA,CAAc,KAAK,UAAA,EAAY,IAAA,CAAK,UAAU,OAAO,CAAA;AAGvE,IAAA,IAAA,CAAK,WAAiB,KAAA,CAAA,YAAA,EAAa;AACnC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,WAAgB,IAAA,CAAA,YAAA,EAAa;AAClC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,SAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,CAAC,MAAA,KAAW;AAC7C,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,CAAC,MAAA,KAAW;AAC/B,QAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,EAAS,CAAE,WAAW,gBAAgB,CAAA;AAC7D,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,iDAAA,EAAoD,OAAA,GAAU,eAAA,GAAkB,gBAAgB,CAAA;AAAA,SACjG;AACA,QAAA,IAAI,OAAA,EAAS;AACZ,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC,CAAA,MAAO;AACN,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC;AACA,QAAA,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,MACtB,CAAC,CAAA;AACD,MAAA,MAAA,CAAO,EAAA;AAAA,QAAG,OAAA;AAAA,QAAS,CAAC,GAAA,KACnB,GAAA,CAAI,MAAM,CAAA,uCAAA,EAA0C,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,OAClE;AAAA,IACD,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AACA,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AAEA,IAAA,GAAA,CAAI,KAAK,4CAA4C,CAAA;AAAA,EACtD;AAAA,EAlDS,UAAA;AAAA,EACA,QAAA;AAAA,EAdD,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAEA,aAAA;AAAA,EACA,WAAA;AAAA,EACS,kBAAA;AAAA,EACT,UAAA,GAAa,KAAA;AAAA,EACb,cAAA,GAAiB,CAAA;AAAA,EAuDjB,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,QAAA,EAAU,CAAC,QAAQ,OAAA,KAAY;AAC/C,MAAA,MAAM,WAAA,GAAc,QAAQ,cAAc,CAAA;AAC1C,MAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,CAAA;AAE5B,MAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACvC,QAAA,IAAA,CAAK,iBAAiB,MAAiC,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC3B,QAAA,IAAA,CAAK,iBAAA,CAAkB,QAAmC,OAAO,CAAA;AAAA,MAClE;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,SAAA,EAAW,OAAO,KAAK,GAAA,KAAQ;AAC/C,MAAA,IAAA,CAAK,cAAA,IAAkB,CAAA;AACvB,MAAA,MAAM,SAAS,MAAM;AACpB,QAAA,GAAA,CAAI,cAAA,CAAe,UAAU,MAAM,CAAA;AACnC,QAAA,GAAA,CAAI,cAAA,CAAe,SAAS,MAAM,CAAA;AAClC,QAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,MAC1D,CAAA;AACA,MAAA,GAAA,CAAI,EAAA,CAAG,UAAU,MAAM,CAAA;AACvB,MAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAEtB,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,IAAO,EAAA;AACvB,MAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AAGnB,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,QAAA,EAAU;AAClB,UAAA,kBAAA,CAAmB,IAAI,EAAC,EAAG,KAAK,QAAA,CAAS,QAAA,GAAW,MAAM,CAAA;AAAA,QAC3D;AACA,QAAA,IAAI,KAAK,MAAA,EAAQ;AAChB,UAAA,iBAAA,CAAkB,IAAI,EAAC,EAAG,IAAA,CAAK,MAAA,CAAO,sBAAsB,CAAA;AAAA,QAC7D;AACA,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,UAClB,cAAA,EAAgB;AAAA,SAChB,CAAA;AACD,QAAA,GAAA,CAAI,GAAA,CAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA;AAC9C,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,IAAA;AAAA,YACR,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA;AAAA,YACnC,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,SAAA,EAAW;AAC1C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,MAAM,cAAc,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,WAAU,GAAI,IAAA;AAChE,QAAA,IAAI,CAAC,WAAA,EAAa;AACjB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,WAAA,EAAa,KAAA;AAAA,cACb,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,OAAA;AAAA,YACR,WAAA,EAAa,IAAA;AAAA,YACb,OAAO,IAAA,CAAK,QAAA,GAAW,KAAK,QAAA,CAAS,QAAA,GAAW,MAAA,GAAS,CAAA;AAAA,YACzD,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,IAAA,CAAK,UAAA,IAAc,GAAA,KAAQ,MAAA,EAAQ;AACtC,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,OAAA,EAAS,KAAA;AAAA,YACT,KAAA,EAAO;AAAA,cACN,IAAA,EAAM,KAAA;AAAA,cACN,OAAA,EAAS;AAAA;AACV,WACA;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,cAAc,CAAA;AAC9C,MAAA,IAAI,gBAAA,CAAiB,WAAW,CAAA,EAAG;AAClC,QAAA,MAAM,sBAAA,CAAuB,GAAA,EAAK,GAAA,EAAK,OAAO,SAAS,OAAA,KAAY;AAClE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,uCAAA,EAA0C,OAAO,CAAA,EAAA,EAAK,OAAA,CAAQ,MAAM,CAAA,OAAA;AAAA,WACrE;AACA,UAAA,OAAO;AAAA,YACN,QAAQ,kBAAA,CAAmB,SAAA;AAAA,YAC3B,OAAA,EAAS,IAAA;AAAA,YACT,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,EAAE;AAAA,WACrB;AAAA,QACD,CAAC,CAAA;AACD,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,IAAK,KAAK,aAAA,EAAe;AAClD,QAAA,MAAM,QAAA,GACL,OAAO,IAAA,CAAK,aAAA,CAAc,QAAA,KAAa,aACpC,IAAA,CAAK,aAAA,CAAc,QAAA,EAAS,GAC5B,IAAA,CAAK,aAAA;AAET,QAAA,MAAM,cAAc,GAAA,CAAI,GAAA;AACxB,QAAA,GAAA,CAAI,GAAA,GAAA,CAAO,WAAA,IAAe,EAAA,EAAI,KAAA,CAAM,CAAC,CAAA,IAAK,GAAA;AAC1C,QAAA,IAAI;AACH,UAAA,OAAO,QAAA,CAAS,KAAK,GAAG,CAAA;AAAA,QACzB,CAAA,SAAE;AACD,UAAA,GAAA,CAAI,GAAA,GAAM,WAAA;AAAA,QACX;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,uCAAA,EAAyC;AACxE,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,GAAA,GAAM,8BAAA;AAAA,YACX,IAAA,CAAK,aAAa,SAAA,EAAU;AAAA,YAC5B,IAAA,CAAK,aAAa,WAAA;AAAY,WAC/B;AACA,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAC3B,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,QAAA;AAAA,MACD;AAEA,MAAA,IACC,WAAW,KAAA,KACV,GAAA,KAAQ,OAAO,GAAA,KAAQ,MAAA,IAAU,QAAQ,SAAA,CAAA,EACzC;AACD,QAAA,IACC,QAAQ,SAAA,IACR,GAAA,CAAI,QAAQ,MAAA,EAAQ,QAAA,CAAS,kBAAkB,CAAA,EAC9C;AACD,UAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB;AAAA,YACA,QAAQ,IAAA,CAAK,QAAA,CAAS,SAAA,EAAU,EAAG,UAAS,IAAK,EAAA;AAAA,YACjD,UAAA,EAAY,IAAA,CAAK,QAAA,CACf,aAAA,EAAc,CACd,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,EAAU;AAAA,WAC1B,GACC,IAAA;AACH,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,EAAc,SAAA,EAAU;AAC5C,UAAA,MAAM,OAAA,GAAU,SACb,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GACtB,MAAA,GACA,CAAA,EAAG,MAAM,CAAA,KAAA,CAAA,GACV,EAAA;AACH,UAAA,MAAM,gBAAA,GACL,IAAA,CAAK,YAAA,IAAgB,MAAA,GAClB;AAAA,YACA,MAAA;AAAA,YACA,QAAA,EAAU,GAAG,OAAO,CAAA,KAAA,CAAA;AAAA,YACpB,GAAI,KAAK,aAAA,GACN;AAAA,cACA,cAAA,EAAgB,GAAG,OAAO,CAAA,MAAA;AAAA,gBAE1B;AAAC,WACL,GACC,MAAA;AAEJ,UAAA,MAAM,YAAA,GAAe;AAAA,YACpB,IAAA,EAAM,IAAA,CAAK,QAAA,EAAU,gBAAA,OAAuB,CAAA,GAAI,CAAA;AAAA,YAChD,WAAA,EAAa,IAAA,CAAK,YAAA,GACf,uCAAA,GACA,MAAA;AAAA,YACH,qBAAA,EAAuB,CAAC,UAAA,EAAY,UAAA,EAAY,SAAS;AAAA,WAC1D;AAEA,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,IAAA,EAAM,IAAA,CAAK,UAAA,CAAW,aAAA,EAAc;AAAA,cACpC,IAAA,EAAM,QAAA;AAAA,cACN,KAAA,EAAO,KAAK,UAAA,CAAW,SAAA,GAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA;AAAA,cACpD,IAAA,EAAM,gBAAA;AAAA,cACN,QAAA,EAAU,YAAA;AAAA,cACV,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,4BAA4B,CAAA;AACjE,QAAA,GAAA,CAAI,GAAA,CAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAA,CAWK,CAAA;AACb,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,GAAA,KAAQ,MAAA,IAAU,MAAA,KAAW,MAAA,EAAQ;AACxC,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,aAAA;AAC/B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACjD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AAClD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,IAAI,IAAA,GAAO,EAAA;AACX,QAAA,GAAA,CAAI,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACpD,QAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AAEzB,UAAA,MAAM,QAAA,GAAW,GAAA,CAAI,MAAA,CAAO,aAAA,IAAiB,WAAA;AAC7C,UAAA,MAAM,YAAA,GAAe,UAAU,QAAA,GAC5B,CAAA,OAAA,EAAU,SAAS,QAAQ,CAAA,CAAA,GAC3B,MAAM,QAAQ,CAAA,CAAA;AACjB,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,KAAA,CAAM,YAAY,CAAA;AACtD,UAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACxB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,cAAA,EAAgB,kBAAA;AAAA,cAChB,eAAe,IAAA,CAAK,IAAA,CAAK,WAAW,OAAA,GAAU,GAAI,EAAE,QAAA;AAAS,aAC7D,CAAA;AACD,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,EAAA,EAAI,IAAA;AAAA,gBACJ,KAAA,EAAO;AAAA,kBACN,IAAA,EAAM,MAAA;AAAA,kBACN,OAAA,EAAS;AAAA;AACV,eACA;AAAA,aACF;AACA,YAAA;AAAA,UACD;AAEA,UAAA,IAAI;AACH,YAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAMnC,YAAA,IAAI,IAAA,CAAK,oBAAoB,WAAA,EAAa;AACzC,cAAA,MAAM,UAAU,MAAM,yBAAA;AAAA,gBACrB,WAAA;AAAA,gBACA,EAAE,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,OAAA,EAAQ;AAAA,gBACxC,IAAA,CAAK;AAAA,eAIN;AACA,cAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACrB,gBAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,gBAAA,GAAA,CAAI,GAAA;AAAA,kBACH,KAAK,SAAA,CAAU;AAAA,oBACd,OAAA,EAAS,KAAA;AAAA,oBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,oBACtB,KAAA,EAAO;AAAA,sBACN,IAAA,EAAM,QAAQ,SAAA,IAAa,CAAA,KAAA;AAAA,sBAC3B,OAAA,EACC,QAAQ,MAAA,IACR;AAAA;AACF,mBACA;AAAA,iBACF;AACA,gBAAA;AAAA,cACD;AAAA,YACD;AAGA,YAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA;AAC1C,YAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA;AACtC,YAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAIrD,YAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,cAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,gBAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,cAC7B;AACA,cAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CACnB,yCACD,CAAA,EACC;AACD,gBAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,cACL;AAAA,YACD;AAEA,YAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,YAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,YAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,UACjC,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,kDAAA,EAAsD,EAAY,OAAO,CAAA;AAAA,aAC1E;AACA,YAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,aAAA;AAAc,eAC9C;AAAA,aACF;AAAA,UACD;AAAA,QACD,CAAC,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AAAA,MACpB;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,iBAAiB,MAAA,EAAiC;AACzD,IAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAmB;AAErC,MAAA,MAAM,IAAA,GAAO,KAAA;AACb,MAAA,IAAI,IAAA;AACH,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,yCAAA,EAA4C,KAAK,MAAM,CAAA,MAAA;AAAA,SACxD;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,cAAA,EAAgB,oBAAoB,CAAA;AACrE,IAAA,MAAA,CAAO,GAAA,EAAI;AAAA,EACZ;AAAA,EAEQ,iBAAA,CACP,QACA,OAAA,EACC;AACD,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,MAAA,CAAO,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACvD,IAAA,MAAA,CAAO,EAAA,CAAG,OAAO,YAAY;AAC5B,MAAA,IAAI;AACH,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,aAAa,OAAA,CAAQ,aAAA;AAC3B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACpD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AACrD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAGnC,QAAA,IAAI,IAAA,CAAK,oBAAoB,WAAA,EAAa;AACzC,UAAA,MAAM,UAAA,GACL,MAAA,CAAO,OAAA,EAAS,MAAA,EAAQ,aAAA,IAAiB,WAAA;AAC1C,UAAA,MAAM,UAAU,MAAM,yBAAA;AAAA,YACrB,WAAA;AAAA,YACA,EAAE,QAAA,EAAU,UAAA,EAAY,QAAA,EAAU,UAAU,OAAA,EAAQ;AAAA,YACpD,IAAA,CAAK;AAAA,WAIN;AACA,UAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACrB,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,GAAA;AAAA,cACN,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,gBACtB,KAAA,EAAO;AAAA,kBACN,IAAA,EAAM,QAAQ,SAAA,IAAa,CAAA,KAAA;AAAA,kBAC3B,OAAA,EACC,QAAQ,MAAA,IACR;AAAA;AACF,eACA;AAAA,aACF;AACA,YAAA;AAAA,UACD;AAAA,QACD;AAGA,QAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,QAAA,MAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAClC,QAAA,MAAM,UAAA,GAAa,QAAQ,sBAAsB,CAAA;AAIjD,QAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,UAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,YAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,UAC7B;AACA,UAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CAAM,yCAAyC,CAAA,EAClE;AACD,YAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,UACL;AAAA,QACD;AAEA,QAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QACpC,CAAA,aAAc,KAAA,EAAM;AAAA,MACrB,SAAS,EAAA,EAAI;AACZ,QAAA,MAAA,CAAO,OAAA,CAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,CAAA;AACjC,QAAA,MAAA,CAAO,GAAA,EAAI;AAAA,MACZ;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEA,MAAa,MAAA,CAAO,IAAA,EAAc,IAAA,GAAe,SAAA,EAA4B;AAC5E,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAG1B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,SAAA,EAAU;AACxC,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,QAAA,MAAM,IAAA,CAAK,QAAA,CAAS,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAChD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,uDAAA,EAAmD,KAAK,IAAI,CAAA;AAAA,SAC7D;AAAA,MACD;AAAA,IACD;AACA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAmC;AAC9D,QAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,8BAA8B,IAAI,CAAA,sCAAA;AAAA,WACnC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,QACzD;AACA,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,MAAM;AACvC,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,EAAQ;AACpC,QAAA,MAAM,aACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,OAAA,IAAW,IAAA;AACpD,QAAA,MAAM,eACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAEjD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,sEAAA,EAAoE,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SAC/F;AACA,QAAA,OAAA,CAAQ,YAAY,CAAA;AAAA,MACrB,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEO,SAAA,GAAqB;AAC3B,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA,EAEA,MAAa,KAAA,CAAM,SAAA,GAAY,GAAA,EAAqB;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,qDAAA,EAAwD,IAAA,CAAK,cAAc,CAAA,WAAA,EAAc,SAAS,CAAA,MAAA;AAAA,KACnG;AACA,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,OAAO,KAAK,cAAA,GAAiB,CAAA,IAAK,KAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,EAAW;AACjE,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,IACvD;AACA,IAAA,MAAM,KAAK,IAAA,EAAK;AAAA,EACjB;AAAA,EAEA,MAAa,IAAA,GAAO;AACnB,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AACvB,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AAAA,EACrB;AAAA,EAEO,SAAA,GAA2B;AACjC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACb;AACD","file":"chunk-OBFNAQAU.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Protected Resource Metadata — RFC 9728\n *\n * Builds the JSON document served at /.well-known/oauth-protected-resource.\n * This enables MCP clients to discover the authorization server and\n * required scopes for accessing LIOP tools and resources.\n *\n * Standards: RFC 9728, MCP Spec 2025-11-25\n */\n\nimport { LIOP_SCOPES } from \"./rbac.js\";\n\n/**\n * RFC 9728 Protected Resource Metadata response.\n *\n * @see https://datatracker.ietf.org/doc/rfc9728\n */\nexport interface ProtectedResourceMetadata {\n\t/** Identifier for the protected resource. */\n\tresource: string;\n\t/** Array of authorization server issuer URLs that can issue tokens for this resource. */\n\tauthorization_servers: string[];\n\t/** OAuth scopes accepted by this resource. */\n\tscopes_supported: readonly string[];\n\t/** Methods of presenting the bearer token (always \"header\" for LIOP). */\n\tbearer_methods_supported: string[];\n\t/** URL to the resource documentation. */\n\tresource_documentation: string;\n}\n\n/**\n * Builds the Protected Resource Metadata document (RFC 9728).\n *\n * @param issuer - OIDC issuer URL of the Nexus authorization server\n * @param audience - JWT audience claim (resource identifier)\n */\nexport function buildProtectedResourceMetadata(\n\tissuer: string,\n\taudience: string,\n): ProtectedResourceMetadata {\n\treturn {\n\t\tresource: audience,\n\t\tauthorization_servers: [issuer],\n\t\tscopes_supported: LIOP_SCOPES,\n\t\tbearer_methods_supported: [\"header\"],\n\t\tresource_documentation: \"https://github.com/nekzus/liop\",\n\t};\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP gRPC-Web Protocol Adapter (HTTP/1.1 Fallback)\n *\n * Implements standard gRPC-Web framing per the official gRPC-Web specification:\n * https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-WEB.md\n *\n * Allows web browsers, corporate Layer 7 HTTP/1.1 proxies, and enterprise WAFs\n * to invoke LIOP nodes over HTTP/1.1 without requiring HTTP/2 streaming or h2c.\n *\n * Frame Format:\n * - 1 byte: Frame Flag (0x00 = Data Frame, 0x80 = Trailers Frame)\n * - 4 bytes: 32-bit Big-Endian Unsigned Integer (payload length in bytes)\n * - N bytes: Message or Trailer payload\n */\n\nimport type * as http from \"node:http\";\nimport { log } from \"../utils/logger.js\";\n\nexport const GRPC_WEB_CONSTANTS = {\n\tFLAG_DATA: 0x00,\n\tFLAG_TRAILERS: 0x80,\n\tHEADER_LENGTH: 5,\n\tCONTENT_TYPE_PREFIX: \"application/grpc-web\",\n\tSTATUS_OK: 0,\n\tSTATUS_CANCELLED: 1,\n\tSTATUS_UNKNOWN: 2,\n\tSTATUS_INVALID_ARGUMENT: 3,\n\tSTATUS_DEADLINE_EXCEEDED: 4,\n\tSTATUS_NOT_FOUND: 5,\n\tSTATUS_PERMISSION_DENIED: 7,\n\tSTATUS_UNAUTHENTICATED: 16,\n\tSTATUS_INTERNAL: 13,\n} as const;\n\nexport interface GrpcWebFrame {\n\tisTrailer: boolean;\n\tpayload: Buffer;\n}\n\n/**\n * Checks if an incoming HTTP request is a gRPC-Web request.\n */\nexport function isGrpcWebRequest(contentType?: string): boolean {\n\tif (!contentType) return false;\n\tconst lower = contentType.toLowerCase();\n\treturn (\n\t\tlower.startsWith(\"application/grpc-web\") ||\n\t\tlower.startsWith(\"application/grpc-web+proto\") ||\n\t\tlower.startsWith(\"application/grpc-web+json\")\n\t);\n}\n\n/**\n * Encodes a binary payload into a standard 5-byte framed gRPC-Web Data Frame.\n */\nexport function encodeDataFrame(payload: Buffer | Uint8Array): Buffer {\n\tconst buf = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_DATA, 0);\n\theader.writeUInt32BE(buf.length, 1);\n\treturn Buffer.concat([header, buf]);\n}\n\n/**\n * Encodes gRPC status and optional message into a 5-byte framed gRPC-Web Trailer Frame.\n */\nexport function encodeTrailerFrame(\n\tstatus: number = GRPC_WEB_CONSTANTS.STATUS_OK,\n\tmessage: string = \"\",\n\tcustomTrailers: Record<string, string> = {},\n): Buffer {\n\tconst lines = [\n\t\t`grpc-status:${status}`,\n\t\t`grpc-message:${encodeURIComponent(message)}`,\n\t];\n\n\tfor (const [key, value] of Object.entries(customTrailers)) {\n\t\tlines.push(`${key}:${value}`);\n\t}\n\n\tconst trailerText = `${lines.join(\"\\r\\n\")}\\r\\n`;\n\tconst trailerBuf = Buffer.from(trailerText, \"utf-8\");\n\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_TRAILERS, 0);\n\theader.writeUInt32BE(trailerBuf.length, 1);\n\n\treturn Buffer.concat([header, trailerBuf]);\n}\n\n/**\n * Parses raw gRPC-Web byte streams into an array of frames.\n */\nexport function decodeFrames(buffer: Buffer): GrpcWebFrame[] {\n\tconst frames: GrpcWebFrame[] = [];\n\tlet offset = 0;\n\n\twhile (offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH <= buffer.length) {\n\t\tconst flag = buffer.readUInt8(offset);\n\t\tconst length = buffer.readUInt32BE(offset + 1);\n\t\tconst payloadStart = offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH;\n\t\tconst payloadEnd = payloadStart + length;\n\n\t\tif (payloadEnd > buffer.length) {\n\t\t\tbreak; // Incomplete frame\n\t\t}\n\n\t\tconst payload = buffer.subarray(payloadStart, payloadEnd);\n\t\tframes.push({\n\t\t\tisTrailer:\n\t\t\t\t(flag & GRPC_WEB_CONSTANTS.FLAG_TRAILERS) ===\n\t\t\t\tGRPC_WEB_CONSTANTS.FLAG_TRAILERS,\n\t\t\tpayload: Buffer.from(payload),\n\t\t});\n\n\t\toffset = payloadEnd;\n\t}\n\n\treturn frames;\n}\n\n/**\n * Dispatches an HTTP/1.1 gRPC-Web request to an underlying protocol handler\n * and serializes data and trailer frames back to the client.\n */\nexport async function dispatchGrpcWebRequest(\n\treq: http.IncomingMessage,\n\tres: http.ServerResponse,\n\thandler: (\n\t\tpath: string,\n\t\tpayload: Buffer,\n\t) => Promise<{ status: number; message?: string; data?: Buffer }>,\n): Promise<void> {\n\tconst chunks: Buffer[] = [];\n\n\treq.on(\"data\", (chunk: Buffer) => {\n\t\tchunks.push(chunk);\n\t});\n\n\treq.on(\"end\", async () => {\n\t\ttry {\n\t\t\tconst fullBody = Buffer.concat(chunks);\n\t\t\tconst frames = decodeFrames(fullBody);\n\t\t\tconst dataPayload =\n\t\t\t\tframes.find((f) => !f.isTrailer)?.payload ?? Buffer.alloc(0);\n\t\t\tconst requestPath = req.url || \"/\";\n\n\t\t\tlog.info(\n\t\t\t\t`[gRPC-Web] Handling request for ${requestPath} (${dataPayload.length} bytes)`,\n\t\t\t);\n\n\t\t\tconst result = await handler(requestPath, dataPayload);\n\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.setHeader(\"access-control-allow-origin\", \"*\");\n\t\t\tres.setHeader(\n\t\t\t\t\"access-control-expose-headers\",\n\t\t\t\t\"grpc-status, grpc-message, content-type\",\n\t\t\t);\n\n\t\t\t// Write Data Frame (if response payload exists)\n\t\t\tif (result.data && result.data.length > 0) {\n\t\t\t\tres.write(encodeDataFrame(result.data));\n\t\t\t}\n\n\t\t\t// Write Trailer Frame (status and message)\n\t\t\tres.write(encodeTrailerFrame(result.status, result.message || \"\"));\n\t\t\tres.end();\n\t\t} catch (error) {\n\t\t\tlog.error(`[gRPC-Web] Dispatch error: ${error}`);\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.write(\n\t\t\t\tencodeTrailerFrame(\n\t\t\t\t\tGRPC_WEB_CONSTANTS.STATUS_INTERNAL,\n\t\t\t\t\t(error as Error).message || \"Internal server error\",\n\t\t\t\t),\n\t\t\t);\n\t\t\tres.end();\n\t\t}\n\t});\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { AuthInfo } from \"../security/jwt-validator.js\";\nimport type { McpRequest } from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\n/**\n * Verdict returned by a GatewayInterceptor function.\n * Determines whether the request is admitted into the routing pipeline.\n */\nexport interface GatewayAdmissionResult {\n\t/** true = request passes to router.dispatch(). false = rejected at perimeter. */\n\tallowed: boolean;\n\t/** Human-readable denial reason (included in JSON-RPC error response). */\n\treason?: string;\n\t/** Custom JSON-RPC error code. Defaults to -32099 when omitted. */\n\terrorCode?: number;\n\t/** Opaque metadata bag for telemetry or audit logging downstream. */\n\tmetadata?: Record<string, unknown>;\n}\n\n/**\n * Contextual information passed to the interceptor alongside the request.\n * Contains only non-sensitive, non-cryptographic perimeter metadata.\n */\nexport interface GatewayInterceptorContext {\n\t/** Originating client IP address (post-JWT, post-rate-limit). */\n\tclientIp: string;\n\t/** Authenticated identity from JWT validation, or null for unauthenticated gateways. */\n\tauthInfo: AuthInfo | null;\n\t/** Transport protocol that received this request. */\n\tprotocol: \"http1\" | \"http2\";\n\t/** Abort signal that fires when the interceptor timeout expires. */\n\tsignal: AbortSignal;\n}\n\n/**\n * Technology-agnostic admission function.\n * The developer implements this in their application code, connecting\n * any decision engine (TypeSafe Jev, ONNX, regex rules, custom logic).\n *\n * Receives a frozen deep-clone of the request to prevent prototype pollution.\n * May return synchronously or asynchronously.\n */\nexport type GatewayInterceptor = (\n\trequest: Readonly<McpRequest>,\n\tcontext: GatewayInterceptorContext,\n) => Promise<GatewayAdmissionResult> | GatewayAdmissionResult;\n\n/**\n * Configuration for the perimeter admission hook.\n */\nexport interface GatewayInterceptorOptions {\n\t/** The interceptor function. When undefined, the gateway skips interception entirely. */\n\tinterceptor?: GatewayInterceptor;\n\t/** Maximum milliseconds to wait for the interceptor. Default: 2500. */\n\ttimeoutMs?: number;\n\t/** Behavior when the interceptor throws or times out. Default: \"closed\". */\n\tfailMode?: \"closed\" | \"open\";\n}\n\nconst DEFAULT_TIMEOUT_MS = 2500;\n\n/**\n * Executes the interceptor with timeout enforcement via AbortSignal.timeout(),\n * prototype pollution isolation via structuredClone + Object.freeze,\n * and fail-mode policy enforcement.\n *\n * AbortSignal.timeout() is stable since Node.js 17.3 (available in Node.js 20+ LTS).\n * Promise.race guarantees the gateway never blocks beyond timeoutMs even if the\n * interceptor ignores the signal.\n */\nexport async function executeGatewayInterceptor(\n\trequest: McpRequest,\n\tcontext: Omit<GatewayInterceptorContext, \"signal\">,\n\toptions: Required<Pick<GatewayInterceptorOptions, \"interceptor\">> &\n\t\tGatewayInterceptorOptions,\n): Promise<GatewayAdmissionResult> {\n\tconst timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\tconst failMode = options.failMode ?? \"closed\";\n\tconst signal = AbortSignal.timeout(timeoutMs);\n\n\t// structuredClone severs all prototype chain references (deep copy).\n\t// Object.freeze blocks top-level mutation on the clone.\n\t// Even if the interceptor mutates nested properties, the original\n\t// jsonRequest in the gateway scope remains untouched.\n\tconst frozenRequest = Object.freeze(structuredClone(request));\n\n\tlet onAbortListener: (() => void) | undefined;\n\tconst abortPromise = new Promise<never>((_, reject) => {\n\t\tonAbortListener = () => reject(signal.reason);\n\t\tsignal.addEventListener(\"abort\", onAbortListener, { once: true });\n\t});\n\n\ttry {\n\t\tconst result = await Promise.race([\n\t\t\tPromise.resolve(\n\t\t\t\toptions.interceptor(frozenRequest, { ...context, signal }),\n\t\t\t),\n\t\t\tabortPromise,\n\t\t]);\n\t\treturn result;\n\t} catch (error: unknown) {\n\t\tconst errorMessage = error instanceof Error ? error.message : String(error);\n\n\t\tif (failMode === \"open\") {\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-Gateway] Interceptor error (fail-open, allowing request): ${errorMessage}`,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tallowed: true,\n\t\t\t\tmetadata: { interceptorError: errorMessage, failMode: \"open\" },\n\t\t\t};\n\t\t}\n\n\t\t// fail-closed: reject with error response\n\t\tlog.error(\n\t\t\t`[LIOP-Gateway] Interceptor error (fail-closed, rejecting request): ${errorMessage}`,\n\t\t);\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Interceptor unavailable: ${errorMessage}`,\n\t\t\terrorCode: -32098,\n\t\t\tmetadata: { interceptorError: errorMessage, failMode: \"closed\" },\n\t\t};\n\t} finally {\n\t\tif (onAbortListener) {\n\t\t\tsignal.removeEventListener(\"abort\", onAbortListener);\n\t\t}\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Sliding-Window Rate Limiter\n *\n * High-performance, zero-dependency in-memory rate limiter designed\n * to protect the LIOP Hybrid Gateway and Mesh Nodes against Denial of Service (DoS),\n * worker pool exhaustion, and brute-force attacks.\n *\n * Conforms to OWASP API Security Top 10 (API4:2023 - Unrestricted Resource Consumption).\n */\n\nexport interface RateLimiterOptions {\n\t/** Window duration in milliseconds (default: 60,000ms = 1 minute) */\n\twindowMs?: number;\n\t/** Maximum number of allowed requests per window (default: 120) */\n\tmaxRequests?: number;\n}\n\nexport interface RateLimitStatus {\n\tallowed: boolean;\n\tremaining: number;\n\tlimit: number;\n\tresetMs: number;\n}\n\ninterface WindowRecord {\n\tcount: number;\n\tresetTime: number;\n}\n\nexport class InMemoryRateLimiter {\n\tprivate readonly windowMs: number;\n\tprivate readonly maxRequests: number;\n\tprivate readonly records: Map<string, WindowRecord> = new Map();\n\tprivate cleanupTimer?: NodeJS.Timeout;\n\n\tconstructor(options: RateLimiterOptions = {}) {\n\t\tthis.windowMs = options.windowMs ?? 60_000;\n\t\tthis.maxRequests = options.maxRequests ?? 120;\n\n\t\t// Clean up expired buckets periodically (every 30s)\n\t\tthis.cleanupTimer = setInterval(() => this.cleanup(), 30_000);\n\t\tif (typeof this.cleanupTimer.unref === \"function\") {\n\t\t\tthis.cleanupTimer.unref();\n\t\t}\n\t}\n\n\t/**\n\t * Evaluates whether a request from the given key (IP, token, or clientId) is permitted.\n\t *\n\t * @param key Identifier for the client (e.g., remote IP or OAuth client ID)\n\t * @returns Status containing allowed boolean, remaining quota, and time until reset\n\t */\n\tpublic check(key: string): RateLimitStatus {\n\t\tconst now = Date.now();\n\t\tlet record = this.records.get(key);\n\n\t\tif (!record || now >= record.resetTime) {\n\t\t\trecord = {\n\t\t\t\tcount: 1,\n\t\t\t\tresetTime: now + this.windowMs,\n\t\t\t};\n\t\t\tthis.records.set(key, record);\n\t\t\treturn {\n\t\t\t\tallowed: true,\n\t\t\t\tremaining: this.maxRequests - 1,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: this.windowMs,\n\t\t\t};\n\t\t}\n\n\t\tif (record.count >= this.maxRequests) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\tremaining: 0,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t\t};\n\t\t}\n\n\t\trecord.count++;\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\tremaining: this.maxRequests - record.count,\n\t\t\tlimit: this.maxRequests,\n\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t};\n\t}\n\n\t/**\n\t * Explicitly resets the rate limit bucket for a given key.\n\t */\n\tpublic reset(key: string): void {\n\t\tthis.records.delete(key);\n\t}\n\n\t/**\n\t * Cleans up expired rate-limiting buckets to prevent memory leaks.\n\t */\n\tpublic cleanup(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [key, record] of this.records.entries()) {\n\t\t\tif (now >= record.resetTime) {\n\t\t\t\tthis.records.delete(key);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Destroys internal timers and clears records.\n\t */\n\tpublic close(): void {\n\t\tif (this.cleanupTimer) {\n\t\t\tclearInterval(this.cleanupTimer);\n\t\t\tthis.cleanupTimer = undefined;\n\t\t}\n\t\tthis.records.clear();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as http from \"node:http\";\nimport * as http2 from \"node:http2\";\nimport * as net from \"node:net\";\nimport type { MeshNode } from \"../mesh/index.js\";\nimport {\n\tmanifestCacheSize,\n\tmeshPeersConnected,\n\tprotocolMetrics,\n} from \"../observability/metrics.js\";\nimport type { AuthInfo, JwtValidator } from \"../security/jwt-validator.js\";\nimport { buildProtectedResourceMetadata } from \"../security/prm.js\";\nimport type { LiopServer } from \"../server/index.js\";\nimport { log } from \"../utils/logger.js\";\nimport {\n\tdispatchGrpcWebRequest,\n\tGRPC_WEB_CONSTANTS,\n\tisGrpcWebRequest,\n} from \"./grpc-web.js\";\nimport {\n\texecuteGatewayInterceptor,\n\ttype GatewayInterceptorOptions,\n} from \"./interceptor.js\";\nimport {\n\tInMemoryRateLimiter,\n\ttype RateLimiterOptions,\n} from \"./rate-limiter.js\";\nimport { LiopMcpRouter } from \"./router.js\";\n\n/**\n * LIOP Hybrid Gateway\n * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.\n */\nexport class LiopHybridGateway {\n\tprivate netServer: net.Server;\n\tprivate h2Server: http2.Http2Server;\n\tprivate h1Server: http.Server;\n\tprivate router: LiopMcpRouter;\n\tprivate jwtValidator?: JwtValidator;\n\t// biome-ignore lint/suspicious/noExplicitAny: oidc-provider is loaded in Phase C\n\tprivate oauthProvider?: any;\n\tprivate rateLimiter: InMemoryRateLimiter;\n\tprivate readonly interceptorOptions?: GatewayInterceptorOptions;\n\tprivate isDraining = false;\n\tprivate activeRequests = 0;\n\n\tconstructor(\n\t\tprivate liopServer: LiopServer,\n\t\tprivate meshNode: MeshNode | null = null,\n\t\trpcPort: number = 50051,\n\t\trateLimiterOptions?: RateLimiterOptions,\n\t\tinterceptorOptions?: GatewayInterceptorOptions,\n\t) {\n\t\tthis.jwtValidator = this.liopServer.jwtValidator;\n\t\tthis.oauthProvider = this.liopServer.oauthProvider;\n\t\tthis.rateLimiter = new InMemoryRateLimiter(rateLimiterOptions);\n\t\tthis.interceptorOptions = interceptorOptions;\n\n\t\t// Initialize the Universal Router\n\t\tthis.router = new LiopMcpRouter(this.liopServer, this.meshNode, rpcPort);\n\n\t\t// Internal HTTP/2 Server (for Native gRPC Proxying)\n\t\tthis.h2Server = http2.createServer();\n\t\tthis.setupH2Routes();\n\n\t\t// Internal HTTP/1 Server (for Browser/MCP)\n\t\tthis.h1Server = http.createServer();\n\t\tthis.setupH1Routes();\n\n\t\t// Primary Multiplexer (L4)\n\t\tthis.netServer = net.createServer((socket) => {\n\t\t\tsocket.once(\"data\", (buffer) => {\n\t\t\t\tconst isHttp2 = buffer.toString().startsWith(\"PRI * HTTP/2.0\");\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Incoming L4 Connection. Protocol: ${isHttp2 ? \"HTTP/2 (gRPC)\" : \"HTTP/1.1 (MCP)\"}`,\n\t\t\t\t);\n\t\t\t\tif (isHttp2) {\n\t\t\t\t\tthis.h2Server.emit(\"connection\", socket);\n\t\t\t\t} else {\n\t\t\t\t\tthis.h1Server.emit(\"connection\", socket);\n\t\t\t\t}\n\t\t\t\tsocket.unshift(buffer);\n\t\t\t});\n\t\t\tsocket.on(\"error\", (err) =>\n\t\t\t\tlog.error(`[LIOP-Gateway] NetServer Socket Error: ${err.message}`),\n\t\t\t);\n\t\t});\n\n\t\t// Attach error listeners to sub-servers to catch silent failures\n\t\tthis.h1Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H1 Server Error: ${err.message}`),\n\t\t);\n\t\tthis.h2Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H2 Server Error: ${err.message}`),\n\t\t);\n\n\t\tlog.info(\"[LIOP-Gateway] Hybrid adapter initialized.\");\n\t}\n\n\tprivate setupH2Routes() {\n\t\tthis.h2Server.on(\"stream\", (stream, headers) => {\n\t\t\tconst contentType = headers[\"content-type\"] as string;\n\t\t\tconst path = headers[\":path\"] as string;\n\n\t\t\tif (contentType === \"application/grpc\") {\n\t\t\t\tthis.handleGrpcStream(stream as http2.ServerHttp2Stream);\n\t\t\t} else if (path === \"/mcp\") {\n\t\t\t\tthis.handleMcpH2Stream(stream as http2.ServerHttp2Stream, headers);\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate setupH1Routes() {\n\t\tthis.h1Server.on(\"request\", async (req, res) => {\n\t\t\tthis.activeRequests += 1;\n\t\t\tconst onDone = () => {\n\t\t\t\tres.removeListener(\"finish\", onDone);\n\t\t\t\tres.removeListener(\"close\", onDone);\n\t\t\t\tthis.activeRequests = Math.max(0, this.activeRequests - 1);\n\t\t\t};\n\t\t\tres.on(\"finish\", onDone);\n\t\t\tres.on(\"close\", onDone);\n\n\t\t\tconst url = req.url || \"\";\n\t\t\tconst method = req.method;\n\n\t\t\t// [Phase Beta-3] Prometheus Metrics Endpoint\n\t\t\tif (method === \"GET\" && url === \"/metrics\") {\n\t\t\t\tif (this.meshNode) {\n\t\t\t\t\tmeshPeersConnected.set({}, this.meshNode.getPeers().length);\n\t\t\t\t}\n\t\t\t\tif (this.router) {\n\t\t\t\t\tmanifestCacheSize.set({}, this.router.getManifestCacheSize());\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, {\n\t\t\t\t\t\"Content-Type\": \"text/plain; version=0.0.4; charset=utf-8\",\n\t\t\t\t});\n\t\t\t\tres.end(protocolMetrics.exportPrometheusText());\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Liveness Probe\n\t\t\tif (method === \"GET\" && url === \"/healthz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ok\",\n\t\t\t\t\t\tuptime: Math.floor(process.uptime()),\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Readiness Probe\n\t\t\tif (method === \"GET\" && url === \"/readyz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst meshStarted = this.meshNode ? this.meshNode.isStarted() : true;\n\t\t\t\tif (!meshStarted) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"unready\",\n\t\t\t\t\t\t\tmeshStarted: false,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ready\",\n\t\t\t\t\t\tmeshStarted: true,\n\t\t\t\t\t\tpeers: this.meshNode ? this.meshNode.getPeers().length : 0,\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Reject new MCP requests if draining\n\t\t\tif (this.isDraining && url === \"/mcp\") {\n\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tcode: -32000,\n\t\t\t\t\t\t\tmessage: \"Gateway is draining connections for shutdown\",\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-2] gRPC-Web HTTP/1.1 Framing Fallback\n\t\t\tconst contentType = req.headers[\"content-type\"];\n\t\t\tif (isGrpcWebRequest(contentType)) {\n\t\t\t\tawait dispatchGrpcWebRequest(req, res, async (reqPath, payload) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] gRPC-Web fallback call: ${reqPath} (${payload.length} bytes)`,\n\t\t\t\t\t);\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: GRPC_WEB_CONSTANTS.STATUS_OK,\n\t\t\t\t\t\tmessage: \"OK\",\n\t\t\t\t\t\tdata: Buffer.from(\"\"),\n\t\t\t\t\t};\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [SEC] M2M OAuth 2.1 OIDC Authorization Server Router (Phase C proxy)\n\t\t\tif (url.startsWith(\"/oidc\") && this.oauthProvider) {\n\t\t\t\tconst callback =\n\t\t\t\t\ttypeof this.oauthProvider.callback === \"function\"\n\t\t\t\t\t\t? this.oauthProvider.callback()\n\t\t\t\t\t\t: this.oauthProvider;\n\t\t\t\t// Rewrite req.url to strip the '/oidc' prefix before delegating to oidc-provider\n\t\t\t\tconst originalUrl = req.url;\n\t\t\t\treq.url = (originalUrl || \"\").slice(5) || \"/\";\n\t\t\t\ttry {\n\t\t\t\t\treturn callback(req, res);\n\t\t\t\t} finally {\n\t\t\t\t\treq.url = originalUrl;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// [SEC] RFC 9728 Protected Resource Metadata (PRM) Endpoint\n\t\t\tif (method === \"GET\" && url === \"/.well-known/oauth-protected-resource\") {\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst prm = buildProtectedResourceMetadata(\n\t\t\t\t\t\tthis.jwtValidator.getIssuer(),\n\t\t\t\t\t\tthis.jwtValidator.getAudience(),\n\t\t\t\t\t);\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(JSON.stringify(prm));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\tmethod === \"GET\" &&\n\t\t\t\t(url === \"/\" || url === \"/mcp\" || url === \"/health\")\n\t\t\t) {\n\t\t\t\tif (\n\t\t\t\t\turl === \"/health\" &&\n\t\t\t\t\treq.headers.accept?.includes(\"application/json\")\n\t\t\t\t) {\n\t\t\t\t\tconst meshInfo = this.meshNode\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\tpeerId: this.meshNode.getPeerId()?.toString() || \"\",\n\t\t\t\t\t\t\t\tmultiaddrs: this.meshNode\n\t\t\t\t\t\t\t\t\t.getMultiaddrs()\n\t\t\t\t\t\t\t\t\t.map((m) => m.toString()),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: null;\n\t\t\t\t\tconst issuer = this.jwtValidator?.getIssuer();\n\t\t\t\t\tconst baseUrl = issuer\n\t\t\t\t\t\t? issuer.endsWith(\"/oidc\")\n\t\t\t\t\t\t\t? issuer\n\t\t\t\t\t\t\t: `${issuer}/oidc`\n\t\t\t\t\t\t: \"\";\n\t\t\t\t\tconst authInfoResponse =\n\t\t\t\t\t\tthis.jwtValidator && issuer\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tissuer,\n\t\t\t\t\t\t\t\t\tjwks_uri: `${baseUrl}/jwks`,\n\t\t\t\t\t\t\t\t\t...(this.oauthProvider\n\t\t\t\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\t\t\t\ttoken_endpoint: `${baseUrl}/token`,\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: undefined;\n\n\t\t\t\t\tconst topologyInfo = {\n\t\t\t\t\t\ttier: this.meshNode?.isPrivateNetwork?.() ? 1 : 2,\n\t\t\t\t\t\tprmEndpoint: this.jwtValidator\n\t\t\t\t\t\t\t? \"/.well-known/oauth-protected-resource\"\n\t\t\t\t\t\t\t: undefined,\n\t\t\t\t\t\ttransportCapabilities: [\"http-mcp\", \"grpc-lio\", \"p2p-dht\"],\n\t\t\t\t\t};\n\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"healthy\",\n\t\t\t\t\t\t\tnode: this.liopServer.getServerInfo(),\n\t\t\t\t\t\t\tmesh: meshInfo,\n\t\t\t\t\t\t\ttools: this.liopServer.listTools().map((t) => t.name),\n\t\t\t\t\t\t\tauth: authInfoResponse,\n\t\t\t\t\t\t\ttopology: topologyInfo,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(`\n                    <body style=\"background:#0f172a;color:#f8fafc;font-family:sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;margin:0\">\n                        <div style=\"background:#1e293b;padding:40px;border-radius:16px;border:1px solid #38bdf8;text-align:center;box-shadow:0 20px 25px -5px rgba(0,0,0,0.1)\">\n                            <h1 style=\"color:#38bdf8;margin-top:0\">LIOP Protocol Transformer</h1>\n                            <p style=\"opacity:0.8;font-weight:600\">L4/L7 Transcoding: JSON-RPC &harr; gRPC</p>\n                            <p style=\"opacity:0.6;font-size:14px\">Active Protections: Kyber768 + AES-256-GCM + ZK-Proof Ready</p>\n                            <div style=\"background:#0f172a;padding:15px;border-radius:8px;margin-top:20px;border:1px dashed #334155\">\n                                <code style=\"color:#10b981\">Endpoint: http://localhost:3000/mcp</code>\n                            </div>\n                        </div>\n                    </body>\n                `);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (url === \"/mcp\" && method === \"POST\") {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = req.headers.authorization;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tlet body = \"\";\n\t\t\t\treq.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\t\t\treq.on(\"end\", async () => {\n\t\t\t\t\t// [SEC] Rate limiting per IP or authenticated client (OWASP API4:2023)\n\t\t\t\t\tconst clientIp = req.socket.remoteAddress || \"127.0.0.1\";\n\t\t\t\t\tconst rateLimitKey = authInfo?.clientId\n\t\t\t\t\t\t? `client:${authInfo.clientId}`\n\t\t\t\t\t\t: `ip:${clientIp}`;\n\t\t\t\t\tconst rateStatus = this.rateLimiter.check(rateLimitKey);\n\t\t\t\t\tif (!rateStatus.allowed) {\n\t\t\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t\t\"Retry-After\": Math.ceil(rateStatus.resetMs / 1000).toString(),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\tid: null,\n\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\tcode: -32029,\n\t\t\t\t\t\t\t\t\tmessage: \"Rate limit exceeded. Too many requests.\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t\t\t// [SEC] Perimeter Admission Hook (technology-agnostic)\n\t\t\t\t\t\t// Executes AFTER JWT + RateLimiter to prevent attackers from\n\t\t\t\t\t\t// exhausting external API quotas (e.g., TYPESAFE_API_KEY) with\n\t\t\t\t\t\t// unauthenticated or rate-limited traffic.\n\t\t\t\t\t\tif (this.interceptorOptions?.interceptor) {\n\t\t\t\t\t\t\tconst verdict = await executeGatewayInterceptor(\n\t\t\t\t\t\t\t\tjsonRequest,\n\t\t\t\t\t\t\t\t{ clientIp, authInfo, protocol: \"http1\" },\n\t\t\t\t\t\t\t\tthis.interceptorOptions as Required<\n\t\t\t\t\t\t\t\t\tPick<GatewayInterceptorOptions, \"interceptor\">\n\t\t\t\t\t\t\t\t> &\n\t\t\t\t\t\t\t\t\tGatewayInterceptorOptions,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tif (!verdict.allowed) {\n\t\t\t\t\t\t\t\tres.writeHead(403, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\t\tcode: verdict.errorCode ?? -32099,\n\t\t\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t\t\tverdict.reason ||\n\t\t\t\t\t\t\t\t\t\t\t\t\"Forbidden: Rejected by Gateway Interceptor\",\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// [SEP-2243] Header-based routing validation\n\t\t\t\t\t\tconst mcpMethod = req.headers[\"mcp-method\"] as string | undefined;\n\t\t\t\t\t\tconst mcpName = req.headers[\"mcp-name\"] as string | undefined;\n\t\t\t\t\t\tconst mcpVersion = req.headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t\t\t| string\n\t\t\t\t\t\t\t| undefined;\n\n\t\t\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\tmcpName &&\n\t\t\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\t!jsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\tres.end(JSON.stringify(response));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Gateway] Error processing JSON-RPC payload: ${(e as Error).message}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tres.writeHead(400);\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\terror: { code: -32700, message: \"Parse error\" },\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate handleGrpcStream(stream: http2.ServerHttp2Stream) {\n\t\tstream.on(\"data\", (chunk: unknown) => {\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Standard gRPC stream data is Buffer\n\t\t\tconst data = chunk as any;\n\t\t\tif (data)\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Native gRPC Proxy passing ${data.length} bytes`,\n\t\t\t\t);\n\t\t});\n\t\tstream.respond({ \":status\": 200, \"content-type\": \"application/grpc\" });\n\t\tstream.end();\n\t}\n\n\tprivate handleMcpH2Stream(\n\t\tstream: http2.ServerHttp2Stream,\n\t\theaders: http2.IncomingHttpHeaders,\n\t) {\n\t\tlet body = \"\";\n\t\tstream.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\tstream.on(\"end\", async () => {\n\t\t\ttry {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token over HTTP/2 (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = headers.authorization as string;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t// [SEC] Perimeter Admission Hook (HTTP/2 symmetry)\n\t\t\t\tif (this.interceptorOptions?.interceptor) {\n\t\t\t\t\tconst h2ClientIp =\n\t\t\t\t\t\tstream.session?.socket?.remoteAddress || \"127.0.0.1\";\n\t\t\t\t\tconst verdict = await executeGatewayInterceptor(\n\t\t\t\t\t\tjsonRequest,\n\t\t\t\t\t\t{ clientIp: h2ClientIp, authInfo, protocol: \"http2\" },\n\t\t\t\t\t\tthis.interceptorOptions as Required<\n\t\t\t\t\t\t\tPick<GatewayInterceptorOptions, \"interceptor\">\n\t\t\t\t\t\t> &\n\t\t\t\t\t\t\tGatewayInterceptorOptions,\n\t\t\t\t\t);\n\t\t\t\t\tif (!verdict.allowed) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 403,\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\tcode: verdict.errorCode ?? -32099,\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\tverdict.reason ||\n\t\t\t\t\t\t\t\t\t\t\"Forbidden: Rejected by Gateway Interceptor\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// [SEP-2243] Header-based routing validation in HTTP/2\n\t\t\t\tconst mcpMethod = headers[\"mcp-method\"] as string | undefined;\n\t\t\t\tconst mcpName = headers[\"mcp-name\"] as string | undefined;\n\t\t\t\tconst mcpVersion = headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t| string\n\t\t\t\t\t| undefined;\n\n\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (\n\t\t\t\t\tmcpName &&\n\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t}\n\t\t\t\t\tif (\n\t\t\t\t\t\t!jsonRequest.params._meta[\"io.modelcontextprotocol/protocolVersion\"]\n\t\t\t\t\t) {\n\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\tif (response) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 200,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(JSON.stringify(response));\n\t\t\t\t} else stream.close();\n\t\t\t} catch (_e) {\n\t\t\t\tstream.respond({ \":status\": 400 });\n\t\t\t\tstream.end();\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic async listen(port: number, host: string = \"0.0.0.0\"): Promise<number> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.start();\n\n\t\t\t// Announce all local tools to the DHT\n\t\t\tconst tools = this.liopServer.listTools();\n\t\t\tfor (const tool of tools) {\n\t\t\t\tawait this.meshNode.announceCapability(tool.name);\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] 📡 Announced local tool to Mesh: ${tool.name}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tthis.netServer.on(\"error\", (err: Error & { code?: string }) => {\n\t\t\t\tif (err.code === \"EADDRINUSE\") {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] FATAL: Port ${port} is already in use by another process.`,\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\tlog.error(`[LIOP-Gateway] Binding Error: ${err.message}`);\n\t\t\t\t}\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tthis.netServer.listen(port, host, () => {\n\t\t\t\tconst addr = this.netServer.address();\n\t\t\t\tconst actualHost =\n\t\t\t\t\ttypeof addr === \"string\" ? addr : addr?.address || host;\n\t\t\t\tconst assignedPort =\n\t\t\t\t\ttypeof addr === \"string\" ? port : addr?.port || port;\n\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] ✅ Transformer Mesh Gateway READY and listening on ${actualHost}:${assignedPort}`,\n\t\t\t\t);\n\t\t\t\tresolve(assignedPort);\n\t\t\t});\n\t\t});\n\t}\n\n\tpublic isDrained(): boolean {\n\t\treturn this.isDraining;\n\t}\n\n\tpublic async drain(timeoutMs = 5000): Promise<void> {\n\t\tthis.isDraining = true;\n\t\tlog.info(\n\t\t\t`[LIOP-Gateway] Draining gateway connections (active: ${this.activeRequests}, timeout: ${timeoutMs}ms)...`,\n\t\t);\n\t\tconst start = Date.now();\n\t\twhile (this.activeRequests > 0 && Date.now() - start < timeoutMs) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, 50));\n\t\t}\n\t\tawait this.stop();\n\t}\n\n\tpublic async stop() {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t\tthis.rateLimiter.close();\n\t\tthis.netServer.close();\n\t\tthis.h2Server.close();\n\t\tthis.h1Server.close();\n\t}\n\n\tpublic getRouter(): LiopMcpRouter {\n\t\treturn this.router;\n\t}\n}\n"]}
+{"version":3,"sources":["../src/security/prm.ts","../src/gateway/grpc-web.ts","../src/gateway/interceptor.ts","../src/gateway/rate-limiter.ts","../src/gateway/hybrid.ts"],"names":[],"mappings":";;;;;;;;;AAuCO,SAAS,8BAAA,CACf,QACA,QAAA,EAC4B;AAC5B,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,QAAA;AAAA,IACV,qBAAA,EAAuB,CAAC,MAAM,CAAA;AAAA,IAC9B,gBAAA,EAAkB,WAAA;AAAA,IAClB,wBAAA,EAA0B,CAAC,QAAQ,CAAA;AAAA,IACnC,sBAAA,EAAwB;AAAA,GACzB;AACD;;;AC7BO,IAAM,kBAAA,GAAqB;AAAA,EACjC,SAAA,EAAW,CAAA;AAAA,EACX,aAAA,EAAe,GAAA;AAAA,EACf,aAAA,EAAe,CAAA;AAAA,EACf,mBAAA,EAAqB,sBAAA;AAAA,EACrB,SAAA,EAAW,CAAA;AAAA,EACX,gBAAA,EAAkB,CAAA;AAAA,EAClB,cAAA,EAAgB,CAAA;AAAA,EAChB,uBAAA,EAAyB,CAAA;AAAA,EACzB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,gBAAA,EAAkB,CAAA;AAAA,EAClB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,sBAAA,EAAwB,EAAA;AAAA,EACxB,eAAA,EAAiB;AAClB;AAUO,SAAS,iBAAiB,WAAA,EAA+B;AAC/D,EAAA,IAAI,CAAC,aAAa,OAAO,KAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,YAAY,WAAA,EAAY;AACtC,EAAA,OACC,KAAA,CAAM,UAAA,CAAW,sBAAsB,CAAA,IACvC,KAAA,CAAM,WAAW,4BAA4B,CAAA,IAC7C,KAAA,CAAM,UAAA,CAAW,2BAA2B,CAAA;AAE9C;AAKO,SAAS,gBAAgB,OAAA,EAAsC;AACrE,EAAA,MAAM,GAAA,GAAM,OAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU,MAAA,CAAO,KAAK,OAAO,CAAA;AACpE,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,SAAA,EAAW,CAAC,CAAA;AACjD,EAAA,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,MAAA,EAAQ,CAAC,CAAA;AAClC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAA;AACnC;AAKO,SAAS,kBAAA,CACf,SAAiB,kBAAA,CAAmB,SAAA,EACpC,UAAkB,EAAA,EAClB,cAAA,GAAyC,EAAC,EACjC;AACT,EAAA,MAAM,KAAA,GAAQ;AAAA,IACb,eAAe,MAAM,CAAA,CAAA;AAAA,IACrB,CAAA,aAAA,EAAgB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAAA,GAC5C;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EAAG;AAC1D,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,EAC7B;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,CAAA;AACzC,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,OAAO,CAAA;AAEnD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,aAAA,EAAe,CAAC,CAAA;AACrD,EAAA,MAAA,CAAO,aAAA,CAAc,UAAA,CAAW,MAAA,EAAQ,CAAC,CAAA;AAEzC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,MAAA,EAAgC;AAC5D,EAAA,MAAM,SAAyB,EAAC;AAChC,EAAA,IAAI,MAAA,GAAS,CAAA;AAEb,EAAA,OAAO,MAAA,GAAS,kBAAA,CAAmB,aAAA,IAAiB,MAAA,CAAO,MAAA,EAAQ;AAClE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,CAAa,MAAA,GAAS,CAAC,CAAA;AAC7C,IAAA,MAAM,YAAA,GAAe,SAAS,kBAAA,CAAmB,aAAA;AACjD,IAAA,MAAM,aAAa,YAAA,GAAe,MAAA;AAElC,IAAA,IAAI,UAAA,GAAa,OAAO,MAAA,EAAQ;AAC/B,MAAA;AAAA,IACD;AAEA,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,CAAS,YAAA,EAAc,UAAU,CAAA;AACxD,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACX,SAAA,EAAA,CACE,IAAA,GAAO,kBAAA,CAAmB,aAAA,MAC3B,kBAAA,CAAmB,aAAA;AAAA,MACpB,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAO;AAAA,KAC5B,CAAA;AAED,IAAA,MAAA,GAAS,UAAA;AAAA,EACV;AAEA,EAAA,OAAO,MAAA;AACR;AAMA,eAAsB,sBAAA,CACrB,GAAA,EACA,GAAA,EACA,OAAA,EAIgB;AAChB,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACjC,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EAClB,CAAC,CAAA;AAED,EAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AACzB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AACrC,MAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AACpC,MAAA,MAAM,WAAA,GACL,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,SAAS,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC5D,MAAA,MAAM,WAAA,GAAc,IAAI,GAAA,IAAO,GAAA;AAE/B,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,gCAAA,EAAmC,WAAW,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,CAAA,OAAA;AAAA,OACtE;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,WAAA,EAAa,WAAW,CAAA;AAErD,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,GAAG,CAAA;AAChD,MAAA,GAAA,CAAI,SAAA;AAAA,QACH,+BAAA;AAAA,QACA;AAAA,OACD;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,EAAG;AAC1C,QAAA,GAAA,CAAI,KAAA,CAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,MACvC;AAGA,MAAA,GAAA,CAAI,MAAM,kBAAA,CAAmB,MAAA,CAAO,QAAQ,MAAA,CAAO,OAAA,IAAW,EAAE,CAAC,CAAA;AACjE,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,CAAE,CAAA;AAC/C,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,KAAA;AAAA,QACH,kBAAA;AAAA,UACC,kBAAA,CAAmB,eAAA;AAAA,UAClB,MAAgB,OAAA,IAAW;AAAA;AAC7B,OACD;AACA,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT;AAAA,EACD,CAAC,CAAA;AACF;;;AC3HA,IAAM,kBAAA,GAAqB,IAAA;AAW3B,eAAsB,yBAAA,CACrB,OAAA,EACA,OAAA,EACA,OAAA,EAEkC;AAClC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,QAAA;AACrC,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAM5C,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,OAAO,CAAC,CAAA;AAE5D,EAAA,IAAI,eAAA;AACJ,EAAA,MAAM,YAAA,GAAe,IAAI,OAAA,CAAe,CAAC,GAAG,MAAA,KAAW;AACtD,IAAA,eAAA,GAAkB,MAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,eAAA,EAAiB,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EACjE,CAAC,CAAA;AAED,EAAA,IAAI;AACH,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,MACjC,OAAA,CAAQ,OAAA;AAAA,QACP,QAAQ,WAAA,CAAY,aAAA,EAAe,EAAE,GAAG,OAAA,EAAS,QAAQ;AAAA,OAC1D;AAAA,MACA;AAAA,KACA,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACR,SAAS,KAAA,EAAgB;AACxB,IAAA,MAAM,eAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAE1E,IAAA,IAAI,aAAa,MAAA,EAAQ;AACxB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,mEAAmE,YAAY,CAAA;AAAA,OAChF;AACA,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,QAAA,EAAU,EAAE,gBAAA,EAAkB,YAAA,EAAc,UAAU,MAAA;AAAO,OAC9D;AAAA,IACD;AAGA,IAAA,GAAA,CAAI,KAAA;AAAA,MACH,sEAAsE,YAAY,CAAA;AAAA,KACnF;AACA,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,4BAA4B,YAAY,CAAA,CAAA;AAAA,MAChD,SAAA,EAAW,MAAA;AAAA,MACX,QAAA,EAAU,EAAE,gBAAA,EAAkB,YAAA,EAAc,UAAU,QAAA;AAAS,KAChE;AAAA,EACD,CAAA,SAAE;AACD,IAAA,IAAI,eAAA,EAAiB;AACpB,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,eAAe,CAAA;AAAA,IACpD;AAAA,EACD;AACD;;;ACnGO,IAAM,sBAAN,MAA0B;AAAA,EACf,QAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA,uBAAyC,GAAA,EAAI;AAAA,EACtD,YAAA;AAAA,EAER,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAG;AAC7C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,GAAA;AACpC,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,GAAA;AAG1C,IAAA,IAAA,CAAK,eAAe,WAAA,CAAY,MAAM,IAAA,CAAK,OAAA,IAAW,GAAM,CAAA;AAC5D,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,KAAU,UAAA,EAAY;AAClD,MAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,IACzB;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,MAAM,GAAA,EAA8B;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAEjC,IAAA,IAAI,CAAC,MAAA,IAAU,GAAA,IAAO,MAAA,CAAO,SAAA,EAAW;AACvC,MAAA,MAAA,GAAS;AAAA,QACR,KAAA,EAAO,CAAA;AAAA,QACP,SAAA,EAAW,MAAM,IAAA,CAAK;AAAA,OACvB;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAC5B,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,KAAK,WAAA,GAAc,CAAA;AAAA,QAC9B,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK;AAAA,OACf;AAAA,IACD;AAEA,IAAA,IAAI,MAAA,CAAO,KAAA,IAAS,IAAA,CAAK,WAAA,EAAa;AACrC,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW,CAAA;AAAA,QACX,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,OAC5C;AAAA,IACD;AAEA,IAAA,MAAA,CAAO,KAAA,EAAA;AACP,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,IAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,WAAA,GAAc,MAAA,CAAO,KAAA;AAAA,MACrC,OAAO,IAAA,CAAK,WAAA;AAAA,MACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,KAC5C;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,MAAM,GAAA,EAAmB;AAC/B,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,KAAK,IAAA,CAAK,OAAA,CAAQ,SAAQ,EAAG;AACnD,MAAA,IAAI,GAAA,IAAO,OAAO,SAAA,EAAW;AAC5B,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,MACxB;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,KAAA,GAAc;AACpB,IAAA,IAAI,KAAK,YAAA,EAAc;AACtB,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,MAAA;AAAA,IACrB;AACA,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACpB;AACD;;;ACrFO,IAAM,oBAAN,MAAwB;AAAA,EAa9B,YACS,UAAA,EACA,QAAA,GAA4B,MACpC,OAAA,GAAkB,KAAA,EAClB,oBACA,kBAAA,EACC;AALO,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAKR,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,UAAA,CAAW,YAAA;AACpC,IAAA,IAAA,CAAK,aAAA,GAAgB,KAAK,UAAA,CAAW,aAAA;AACrC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAI,mBAAA,CAAoB,kBAAkB,CAAA;AAC7D,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAG1B,IAAA,IAAA,CAAK,SAAS,IAAI,aAAA,CAAc,KAAK,UAAA,EAAY,IAAA,CAAK,UAAU,OAAO,CAAA;AAGvE,IAAA,IAAA,CAAK,WAAiB,KAAA,CAAA,YAAA,EAAa;AACnC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,WAAgB,IAAA,CAAA,YAAA,EAAa;AAClC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,SAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,CAAC,MAAA,KAAW;AAC7C,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,CAAC,MAAA,KAAW;AAC/B,QAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,EAAS,CAAE,WAAW,gBAAgB,CAAA;AAC7D,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,iDAAA,EAAoD,OAAA,GAAU,eAAA,GAAkB,gBAAgB,CAAA;AAAA,SACjG;AACA,QAAA,IAAI,OAAA,EAAS;AACZ,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC,CAAA,MAAO;AACN,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC;AACA,QAAA,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,MACtB,CAAC,CAAA;AACD,MAAA,MAAA,CAAO,EAAA;AAAA,QAAG,OAAA;AAAA,QAAS,CAAC,GAAA,KACnB,GAAA,CAAI,MAAM,CAAA,uCAAA,EAA0C,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,OAClE;AAAA,IACD,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AACA,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AAEA,IAAA,GAAA,CAAI,KAAK,4CAA4C,CAAA;AAAA,EACtD;AAAA,EAlDS,UAAA;AAAA,EACA,QAAA;AAAA,EAdD,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAEA,aAAA;AAAA,EACA,WAAA;AAAA,EACS,kBAAA;AAAA,EACT,UAAA,GAAa,KAAA;AAAA,EACb,cAAA,GAAiB,CAAA;AAAA,EAuDjB,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,QAAA,EAAU,CAAC,QAAQ,OAAA,KAAY;AAC/C,MAAA,MAAM,WAAA,GAAc,QAAQ,cAAc,CAAA;AAC1C,MAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,CAAA;AAE5B,MAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACvC,QAAA,IAAA,CAAK,iBAAiB,MAAiC,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC3B,QAAA,IAAA,CAAK,iBAAA,CAAkB,QAAmC,OAAO,CAAA;AAAA,MAClE;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,SAAA,EAAW,OAAO,KAAK,GAAA,KAAQ;AAC/C,MAAA,IAAA,CAAK,cAAA,IAAkB,CAAA;AACvB,MAAA,MAAM,SAAS,MAAM;AACpB,QAAA,GAAA,CAAI,cAAA,CAAe,UAAU,MAAM,CAAA;AACnC,QAAA,GAAA,CAAI,cAAA,CAAe,SAAS,MAAM,CAAA;AAClC,QAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,MAC1D,CAAA;AACA,MAAA,GAAA,CAAI,EAAA,CAAG,UAAU,MAAM,CAAA;AACvB,MAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAEtB,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,IAAO,EAAA;AACvB,MAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AAGnB,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,QAAA,EAAU;AAClB,UAAA,kBAAA,CAAmB,IAAI,EAAC,EAAG,KAAK,QAAA,CAAS,QAAA,GAAW,MAAM,CAAA;AAAA,QAC3D;AACA,QAAA,IAAI,KAAK,MAAA,EAAQ;AAChB,UAAA,iBAAA,CAAkB,IAAI,EAAC,EAAG,IAAA,CAAK,MAAA,CAAO,sBAAsB,CAAA;AAAA,QAC7D;AACA,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,UAClB,cAAA,EAAgB;AAAA,SAChB,CAAA;AACD,QAAA,GAAA,CAAI,GAAA,CAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA;AAC9C,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,IAAA;AAAA,YACR,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA;AAAA,YACnC,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,SAAA,EAAW;AAC1C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,MAAM,cAAc,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,WAAU,GAAI,IAAA;AAChE,QAAA,IAAI,CAAC,WAAA,EAAa;AACjB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,WAAA,EAAa,KAAA;AAAA,cACb,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,OAAA;AAAA,YACR,WAAA,EAAa,IAAA;AAAA,YACb,OAAO,IAAA,CAAK,QAAA,GAAW,KAAK,QAAA,CAAS,QAAA,GAAW,MAAA,GAAS,CAAA;AAAA,YACzD,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,IAAA,CAAK,UAAA,IAAc,GAAA,KAAQ,MAAA,EAAQ;AACtC,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,OAAA,EAAS,KAAA;AAAA,YACT,KAAA,EAAO;AAAA,cACN,IAAA,EAAM,KAAA;AAAA,cACN,OAAA,EAAS;AAAA;AACV,WACA;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,cAAc,CAAA;AAC9C,MAAA,IAAI,gBAAA,CAAiB,WAAW,CAAA,EAAG;AAClC,QAAA,MAAM,sBAAA,CAAuB,GAAA,EAAK,GAAA,EAAK,OAAO,SAAS,OAAA,KAAY;AAClE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,uCAAA,EAA0C,OAAO,CAAA,EAAA,EAAK,OAAA,CAAQ,MAAM,CAAA,OAAA;AAAA,WACrE;AACA,UAAA,OAAO;AAAA,YACN,QAAQ,kBAAA,CAAmB,SAAA;AAAA,YAC3B,OAAA,EAAS,IAAA;AAAA,YACT,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,EAAE;AAAA,WACrB;AAAA,QACD,CAAC,CAAA;AACD,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,IAAK,KAAK,aAAA,EAAe;AAClD,QAAA,MAAM,QAAA,GACL,OAAO,IAAA,CAAK,aAAA,CAAc,QAAA,KAAa,aACpC,IAAA,CAAK,aAAA,CAAc,QAAA,EAAS,GAC5B,IAAA,CAAK,aAAA;AAET,QAAA,MAAM,cAAc,GAAA,CAAI,GAAA;AACxB,QAAA,GAAA,CAAI,GAAA,GAAA,CAAO,WAAA,IAAe,EAAA,EAAI,KAAA,CAAM,CAAC,CAAA,IAAK,GAAA;AAC1C,QAAA,IAAI;AACH,UAAA,OAAO,QAAA,CAAS,KAAK,GAAG,CAAA;AAAA,QACzB,CAAA,SAAE;AACD,UAAA,GAAA,CAAI,GAAA,GAAM,WAAA;AAAA,QACX;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,uCAAA,EAAyC;AACxE,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,GAAA,GAAM,8BAAA;AAAA,YACX,IAAA,CAAK,aAAa,SAAA,EAAU;AAAA,YAC5B,IAAA,CAAK,aAAa,WAAA;AAAY,WAC/B;AACA,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAC3B,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,QAAA;AAAA,MACD;AAEA,MAAA,IACC,WAAW,KAAA,KACV,GAAA,KAAQ,OAAO,GAAA,KAAQ,MAAA,IAAU,QAAQ,SAAA,CAAA,EACzC;AACD,QAAA,IACC,QAAQ,SAAA,IACR,GAAA,CAAI,QAAQ,MAAA,EAAQ,QAAA,CAAS,kBAAkB,CAAA,EAC9C;AACD,UAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB;AAAA,YACA,QAAQ,IAAA,CAAK,QAAA,CAAS,SAAA,EAAU,EAAG,UAAS,IAAK,EAAA;AAAA,YACjD,UAAA,EAAY,IAAA,CAAK,QAAA,CACf,aAAA,EAAc,CACd,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,EAAU;AAAA,WAC1B,GACC,IAAA;AACH,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,EAAc,SAAA,EAAU;AAC5C,UAAA,MAAM,OAAA,GAAU,SACb,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GACtB,MAAA,GACA,CAAA,EAAG,MAAM,CAAA,KAAA,CAAA,GACV,EAAA;AACH,UAAA,MAAM,gBAAA,GACL,IAAA,CAAK,YAAA,IAAgB,MAAA,GAClB;AAAA,YACA,MAAA;AAAA,YACA,QAAA,EAAU,GAAG,OAAO,CAAA,KAAA,CAAA;AAAA,YACpB,GAAI,KAAK,aAAA,GACN;AAAA,cACA,cAAA,EAAgB,GAAG,OAAO,CAAA,MAAA;AAAA,gBAE1B;AAAC,WACL,GACC,MAAA;AAEJ,UAAA,MAAM,YAAA,GAAe;AAAA,YACpB,IAAA,EAAM,IAAA,CAAK,QAAA,EAAU,gBAAA,OAAuB,CAAA,GAAI,CAAA;AAAA,YAChD,WAAA,EAAa,IAAA,CAAK,YAAA,GACf,uCAAA,GACA,MAAA;AAAA,YACH,qBAAA,EAAuB,CAAC,UAAA,EAAY,UAAA,EAAY,SAAS;AAAA,WAC1D;AAEA,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,IAAA,EAAM,IAAA,CAAK,UAAA,CAAW,aAAA,EAAc;AAAA,cACpC,IAAA,EAAM,QAAA;AAAA,cACN,KAAA,EAAO,KAAK,UAAA,CAAW,SAAA,GAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA;AAAA,cACpD,IAAA,EAAM,gBAAA;AAAA,cACN,QAAA,EAAU,YAAA;AAAA,cACV,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,4BAA4B,CAAA;AACjE,QAAA,GAAA,CAAI,GAAA,CAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAA,CAWK,CAAA;AACb,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,GAAA,KAAQ,MAAA,IAAU,MAAA,KAAW,MAAA,EAAQ;AACxC,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,aAAA;AAC/B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACjD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AAClD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,IAAI,IAAA,GAAO,EAAA;AACX,QAAA,GAAA,CAAI,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACpD,QAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AAEzB,UAAA,MAAM,QAAA,GAAW,GAAA,CAAI,MAAA,CAAO,aAAA,IAAiB,WAAA;AAC7C,UAAA,MAAM,YAAA,GAAe,UAAU,QAAA,GAC5B,CAAA,OAAA,EAAU,SAAS,QAAQ,CAAA,CAAA,GAC3B,MAAM,QAAQ,CAAA,CAAA;AACjB,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,KAAA,CAAM,YAAY,CAAA;AACtD,UAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACxB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,cAAA,EAAgB,kBAAA;AAAA,cAChB,eAAe,IAAA,CAAK,IAAA,CAAK,WAAW,OAAA,GAAU,GAAI,EAAE,QAAA;AAAS,aAC7D,CAAA;AACD,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,EAAA,EAAI,IAAA;AAAA,gBACJ,KAAA,EAAO;AAAA,kBACN,IAAA,EAAM,MAAA;AAAA,kBACN,OAAA,EAAS;AAAA;AACV,eACA;AAAA,aACF;AACA,YAAA;AAAA,UACD;AAEA,UAAA,IAAI;AACH,YAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAMnC,YAAA,IAAI,IAAA,CAAK,oBAAoB,WAAA,EAAa;AACzC,cAAA,MAAM,UAAU,MAAM,yBAAA;AAAA,gBACrB,WAAA;AAAA,gBACA,EAAE,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,OAAA,EAAQ;AAAA,gBACxC,IAAA,CAAK;AAAA,eAIN;AACA,cAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACrB,gBAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,gBAAA,GAAA,CAAI,GAAA;AAAA,kBACH,KAAK,SAAA,CAAU;AAAA,oBACd,OAAA,EAAS,KAAA;AAAA,oBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,oBACtB,KAAA,EAAO;AAAA,sBACN,IAAA,EAAM,QAAQ,SAAA,IAAa,CAAA,KAAA;AAAA,sBAC3B,OAAA,EACC,QAAQ,MAAA,IACR;AAAA;AACF,mBACA;AAAA,iBACF;AACA,gBAAA;AAAA,cACD;AAAA,YACD;AAGA,YAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA;AAC1C,YAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA;AACtC,YAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAIrD,YAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,cAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,gBAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,cAC7B;AACA,cAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CACnB,yCACD,CAAA,EACC;AACD,gBAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,cACL;AAAA,YACD;AAEA,YAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,YAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,YAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,UACjC,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,kDAAA,EAAsD,EAAY,OAAO,CAAA;AAAA,aAC1E;AACA,YAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,aAAA;AAAc,eAC9C;AAAA,aACF;AAAA,UACD;AAAA,QACD,CAAC,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AAAA,MACpB;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,iBAAiB,MAAA,EAAiC;AACzD,IAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAmB;AAErC,MAAA,MAAM,IAAA,GAAO,KAAA;AACb,MAAA,IAAI,IAAA;AACH,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,yCAAA,EAA4C,KAAK,MAAM,CAAA,MAAA;AAAA,SACxD;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,cAAA,EAAgB,oBAAoB,CAAA;AACrE,IAAA,MAAA,CAAO,GAAA,EAAI;AAAA,EACZ;AAAA,EAEQ,iBAAA,CACP,QACA,OAAA,EACC;AACD,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,MAAA,CAAO,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACvD,IAAA,MAAA,CAAO,EAAA,CAAG,OAAO,YAAY;AAC5B,MAAA,IAAI;AACH,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,aAAa,OAAA,CAAQ,aAAA;AAC3B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACpD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AACrD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAGnC,QAAA,IAAI,IAAA,CAAK,oBAAoB,WAAA,EAAa;AACzC,UAAA,MAAM,UAAA,GACL,MAAA,CAAO,OAAA,EAAS,MAAA,EAAQ,aAAA,IAAiB,WAAA;AAC1C,UAAA,MAAM,UAAU,MAAM,yBAAA;AAAA,YACrB,WAAA;AAAA,YACA,EAAE,QAAA,EAAU,UAAA,EAAY,QAAA,EAAU,UAAU,OAAA,EAAQ;AAAA,YACpD,IAAA,CAAK;AAAA,WAIN;AACA,UAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACrB,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,GAAA;AAAA,cACN,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,gBACtB,KAAA,EAAO;AAAA,kBACN,IAAA,EAAM,QAAQ,SAAA,IAAa,CAAA,KAAA;AAAA,kBAC3B,OAAA,EACC,QAAQ,MAAA,IACR;AAAA;AACF,eACA;AAAA,aACF;AACA,YAAA;AAAA,UACD;AAAA,QACD;AAGA,QAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,QAAA,MAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAClC,QAAA,MAAM,UAAA,GAAa,QAAQ,sBAAsB,CAAA;AAIjD,QAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,UAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,YAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,UAC7B;AACA,UAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CAAM,yCAAyC,CAAA,EAClE;AACD,YAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,UACL;AAAA,QACD;AAEA,QAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QACpC,CAAA,aAAc,KAAA,EAAM;AAAA,MACrB,SAAS,EAAA,EAAI;AACZ,QAAA,MAAA,CAAO,OAAA,CAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,CAAA;AACjC,QAAA,MAAA,CAAO,GAAA,EAAI;AAAA,MACZ;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEA,MAAa,MAAA,CAAO,IAAA,EAAc,IAAA,GAAe,SAAA,EAA4B;AAC5E,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAG1B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,SAAA,EAAU;AACxC,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,QAAA,MAAM,IAAA,CAAK,QAAA,CAAS,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAChD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,uDAAA,EAAmD,KAAK,IAAI,CAAA;AAAA,SAC7D;AAAA,MACD;AAAA,IACD;AACA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAmC;AAC9D,QAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,8BAA8B,IAAI,CAAA,sCAAA;AAAA,WACnC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,QACzD;AACA,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,MAAM;AACvC,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,EAAQ;AACpC,QAAA,MAAM,aACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,OAAA,IAAW,IAAA;AACpD,QAAA,MAAM,eACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAEjD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,sEAAA,EAAoE,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SAC/F;AACA,QAAA,OAAA,CAAQ,YAAY,CAAA;AAAA,MACrB,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEO,SAAA,GAAqB;AAC3B,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA,EAEA,MAAa,KAAA,CAAM,SAAA,GAAY,GAAA,EAAqB;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,qDAAA,EAAwD,IAAA,CAAK,cAAc,CAAA,WAAA,EAAc,SAAS,CAAA,MAAA;AAAA,KACnG;AACA,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,OAAO,KAAK,cAAA,GAAiB,CAAA,IAAK,KAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,EAAW;AACjE,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,IACvD;AACA,IAAA,MAAM,KAAK,IAAA,EAAK;AAAA,EACjB;AAAA,EAEA,MAAa,IAAA,GAAO;AACnB,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AACvB,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AAAA,EACrB;AAAA,EAEO,SAAA,GAA2B;AACjC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACb;AACD","file":"chunk-EJ426URA.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Protected Resource Metadata — RFC 9728\n *\n * Builds the JSON document served at /.well-known/oauth-protected-resource.\n * This enables MCP clients to discover the authorization server and\n * required scopes for accessing LIOP tools and resources.\n *\n * Standards: RFC 9728, MCP Spec 2025-11-25\n */\n\nimport { LIOP_SCOPES } from \"./rbac.js\";\n\n/**\n * RFC 9728 Protected Resource Metadata response.\n *\n * @see https://datatracker.ietf.org/doc/rfc9728\n */\nexport interface ProtectedResourceMetadata {\n\t/** Identifier for the protected resource. */\n\tresource: string;\n\t/** Array of authorization server issuer URLs that can issue tokens for this resource. */\n\tauthorization_servers: string[];\n\t/** OAuth scopes accepted by this resource. */\n\tscopes_supported: readonly string[];\n\t/** Methods of presenting the bearer token (always \"header\" for LIOP). */\n\tbearer_methods_supported: string[];\n\t/** URL to the resource documentation. */\n\tresource_documentation: string;\n}\n\n/**\n * Builds the Protected Resource Metadata document (RFC 9728).\n *\n * @param issuer - OIDC issuer URL of the Nexus authorization server\n * @param audience - JWT audience claim (resource identifier)\n */\nexport function buildProtectedResourceMetadata(\n\tissuer: string,\n\taudience: string,\n): ProtectedResourceMetadata {\n\treturn {\n\t\tresource: audience,\n\t\tauthorization_servers: [issuer],\n\t\tscopes_supported: LIOP_SCOPES,\n\t\tbearer_methods_supported: [\"header\"],\n\t\tresource_documentation: \"https://github.com/nekzus/liop\",\n\t};\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP gRPC-Web Protocol Adapter (HTTP/1.1 Fallback)\n *\n * Implements standard gRPC-Web framing per the official gRPC-Web specification:\n * https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-WEB.md\n *\n * Allows web browsers, corporate Layer 7 HTTP/1.1 proxies, and enterprise WAFs\n * to invoke LIOP nodes over HTTP/1.1 without requiring HTTP/2 streaming or h2c.\n *\n * Frame Format:\n * - 1 byte: Frame Flag (0x00 = Data Frame, 0x80 = Trailers Frame)\n * - 4 bytes: 32-bit Big-Endian Unsigned Integer (payload length in bytes)\n * - N bytes: Message or Trailer payload\n */\n\nimport type * as http from \"node:http\";\nimport { log } from \"../utils/logger.js\";\n\nexport const GRPC_WEB_CONSTANTS = {\n\tFLAG_DATA: 0x00,\n\tFLAG_TRAILERS: 0x80,\n\tHEADER_LENGTH: 5,\n\tCONTENT_TYPE_PREFIX: \"application/grpc-web\",\n\tSTATUS_OK: 0,\n\tSTATUS_CANCELLED: 1,\n\tSTATUS_UNKNOWN: 2,\n\tSTATUS_INVALID_ARGUMENT: 3,\n\tSTATUS_DEADLINE_EXCEEDED: 4,\n\tSTATUS_NOT_FOUND: 5,\n\tSTATUS_PERMISSION_DENIED: 7,\n\tSTATUS_UNAUTHENTICATED: 16,\n\tSTATUS_INTERNAL: 13,\n} as const;\n\nexport interface GrpcWebFrame {\n\tisTrailer: boolean;\n\tpayload: Buffer;\n}\n\n/**\n * Checks if an incoming HTTP request is a gRPC-Web request.\n */\nexport function isGrpcWebRequest(contentType?: string): boolean {\n\tif (!contentType) return false;\n\tconst lower = contentType.toLowerCase();\n\treturn (\n\t\tlower.startsWith(\"application/grpc-web\") ||\n\t\tlower.startsWith(\"application/grpc-web+proto\") ||\n\t\tlower.startsWith(\"application/grpc-web+json\")\n\t);\n}\n\n/**\n * Encodes a binary payload into a standard 5-byte framed gRPC-Web Data Frame.\n */\nexport function encodeDataFrame(payload: Buffer | Uint8Array): Buffer {\n\tconst buf = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_DATA, 0);\n\theader.writeUInt32BE(buf.length, 1);\n\treturn Buffer.concat([header, buf]);\n}\n\n/**\n * Encodes gRPC status and optional message into a 5-byte framed gRPC-Web Trailer Frame.\n */\nexport function encodeTrailerFrame(\n\tstatus: number = GRPC_WEB_CONSTANTS.STATUS_OK,\n\tmessage: string = \"\",\n\tcustomTrailers: Record<string, string> = {},\n): Buffer {\n\tconst lines = [\n\t\t`grpc-status:${status}`,\n\t\t`grpc-message:${encodeURIComponent(message)}`,\n\t];\n\n\tfor (const [key, value] of Object.entries(customTrailers)) {\n\t\tlines.push(`${key}:${value}`);\n\t}\n\n\tconst trailerText = `${lines.join(\"\\r\\n\")}\\r\\n`;\n\tconst trailerBuf = Buffer.from(trailerText, \"utf-8\");\n\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_TRAILERS, 0);\n\theader.writeUInt32BE(trailerBuf.length, 1);\n\n\treturn Buffer.concat([header, trailerBuf]);\n}\n\n/**\n * Parses raw gRPC-Web byte streams into an array of frames.\n */\nexport function decodeFrames(buffer: Buffer): GrpcWebFrame[] {\n\tconst frames: GrpcWebFrame[] = [];\n\tlet offset = 0;\n\n\twhile (offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH <= buffer.length) {\n\t\tconst flag = buffer.readUInt8(offset);\n\t\tconst length = buffer.readUInt32BE(offset + 1);\n\t\tconst payloadStart = offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH;\n\t\tconst payloadEnd = payloadStart + length;\n\n\t\tif (payloadEnd > buffer.length) {\n\t\t\tbreak; // Incomplete frame\n\t\t}\n\n\t\tconst payload = buffer.subarray(payloadStart, payloadEnd);\n\t\tframes.push({\n\t\t\tisTrailer:\n\t\t\t\t(flag & GRPC_WEB_CONSTANTS.FLAG_TRAILERS) ===\n\t\t\t\tGRPC_WEB_CONSTANTS.FLAG_TRAILERS,\n\t\t\tpayload: Buffer.from(payload),\n\t\t});\n\n\t\toffset = payloadEnd;\n\t}\n\n\treturn frames;\n}\n\n/**\n * Dispatches an HTTP/1.1 gRPC-Web request to an underlying protocol handler\n * and serializes data and trailer frames back to the client.\n */\nexport async function dispatchGrpcWebRequest(\n\treq: http.IncomingMessage,\n\tres: http.ServerResponse,\n\thandler: (\n\t\tpath: string,\n\t\tpayload: Buffer,\n\t) => Promise<{ status: number; message?: string; data?: Buffer }>,\n): Promise<void> {\n\tconst chunks: Buffer[] = [];\n\n\treq.on(\"data\", (chunk: Buffer) => {\n\t\tchunks.push(chunk);\n\t});\n\n\treq.on(\"end\", async () => {\n\t\ttry {\n\t\t\tconst fullBody = Buffer.concat(chunks);\n\t\t\tconst frames = decodeFrames(fullBody);\n\t\t\tconst dataPayload =\n\t\t\t\tframes.find((f) => !f.isTrailer)?.payload ?? Buffer.alloc(0);\n\t\t\tconst requestPath = req.url || \"/\";\n\n\t\t\tlog.info(\n\t\t\t\t`[gRPC-Web] Handling request for ${requestPath} (${dataPayload.length} bytes)`,\n\t\t\t);\n\n\t\t\tconst result = await handler(requestPath, dataPayload);\n\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.setHeader(\"access-control-allow-origin\", \"*\");\n\t\t\tres.setHeader(\n\t\t\t\t\"access-control-expose-headers\",\n\t\t\t\t\"grpc-status, grpc-message, content-type\",\n\t\t\t);\n\n\t\t\t// Write Data Frame (if response payload exists)\n\t\t\tif (result.data && result.data.length > 0) {\n\t\t\t\tres.write(encodeDataFrame(result.data));\n\t\t\t}\n\n\t\t\t// Write Trailer Frame (status and message)\n\t\t\tres.write(encodeTrailerFrame(result.status, result.message || \"\"));\n\t\t\tres.end();\n\t\t} catch (error) {\n\t\t\tlog.error(`[gRPC-Web] Dispatch error: ${error}`);\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.write(\n\t\t\t\tencodeTrailerFrame(\n\t\t\t\t\tGRPC_WEB_CONSTANTS.STATUS_INTERNAL,\n\t\t\t\t\t(error as Error).message || \"Internal server error\",\n\t\t\t\t),\n\t\t\t);\n\t\t\tres.end();\n\t\t}\n\t});\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { AuthInfo } from \"../security/jwt-validator.js\";\nimport type { McpRequest } from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\n/**\n * Verdict returned by a GatewayInterceptor function.\n * Determines whether the request is admitted into the routing pipeline.\n */\nexport interface GatewayAdmissionResult {\n\t/** true = request passes to router.dispatch(). false = rejected at perimeter. */\n\tallowed: boolean;\n\t/** Human-readable denial reason (included in JSON-RPC error response). */\n\treason?: string;\n\t/** Custom JSON-RPC error code. Defaults to -32099 when omitted. */\n\terrorCode?: number;\n\t/** Opaque metadata bag for telemetry or audit logging downstream. */\n\tmetadata?: Record<string, unknown>;\n}\n\n/**\n * Contextual information passed to the interceptor alongside the request.\n * Contains only non-sensitive, non-cryptographic perimeter metadata.\n */\nexport interface GatewayInterceptorContext {\n\t/** Originating client IP address (post-JWT, post-rate-limit). */\n\tclientIp: string;\n\t/** Authenticated identity from JWT validation, or null for unauthenticated gateways. */\n\tauthInfo: AuthInfo | null;\n\t/** Transport protocol that received this request. */\n\tprotocol: \"http1\" | \"http2\";\n\t/** Abort signal that fires when the interceptor timeout expires. */\n\tsignal: AbortSignal;\n}\n\n/**\n * Technology-agnostic admission function.\n * The developer implements this in their application code, connecting\n * any decision engine (TypeSafe Jev, ONNX, regex rules, custom logic).\n *\n * Receives a frozen deep-clone of the request to prevent prototype pollution.\n * May return synchronously or asynchronously.\n */\nexport type GatewayInterceptor = (\n\trequest: Readonly<McpRequest>,\n\tcontext: GatewayInterceptorContext,\n) => Promise<GatewayAdmissionResult> | GatewayAdmissionResult;\n\n/**\n * Configuration for the perimeter admission hook.\n */\nexport interface GatewayInterceptorOptions {\n\t/** The interceptor function. When undefined, the gateway skips interception entirely. */\n\tinterceptor?: GatewayInterceptor;\n\t/** Maximum milliseconds to wait for the interceptor. Default: 2500. */\n\ttimeoutMs?: number;\n\t/** Behavior when the interceptor throws or times out. Default: \"closed\". */\n\tfailMode?: \"closed\" | \"open\";\n}\n\nconst DEFAULT_TIMEOUT_MS = 2500;\n\n/**\n * Executes the interceptor with timeout enforcement via AbortSignal.timeout(),\n * prototype pollution isolation via structuredClone + Object.freeze,\n * and fail-mode policy enforcement.\n *\n * AbortSignal.timeout() is stable since Node.js 17.3 (available in Node.js 20+ LTS).\n * Promise.race guarantees the gateway never blocks beyond timeoutMs even if the\n * interceptor ignores the signal.\n */\nexport async function executeGatewayInterceptor(\n\trequest: McpRequest,\n\tcontext: Omit<GatewayInterceptorContext, \"signal\">,\n\toptions: Required<Pick<GatewayInterceptorOptions, \"interceptor\">> &\n\t\tGatewayInterceptorOptions,\n): Promise<GatewayAdmissionResult> {\n\tconst timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\tconst failMode = options.failMode ?? \"closed\";\n\tconst signal = AbortSignal.timeout(timeoutMs);\n\n\t// structuredClone severs all prototype chain references (deep copy).\n\t// Object.freeze blocks top-level mutation on the clone.\n\t// Even if the interceptor mutates nested properties, the original\n\t// jsonRequest in the gateway scope remains untouched.\n\tconst frozenRequest = Object.freeze(structuredClone(request));\n\n\tlet onAbortListener: (() => void) | undefined;\n\tconst abortPromise = new Promise<never>((_, reject) => {\n\t\tonAbortListener = () => reject(signal.reason);\n\t\tsignal.addEventListener(\"abort\", onAbortListener, { once: true });\n\t});\n\n\ttry {\n\t\tconst result = await Promise.race([\n\t\t\tPromise.resolve(\n\t\t\t\toptions.interceptor(frozenRequest, { ...context, signal }),\n\t\t\t),\n\t\t\tabortPromise,\n\t\t]);\n\t\treturn result;\n\t} catch (error: unknown) {\n\t\tconst errorMessage = error instanceof Error ? error.message : String(error);\n\n\t\tif (failMode === \"open\") {\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-Gateway] Interceptor error (fail-open, allowing request): ${errorMessage}`,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tallowed: true,\n\t\t\t\tmetadata: { interceptorError: errorMessage, failMode: \"open\" },\n\t\t\t};\n\t\t}\n\n\t\t// fail-closed: reject with error response\n\t\tlog.error(\n\t\t\t`[LIOP-Gateway] Interceptor error (fail-closed, rejecting request): ${errorMessage}`,\n\t\t);\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Interceptor unavailable: ${errorMessage}`,\n\t\t\terrorCode: -32098,\n\t\t\tmetadata: { interceptorError: errorMessage, failMode: \"closed\" },\n\t\t};\n\t} finally {\n\t\tif (onAbortListener) {\n\t\t\tsignal.removeEventListener(\"abort\", onAbortListener);\n\t\t}\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Sliding-Window Rate Limiter\n *\n * High-performance, zero-dependency in-memory rate limiter designed\n * to protect the LIOP Hybrid Gateway and Mesh Nodes against Denial of Service (DoS),\n * worker pool exhaustion, and brute-force attacks.\n *\n * Conforms to OWASP API Security Top 10 (API4:2023 - Unrestricted Resource Consumption).\n */\n\nexport interface RateLimiterOptions {\n\t/** Window duration in milliseconds (default: 60,000ms = 1 minute) */\n\twindowMs?: number;\n\t/** Maximum number of allowed requests per window (default: 120) */\n\tmaxRequests?: number;\n}\n\nexport interface RateLimitStatus {\n\tallowed: boolean;\n\tremaining: number;\n\tlimit: number;\n\tresetMs: number;\n}\n\ninterface WindowRecord {\n\tcount: number;\n\tresetTime: number;\n}\n\nexport class InMemoryRateLimiter {\n\tprivate readonly windowMs: number;\n\tprivate readonly maxRequests: number;\n\tprivate readonly records: Map<string, WindowRecord> = new Map();\n\tprivate cleanupTimer?: NodeJS.Timeout;\n\n\tconstructor(options: RateLimiterOptions = {}) {\n\t\tthis.windowMs = options.windowMs ?? 60_000;\n\t\tthis.maxRequests = options.maxRequests ?? 120;\n\n\t\t// Clean up expired buckets periodically (every 30s)\n\t\tthis.cleanupTimer = setInterval(() => this.cleanup(), 30_000);\n\t\tif (typeof this.cleanupTimer.unref === \"function\") {\n\t\t\tthis.cleanupTimer.unref();\n\t\t}\n\t}\n\n\t/**\n\t * Evaluates whether a request from the given key (IP, token, or clientId) is permitted.\n\t *\n\t * @param key Identifier for the client (e.g., remote IP or OAuth client ID)\n\t * @returns Status containing allowed boolean, remaining quota, and time until reset\n\t */\n\tpublic check(key: string): RateLimitStatus {\n\t\tconst now = Date.now();\n\t\tlet record = this.records.get(key);\n\n\t\tif (!record || now >= record.resetTime) {\n\t\t\trecord = {\n\t\t\t\tcount: 1,\n\t\t\t\tresetTime: now + this.windowMs,\n\t\t\t};\n\t\t\tthis.records.set(key, record);\n\t\t\treturn {\n\t\t\t\tallowed: true,\n\t\t\t\tremaining: this.maxRequests - 1,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: this.windowMs,\n\t\t\t};\n\t\t}\n\n\t\tif (record.count >= this.maxRequests) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\tremaining: 0,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t\t};\n\t\t}\n\n\t\trecord.count++;\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\tremaining: this.maxRequests - record.count,\n\t\t\tlimit: this.maxRequests,\n\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t};\n\t}\n\n\t/**\n\t * Explicitly resets the rate limit bucket for a given key.\n\t */\n\tpublic reset(key: string): void {\n\t\tthis.records.delete(key);\n\t}\n\n\t/**\n\t * Cleans up expired rate-limiting buckets to prevent memory leaks.\n\t */\n\tpublic cleanup(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [key, record] of this.records.entries()) {\n\t\t\tif (now >= record.resetTime) {\n\t\t\t\tthis.records.delete(key);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Destroys internal timers and clears records.\n\t */\n\tpublic close(): void {\n\t\tif (this.cleanupTimer) {\n\t\t\tclearInterval(this.cleanupTimer);\n\t\t\tthis.cleanupTimer = undefined;\n\t\t}\n\t\tthis.records.clear();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as http from \"node:http\";\nimport * as http2 from \"node:http2\";\nimport * as net from \"node:net\";\nimport type { MeshNode } from \"../mesh/index.js\";\nimport {\n\tmanifestCacheSize,\n\tmeshPeersConnected,\n\tprotocolMetrics,\n} from \"../observability/metrics.js\";\nimport type { AuthInfo, JwtValidator } from \"../security/jwt-validator.js\";\nimport { buildProtectedResourceMetadata } from \"../security/prm.js\";\nimport type { LiopServer } from \"../server/index.js\";\nimport { log } from \"../utils/logger.js\";\nimport {\n\tdispatchGrpcWebRequest,\n\tGRPC_WEB_CONSTANTS,\n\tisGrpcWebRequest,\n} from \"./grpc-web.js\";\nimport {\n\texecuteGatewayInterceptor,\n\ttype GatewayInterceptorOptions,\n} from \"./interceptor.js\";\nimport {\n\tInMemoryRateLimiter,\n\ttype RateLimiterOptions,\n} from \"./rate-limiter.js\";\nimport { LiopMcpRouter } from \"./router.js\";\n\n/**\n * LIOP Hybrid Gateway\n * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.\n */\nexport class LiopHybridGateway {\n\tprivate netServer: net.Server;\n\tprivate h2Server: http2.Http2Server;\n\tprivate h1Server: http.Server;\n\tprivate router: LiopMcpRouter;\n\tprivate jwtValidator?: JwtValidator;\n\t// biome-ignore lint/suspicious/noExplicitAny: oidc-provider is loaded in Phase C\n\tprivate oauthProvider?: any;\n\tprivate rateLimiter: InMemoryRateLimiter;\n\tprivate readonly interceptorOptions?: GatewayInterceptorOptions;\n\tprivate isDraining = false;\n\tprivate activeRequests = 0;\n\n\tconstructor(\n\t\tprivate liopServer: LiopServer,\n\t\tprivate meshNode: MeshNode | null = null,\n\t\trpcPort: number = 50051,\n\t\trateLimiterOptions?: RateLimiterOptions,\n\t\tinterceptorOptions?: GatewayInterceptorOptions,\n\t) {\n\t\tthis.jwtValidator = this.liopServer.jwtValidator;\n\t\tthis.oauthProvider = this.liopServer.oauthProvider;\n\t\tthis.rateLimiter = new InMemoryRateLimiter(rateLimiterOptions);\n\t\tthis.interceptorOptions = interceptorOptions;\n\n\t\t// Initialize the Universal Router\n\t\tthis.router = new LiopMcpRouter(this.liopServer, this.meshNode, rpcPort);\n\n\t\t// Internal HTTP/2 Server (for Native gRPC Proxying)\n\t\tthis.h2Server = http2.createServer();\n\t\tthis.setupH2Routes();\n\n\t\t// Internal HTTP/1 Server (for Browser/MCP)\n\t\tthis.h1Server = http.createServer();\n\t\tthis.setupH1Routes();\n\n\t\t// Primary Multiplexer (L4)\n\t\tthis.netServer = net.createServer((socket) => {\n\t\t\tsocket.once(\"data\", (buffer) => {\n\t\t\t\tconst isHttp2 = buffer.toString().startsWith(\"PRI * HTTP/2.0\");\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Incoming L4 Connection. Protocol: ${isHttp2 ? \"HTTP/2 (gRPC)\" : \"HTTP/1.1 (MCP)\"}`,\n\t\t\t\t);\n\t\t\t\tif (isHttp2) {\n\t\t\t\t\tthis.h2Server.emit(\"connection\", socket);\n\t\t\t\t} else {\n\t\t\t\t\tthis.h1Server.emit(\"connection\", socket);\n\t\t\t\t}\n\t\t\t\tsocket.unshift(buffer);\n\t\t\t});\n\t\t\tsocket.on(\"error\", (err) =>\n\t\t\t\tlog.error(`[LIOP-Gateway] NetServer Socket Error: ${err.message}`),\n\t\t\t);\n\t\t});\n\n\t\t// Attach error listeners to sub-servers to catch silent failures\n\t\tthis.h1Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H1 Server Error: ${err.message}`),\n\t\t);\n\t\tthis.h2Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H2 Server Error: ${err.message}`),\n\t\t);\n\n\t\tlog.info(\"[LIOP-Gateway] Hybrid adapter initialized.\");\n\t}\n\n\tprivate setupH2Routes() {\n\t\tthis.h2Server.on(\"stream\", (stream, headers) => {\n\t\t\tconst contentType = headers[\"content-type\"] as string;\n\t\t\tconst path = headers[\":path\"] as string;\n\n\t\t\tif (contentType === \"application/grpc\") {\n\t\t\t\tthis.handleGrpcStream(stream as http2.ServerHttp2Stream);\n\t\t\t} else if (path === \"/mcp\") {\n\t\t\t\tthis.handleMcpH2Stream(stream as http2.ServerHttp2Stream, headers);\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate setupH1Routes() {\n\t\tthis.h1Server.on(\"request\", async (req, res) => {\n\t\t\tthis.activeRequests += 1;\n\t\t\tconst onDone = () => {\n\t\t\t\tres.removeListener(\"finish\", onDone);\n\t\t\t\tres.removeListener(\"close\", onDone);\n\t\t\t\tthis.activeRequests = Math.max(0, this.activeRequests - 1);\n\t\t\t};\n\t\t\tres.on(\"finish\", onDone);\n\t\t\tres.on(\"close\", onDone);\n\n\t\t\tconst url = req.url || \"\";\n\t\t\tconst method = req.method;\n\n\t\t\t// [Phase Beta-3] Prometheus Metrics Endpoint\n\t\t\tif (method === \"GET\" && url === \"/metrics\") {\n\t\t\t\tif (this.meshNode) {\n\t\t\t\t\tmeshPeersConnected.set({}, this.meshNode.getPeers().length);\n\t\t\t\t}\n\t\t\t\tif (this.router) {\n\t\t\t\t\tmanifestCacheSize.set({}, this.router.getManifestCacheSize());\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, {\n\t\t\t\t\t\"Content-Type\": \"text/plain; version=0.0.4; charset=utf-8\",\n\t\t\t\t});\n\t\t\t\tres.end(protocolMetrics.exportPrometheusText());\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Liveness Probe\n\t\t\tif (method === \"GET\" && url === \"/healthz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ok\",\n\t\t\t\t\t\tuptime: Math.floor(process.uptime()),\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Readiness Probe\n\t\t\tif (method === \"GET\" && url === \"/readyz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst meshStarted = this.meshNode ? this.meshNode.isStarted() : true;\n\t\t\t\tif (!meshStarted) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"unready\",\n\t\t\t\t\t\t\tmeshStarted: false,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ready\",\n\t\t\t\t\t\tmeshStarted: true,\n\t\t\t\t\t\tpeers: this.meshNode ? this.meshNode.getPeers().length : 0,\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Reject new MCP requests if draining\n\t\t\tif (this.isDraining && url === \"/mcp\") {\n\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tcode: -32000,\n\t\t\t\t\t\t\tmessage: \"Gateway is draining connections for shutdown\",\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-2] gRPC-Web HTTP/1.1 Framing Fallback\n\t\t\tconst contentType = req.headers[\"content-type\"];\n\t\t\tif (isGrpcWebRequest(contentType)) {\n\t\t\t\tawait dispatchGrpcWebRequest(req, res, async (reqPath, payload) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] gRPC-Web fallback call: ${reqPath} (${payload.length} bytes)`,\n\t\t\t\t\t);\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: GRPC_WEB_CONSTANTS.STATUS_OK,\n\t\t\t\t\t\tmessage: \"OK\",\n\t\t\t\t\t\tdata: Buffer.from(\"\"),\n\t\t\t\t\t};\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [SEC] M2M OAuth 2.1 OIDC Authorization Server Router (Phase C proxy)\n\t\t\tif (url.startsWith(\"/oidc\") && this.oauthProvider) {\n\t\t\t\tconst callback =\n\t\t\t\t\ttypeof this.oauthProvider.callback === \"function\"\n\t\t\t\t\t\t? this.oauthProvider.callback()\n\t\t\t\t\t\t: this.oauthProvider;\n\t\t\t\t// Rewrite req.url to strip the '/oidc' prefix before delegating to oidc-provider\n\t\t\t\tconst originalUrl = req.url;\n\t\t\t\treq.url = (originalUrl || \"\").slice(5) || \"/\";\n\t\t\t\ttry {\n\t\t\t\t\treturn callback(req, res);\n\t\t\t\t} finally {\n\t\t\t\t\treq.url = originalUrl;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// [SEC] RFC 9728 Protected Resource Metadata (PRM) Endpoint\n\t\t\tif (method === \"GET\" && url === \"/.well-known/oauth-protected-resource\") {\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst prm = buildProtectedResourceMetadata(\n\t\t\t\t\t\tthis.jwtValidator.getIssuer(),\n\t\t\t\t\t\tthis.jwtValidator.getAudience(),\n\t\t\t\t\t);\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(JSON.stringify(prm));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\tmethod === \"GET\" &&\n\t\t\t\t(url === \"/\" || url === \"/mcp\" || url === \"/health\")\n\t\t\t) {\n\t\t\t\tif (\n\t\t\t\t\turl === \"/health\" &&\n\t\t\t\t\treq.headers.accept?.includes(\"application/json\")\n\t\t\t\t) {\n\t\t\t\t\tconst meshInfo = this.meshNode\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\tpeerId: this.meshNode.getPeerId()?.toString() || \"\",\n\t\t\t\t\t\t\t\tmultiaddrs: this.meshNode\n\t\t\t\t\t\t\t\t\t.getMultiaddrs()\n\t\t\t\t\t\t\t\t\t.map((m) => m.toString()),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: null;\n\t\t\t\t\tconst issuer = this.jwtValidator?.getIssuer();\n\t\t\t\t\tconst baseUrl = issuer\n\t\t\t\t\t\t? issuer.endsWith(\"/oidc\")\n\t\t\t\t\t\t\t? issuer\n\t\t\t\t\t\t\t: `${issuer}/oidc`\n\t\t\t\t\t\t: \"\";\n\t\t\t\t\tconst authInfoResponse =\n\t\t\t\t\t\tthis.jwtValidator && issuer\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tissuer,\n\t\t\t\t\t\t\t\t\tjwks_uri: `${baseUrl}/jwks`,\n\t\t\t\t\t\t\t\t\t...(this.oauthProvider\n\t\t\t\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\t\t\t\ttoken_endpoint: `${baseUrl}/token`,\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: undefined;\n\n\t\t\t\t\tconst topologyInfo = {\n\t\t\t\t\t\ttier: this.meshNode?.isPrivateNetwork?.() ? 1 : 2,\n\t\t\t\t\t\tprmEndpoint: this.jwtValidator\n\t\t\t\t\t\t\t? \"/.well-known/oauth-protected-resource\"\n\t\t\t\t\t\t\t: undefined,\n\t\t\t\t\t\ttransportCapabilities: [\"http-mcp\", \"grpc-lio\", \"p2p-dht\"],\n\t\t\t\t\t};\n\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"healthy\",\n\t\t\t\t\t\t\tnode: this.liopServer.getServerInfo(),\n\t\t\t\t\t\t\tmesh: meshInfo,\n\t\t\t\t\t\t\ttools: this.liopServer.listTools().map((t) => t.name),\n\t\t\t\t\t\t\tauth: authInfoResponse,\n\t\t\t\t\t\t\ttopology: topologyInfo,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(`\n                    <body style=\"background:#0f172a;color:#f8fafc;font-family:sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;margin:0\">\n                        <div style=\"background:#1e293b;padding:40px;border-radius:16px;border:1px solid #38bdf8;text-align:center;box-shadow:0 20px 25px -5px rgba(0,0,0,0.1)\">\n                            <h1 style=\"color:#38bdf8;margin-top:0\">LIOP Protocol Transformer</h1>\n                            <p style=\"opacity:0.8;font-weight:600\">L4/L7 Transcoding: JSON-RPC &harr; gRPC</p>\n                            <p style=\"opacity:0.6;font-size:14px\">Active Protections: Kyber768 + AES-256-GCM + ZK-Proof Ready</p>\n                            <div style=\"background:#0f172a;padding:15px;border-radius:8px;margin-top:20px;border:1px dashed #334155\">\n                                <code style=\"color:#10b981\">Endpoint: http://localhost:3000/mcp</code>\n                            </div>\n                        </div>\n                    </body>\n                `);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (url === \"/mcp\" && method === \"POST\") {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = req.headers.authorization;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tlet body = \"\";\n\t\t\t\treq.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\t\t\treq.on(\"end\", async () => {\n\t\t\t\t\t// [SEC] Rate limiting per IP or authenticated client (OWASP API4:2023)\n\t\t\t\t\tconst clientIp = req.socket.remoteAddress || \"127.0.0.1\";\n\t\t\t\t\tconst rateLimitKey = authInfo?.clientId\n\t\t\t\t\t\t? `client:${authInfo.clientId}`\n\t\t\t\t\t\t: `ip:${clientIp}`;\n\t\t\t\t\tconst rateStatus = this.rateLimiter.check(rateLimitKey);\n\t\t\t\t\tif (!rateStatus.allowed) {\n\t\t\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t\t\"Retry-After\": Math.ceil(rateStatus.resetMs / 1000).toString(),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\tid: null,\n\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\tcode: -32029,\n\t\t\t\t\t\t\t\t\tmessage: \"Rate limit exceeded. Too many requests.\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t\t\t// [SEC] Perimeter Admission Hook (technology-agnostic)\n\t\t\t\t\t\t// Executes AFTER JWT + RateLimiter to prevent attackers from\n\t\t\t\t\t\t// exhausting external API quotas (e.g., TYPESAFE_API_KEY) with\n\t\t\t\t\t\t// unauthenticated or rate-limited traffic.\n\t\t\t\t\t\tif (this.interceptorOptions?.interceptor) {\n\t\t\t\t\t\t\tconst verdict = await executeGatewayInterceptor(\n\t\t\t\t\t\t\t\tjsonRequest,\n\t\t\t\t\t\t\t\t{ clientIp, authInfo, protocol: \"http1\" },\n\t\t\t\t\t\t\t\tthis.interceptorOptions as Required<\n\t\t\t\t\t\t\t\t\tPick<GatewayInterceptorOptions, \"interceptor\">\n\t\t\t\t\t\t\t\t> &\n\t\t\t\t\t\t\t\t\tGatewayInterceptorOptions,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tif (!verdict.allowed) {\n\t\t\t\t\t\t\t\tres.writeHead(403, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\t\tcode: verdict.errorCode ?? -32099,\n\t\t\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t\t\tverdict.reason ||\n\t\t\t\t\t\t\t\t\t\t\t\t\"Forbidden: Rejected by Gateway Interceptor\",\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// [SEP-2243] Header-based routing validation\n\t\t\t\t\t\tconst mcpMethod = req.headers[\"mcp-method\"] as string | undefined;\n\t\t\t\t\t\tconst mcpName = req.headers[\"mcp-name\"] as string | undefined;\n\t\t\t\t\t\tconst mcpVersion = req.headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t\t\t| string\n\t\t\t\t\t\t\t| undefined;\n\n\t\t\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\tmcpName &&\n\t\t\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\t!jsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\tres.end(JSON.stringify(response));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Gateway] Error processing JSON-RPC payload: ${(e as Error).message}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tres.writeHead(400);\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\terror: { code: -32700, message: \"Parse error\" },\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate handleGrpcStream(stream: http2.ServerHttp2Stream) {\n\t\tstream.on(\"data\", (chunk: unknown) => {\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Standard gRPC stream data is Buffer\n\t\t\tconst data = chunk as any;\n\t\t\tif (data)\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Native gRPC Proxy passing ${data.length} bytes`,\n\t\t\t\t);\n\t\t});\n\t\tstream.respond({ \":status\": 200, \"content-type\": \"application/grpc\" });\n\t\tstream.end();\n\t}\n\n\tprivate handleMcpH2Stream(\n\t\tstream: http2.ServerHttp2Stream,\n\t\theaders: http2.IncomingHttpHeaders,\n\t) {\n\t\tlet body = \"\";\n\t\tstream.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\tstream.on(\"end\", async () => {\n\t\t\ttry {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token over HTTP/2 (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = headers.authorization as string;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t// [SEC] Perimeter Admission Hook (HTTP/2 symmetry)\n\t\t\t\tif (this.interceptorOptions?.interceptor) {\n\t\t\t\t\tconst h2ClientIp =\n\t\t\t\t\t\tstream.session?.socket?.remoteAddress || \"127.0.0.1\";\n\t\t\t\t\tconst verdict = await executeGatewayInterceptor(\n\t\t\t\t\t\tjsonRequest,\n\t\t\t\t\t\t{ clientIp: h2ClientIp, authInfo, protocol: \"http2\" },\n\t\t\t\t\t\tthis.interceptorOptions as Required<\n\t\t\t\t\t\t\tPick<GatewayInterceptorOptions, \"interceptor\">\n\t\t\t\t\t\t> &\n\t\t\t\t\t\t\tGatewayInterceptorOptions,\n\t\t\t\t\t);\n\t\t\t\t\tif (!verdict.allowed) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 403,\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\tcode: verdict.errorCode ?? -32099,\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\tverdict.reason ||\n\t\t\t\t\t\t\t\t\t\t\"Forbidden: Rejected by Gateway Interceptor\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// [SEP-2243] Header-based routing validation in HTTP/2\n\t\t\t\tconst mcpMethod = headers[\"mcp-method\"] as string | undefined;\n\t\t\t\tconst mcpName = headers[\"mcp-name\"] as string | undefined;\n\t\t\t\tconst mcpVersion = headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t| string\n\t\t\t\t\t| undefined;\n\n\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (\n\t\t\t\t\tmcpName &&\n\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t}\n\t\t\t\t\tif (\n\t\t\t\t\t\t!jsonRequest.params._meta[\"io.modelcontextprotocol/protocolVersion\"]\n\t\t\t\t\t) {\n\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\tif (response) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 200,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(JSON.stringify(response));\n\t\t\t\t} else stream.close();\n\t\t\t} catch (_e) {\n\t\t\t\tstream.respond({ \":status\": 400 });\n\t\t\t\tstream.end();\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic async listen(port: number, host: string = \"0.0.0.0\"): Promise<number> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.start();\n\n\t\t\t// Announce all local tools to the DHT\n\t\t\tconst tools = this.liopServer.listTools();\n\t\t\tfor (const tool of tools) {\n\t\t\t\tawait this.meshNode.announceCapability(tool.name);\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] 📡 Announced local tool to Mesh: ${tool.name}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tthis.netServer.on(\"error\", (err: Error & { code?: string }) => {\n\t\t\t\tif (err.code === \"EADDRINUSE\") {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] FATAL: Port ${port} is already in use by another process.`,\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\tlog.error(`[LIOP-Gateway] Binding Error: ${err.message}`);\n\t\t\t\t}\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tthis.netServer.listen(port, host, () => {\n\t\t\t\tconst addr = this.netServer.address();\n\t\t\t\tconst actualHost =\n\t\t\t\t\ttypeof addr === \"string\" ? addr : addr?.address || host;\n\t\t\t\tconst assignedPort =\n\t\t\t\t\ttypeof addr === \"string\" ? port : addr?.port || port;\n\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] ✅ Transformer Mesh Gateway READY and listening on ${actualHost}:${assignedPort}`,\n\t\t\t\t);\n\t\t\t\tresolve(assignedPort);\n\t\t\t});\n\t\t});\n\t}\n\n\tpublic isDrained(): boolean {\n\t\treturn this.isDraining;\n\t}\n\n\tpublic async drain(timeoutMs = 5000): Promise<void> {\n\t\tthis.isDraining = true;\n\t\tlog.info(\n\t\t\t`[LIOP-Gateway] Draining gateway connections (active: ${this.activeRequests}, timeout: ${timeoutMs}ms)...`,\n\t\t);\n\t\tconst start = Date.now();\n\t\twhile (this.activeRequests > 0 && Date.now() - start < timeoutMs) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, 50));\n\t\t}\n\t\tawait this.stop();\n\t}\n\n\tpublic async stop() {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t\tthis.rateLimiter.close();\n\t\tthis.netServer.close();\n\t\tthis.h2Server.close();\n\t\tthis.h1Server.close();\n\t}\n\n\tpublic getRouter(): LiopMcpRouter {\n\t\treturn this.router;\n\t}\n}\n"]}

package/dist/{chunk-Y6YXTITY.js → chunk-FCFTYOAS.js}

@@ -1,8 +1,7 @@
 import { TokenManager } from './chunk-3QH44NKZ.js';
-import { TokenTelemetryEngine } from './chunk-H2SNR7PB.js';
 import { LiopVerifier } from './chunk-2STZHJ24.js';
 import { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS } from './chunk-3UBNOYMH.js';
+import { createChannelCredentials, liopV1, GRPC_CHANNEL_OPTIONS, TokenTelemetryEngine } from './chunk-UJFWPRDM.js';
 import { pqcHandshakesTotal, pqcHandshakeDurationMs, zkVerificationsTotal, toolCallErrorsTotal, wireEgressBytesTotal } from './chunk-PAICJCKJ.js';
 import { MCP_PROTOCOL_VERSION, MCP_LEGACY_SUPPORT_ENABLED, MCP_PROTOCOL_VERSION_LEGACY } from './chunk-2KSO3W4A.js';
 import { MeshNode } from './chunk-XRDN232O.js';
@@ -790,5 +789,5 @@ var LiopClient = class {
 };
 
 export { AesGcmWrapper, LiopClient, LiopRpcClient };
-//# sourceMappingURL=chunk-Y6YXTITY.js.map
-//# sourceMappingURL=chunk-Y6YXTITY.js.map
+//# sourceMappingURL=chunk-FCFTYOAS.js.map
+//# sourceMappingURL=chunk-FCFTYOAS.js.map

package/dist/chunk-FCFTYOAS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/client.ts","../src/rpc/crypto/aes.ts","../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;AAsBO,IAAM,gBAAN,MAAoB;AAAA;AAAA,EAElB,MAAA;AAAA,EACA,KAAA;AAAA,EACA,iBAAA;AAAA,EACQ,OAAA;AAAA,EAEhB,WAAA,CAAY,OAAA,EAAiB,GAAA,EAAsB,KAAA,EAAuB;AACzE,IAAA,MAAM,WAAA,GAAc,yBAAyB,GAAG,CAAA;AAChD,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,MAAA,CAAO,SAAA;AAAA,MACxB,OAAA;AAAA,MACA,WAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EAChB;AAAA,EAEO,SAAS,KAAA,EAA6B;AAC5C,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAAA,IAC1B;AAAA,EACD;AAAA,EAEA,MAAc,YAAA,GAA4C;AACzD,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,UAAA,EAAY;AACrC,MAAA,IAAA,CAAK,iBAAA,GAAoB,MAAM,IAAA,CAAK,KAAA,EAAM;AAC1C,MAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,IACb;AACA,IAAA,IAAA,CAAK,oBAAoB,IAAA,CAAK,KAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,gBACZ,OAAA,EAC0B;AAC1B,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,YAAA,EAAa;AAC5C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,MAAM,QAAA,GAAW,IAAS,IAAA,CAAA,QAAA,EAAS;AACnC,MAAA,IAAI,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,WAAW,CAAA,CAAE,CAAA;AAAA,MACtD;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,eAAA;AAAA,QACX,OAAA;AAAA,QACA,QAAA;AAAA,QACA,CAAC,OAAiC,QAAA,KAA6B;AAC9D,UAAA,IAAI,KAAA,EAAO;AACV,YAAA,MAAA,CAAO,KAAK,CAAA;AAAA,UACb,CAAA,MAAO;AACN,YAAA,OAAA,CAAQ,QAAQ,CAAA;AAAA,UACjB;AAAA,QACD;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,aACN,OAAA,EAC2C;AAC3C,IAAA,MAAM,QAAA,GAAW,IAAS,IAAA,CAAA,QAAA,EAAS;AACnC,IAAA,MAAM,WAAA,GACL,KAAK,iBAAA,KACJ,OAAO,KAAK,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,MAAA,CAAA;AAChD,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,QAAA,CAAS,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,WAAW,CAAA,CAAE,CAAA;AAAA,IACtD;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEO,KAAA,GAAc;AACpB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AACD;AChGO,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5B,cAAA,CACC,SACA,YAAA,EAIC;AACD,IAAA,IAAI,YAAA,CAAa,WAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AAGA,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,aAAA,EAAe,YAAA,EAAc,KAAK,CAAA;AAGhE,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACxE,IAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAIlC,IAAA,MAAM,kBAAkB,MAAA,CAAO,MAAA,CAAO,CAAC,SAAA,EAAW,OAAO,CAAC,CAAA;AAE1D,IAAA,OAAO;AAAA,MACN,UAAA,EAAY,eAAA;AAAA,MACZ;AAAA,KACD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,gBAAA,EACA,KAAA,EACA,YAAA,EACS;AACT,IAAA,IAAI,gBAAA,CAAiB,SAAS,EAAA,EAAI;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,MAAM,aAAA,GAAgB,gBAAA,CAAiB,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AACtD,IAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,QAAA,CAAS,GAAG,CAAA;AAE7C,IAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,aAAA,EAAe,YAAA,EAAc,KAAK,CAAA;AACpE,IAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAE3B,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAAA,EACxE;AACD;;;AChCO,IAAM,aAAN,MAAiB;AAAA,EACf,QAAA,GAA4B,IAAA;AAAA,EAC5B,UAAA,uBAA6C,GAAA,EAAI;AAAA,EACjD,SAAA,uBAA2C,GAAA,EAAI;AAAA,EAC/C,UAAA;AAAA,EACA,UAAA;AAAA,EACD,QAAA,GAAyB,IAAI,YAAA,EAAa;AAAA,EACzC,UAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAGD,GAAA,GAAc,QAAA;AAAA;AAAA,EAEd,eAAA,GAA0B,oBAAA;AAAA,EAEjC,YAAY,GAAA,EAAsB;AACjC,IAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,OAAA,CACZ,OAAA,EACA,OAAA,EAWgB;AAEhB,IAAA,MAAM,QAAA,GACL,SAAS,IAAA,EAAM,QAAA,IACf,QAAQ,GAAA,CAAI,oBAAA,IACZ,QAAQ,GAAA,CAAI,cAAA;AACb,IAAA,MAAM,YAAA,GACL,SAAS,IAAA,EAAM,YAAA,IACf,QAAQ,GAAA,CAAI,wBAAA,IACZ,QAAQ,GAAA,CAAI,kBAAA;AACb,IAAA,MAAM,WACL,OAAA,EAAS,IAAA,EAAM,QAAA,IACf,OAAA,CAAQ,IAAI,cAAA,IACZ,uBAAA;AACD,IAAA,MAAM,WACL,OAAA,EAAS,IAAA,EAAM,QAAA,IACf,OAAA,CAAQ,IAAI,mBAAA,IACZ,mBAAA;AACD,IAAA,MAAM,QACL,OAAA,EAAS,IAAA,EAAM,KAAA,IACf,OAAA,CAAQ,IAAI,gBAAA,IACZ,sFAAA;AAED,IAAA,IAAA,CAAK,UAAA,GACJ,SAAS,IAAA,EAAM,KAAA,IACf,QAAQ,GAAA,CAAI,gBAAA,IACZ,QAAQ,GAAA,CAAI,UAAA;AAEb,IAAA,IAAI,YAAY,YAAA,EAAc;AAC7B,MAAA,MAAM,OAAA,GAAA,CAAW,QAAY,EAAyB,QAAA,CAAS,OAAO,IACnE,QAAY,GACZ,CAAA,EAAG,QAAmC,CAAA,KAAA,CAAA;AACzC,MAAA,MAAM,aAAA,GAAgB,GAAG,OAAO,CAAA,MAAA,CAAA;AAEhC,MAAA,IAAA,CAAK,YAAA,GAAe,IAAI,YAAA,CAAa;AAAA,QACpC,aAAA;AAAA,QACA,QAAA;AAAA,QACA,YAAA;AAAA,QACA,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACR,CAAA;AAED,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACnD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH;AAAA,SACD;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,mDACC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAChD,CAAA;AAAA,SACD;AAAA,MAED;AAAA,IACD;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,OAAA,EAAS,UAAU,CAAA;AAChD,IAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAC1B,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,6CAAA,EAAgD,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,CAAA;AAAA,KAC1E;AAEA,IAAA,IAAI,OAAA,EAAS;AACZ,MAAA,MAAM,gBAAgB,YAAY;AACjC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AAAA,QACzC;AACA,QAAA,OAAO,IAAA,CAAK,UAAA;AAAA,MACb,CAAA;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA;AAAA,QACf,QAAA;AAAA,QACA,IAAI,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,YAAY,aAAa;AAAA,OAC1D;AACA,MAAA,IAAA,CAAK,aAAa,EAAE,IAAA,EAAM,eAAe,OAAO,CAAA,CAAA,CAAA,EAAK,SAAS,OAAA,EAAQ;AACtE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,yCAAA,EAA4C,OAAO,CAAA,CAAE,CAAA;AAAA,IAC/D,CAAA,MAAO;AACN,MAAA,IAAA,CAAK,UAAA,GAAa,EAAE,IAAA,EAAM,yBAAA,EAA2B,SAAS,OAAA,EAAQ;AAAA,IACvE;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gBAAgB,KAAA,EAAgC;AAEvD,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACjC,MAAA,IAAI,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,CAAA,GAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,MAAM,EAAA,GAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC1B,QAAA,IACC,EAAA,KAAO,WAAA,IACP,CAAC,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,IACrB,EAAA,KAAO,SAAA,IACP,EAAA,KAAO,WAAA,EACN;AACD,UAAA,OAAO,EAAA;AAAA,QACR;AAAA,MACD;AAAA,IACD;AAGA,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACjC,MAAA,IAAI,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,CAAA,GAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,MACvB;AAAA,IACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,kBAAkB,QAAA,EAAmC;AACjE,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAED,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6CAAA,EAAgD,QAAQ,CAAA,GAAA,CAAK,CAAA;AACtE,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,QAAQ,CAAA;AAE5D,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,qDAAqD,QAAQ,CAAA;AAAA,OAC9D;AAAA,IACD;AAEA,IAAA,MAAM,UAAA,GAAa,UAAU,CAAC,CAAA;AAC9B,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AAEvE,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,UAAU,CAAA;AAC7D,IAAA,IAAI,QAAA,EAAU;AACb,MAAA,QAAA,GAAW,QAAA,CAAS,QAAA;AACpB,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACvC,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0CAAA,EAA6C,QAAQ,CAAA,6BAAA,EAAgC,UAAU,CAAA;AAAA,OAChG;AAAA,IACD;AAEA,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,UAAU,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC5C,IAAA,IAAI,SAAA,EAAW;AACd,MAAA,MAAM,QAAA,GAAW,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACzC,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,6DAA6D,QAAQ,CAAA;AAAA,OACtE;AACA,MAAA,OAAO,QAAA;AAAA,IACR;AAEA,IAAA,OAAO,aAAa,QAAQ,CAAA,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,oBAAoB,MAAA,EAI9B;AACF,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAkC;AAAA,QACvC,cAAA,EAAgB,kBAAA;AAAA,QAChB,YAAA,EAAc;AAAA,OACf;AACA,MAAA,IAAI,KAAK,UAAA,EAAY;AACpB,QAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,MAClD;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,QAC/B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACpB,OAAA,EAAS,KAAA;AAAA,UACT,EAAA,EAAI,CAAA;AAAA,UACJ,MAAA,EAAQ,iBAAA;AAAA,UACR,QAAQ;AAAC,SACT;AAAA,OACD,CAAA;AAED,MAAA,IAAI,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAG7B,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,EAAQ,iBAAA,IAAqB,EAAC;AACrD,QAAA,IAAI,SAAA,CAAU,QAAA,CAAS,oBAAoB,CAAA,EAAG;AAC7C,UAAA,IAAA,CAAK,GAAA,GAAM,QAAA;AACX,UAAA,IAAA,CAAK,eAAA,GAAkB,oBAAA;AACvB,UAAA,OAAO;AAAA,YACN,GAAA,EAAK,QAAA;AAAA,YACL,eAAA,EAAiB,oBAAA;AAAA,YACjB,iBAAA,EAAmB;AAAA,WACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD,SAAS,IAAA,EAAM;AAAA,IAEf;AAGA,IAAA,IAAI,0BAAA,EAA4B;AAC/B,MAAA,IAAA,CAAK,GAAA,GAAM,QAAA;AACX,MAAA,IAAA,CAAK,eAAA,GAAkB,2BAAA;AACvB,MAAA,OAAO;AAAA,QACN,GAAA,EAAK,QAAA;AAAA,QACL,eAAA,EAAiB,2BAAA;AAAA,QACjB,iBAAA,EAAmB,CAAC,2BAA2B;AAAA,OAChD;AAAA,IACD;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,aAAA,CACZ,YAAA,GAAe,KAAA,EACqC;AACpD,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AAEA,IAAA,MAAM,kBAAA,GAAqB,KAAK,GAAA,EAAI;AAEpC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iDAAiD,YAAY,CAAA,IAAA;AAAA,KAC9D;AACA,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,yBAAA,EAA0B;AAClE,IAAA,MAAM,QAAkD,EAAC;AACzD,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAY;AAElC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AACjC,MAAA,IAAI;AACH,QAAA,IAAI,WAA4C,CAAC,YAAA,GAC9C,KAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA,GACzB,KAAA,CAAA;AAEH,QAAA,IAAI,CAAC,QAAA,EAAU;AACd,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,qCAAA,EAAwC,MAAM,CAAA,CAAE,CAAA;AACzD,UAAA,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,aAAA,CAAc,MAAM,CAAA;AACnD,UAAA,IAAI,QAAA,EAAU;AACb,YAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAAA,UACpC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,wCAAA,EAA2C,MAAM,CAAA,CAAE,CAAA;AAAA,QAC7D;AAEA,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,KAAA,EAAO;AAClC,YAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AAC9B,cAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,WAAA,EAAa,IAAA,CAAK,aAAa,CAAA;AAC7D,cAAA,SAAA,CAAU,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,YACxB;AAAA,UACD;AAAA,QACD;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,6CAA6C,MAAM,CAAA,CAAA,CAAA;AAAA,UACnD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,SAChD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,uCAAA,EAA0C,MAAM,MAAM,CAAA,cAAA;AAAA,KACvD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,MAAA,MAAM,YAAA,GAAe,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACzC,MAAA,MAAM,oBAAA,GAAuB,IAAA,CAAK,SAAA,CAAU,EAAE,OAAO,CAAA;AACrD,MAAA,SAAA,CAAU,MAAA,CAAO;AAAA,QAChB,IAAA,EAAM,YAAA;AAAA,QACN,MAAA,EAAQ,eAAA;AAAA,QACR,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,YAAY,CAAA;AAAA,QACxD,qBAAA,EAAuB,SAAA,CAAU,WAAA,CAAY,oBAAoB,CAAA;AAAA,QACjE,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB,CAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QAAA,CACZ,OAAA,EACA,YAAA,EAC0B;AAC1B,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,aAAA,GAAgB,KAAK,GAAA,EAAI;AAC/B,IAAA,MAAM,WAAW,OAAA,CAAQ,IAAA;AACzB,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAE,CAAA;AAGnD,IAAA,IAAI,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,IAAI,eAAA,GAAkB,QAAA;AAEtB,IAAA,IAAI,CAAC,SAAA,EAAW;AAEf,MAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA,EAAG;AAClC,QAAA,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AACxC,QAAA,eAAA,GAAkB,QAAA;AAAA,MACnB;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,SAAA,EAAW;AAEf,MAAA,IAAI,YAAA,GAA8B,IAAA;AAClC,MAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,QAAQ,KAAK,IAAA,CAAK,SAAA,CAAU,SAAQ,EAAG;AAC1D,QAAA,IAAI,QAAA,CAAS,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,QAAQ,CAAA,EAAG;AAEpD,UAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,YAAA,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACtC,YAAA,eAAA,GAAkB,MAAA;AAClB,YAAA;AAAA,UACD;AAEA,UAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,MAAM,CAAA;AACpD,UAAA,MAAM,SAAA,GAAY,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC5C,UAAA,IAAI,SAAA,EAAW;AACd,YAAA,YAAA,GAAe,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAA,CAAS,QAAQ,CAAA,CAAA;AAChD,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,iCAAA,EAAoC,QAAQ,CAAA,uCAAA,EAA0C,YAAY,CAAA;AAAA,aACnG;AACA,YAAA,eAAA,GAAkB,MAAA;AAClB,YAAA,SAAA,GAAY,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,YAAY,CAAA;AAC1D,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,SAAA,EAAW;AACf,QAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,iBAAA,CAAkB,QAAQ,CAAA;AAC5D,QAAA,eAAA,GAAkB,QAAA;AAClB,QAAA,SAAA,GAAY,IAAA,CAAK,oBAAA,CAAqB,QAAA,EAAU,cAAc,CAAA;AAAA,MAC/D;AAAA,IACD,CAAA,MAAO;AACN,MAAA,eAAA,GAAkB,QAAA;AAClB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,0DAA0D,QAAQ,CAAA,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,oCAAA,EAAuC,QAAQ,CAAA,GAAA,CAAK,CAAA;AAC7D,IAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB,CAAA,SAAA,EAAY,KAAK,QAAA,CAAS,SAAA,EAAW,CAAA,CAAA,GACrC,oBAAA;AACH,IAAA,MAAM,aAAA,GAAgB,OAAO,IAAA,CAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,CAAA;AAC7D,IAAA,MAAM,aAAA,GAAgB,KAAK,QAAA,GACxB,MAAM,KAAK,QAAA,CAAS,IAAA,CAAK,aAAa,CAAA,GACtC,aAAA;AAEH,IAAA,IAAI,cAAA;AASJ,IAAA,IAAI;AACH,MAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,QACjD,SAAA,EAAW,QAAA;AAAA,QACX,eAAA,EAAiB,QAAA;AAAA,QACjB,eAAA,EAAiB;AAAA,OACjB,CAAA;AAAA,IACF,SAAS,GAAA,EAAc;AACtB,MAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,MAAA,IACC,KAAK,YAAA,KACJ,MAAA,CAAO,QAAA,CAAS,iBAAiB,KACjC,MAAA,CAAO,QAAA,CAAS,aAAa,CAAA,IAC7B,OAAO,QAAA,CAAS,wBAAwB,KACxC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,CAAA,EACzB;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,kDAAkD,QAAQ,CAAA,qEAAA;AAAA,SAC3D;AACA,QAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACpD,QAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,QAAA,SAAA,CAAU,SAAS,UAAU,CAAA;AAC7B,QAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,UACjD,SAAA,EAAW,QAAA;AAAA,UACX,eAAA,EAAiB,QAAA;AAAA,UACjB,eAAA,EAAiB;AAAA,SACjB,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,MAAM,GAAA;AAAA,MACP;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,eAAe,QAAA,EAAU;AAC7B,MAAA,IACC,IAAA,CAAK,iBACJ,cAAA,CAAe,aAAA,EAAe,SAAS,OAAO,CAAA,IAC9C,eAAe,aAAA,EAAe,QAAA,CAAS,iBAAiB,CAAA,IACxD,cAAA,CAAe,eAAe,QAAA,CAAS,SAAS,KAChD,cAAA,CAAe,aAAA,EAAe,QAAA,CAAS,wBAAwB,CAAA,CAAA,EAC/D;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,+CAAA,EAAkD,eAAe,aAAa,CAAA,mCAAA;AAAA,SAC/E;AACA,QAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACpD,QAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,QAAA,SAAA,CAAU,SAAS,UAAU,CAAA;AAC7B,QAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,UACjD,SAAA,EAAW,QAAA;AAAA,UACX,eAAA,EAAiB,QAAA;AAAA,UACjB,eAAA,EAAiB;AAAA,SACjB,CAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,eAAe,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,uBAAA,EAA0B,eAAe,aAAa,CAAA;AAAA,SACvD;AAAA,MACD;AAAA,IACD;AAGA,IAAA,MAAM,SAAA,GACL,cAAA,CAAe,gBAAA,IAAoB,cAAA,CAAe,cAAA;AACnD,IAAA,MAAM,YAAA,GACL,cAAA,CAAe,aAAA,IAAiB,cAAA,CAAe,YAAA;AAEhD,IAAA,IAAI,CAAC,SAAA,EAAW;AACf,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4EAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,IAAI;AACH,QAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,UACtB,SAAA,EAAW,YAAA;AAAA,UACX,MAAA,EAAQ;AAAA,SACR,CAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,QAAQ,IAAI,CAAA,GAAA;AAAA,KAC1E;AACA,IAAA,MAAM,QAAA,GAAW,YAAY,GAAA,EAAI;AACjC,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAM,eAAA,CAAgB,qBAAA,CAAsB,SAAS,CAAA;AACjE,MAAA,eAAA,GAAkB,GAAA,CAAI,UAAA;AACtB,MAAA,YAAA,GAAe,GAAA,CAAI,YAAA;AACnB,MAAA,MAAM,WAAA,GAAc,WAAA,CAAY,GAAA,EAAI,GAAI,QAAA;AACxC,MAAA,sBAAA,CAAuB,QAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA;AAClE,MAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,QACtB,SAAA,EAAW,YAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACR,CAAA;AAAA,IACF,SAAS,UAAA,EAAY;AACpB,MAAA,IAAI;AACH,QAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,UACtB,SAAA,EAAW,YAAA;AAAA,UACX,MAAA,EAAQ;AAAA,SACR,CAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,UAAA;AAAA,IACP;AAGA,IAAA,GAAA,CAAI,KAAK,CAAA,+CAAA,CAAiD,CAAA;AAE1D,IAAA,MAAM,YAAA,GAAe,YAAA,IAAgB,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA;AAGnD,IAAA,MAAM,EAAE,YAAY,aAAA,EAAe,KAAA,EAAO,UAAS,GAClD,aAAA,CAAc,cAAA,CAAe,YAAA,EAAc,YAAY,CAAA;AAGxD,IAAA,MAAM,kBAA8C,EAAC;AACrD,IAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAa,CAAA;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,MAAA,CAAO,QAAQ,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA,EAAG;AACnE,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,WAAA,CAAY,EAAE,CAAA;AACxC,MAAA,MAAM,SAAS,MAAA,CAAO,cAAA;AAAA,QACrB,aAAA;AAAA,QACA,YAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,MAAM,SAAA,GAAY,OAAO,MAAA,CAAO;AAAA,QAC/B,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,QACnC,OAAO,KAAA;AAAM,OACb,CAAA;AACD,MAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,MAAA,eAAA,CAAgB,GAAG,IAAI,MAAA,CAAO,MAAA,CAAO,CAAC,UAAA,EAAY,SAAA,EAAW,OAAO,CAAC,CAAA;AAAA,IACtE;AAGA,IAAA,MAAM,YAAA,GAA6B;AAAA,MAClC,aAAA,EAAe,YAAA;AAAA,MACf,WAAA,EAAa,aAAA;AAAA,MACb,MAAA,EAAQ,eAAA;AAAA,MACR,cAAA,EAAgB,eAAA;AAAA,MAChB,SAAA,EAAW;AAAA,KACZ;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,YAAA,CAAa,YAAY,CAAA;AAClD,MAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,oDAAoD,CAAC,CAAA;AACtE,QAAA;AAAA,MACD;AACA,MAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,MAAA,IAAI,eAAA,GAAkB,KAAA;AAEtB,MAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,OAAO,QAAA,KAA4B;AACpD,QAAA,IAAI,eAAA,EAAiB;AACrB,QAAA,eAAA,GAAkB,IAAA;AAElB,QAAA,GAAA,CAAI,KAAK,0DAA0D,CAAA;AAEnE,QAAA,IAAI;AAIH,UAAA,IAAI,CAAC,SAAS,QAAA,EAAU;AACvB,YAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,QAAA,CAAS,eAAA;AAAA,cACnC,YAAA;AAAA,cACA,OAAO,IAAA,CAAK,QAAA,CAAS,mBAAmB,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,cACxD,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,UAAU,CAAA;AAAA,cAC/B,MAAA,CAAO,KAAK,YAAY,CAAA;AAAA,cACxB,QAAA,CAAS;AAAA,aACV;AAEA,YAAA,IAAI;AACH,cAAA,oBAAA,CAAqB,GAAA,CAAI;AAAA,gBACxB,MAAA,EAAQ,UAAU,OAAA,GAAU;AAAA,eAC5B,CAAA;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAEA,YAAA,IAAI,CAAC,OAAA,EAAS;AACb,cAAA,IAAI;AACH,gBAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,kBACvB,UAAA,EAAY,QAAA;AAAA,kBACZ,UAAA,EAAY;AAAA,iBACZ,CAAA;AAAA,cACF,CAAA,CAAA,MAAQ;AAAA,cAAC;AACT,cAAA,MAAA;AAAA,gBACC,IAAI,KAAA;AAAA,kBACH;AAAA;AACD,eACD;AACA,cAAA;AAAA,YACD;AAAA,UACD,CAAA,MAAO;AACN,YAAA,IAAI;AACH,cAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,gBACvB,UAAA,EAAY,QAAA;AAAA,gBACZ,UAAA,EAAY;AAAA,eACZ,CAAA;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAAC;AAAA,UACV;AAEA,UAAA,eAAA,GAAkB,IAAA;AAGlB,UAAA,IAAI;AACH,YAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,YAAA,MAAM,eAAe,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA;AAC3D,YAAA,SAAA,CAAU,MAAA,CAAO;AAAA,cAChB,IAAA,EAAM,WAAA;AAAA,cACN,MAAA,EAAQ,UAAA;AAAA,cACR,QAAA;AAAA,cACA,MAAA,EACC,eAAA,KAAoB,QAAA,GAAW,eAAA,GAAkB,KAAA,CAAA;AAAA,cAClD,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,YAAY,CAAA;AAAA,cACxD,uBAAuB,SAAA,CAAU,WAAA;AAAA,gBAChC,QAAA,CAAS;AAAA,eACV;AAAA,cACA,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,aACzB,CAAA;AAED,YAAA,MAAM,cACL,MAAA,CAAO,UAAA,CAAW,QAAA,CAAS,iBAAA,IAAqB,EAAE,CAAA,IACjD,QAAA,CAAS,mBAAA,GACP,QAAA,CAAS,oBAAoB,MAAA,GAC7B,CAAA,CAAA,IACF,SAAS,UAAA,GAAa,QAAA,CAAS,WAAW,MAAA,GAAS,CAAA,CAAA;AACrD,YAAA,oBAAA,CAAqB,GAAA,CAAI,EAAE,UAAA,EAAY,QAAA,IAAY,WAAW,CAAA;AAAA,UAC/D,CAAA,CAAA,MAAQ;AAAA,UAER;AAEA,UAAA,OAAA,CAAQ;AAAA,YACP,OAAA,EAAS;AAAA,cACR;AAAA,gBACC,IAAA,EAAM,MAAA;AAAA,gBACN,MAAM,QAAA,CAAS;AAAA;AAChB,aACD;AAAA,YACA,SAAS,QAAA,CAAS;AAAA,WAClB,CAAA;AAAA,QACF,SAAS,GAAA,EAAK;AACb,UAAA,IAAI;AACH,YAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,cACvB,UAAA,EAAY,QAAA;AAAA,cACZ,UAAA,EAAY;AAAA,aACZ,CAAA;AAAA,UACF,CAAA,CAAA,MAAQ;AAAA,UAAC;AACT,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACX;AAAA,MACD,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AAE3B,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,eAAe,CAAA;AACtC,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAC/B,QAAA,IAAI;AACH,UAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,YACvB,UAAA,EAAY,QAAA;AAAA,YACZ,UAAA,EAAY;AAAA,WACZ,CAAA;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAAC;AACT,QAAA,IAAI,eAAA,EAAiB;AACrB,QAAA,GAAA,CAAI,KAAA,CAAM,8BAA8B,GAAG,CAAA;AAC3C,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,EAAA,CAAG,OAAO,MAAM;AAGtB,QAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,eAAA,EAAiB;AACzC,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gDAAgD,CAAC,CAAA;AAAA,QACnE;AAAA,MACD,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,oBAAA,CAAqB,QAAgB,OAAA,EAAgC;AAC5E,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,MAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACxC,MAAA,IAAI,UAAA,GAAa,MAAA;AAIjB,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,wBAAwB,MAAM,CAAA,+EAAA;AAAA,SAC/B;AACA,QAAA,KAAA,MAAW,CAAC,GAAA,EAAK,CAAC,KAAK,IAAA,CAAK,SAAA,CAAU,SAAQ,EAAG;AAChD,UAAA,IAAI,CAAA,CAAE,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,CAAA,EAAG;AAC3C,YAAA,QAAA,GAAW,CAAA;AACX,YAAA,UAAA,GAAa,GAAA;AACb,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,+BAA+B,MAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,sBAAA;AAAA,aAC5E;AACA,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,MAAM,YAAA,GAAe,QAAA,EAAU,UAAA,EAAY,IAAA,EAAM,aAAY,IAAK,EAAA;AAClE,MAAA,IAAI,QAAA;AAGJ,MAAA,MAAM,OAAO,QAAA,EAAU,SAAA;AACvB,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,IAAI,CAAA,CAAE,KAChC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,IAAI,CAAA,CAAE,CAAA;AACvC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,wCAAwC,IAAI,CAAA,cAAA,EAAiB,IAAI,CAAA,YAAA,EAAe,CAAC,CAAC,QAAQ,CAAA;AAAA,SAC3F;AAAA,MACD,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,gDAAgD,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,2BAA2B,KAAA,CAAM,IAAA;AAAA,YACpG,IAAA,CAAK,UAAU,IAAA;AAAK,WACrB,CACE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,EAAE,CAAC,CAAA,CACtB,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,SACb;AAAA,MACD;AAGA,MAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC5B,QAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,EAAE,EAAE,WAAA,EAAY;AACjD,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,CAAE,KACnC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAAA,MAC3C;AAGA,MAAA,IAAI,CAAC,YAAY,YAAA,EAAc;AAC9B,QAAA,MAAM,YAAY,YAAA,CAChB,WAAA,EAAY,CACZ,OAAA,CAAQ,eAAe,GAAG,CAAA;AAC5B,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,KACrC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAE,CAAA;AAAA,MAC7C;AAEA,MAAA,IAAI,QAAA,EAAU;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,sDAAsD,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,CAAA,EAAA,EAAK,gBAAgB,SAAS,CAAA,CAAA;AAAA,SACzG;AAAA,MACD;AAEA,MAAA,MAAM,gBAAgB,YAAY;AACjC,QAAA,IAAI,UAAU,OAAO,QAAA;AACrB,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AAAA,QACzC;AACA,QAAA,OAAO,IAAA,CAAK,UAAA;AAAA,MACb,CAAA;AAEA,MAAA,MAAA,GAAS,IAAI,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,YAAY,aAAa,CAAA;AAClE,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,aAAa,GAAA,EAEvB;AACF,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AACA,IAAA,MAAM,aAAA,GAAgB,KAAK,GAAA,EAAI;AAC/B,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,yCAAA,EAA4C,GAAG,CAAA,GAAA,CAAK,CAAA;AAG7D,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,GAAG,CAAA;AACvD,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,GAAG,CAAA,CAAE,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,SAAS,aAAA,CAAc,SAAA,CAAU,CAAC,CAAC,CAAA;AAC/D,IAAA,IAAI,CAAC,QAAA,EAAU;AACd,MAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,IACpE;AAGA,IAAA,MAAM,WAAA,GAAc,SAAS,SAAA,EAAW,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AACjE,IAAA,IAAI,CAAC,WAAA,EAAa;AACjB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,IACjE;AAGA,IAAA,MAAM,MAAA,GAAS;AAAA,MACd,QAAA,EAAU;AAAA,QACT;AAAA,UACC,GAAA;AAAA,UACA,QAAA,EAAU,YAAY,QAAA,IAAY,kBAAA;AAAA,UAClC,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,WAAA,EAAa,MAAM,CAAC;AAAA;AAC1C;AACD,KACD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAC3C,MAAA,SAAA,CAAU,MAAA,CAAO;AAAA,QAChB,IAAA,EAAM,eAAA;AAAA,QACN,MAAA,EAAQ,cAAA;AAAA,QACR,QAAA,EAAU,GAAA;AAAA,QACV,MAAA,EAAQ,UAAU,CAAC,CAAA;AAAA,QACnB,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,GAAG,CAAA;AAAA,QAC/C,qBAAA,EAAuB,SAAA,CAAU,WAAA,CAAY,aAAa,CAAA;AAAA,QAC1D,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB,CAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,MAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,MAAA,GAAwB;AAClC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU,IAAK,IAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,YAAA,GAAwB;AAClC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU,IAAK,KAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,eAAA,GAA0B;AACpC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,QAAA,EAAS,CAAE,MAAA,IAAU,CAAA;AAAA,EAC5C;AAAA,EAEO,aAAA,GAA+D;AACrE,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,KAAA,GAAuB;AACnC,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AAAA,EACD;AACD","file":"chunk-FCFTYOAS.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as grpc from \"@grpc/grpc-js\";\nimport { GRPC_CHANNEL_OPTIONS } from \"./channel-options.js\";\nimport { liopV1 } from \"./proto.js\";\nimport { createChannelCredentials, type LiopTlsOptions } from \"./tls.js\";\nimport type {\n\tIntentRequest,\n\tIntentResponse,\n\tLogicRequest,\n\tLogicResponse,\n} from \"./types.js\";\n\nexport type TokenProvider =\n\t| string\n\t| (() => Promise<string | undefined> | string | undefined);\n\n/**\n * LIOP gRPC Client Implementation\n * Provides a high-level interface for secure intent negotiation and logic execution.\n */\nexport class LiopRpcClient {\n\t// biome-ignore lint/suspicious/noExplicitAny: internal gRPC client type\n\tprivate client: any;\n\tprivate token?: TokenProvider;\n\tprivate lastResolvedToken?: string;\n\tpublic readonly address: string;\n\n\tconstructor(address: string, tls?: LiopTlsOptions, token?: TokenProvider) {\n\t\tconst credentials = createChannelCredentials(tls);\n\t\tthis.client = new liopV1.LogicMesh(\n\t\t\taddress,\n\t\t\tcredentials,\n\t\t\tGRPC_CHANNEL_OPTIONS,\n\t\t);\n\t\tthis.token = token;\n\t\tif (typeof token === \"string\") {\n\t\t\tthis.lastResolvedToken = token;\n\t\t}\n\t\tthis.address = address;\n\t}\n\n\tpublic setToken(token?: TokenProvider): void {\n\t\tthis.token = token;\n\t\tif (typeof token === \"string\") {\n\t\t\tthis.lastResolvedToken = token;\n\t\t}\n\t}\n\n\tprivate async resolveToken(): Promise<string | undefined> {\n\t\tif (typeof this.token === \"function\") {\n\t\t\tthis.lastResolvedToken = await this.token();\n\t\t\treturn this.lastResolvedToken;\n\t\t}\n\t\tthis.lastResolvedToken = this.token;\n\t\treturn this.token;\n\t}\n\n\t/**\n\t * Negotiates intent with the remote host.\n\t * Returns the ephemeral Kyber public key for payload encryption.\n\t */\n\tpublic async negotiateIntent(\n\t\trequest: IntentRequest,\n\t): Promise<IntentResponse> {\n\t\tconst activeToken = await this.resolveToken();\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst metadata = new grpc.Metadata();\n\t\t\tif (activeToken) {\n\t\t\t\tmetadata.add(\"authorization\", `Bearer ${activeToken}`);\n\t\t\t}\n\t\t\tthis.client.NegotiateIntent(\n\t\t\t\trequest,\n\t\t\t\tmetadata,\n\t\t\t\t(error: grpc.ServiceError | null, response: IntentResponse) => {\n\t\t\t\t\tif (error) {\n\t\t\t\t\t\treject(error);\n\t\t\t\t\t} else {\n\t\t\t\t\t\tresolve(response);\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\t}\n\n\t/**\n\t * Pushes the encrypted Logic-on-Origin payload to the origin.\n\t * Returns a stream of semantic responses and ZK proofs.\n\t */\n\tpublic executeLogic(\n\t\trequest: LogicRequest,\n\t): grpc.ClientReadableStream<LogicResponse> {\n\t\tconst metadata = new grpc.Metadata();\n\t\tconst activeToken =\n\t\t\tthis.lastResolvedToken ||\n\t\t\t(typeof this.token === \"string\" ? this.token : undefined);\n\t\tif (activeToken) {\n\t\t\tmetadata.add(\"authorization\", `Bearer ${activeToken}`);\n\t\t}\n\t\treturn this.client.ExecuteLogic(request, metadata);\n\t}\n\n\tpublic close(): void {\n\t\tthis.client.close();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\n/**\n * LIOP Symmetric Payload Encryption Wrapper\n * Uses AES-256-GCM to secure WASM Code transport over Zero-Trust networks.\n * Fully compatible with the `aes-gcm` Rust crate used by Wasmtime.\n */\nexport const AesGcmWrapper = {\n\t/**\n\t * Encrypts a raw WASM payload using the shared secret negotiated via Kyber768.\n\t *\n\t * @param payload Raw incoming WASM byte array or string.\n\t * @param sharedSecret A perfectly derived 32-byte (256-bit) shared secret array\n\t * @returns The encrypted buffer to push to the GRPc stream, along with the 12-byte initialization vector natively generated.\n\t */\n\tencryptPayload(\n\t\tpayload: Uint8Array | Buffer,\n\t\tsharedSecret: Uint8Array,\n\t): {\n\t\tciphertext: Buffer;\n\t\tnonce: Buffer;\n\t} {\n\t\tif (sharedSecret.length !== 32) {\n\t\t\tthrow new Error(\"Symmetric Key must be exactly 32 bytes (256 bits).\");\n\t\t}\n\n\t\t// LIOP standard demands 96-bit (12 byte) IVs/Nonces for AES-GCM\n\t\tconst nonce = randomBytes(12);\n\n\t\tconst cipher = createCipheriv(\"aes-256-gcm\", sharedSecret, nonce);\n\n\t\t// Encrypt the payload and seal the tag\n\t\tconst encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);\n\t\tconst authTag = cipher.getAuthTag(); // 16 bytes for GCM integrity\n\n\t\t// In LIOP, the auth tag is strictly appended to the end of the ciphertext bytes\n\t\t// mirroring the default serialization logic within `aes_gcm::Aes256Gcm` in Rust\n\t\tconst finalCiphertext = Buffer.concat([encrypted, authTag]);\n\n\t\treturn {\n\t\t\tciphertext: finalCiphertext,\n\t\t\tnonce: nonce,\n\t\t};\n\t},\n\n\t/**\n\t * Decrypts a remote Zero-Knowledge receipt using AES-256-GCM.\n\t */\n\tdecryptPayload(\n\t\tciphertextBuffer: Buffer,\n\t\tnonce: Buffer,\n\t\tsharedSecret: Uint8Array,\n\t): Buffer {\n\t\tif (ciphertextBuffer.length < 16) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Invalid GCM Ciphertext; missing authentication tag length\",\n\t\t\t);\n\t\t}\n\n\t\t// The last 16 bytes represent the AuthTag appended by rust-aes-gcm\n\t\tconst encryptedData = ciphertextBuffer.subarray(0, -16);\n\t\tconst authTag = ciphertextBuffer.subarray(-16);\n\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", sharedSecret, nonce);\n\t\tdecipher.setAuthTag(authTag);\n\n\t\treturn Buffer.concat([decipher.update(encryptedData), decipher.final()]);\n\t},\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { LiopVerifier } from \"../crypto/verifier.js\";\nimport { TokenTelemetryEngine } from \"../economy/telemetry.js\";\nimport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"../gateway/mcp-compat.js\";\nimport {\n\ttype LiopManifest,\n\tMeshNode,\n\ttype MeshNodeConfig,\n} from \"../mesh/node.js\";\nimport {\n\tpqcHandshakeDurationMs,\n\tpqcHandshakesTotal,\n\ttoolCallErrorsTotal,\n\twireEgressBytesTotal,\n\tzkVerificationsTotal,\n} from \"../observability/metrics.js\";\nimport { LiopRpcClient } from \"../rpc/client.js\";\nimport { AesGcmWrapper } from \"../rpc/crypto/aes.js\";\nimport { Kyber768Wrapper } from \"../rpc/crypto/kyber.js\";\nimport type { LiopTlsOptions } from \"../rpc/tls.js\";\nimport type { LogicRequest, LogicResponse } from \"../rpc/types.js\";\nimport { TokenManager } from \"../runtime/token-manager.js\";\nimport {\n\ttype CallToolRequest,\n\ttype CallToolResult,\n\tMCP_PROTOCOL_VERSION,\n\ttype McpEra,\n} from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\n/**\n * LIOP Client\n * High-level orchestration for discovery and execution in the Logic-Injection-on-Origin mesh.\n */\nexport class LiopClient {\n\tprivate meshNode: MeshNode | null = null;\n\tprivate rpcClients: Map<string, LiopRpcClient> = new Map();\n\tprivate manifests: Map<string, LiopManifest> = new Map();\n\tprivate tlsOptions?: LiopTlsOptions;\n\tprivate serverInfo?: { name: string; version: string };\n\tpublic verifier: LiopVerifier = new LiopVerifier();\n\tprivate oauthToken?: string;\n\tprivate tokenManager?: TokenManager;\n\n\t/** Protocol negotiation era */\n\tpublic era: McpEra = \"modern\";\n\t/** Negotiated protocol version */\n\tpublic protocolVersion: string = MCP_PROTOCOL_VERSION;\n\n\tconstructor(tls?: LiopTlsOptions) {\n\t\tthis.tlsOptions = tls;\n\t}\n\n\t/**\n\t * Discovers and connects to the target server or mesh capability.\n\t * If address is omitted, it sets up the MeshNode to act purely dynamically.\n\t */\n\tpublic async connect(\n\t\taddress?: string,\n\t\toptions?: {\n\t\t\tmeshConfig?: MeshNodeConfig;\n\t\t\tauth?: {\n\t\t\t\tclientId?: string;\n\t\t\t\tclientSecret?: string;\n\t\t\t\tnexusUrl?: string;\n\t\t\t\taudience?: string;\n\t\t\t\tscope?: string;\n\t\t\t\ttoken?: string;\n\t\t\t};\n\t\t},\n\t): Promise<void> {\n\t\t// Attempt to acquire OAuth M2M access token if credentials are provided\n\t\tconst clientId =\n\t\t\toptions?.auth?.clientId ||\n\t\t\tprocess.env.LIOP_OAUTH_CLIENT_ID ||\n\t\t\tprocess.env.LIOP_CLIENT_ID;\n\t\tconst clientSecret =\n\t\t\toptions?.auth?.clientSecret ||\n\t\t\tprocess.env.LIOP_OAUTH_CLIENT_SECRET ||\n\t\t\tprocess.env.LIOP_CLIENT_SECRET;\n\t\tconst nexusUrl =\n\t\t\toptions?.auth?.nexusUrl ||\n\t\t\tprocess.env.LIOP_NEXUS_URL ||\n\t\t\t\"http://localhost:3000\";\n\t\tconst audience =\n\t\t\toptions?.auth?.audience ||\n\t\t\tprocess.env.LIOP_OAUTH_AUDIENCE ||\n\t\t\t\"urn:liop:mesh:api\";\n\t\tconst scope =\n\t\t\toptions?.auth?.scope ||\n\t\t\tprocess.env.LIOP_OAUTH_SCOPE ||\n\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\";\n\n\t\tthis.oauthToken =\n\t\t\toptions?.auth?.token ||\n\t\t\tprocess.env.LIOP_OAUTH_TOKEN ||\n\t\t\tprocess.env.LIOP_TOKEN;\n\n\t\tif (clientId && clientSecret) {\n\t\t\tconst baseUrl = (nexusUrl || \"http://127.0.0.1:3000\").endsWith(\"/oidc\")\n\t\t\t\t? nexusUrl || \"http://127.0.0.1:3000\"\n\t\t\t\t: `${nexusUrl || \"http://127.0.0.1:3000\"}/oidc`;\n\t\t\tconst tokenEndpoint = `${baseUrl}/token`;\n\n\t\t\tthis.tokenManager = new TokenManager({\n\t\t\t\ttokenEndpoint,\n\t\t\t\tclientId,\n\t\t\t\tclientSecret,\n\t\t\t\taudience,\n\t\t\t\tscopes: scope,\n\t\t\t});\n\n\t\t\ttry {\n\t\t\t\tthis.oauthToken = await this.tokenManager.getToken();\n\t\t\t\tlog.info(\n\t\t\t\t\t\"[LiopClient] Dynamic TokenManager configured and initial token acquired.\",\n\t\t\t\t);\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.error(\n\t\t\t\t\t`[LiopClient] Failed to acquire OAuth M2M Token: ${\n\t\t\t\t\t\terr instanceof Error ? err.message : String(err)\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t\t// In development or when using static local token, allow connection to proceed\n\t\t\t}\n\t\t}\n\n\t\tthis.meshNode = new MeshNode(options?.meshConfig);\n\t\tawait this.meshNode.start();\n\t\tlog.info(\n\t\t\t`[LiopClient] Mesh Node synchronized. PeerID: ${this.meshNode.getPeerId()}`,\n\t\t);\n\n\t\tif (address) {\n\t\t\tconst tokenResolver = async () => {\n\t\t\t\tif (this.tokenManager) {\n\t\t\t\t\treturn await this.tokenManager.getToken();\n\t\t\t\t}\n\t\t\t\treturn this.oauthToken;\n\t\t\t};\n\t\t\tthis.rpcClients.set(\n\t\t\t\t\"static\",\n\t\t\t\tnew LiopRpcClient(address, this.tlsOptions, tokenResolver),\n\t\t\t);\n\t\t\tthis.serverInfo = { name: `LiopServer (${address})`, version: \"1.0.0\" };\n\t\t\tlog.info(`[LiopClient] Static gRPC configured for: ${address}`);\n\t\t} else {\n\t\t\tthis.serverInfo = { name: \"LiopServer (Mesh Alpha)\", version: \"1.0.0\" };\n\t\t}\n\t}\n\n\t/**\n\t * Selects the optimal IP from an array of multiaddrs.\n\t * Prioritizes routable non-loopback IPv4 addresses (e.g. Docker bridge, LAN, WAN)\n\t * over loopback (127.0.0.1) to prevent inter-container connection failures.\n\t */\n\tprivate selectOptimalIp(addrs: string[]): string | null {\n\t\t// Pass 1: Non-loopback, routable IPv4 addresses\n\t\tfor (const maddr of addrs) {\n\t\t\tconst parts = maddr.split(\"/\");\n\t\t\tconst ipIdx = parts.indexOf(\"ip4\");\n\t\t\tif (ipIdx !== -1 && ipIdx + 1 < parts.length) {\n\t\t\t\tconst ip = parts[ipIdx + 1];\n\t\t\t\tif (\n\t\t\t\t\tip !== \"127.0.0.1\" &&\n\t\t\t\t\t!ip.startsWith(\"127.\") &&\n\t\t\t\t\tip !== \"0.0.0.0\" &&\n\t\t\t\t\tip !== \"localhost\"\n\t\t\t\t) {\n\t\t\t\t\treturn ip;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Pass 2: Fallback to loopback if no external IP is announced\n\t\tfor (const maddr of addrs) {\n\t\t\tconst parts = maddr.split(\"/\");\n\t\t\tconst ipIdx = parts.indexOf(\"ip4\");\n\t\t\tif (ipIdx !== -1 && ipIdx + 1 < parts.length) {\n\t\t\t\treturn parts[ipIdx + 1];\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t}\n\n\t/**\n\t * Dynamically queries Kademlia DHT to find the optimal PeerID providing the Capability\n\t * and returns the physical gRPC target (host:port) resolved from the provider's manifest.\n\t */\n\tpublic async resolveCapability(toolName: string): Promise<string> {\n\t\tif (!this.meshNode)\n\t\t\tthrow new Error(\n\t\t\t\t\"Client must be connected to Mesh to resolve capabilities.\",\n\t\t\t);\n\n\t\tlog.info(`[LiopClient] Querying Mesh DHT for Provider: ${toolName}...`);\n\t\tconst providers = await this.meshNode.findProviders(toolName);\n\n\t\tif (providers.length === 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Kademlia DHT found zero providers for capability: ${toolName}`,\n\t\t\t);\n\t\t}\n\n\t\tconst providerId = providers[0];\n\t\tlog.info(`[LiopClient] Identified Alpha Provider PeerID: ${providerId}`);\n\n\t\tlet grpcPort = 50051;\n\t\tconst manifest = await this.meshNode.queryManifest(providerId);\n\t\tif (manifest) {\n\t\t\tgrpcPort = manifest.grpcPort;\n\t\t\tthis.manifests.set(providerId, manifest);\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Manifest resolved: gRPC port ${grpcPort}. Cached manifest for PeerID ${providerId}`,\n\t\t\t);\n\t\t}\n\n\t\tconst addrs = await this.meshNode.resolvePeer(providerId);\n\t\tconst optimalIp = this.selectOptimalIp(addrs);\n\t\tif (optimalIp) {\n\t\t\tconst grpcHost = `${optimalIp}:${grpcPort}`;\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Translated Multiaddr to optimal gRPC Target: ${grpcHost}`,\n\t\t\t);\n\t\t\treturn grpcHost;\n\t\t}\n\n\t\treturn `127.0.0.1:${grpcPort}`;\n\t}\n\n\t/**\n\t * Probes a remote MCP endpoint using 'server/discover' to negotiate protocol era.\n\t * Falls back to legacy initialize handshake if server/discover fails.\n\t */\n\tpublic async probeServerDiscover(mcpUrl: string): Promise<{\n\t\tera: McpEra;\n\t\tprotocolVersion: string;\n\t\tsupportedVersions: string[];\n\t}> {\n\t\ttry {\n\t\t\tconst headers: Record<string, string> = {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Mcp-Method\": \"server/discover\",\n\t\t\t};\n\t\t\tif (this.oauthToken) {\n\t\t\t\theaders.Authorization = `Bearer ${this.oauthToken}`;\n\t\t\t}\n\n\t\t\tconst res = await fetch(mcpUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders,\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\tid: 1,\n\t\t\t\t\tmethod: \"server/discover\",\n\t\t\t\t\tparams: {},\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (res.ok) {\n\t\t\t\tconst json = (await res.json()) as {\n\t\t\t\t\tresult?: { supportedVersions?: string[] };\n\t\t\t\t};\n\t\t\t\tconst supported = json.result?.supportedVersions || [];\n\t\t\t\tif (supported.includes(MCP_PROTOCOL_VERSION)) {\n\t\t\t\t\tthis.era = \"modern\";\n\t\t\t\t\tthis.protocolVersion = MCP_PROTOCOL_VERSION;\n\t\t\t\t\treturn {\n\t\t\t\t\t\tera: \"modern\",\n\t\t\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION,\n\t\t\t\t\t\tsupportedVersions: supported,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (_err) {\n\t\t\t// Ignore discovery network probe failures and fallback to legacy if enabled\n\t\t}\n\n\t\t/** @mcp-legacy Fallback to legacy era. Remove when v1 EOL. */\n\t\tif (MCP_LEGACY_SUPPORT_ENABLED) {\n\t\t\tthis.era = \"legacy\";\n\t\t\tthis.protocolVersion = MCP_PROTOCOL_VERSION_LEGACY;\n\t\t\treturn {\n\t\t\t\tera: \"legacy\",\n\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\t\tsupportedVersions: [MCP_PROTOCOL_VERSION_LEGACY],\n\t\t\t};\n\t\t}\n\n\t\tthrow new Error(\n\t\t\t\"Server does not support MCP 2026-07-28 and legacy support is disabled.\",\n\t\t);\n\t}\n\n\t/**\n\t * Discovers remote capabilities via the LIOP Manifest Protocol.\n\t * Utilizes a memory cache to avoid redundant network dials against live peers.\n\t */\n\tpublic async discoverTools(\n\t\tforceRefresh = false,\n\t): Promise<{ name: string; description?: string }[]> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before discovering tools.\");\n\t\t}\n\n\t\tconst discoveryStartTime = Date.now();\n\n\t\tlog.info(\n\t\t\t`[LiopClient] Discovery started (forceRefresh: ${forceRefresh})...`,\n\t\t);\n\t\tconst providerIds = await this.meshNode.discoverManifestProviders();\n\t\tconst tools: { name: string; description?: string }[] = [];\n\t\tconst seenNames = new Set<string>();\n\n\t\tfor (const peerId of providerIds) {\n\t\t\ttry {\n\t\t\t\tlet manifest: LiopManifest | null | undefined = !forceRefresh\n\t\t\t\t\t? this.manifests.get(peerId)\n\t\t\t\t\t: undefined;\n\n\t\t\t\tif (!manifest) {\n\t\t\t\t\tlog.info(`[LiopClient] Querying manifest from: ${peerId}`);\n\t\t\t\t\tmanifest = await this.meshNode.queryManifest(peerId);\n\t\t\t\t\tif (manifest) {\n\t\t\t\t\t\tthis.manifests.set(peerId, manifest);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tlog.info(`[LiopClient] Using cached manifest for: ${peerId}`);\n\t\t\t\t}\n\n\t\t\t\tif (manifest) {\n\t\t\t\t\tfor (const tool of manifest.tools) {\n\t\t\t\t\t\tif (!seenNames.has(tool.name)) {\n\t\t\t\t\t\t\ttools.push({ name: tool.name, description: tool.description });\n\t\t\t\t\t\t\tseenNames.add(tool.name);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Error querying manifest from ${peerId}:`,\n\t\t\t\t\terr instanceof Error ? err.message : String(err),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[LiopClient] Discovery finished. Found ${tools.length} unique tools.`,\n\t\t);\n\n\t\t// [Token Economy] Record telemetry for discoverTools\n\t\ttry {\n\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\tconst toolsPayload = JSON.stringify(tools);\n\t\t\tconst toolsResponsePayload = JSON.stringify({ tools });\n\t\t\ttelemetry.record({\n\t\t\t\ttype: \"tools_list\",\n\t\t\t\tmethod: \"discoverTools\",\n\t\t\t\testimatedInputTokens: telemetry.countTokens(toolsPayload),\n\t\t\t\testimatedOutputTokens: telemetry.countTokens(toolsResponsePayload),\n\t\t\t\tdurationMs: Date.now() - discoveryStartTime,\n\t\t\t});\n\t\t} catch {\n\t\t\t// Telemetry error isolation\n\t\t}\n\n\t\treturn tools;\n\t}\n\n\t/**\n\t * Invokes a tool.\n\t */\n\tpublic async callTool(\n\t\trequest: CallToolRequest,\n\t\t_wasmPayload?: Buffer,\n\t): Promise<CallToolResult> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before calling tools.\");\n\t\t}\n\n\t\tconst callStartTime = Date.now();\n\t\tconst toolName = request.name;\n\t\tlog.info(`[LiopClient] Resolving Tool: ${toolName}`);\n\n\t\t// [ALPHA-FIX] Bypass DHT discovery if we are already statically connected to a provider (Enterprise/Test mode)\n\t\tlet rpcClient = this.rpcClients.get(\"static\");\n\t\tlet targetClientKey = toolName;\n\n\t\tif (!rpcClient) {\n\t\t\t// 1. If an RPC client was already registered for this toolName, reuse it\n\t\t\tif (this.rpcClients.has(toolName)) {\n\t\t\t\trpcClient = this.rpcClients.get(toolName);\n\t\t\t\ttargetClientKey = toolName;\n\t\t\t}\n\t\t}\n\n\t\tif (!rpcClient) {\n\t\t\t// 2. Fast-path: Check if capability already exists in cached manifests to bypass DHT walk\n\t\t\tlet resolvedHost: string | null = null;\n\t\t\tfor (const [peerId, manifest] of this.manifests.entries()) {\n\t\t\t\tif (manifest.tools.some((t) => t.name === toolName)) {\n\t\t\t\t\t// If we already have a client registered for this peerId, reuse it immediately\n\t\t\t\t\tif (this.rpcClients.has(peerId)) {\n\t\t\t\t\t\trpcClient = this.rpcClients.get(peerId);\n\t\t\t\t\t\ttargetClientKey = peerId;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tconst addrs = await this.meshNode.resolvePeer(peerId);\n\t\t\t\t\tconst optimalIp = this.selectOptimalIp(addrs);\n\t\t\t\t\tif (optimalIp) {\n\t\t\t\t\t\tresolvedHost = `${optimalIp}:${manifest.grpcPort}`;\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LiopClient] Fast-path: Resolved ${toolName} from manifest cache to optimal target ${resolvedHost}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\ttargetClientKey = peerId;\n\t\t\t\t\t\trpcClient = this.getOrCreateRpcClient(peerId, resolvedHost);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!rpcClient) {\n\t\t\t\tconst dynamicAddress = await this.resolveCapability(toolName);\n\t\t\t\ttargetClientKey = toolName;\n\t\t\t\trpcClient = this.getOrCreateRpcClient(toolName, dynamicAddress);\n\t\t\t}\n\t\t} else {\n\t\t\ttargetClientKey = \"static\";\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Using existing static gRPC connection for ${toolName}.`,\n\t\t\t);\n\t\t}\n\n\t\tlog.info(`[LiopClient] Negotiating intent for ${toolName}...`);\n\t\tconst agentDid = this.meshNode\n\t\t\t? `did:liop:${this.meshNode.getPeerId()}`\n\t\t\t: \"did:liop:ephemeral\";\n\t\tconst intentPayload = Buffer.from(`${toolName}:${Date.now()}`);\n\t\tconst proofOfIntent = this.meshNode\n\t\t\t? await this.meshNode.sign(intentPayload)\n\t\t\t: intentPayload;\n\n\t\tlet intentResponse: {\n\t\t\taccepted: boolean;\n\t\t\terror_message: string;\n\t\t\tkyber_public_key: Uint8Array;\n\t\t\tkyberPublicKey: Uint8Array;\n\t\t\tsession_token: string;\n\t\t\tsessionToken: string;\n\t\t};\n\n\t\ttry {\n\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\tagent_did: agentDid,\n\t\t\t\tcapability_hash: toolName,\n\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t})) as unknown as typeof intentResponse;\n\t\t} catch (err: unknown) {\n\t\t\tconst errMsg = err instanceof Error ? err.message : String(err);\n\t\t\tif (\n\t\t\t\tthis.tokenManager &&\n\t\t\t\t(errMsg.includes(\"UNAUTHENTICATED\") ||\n\t\t\t\t\terrMsg.includes(\"Invalid JWT\") ||\n\t\t\t\t\terrMsg.includes(\"timestamp check failed\") ||\n\t\t\t\t\terrMsg.includes(\"expired\"))\n\t\t\t) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[LiopClient] Token expired/unauthenticated for ${toolName}. Preemptively refreshing OAuth token and retrying negotiateIntent...`,\n\t\t\t\t);\n\t\t\t\tthis.tokenManager.invalidate();\n\t\t\t\tconst freshToken = await this.tokenManager.getToken();\n\t\t\t\tthis.oauthToken = freshToken;\n\t\t\t\trpcClient.setToken(freshToken);\n\t\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\t\tagent_did: agentDid,\n\t\t\t\t\tcapability_hash: toolName,\n\t\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t\t})) as unknown as typeof intentResponse;\n\t\t\t} else {\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t}\n\n\t\tif (!intentResponse.accepted) {\n\t\t\tif (\n\t\t\t\tthis.tokenManager &&\n\t\t\t\t(intentResponse.error_message?.includes(\"token\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"UNAUTHENTICATED\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"expired\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"timestamp check failed\"))\n\t\t\t) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[LiopClient] Intent rejected with auth error: \"${intentResponse.error_message}\". Refreshing token and retrying...`,\n\t\t\t\t);\n\t\t\t\tthis.tokenManager.invalidate();\n\t\t\t\tconst freshToken = await this.tokenManager.getToken();\n\t\t\t\tthis.oauthToken = freshToken;\n\t\t\t\trpcClient.setToken(freshToken);\n\t\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\t\tagent_did: agentDid,\n\t\t\t\t\tcapability_hash: toolName,\n\t\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t\t})) as unknown as typeof intentResponse;\n\t\t\t}\n\t\t\tif (!intentResponse.accepted) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Intent denied by host: ${intentResponse.error_message}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// LIOP Robust Field Extraction (Supports both snake_case and camelCase via gRPC-JS)\n\t\tconst publicKey =\n\t\t\tintentResponse.kyber_public_key || intentResponse.kyberPublicKey;\n\t\tconst sessionToken =\n\t\t\tintentResponse.session_token || intentResponse.sessionToken;\n\n\t\tif (!publicKey) {\n\t\t\tlog.info(\n\t\t\t\t\"[LiopClient] Critical Error: Kyber Public Key not found in IntentResponse.\",\n\t\t\t\tintentResponse,\n\t\t\t);\n\t\t\ttry {\n\t\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\t\tstatus: \"failure\",\n\t\t\t\t});\n\t\t\t} catch {}\n\t\t\tthrow new Error(\n\t\t\t\t\"Handshake failed: Remote host did not provide a valid Kyber Public Key.\",\n\t\t\t);\n\t\t}\n\n\t\t// 2. Post-Quantum Encapsulation (ML-KEM-768)\n\t\tlog.info(\n\t\t\t`[LiopClient] Encapsulating Post-Quantum Shared Secret for ${request.name}...`,\n\t\t);\n\t\tconst pqcStart = performance.now();\n\t\tlet kyberCiphertext: Uint8Array;\n\t\tlet sharedSecret: Uint8Array;\n\t\ttry {\n\t\t\tconst res = await Kyber768Wrapper.encapsulateAsymmetric(publicKey);\n\t\t\tkyberCiphertext = res.ciphertext;\n\t\t\tsharedSecret = res.sharedSecret;\n\t\t\tconst pqcDuration = performance.now() - pqcStart;\n\t\t\tpqcHandshakeDurationMs.observe({ tool: request.name }, pqcDuration);\n\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\tstatus: \"success\",\n\t\t\t});\n\t\t} catch (encapError) {\n\t\t\ttry {\n\t\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\t\tstatus: \"failure\",\n\t\t\t\t});\n\t\t\t} catch {}\n\t\t\tthrow encapError;\n\t\t}\n\n\t\t// 3. Symmetric Sealing (AES-256-GCM)\n\t\tlog.info(`[LiopClient] Sealing WASM Payload and Inputs...`);\n\n\t\tconst _safePayload = _wasmPayload || Buffer.from(\"\");\n\n\t\t// Encrypt WASM binary\n\t\tconst { ciphertext: encryptedWasm, nonce: aesNonce } =\n\t\t\tAesGcmWrapper.encryptPayload(_safePayload, sharedSecret);\n\n\t\t// Encrypt inputs using a fresh random nonce per input to prevent AES-GCM nonce reuse\n\t\tconst encryptedInputs: Record<string, Uint8Array> = {};\n\t\tconst crypto = await import(\"node:crypto\");\n\t\tfor (const [key, value] of Object.entries(request.arguments || {})) {\n\t\t\tconst inputNonce = crypto.randomBytes(12);\n\t\t\tconst cipher = crypto.createCipheriv(\n\t\t\t\t\"aes-256-gcm\",\n\t\t\t\tsharedSecret,\n\t\t\t\tinputNonce,\n\t\t\t);\n\t\t\tconst encrypted = Buffer.concat([\n\t\t\t\tcipher.update(JSON.stringify(value)),\n\t\t\t\tcipher.final(),\n\t\t\t]);\n\t\t\tconst authTag = cipher.getAuthTag();\n\t\t\t// Prepend the 12-byte nonce to the ciphertext\n\t\t\tencryptedInputs[key] = Buffer.concat([inputNonce, encrypted, authTag]);\n\t\t}\n\n\t\t// 4. Assemble and Execute gRPC LogicRequest\n\t\tconst logicRequest: LogicRequest = {\n\t\t\tsession_token: sessionToken,\n\t\t\twasm_binary: encryptedWasm,\n\t\t\tinputs: encryptedInputs,\n\t\t\tpqc_ciphertext: kyberCiphertext,\n\t\t\taes_nonce: aesNonce,\n\t\t};\n\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst stream = rpcClient.executeLogic(logicRequest);\n\t\t\tif (!stream) {\n\t\t\t\treject(new Error(\"RPC Client unavailable or failed to create stream.\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlet resultFulfilled = false;\n\t\t\tlet hasReceivedData = false;\n\n\t\t\tstream.on(\"data\", async (response: LogicResponse) => {\n\t\t\t\tif (resultFulfilled) return;\n\t\t\t\thasReceivedData = true;\n\n\t\t\t\tlog.info(\"[LiopClient] Logic Executed. Verification in progress...\");\n\n\t\t\t\ttry {\n\t\t\t\t\t// Only verify ZK-Receipt if the remote execution succeeded.\n\t\t\t\t\t// If the remote execution failed due to a policy error (e.g. Egress Shield),\n\t\t\t\t\t// the ZK proof is empty and we should bypass validation to propagate the original error.\n\t\t\t\t\tif (!response.is_error) {\n\t\t\t\t\t\tconst isValid = await this.verifier.verifyZkReceipt(\n\t\t\t\t\t\t\t_safePayload,\n\t\t\t\t\t\t\tBuffer.from(response.cryptographic_proof).toString(\"hex\"),\n\t\t\t\t\t\t\tBuffer.from(response.zk_receipt),\n\t\t\t\t\t\t\tBuffer.from(sharedSecret),\n\t\t\t\t\t\t\tresponse.semantic_evidence,\n\t\t\t\t\t\t);\n\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tzkVerificationsTotal.inc({\n\t\t\t\t\t\t\t\tstatus: isValid ? \"valid\" : \"invalid\",\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\t// Metrics isolation\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (!isValid) {\n\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\t\t\terror_type: \"zk_verification_failed\",\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t} catch {}\n\t\t\t\t\t\t\treject(\n\t\t\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t\t\t\"PROTOCOL INTEGRITY VIOLATION: ZK-Receipt verification failed.\",\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\t\terror_type: \"remote_execution_error\",\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} catch {}\n\t\t\t\t\t}\n\n\t\t\t\t\tresultFulfilled = true;\n\n\t\t\t\t\t// [Token Economy & Wire Telemetry] Record telemetry for callTool\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\t\t\t\tconst inputPayload = JSON.stringify(request.arguments ?? {});\n\t\t\t\t\t\ttelemetry.record({\n\t\t\t\t\t\t\ttype: \"tool_call\",\n\t\t\t\t\t\t\tmethod: \"callTool\",\n\t\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\t\tpeerId:\n\t\t\t\t\t\t\t\ttargetClientKey !== toolName ? targetClientKey : undefined,\n\t\t\t\t\t\t\testimatedInputTokens: telemetry.countTokens(inputPayload),\n\t\t\t\t\t\t\testimatedOutputTokens: telemetry.countTokens(\n\t\t\t\t\t\t\t\tresponse.semantic_evidence,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tdurationMs: Date.now() - callStartTime,\n\t\t\t\t\t\t});\n\n\t\t\t\t\t\tconst egressBytes =\n\t\t\t\t\t\t\tBuffer.byteLength(response.semantic_evidence || \"\") +\n\t\t\t\t\t\t\t(response.cryptographic_proof\n\t\t\t\t\t\t\t\t? response.cryptographic_proof.length\n\t\t\t\t\t\t\t\t: 0) +\n\t\t\t\t\t\t\t(response.zk_receipt ? response.zk_receipt.length : 0);\n\t\t\t\t\t\twireEgressBytesTotal.inc({ capability: toolName }, egressBytes);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\t// Telemetry error isolation\n\t\t\t\t\t}\n\n\t\t\t\t\tresolve({\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: response.semantic_evidence,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tisError: response.is_error,\n\t\t\t\t\t});\n\t\t\t\t} catch (err) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\terror_type: \"verification_exception\",\n\t\t\t\t\t\t});\n\t\t\t\t\t} catch {}\n\t\t\t\t\treject(err);\n\t\t\t\t}\n\t\t\t});\n\n\t\t\tstream.on(\"error\", (err) => {\n\t\t\t\t// Evict faulted client from cache so subsequent requests reconnect cleanly\n\t\t\t\tthis.rpcClients.delete(targetClientKey);\n\t\t\t\tthis.rpcClients.delete(toolName);\n\t\t\t\ttry {\n\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\terror_type: \"stream_error\",\n\t\t\t\t\t});\n\t\t\t\t} catch {}\n\t\t\t\tif (resultFulfilled) return;\n\t\t\t\tlog.error(\"[LiopClient] Stream Error:\", err);\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tstream.on(\"end\", () => {\n\t\t\t\t// We don't throw here if we already received a response block that is currently\n\t\t\t\t// undergoing ZK Verification in the Piscina worker pool.\n\t\t\t\tif (!hasReceivedData && !resultFulfilled) {\n\t\t\t\t\treject(new Error(\"Logic-on-Origin stream closed without results.\"));\n\t\t\t\t}\n\t\t\t});\n\t\t});\n\t}\n\n\tprivate getOrCreateRpcClient(peerId: string, address: string): LiopRpcClient {\n\t\tlet client = this.rpcClients.get(peerId);\n\t\tif (!client) {\n\t\t\tlet manifest = this.manifests.get(peerId);\n\t\t\tlet realPeerId = peerId;\n\n\t\t\t// If peerId is actually a toolName (which happens when called from callTool),\n\t\t\t// resolve the real PeerID and its manifest from the manifest cache.\n\t\t\tif (!manifest) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] PeerID \"${peerId}\" not found in manifest cache as PeerID. Searching tools in cached manifests...`,\n\t\t\t\t);\n\t\t\t\tfor (const [pId, m] of this.manifests.entries()) {\n\t\t\t\t\tif (m.tools.some((t) => t.name === peerId)) {\n\t\t\t\t\t\tmanifest = m;\n\t\t\t\t\t\trealPeerId = pId;\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LiopClient] Resolved tool \"${peerId}\" to provider PeerID \"${pId.slice(-8)}\" from manifest cache.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst providerName = manifest?.serverInfo?.name?.toLowerCase() || \"\";\n\t\t\tlet envToken: string | undefined;\n\n\t\t\t// 0. Deterministic tokenSlug resolution (highest priority, zero heuristic)\n\t\t\tconst slug = manifest?.tokenSlug;\n\t\t\tif (slug) {\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${slug}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${slug}`];\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Resolved via tokenSlug \"${slug}\" (LIOP_TOKEN_${slug}) -> found: ${!!envToken}`,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] No tokenSlug available for peer ${realPeerId.slice(-8)}. Available cache keys: ${Array.from(\n\t\t\t\t\t\tthis.manifests.keys(),\n\t\t\t\t\t)\n\t\t\t\t\t\t.map((k) => k.slice(-8))\n\t\t\t\t\t\t.join(\", \")}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// 1. PeerID-specific resolution: LIOP_TOKEN_<last 8 chars of PeerID in uppercase>\n\t\t\tif (!envToken && realPeerId) {\n\t\t\t\tconst shortId = realPeerId.slice(-8).toUpperCase();\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${shortId}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${shortId}`];\n\t\t\t}\n\n\t\t\t// 2. Provider-name resolution: LIOP_TOKEN_<CLEAN_PROVIDER_NAME_UPPERCASE>\n\t\t\tif (!envToken && providerName) {\n\t\t\t\tconst cleanName = providerName\n\t\t\t\t\t.toUpperCase()\n\t\t\t\t\t.replace(/[^A-Z0-9_]/g, \"_\");\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${cleanName}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${cleanName}`];\n\t\t\t}\n\n\t\t\tif (envToken) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Resolved node-specific token for peer ${realPeerId.slice(-8)} (${providerName || \"unknown\"})`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst tokenResolver = async () => {\n\t\t\t\tif (envToken) return envToken;\n\t\t\t\tif (this.tokenManager) {\n\t\t\t\t\treturn await this.tokenManager.getToken();\n\t\t\t\t}\n\t\t\t\treturn this.oauthToken;\n\t\t\t};\n\n\t\t\tclient = new LiopRpcClient(address, this.tlsOptions, tokenResolver);\n\t\t\tthis.rpcClients.set(peerId, client);\n\t\t}\n\t\treturn client;\n\t}\n\n\t/**\n\t * Reads a specific resource by URI.\n\t * In LIOP, resources can be static definitions or dynamic streams.\n\t */\n\tpublic async readResource(uri: string): Promise<{\n\t\tcontents: Array<{ uri: string; mimeType?: string; text: string }>;\n\t}> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before reading resources.\");\n\t\t}\n\t\tconst readStartTime = Date.now();\n\t\tlog.info(`[LiopClient] Querying Mesh for Resource: ${uri}...`);\n\n\t\t// We search for the peer hosting the resource in the P2P Mesh\n\t\tconst providers = await this.meshNode.findProviders(uri);\n\t\tif (providers.length === 0) {\n\t\t\tthrow new Error(`No mesh providers found for resource: ${uri}`);\n\t\t}\n\n\t\t// Query the remote peer's manifest\n\t\tconst manifest = await this.meshNode.queryManifest(providers[0]);\n\t\tif (!manifest) {\n\t\t\tthrow new Error(\"Target peer did not return a valid LIOP Manifest.\");\n\t\t}\n\n\t\t// Locate the exact resource metadata\n\t\tconst resourceDef = manifest.resources?.find((r) => r.uri === uri);\n\t\tif (!resourceDef) {\n\t\t\tthrow new Error(`Resource ${uri} not listed in remote manifest.`);\n\t\t}\n\n\t\t// Return the declarative metadata (Logic-Injection is required for actual data extraction)\n\t\tconst result = {\n\t\t\tcontents: [\n\t\t\t\t{\n\t\t\t\t\turi,\n\t\t\t\t\tmimeType: resourceDef.mimeType || \"application/json\",\n\t\t\t\t\ttext: JSON.stringify(resourceDef, null, 2),\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\n\t\t// [Token Economy] Record telemetry for readResource\n\t\ttry {\n\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\tconst outputPayload = JSON.stringify(result);\n\t\t\ttelemetry.record({\n\t\t\t\ttype: \"resource_read\",\n\t\t\t\tmethod: \"readResource\",\n\t\t\t\ttoolName: uri,\n\t\t\t\tpeerId: providers[0],\n\t\t\t\testimatedInputTokens: telemetry.countTokens(uri),\n\t\t\t\testimatedOutputTokens: telemetry.countTokens(outputPayload),\n\t\t\t\tdurationMs: Date.now() - readStartTime,\n\t\t\t});\n\t\t} catch {\n\t\t\t// Telemetry error isolation\n\t\t}\n\n\t\treturn result;\n\t}\n\n\t/**\n\t * Returns the local PeerId string if the mesh node is active, null otherwise.\n\t * PeerIds are public identifiers by libp2p protocol design (Ed25519 public key hash).\n\t */\n\tpublic get peerId(): string | null {\n\t\treturn this.meshNode?.getPeerId() ?? null;\n\t}\n\n\t/**\n\t * Returns true if the mesh node is initialized and running.\n\t */\n\tpublic get isMeshActive(): boolean {\n\t\treturn this.meshNode?.isStarted() ?? false;\n\t}\n\n\t/**\n\t * Returns the number of active P2P connections, or 0 if the mesh is inactive.\n\t */\n\tpublic get connectionCount(): number {\n\t\treturn this.meshNode?.getPeers().length ?? 0;\n\t}\n\n\tpublic getServerInfo(): { name: string; version: string } | undefined {\n\t\treturn this.serverInfo;\n\t}\n\n\t/**\n\t * Destroys the active Mesh Node resources.\n\t */\n\tpublic async close(): Promise<void> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t}\n}\n"]}