@nekzus/liop 2.4.0-alpha.2 → 2.4.0-alpha.21

package/dist/chunk-JIJPZFR2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/output-sanitizer.ts"],"names":[],"mappings":";AAeA,IAAM,cAAA,GAAkD;AAAA,EACvD,gBAAA,EAAkB,CAAA;AAAA,EAClB,gBAAA,EAAkB;AACnB,CAAA;AASO,SAAS,cAAA,CACf,QACA,MAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,MAAA,EAAO;AAC9C,EAAA,MAAM,IAAA,uBAAW,OAAA,EAAgB;AAEjC,EAAA,SAAS,KAAK,IAAA,EAAwB;AACrC,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACxC,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,QAAA,OAAO,IAAA;AAAA,MACR;AAEA,MAAA,IAAI,KAAA,GAAQ,IAAA;AAGZ,MAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,KAAA,GAAQ,CAAA,EAAG;AACzC,QAAA,KAAA,GAAQ,CAAA;AAAA,MACT;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,gBAAA;AAC5B,MAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA,GAAI,MAAA;AAErC,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,SAAS,SAAA,EAAW;AAC1D,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE7B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAc,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACR;AACA,MAAA,IAAA,CAAK,IAAI,IAAc,CAAA;AAEvB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,QAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MACrC;AAEA,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,QAC/B;AAAA,OACD,EAAG;AACF,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,MAAM,CAAA;AACnB","file":"chunk-JIJPZFR2.js","sourcesContent":["/**\n * LIOP Egress Shield Output Sanitizer (NIST SP 800-226 and OWASP DLP 2025 compliant)\n * Recursively sanitizes execution outputs by rounding floating-point numbers\n * and clamping negative values to zero floor where appropriate.\n *\n * Implements absolute immutability, returning a fresh copy of the data.\n */\n\nexport interface OutputSanitizerConfig {\n\t/** Maximum decimal places for floating-point values (default: 4) */\n\tmaxDecimalPlaces?: number;\n\t/** Clamp negative values to zero floor (default: true) */\n\tclampNonNegative?: boolean;\n}\n\nconst DEFAULT_CONFIG: Required<OutputSanitizerConfig> = {\n\tmaxDecimalPlaces: 4,\n\tclampNonNegative: true,\n};\n\n/**\n * Recursively walks a JSON-like tree, rounding floats and clamping negative values.\n *\n * @param output - The raw or DP-modified output object/value to sanitize\n * @param config - Sanitization parameters (rounding depth, negative clamping)\n * @returns A sanitized deep copy of the output\n */\nexport function sanitizeOutput(\n\toutput: unknown,\n\tconfig?: OutputSanitizerConfig,\n): unknown {\n\tconst merged = { ...DEFAULT_CONFIG, ...config };\n\tconst seen = new WeakSet<object>();\n\n\tfunction walk(node: unknown): unknown {\n\t\tif (node === null || node === undefined) {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"number\") {\n\t\t\tif (!Number.isFinite(node)) {\n\t\t\t\treturn node;\n\t\t\t}\n\n\t\t\tlet value = node;\n\n\t\t\t// 1. Clamp negative values to 0 if configured\n\t\t\tif (merged.clampNonNegative && value < 0) {\n\t\t\t\tvalue = 0;\n\t\t\t}\n\n\t\t\t// 2. Round to maximum decimal places\n\t\t\tconst factor = 10 ** merged.maxDecimalPlaces;\n\t\t\tvalue = Math.round(value * factor) / factor;\n\n\t\t\treturn value;\n\t\t}\n\n\t\tif (typeof node === \"string\" || typeof node === \"boolean\") {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"object\") {\n\t\t\t// Circular reference protection\n\t\t\tif (seen.has(node as object)) {\n\t\t\t\treturn node;\n\t\t\t}\n\t\t\tseen.add(node as object);\n\n\t\t\tif (Array.isArray(node)) {\n\t\t\t\treturn node.map((item) => walk(item));\n\t\t\t}\n\n\t\t\tconst result: Record<string, unknown> = {};\n\t\t\tfor (const [key, val] of Object.entries(\n\t\t\t\tnode as Record<string, unknown>,\n\t\t\t)) {\n\t\t\t\tresult[key] = walk(val);\n\t\t\t}\n\t\t\treturn result;\n\t\t}\n\n\t\treturn node;\n\t}\n\n\treturn walk(output);\n}\n"]}

package/dist/chunk-OIMJZ64E.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/observability/metrics.ts","../src/rpc/crypto/dilithium.ts","../src/security/rbac.ts"],"names":[],"mappings":";;;AAeA,SAAS,aAAa,MAAA,EAA+B;AACpD,EAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAChD,IAAA,OAAO,EAAA;AAAA,EACR;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,EACnC,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA;AAC5D,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEA,SAAS,YAAY,MAAA,EAA+B;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AACpB,EAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAC1B,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA,KAAM,EAAE,aAAA,CAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,CAC3B,KAAK,GAAG,CAAA;AACX;AAEO,IAAM,UAAN,MAAc;AAAA,EAGpB,WAAA,CACiB,MACA,IAAA,EACf;AAFe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EACd;AAAA,EALK,MAAA,uBAAa,GAAA,EAAsD;AAAA,EAO3E,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,IAAI,QAAQ,CAAA,EAAG;AACd,MAAA,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,IAAI,MAAA,EAA+B;AAClC,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,KAAA,IAAS,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,QAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,KAAS,CAAA,EAAG;AAC3B,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,CAAI,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,YAAA,CAAa,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA,CAAE,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,QAAN,MAAY;AAAA,EAGlB,WAAA,CACiB,MACA,IAAA,EACf;AAFe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EACd;AAAA,EALK,MAAA,uBAAa,GAAA,EAAsD;AAAA,EAO3E,GAAA,CAAI,eAAsC,UAAA,EAA2B;AACpE,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACtC,MAAA,IAAA,CAAK,OAAO,GAAA,CAAI,EAAA,EAAI,EAAE,KAAA,EAAO,eAAe,CAAA;AAC5C,MAAA;AAAA,IACD;AACA,IAAA,MAAM,MAAA,GAAS,aAAA;AACf,IAAA,MAAM,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,CAAA;AAC1D,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,OAAO,GAAA,CAAI,GAAA,EAAK,EAAE,KAAA,EAAO,GAAA,EAAK,QAAQ,CAAA;AAAA,EAC5C;AAAA,EAEA,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,IAAI,MAAA,EAA+B;AAClC,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,KAAA,IAAS,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,MAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,KAAS,CAAA,EAAG;AAC3B,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,CAAI,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,YAAA,CAAa,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA,CAAE,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,YAAN,MAAgB;AAAA,EAYtB,YACiB,IAAA,EACA,IAAA,EAChB,OAAA,GAAoB,CAAC,GAAG,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAM,IAAA,EAAM,GAAA,EAAM,GAAK,CAAA,EACzE;AAHe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAGhB,IAAA,IAAA,CAAK,OAAA,GAAU,CAAC,GAAG,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,GAAI,CAAC,CAAA;AAAA,EACjD;AAAA,EAjBgB,OAAA;AAAA,EACR,YAAA,uBAAmB,GAAA,EAQzB;AAAA,EAUF,OAAA,CAAQ,eAAsC,UAAA,EAA2B;AACxE,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACtC,MAAA,GAAA,GAAM,aAAA;AAAA,IACP,CAAA,MAAO;AACN,MAAA,MAAA,GAAS,aAAA;AACT,MAAA,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,IAAI,KAAA,GAAQ,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,KAAA,GAAQ;AAAA,QACP,KAAA,EAAO,CAAA;AAAA,QACP,GAAA,EAAK,CAAA;AAAA,QACL,YAAA,EAAc,IAAI,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,EAAG,CAAC,CAAC,CAAC,CAAA;AAAA,QACrD;AAAA,OACD;AACA,MAAA,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IACjC;AAEA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,KAAA,CAAM,GAAA,IAAO,GAAA;AAEb,IAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AACjC,MAAA,IAAI,OAAO,KAAA,EAAO;AACjB,QAAA,MAAM,GAAA,GAAM,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA,IAAK,CAAA;AAC7C,QAAA,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,GAAA,GAAM,CAAC,CAAA;AAAA,MACtC;AAAA,IACD;AAAA,EACD;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EACzB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,UAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,IAAA,KAAS,CAAA,EAAG;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,QAAA,CAAU,CAAA;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,MAAA,CAAQ,CAAA;AAC/B,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,YAAA,CAAa,MAAA,EAAO,EAAG;AAC/C,MAAA,MAAM,UAAA,GAAa,KAAA,CAAM,MAAA,IAAU,EAAC;AACpC,MAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AACjC,QAAA,MAAM,eAAe,EAAE,GAAG,YAAY,EAAA,EAAI,MAAA,CAAO,KAAK,CAAA,EAAE;AACxD,QAAA,KAAA,CAAM,IAAA;AAAA,UACL,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,OAAA,EAAU,YAAA,CAAa,YAAY,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,EAAE,GAAG,UAAA,EAAY,IAAI,MAAA,EAAO;AAC9C,MAAA,KAAA,CAAM,IAAA;AAAA,QACL,CAAA,EAAG,KAAK,IAAI,CAAA,OAAA,EAAU,aAAa,SAAS,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA;AAAA,OAC7D;AACA,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,IAAA,EAAO,YAAA,CAAa,UAAU,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAA;AACrE,MAAA,KAAA,CAAM,IAAA;AAAA,QACL,CAAA,EAAG,KAAK,IAAI,CAAA,MAAA,EAAS,aAAa,UAAU,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA;AAAA,OAC7D;AAAA,IACD;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACpB,QAAA,uBAAe,GAAA,EAAqB;AAAA,EACpC,MAAA,uBAAa,GAAA,EAAmB;AAAA,EAChC,UAAA,uBAAiB,GAAA,EAAuB;AAAA,EAEhD,OAAA,CAAQ,MAAc,IAAA,EAAuB;AAC5C,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA;AAC9B,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA;AAC1B,MAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IAC1B;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,KAAA,CAAM,MAAc,IAAA,EAAqB;AACxC,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC5B,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AACxB,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,SAAA,CAAU,IAAA,EAAc,IAAA,EAAc,OAAA,EAA+B;AACpE,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AAChC,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,OAAO,CAAA;AACrC,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,qBAAA,GAA8B;AAC7B,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MACnB,6BAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,MAAA,CAAO,IAAI,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAEvC,IAAA,IAAI,OAAO,OAAA,CAAQ,WAAA,KAAgB,UAAA,EAAY;AAC9C,MAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA;AAAA,QAChB,+BAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,IAAI,GAAG,CAAA;AAEf,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AAAA,QACrB,qCAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,QAAA,CAAS,GAAA,CAAI,IAAI,QAAQ,CAAA;AAAA,IAC1B;AAAA,EACD;AAAA,EAEA,oBAAA,GAA+B;AAC9B,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAE3B,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,EAAG;AACvC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACrC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACvB;AAAA,EAEA,QAAA,GAAiB;AAChB,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,IAAK,KAAA,EAAM;AAChD,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,IAAK,KAAA,EAAM;AAC9C,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,IAAK,KAAA,EAAM;AAAA,EACnD;AACD;AAIO,IAAM,eAAA,GAAkB,IAAI,eAAA;AAE5B,IAAM,iBAAiB,eAAA,CAAgB,OAAA;AAAA,EAC7C,uBAAA;AAAA,EACA;AACD;AAEO,IAAM,eAAe,eAAA,CAAgB,SAAA;AAAA,EAC3C,0BAAA;AAAA,EACA,qDAAA;AAAA,EACA,CAAC,KAAK,GAAA,EAAK,GAAA,EAAM,MAAM,GAAA,EAAM,GAAA,EAAO,KAAO,GAAM;AAClD;AAEO,IAAM,qBAAqB,eAAA,CAAgB,KAAA;AAAA,EACjD,2BAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,KAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,OAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,2BAA2B,eAAA,CAAgB,SAAA;AAAA,EACvD,kCAAA;AAAA,EACA,iEAAA;AAAA,EACA,CAAC,CAAA,EAAG,CAAA,EAAG,GAAG,EAAA,EAAI,EAAA,EAAI,IAAI,GAAG;AAC1B;AClUO,IAAM,qBAAA,GAAwB;AAAA,EACpC,gBAAA,EAAkB,IAAA;AAAA,EAClB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB,IAAA;AAAA,EACjB,eAAA,EAAiB,IAAI,WAAA,EAAY,CAAE,OAAO,wBAAwB;AACnE;AAKA,SAAS,iBAAiB,OAAA,EAA0C;AACnE,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAChC,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,OAAA;AACR;AAMA,SAAS,iBAAiB,GAAA,EAAsB;AAC/C,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC5C,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,IAAI,GAAA,CAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,GAA8B,EAAE,IAAA,EAAK;AACpE,EAAA,MAAM,UAAU,UAAA,CAAW,GAAA;AAAA,IAC1B,CAAC,GAAA,KACA,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAkB,GAAA,CAAgC,GAAG,CAAC,CAAC,CAAA;AAAA,GACnF;AACA,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEO,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEjC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,iBAAiB,qBAAA,CAAsB,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvC,gBAAgB,IAAA,EAGd;AACD,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,mDAAA,EAAsD,KAAK,MAAM,CAAA,CAAA;AAAA,OAClE;AAAA,IACD;AACA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA;AACjC,IAAA,OAAO;AAAA,MACN,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KACjB;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAC7D,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,OAAO,MAAM,CAAA,CAAA;AAAA,OACjH;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CACC,OAAA,EACA,SAAA,EACA,OAAA,EACa;AACb,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,UAAU,MAAM,CAAA,CAAA;AAAA,OACpH;AAAA,IACD;AACA,IAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,IAAA,OAAO,SAAS,IAAA,CAAK,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,EAC3D,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,CACC,SAAA,EACA,OAAA,EACA,SAAA,EACA,OAAA,EACU;AACV,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,eAAA,EAAiB;AAC/D,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,MAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,MAAA,OAAO,QAAA,CAAS,OAAO,SAAA,EAAW,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CACC,QAAA,EACA,SAAA,EACA,SAAA,EAC2C;AAC3C,IAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,IAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAS,CAAA;AAC7C,IAAA,OAAO;AAAA,MACN,WAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,MAC7C,WAAW,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,QAAQ;AAAA,KACpD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,QAAA,EACA,eAAA,EACA,eAAA,EACU;AACV,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,MAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,MAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK,YAAA,EAAc,GAAG,CAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AACD;;;ACvJA,IAAM,SAAA,GAAyD;AAAA;AAAA,EAE9D,YAAY,EAAC;AAAA,EACb,6BAA6B,EAAC;AAAA,EAC9B,2BAA2B,EAAC;AAAA,EAC5B,MAAM,EAAC;AAAA;AAAA,EAGP,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA,EAChC,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA;AAAA,EAGhC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA;AAAA,EAGxC,cAAA,EAAgB,CAAC,kBAAkB,CAAA;AAAA,EACnC,aAAA,EAAe,CAAC,kBAAkB;AACnC,CAAA;AAuBO,SAAS,gBAAA,CACf,MAAA,EACA,IAAA,EACA,gBAAA,EACsB;AACtB,EAAA,MAAM,YAAA,GAAe,UAAU,MAAM,CAAA;AAGrC,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AAC5D,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACxB;AAGA,EAAA,IAAI,CAAC,IAAA,EAAM;AACV,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,uCAAuC,MAAM,CAAA;AAAA,KACtD;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GAAS,CAAC,GAAI,YAAA,IAAgB,EAAC,EAAI,GAAI,gBAAA,IAAoB,EAAG,CAAA;AAGpE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACxB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,mBAAmB,MAAM,CAAA,8BAAA;AAAA,KAClC;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,GAAA,CAAI,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACvB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,QAAQ,CAAA,wBAAA,EAA2B,MAAM,cAAc,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC1E;AAAA,EACD;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACxB;AAMO,IAAM,WAAA,GAAc;AAAA,EAC1B,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACD","file":"chunk-OIMJZ64E.js","sourcesContent":["/**\n * LIOP Prometheus Metrics Registry (Phase Beta-3)\n * Lightweight, zero-dependency, high-performance metrics collector\n * complying with Prometheus and OpenMetrics exposition format.\n */\n\nexport type MetricLabels = Record<string, string | number>;\n\nexport interface MetricDefinition {\n\tname: string;\n\thelp: string;\n\ttype: \"counter\" | \"gauge\" | \"histogram\";\n\tbuckets?: number[];\n}\n\nfunction formatLabels(labels?: MetricLabels): string {\n\tif (!labels || Object.keys(labels).length === 0) {\n\t\treturn \"\";\n\t}\n\tconst entries = Object.entries(labels)\n\t\t.sort(([a], [b]) => a.localeCompare(b))\n\t\t.map(([k, v]) => `${k}=\"${String(v).replace(/\"/g, '\\\\\"')}\"`);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nfunction labelsToKey(labels?: MetricLabels): string {\n\tif (!labels) return \"\";\n\treturn Object.entries(labels)\n\t\t.sort(([a], [b]) => a.localeCompare(b))\n\t\t.map(([k, v]) => `${k}:${v}`)\n\t\t.join(\"|\");\n}\n\nexport class Counter {\n\tprivate values = new Map<string, { value: number; labels?: MetricLabels }>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t) {}\n\n\tinc(labels?: MetricLabels, value = 1): void {\n\t\tif (value < 0) {\n\t\t\tthrow new Error(\"Counter increments must be non-negative\");\n\t\t}\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value += value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tget(labels?: MetricLabels): number {\n\t\tconst key = labelsToKey(labels);\n\t\treturn this.values.get(key)?.value || 0;\n\t}\n\n\treset(): void {\n\t\tthis.values.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} counter`,\n\t\t];\n\t\tif (this.values.size === 0) {\n\t\t\tlines.push(`${this.name} 0`);\n\t\t\treturn lines;\n\t\t}\n\t\tfor (const entry of this.values.values()) {\n\t\t\tlines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class Gauge {\n\tprivate values = new Map<string, { value: number; labels?: MetricLabels }>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t) {}\n\n\tset(labelsOrValue: MetricLabels | number, maybeValue?: number): void {\n\t\tif (typeof labelsOrValue === \"number\") {\n\t\t\tthis.values.set(\"\", { value: labelsOrValue });\n\t\t\treturn;\n\t\t}\n\t\tconst labels = labelsOrValue;\n\t\tconst val = typeof maybeValue === \"number\" ? maybeValue : 0;\n\t\tconst key = labelsToKey(labels);\n\t\tthis.values.set(key, { value: val, labels });\n\t}\n\n\tinc(labels?: MetricLabels, value = 1): void {\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value += value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tdec(labels?: MetricLabels, value = 1): void {\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value -= value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tget(labels?: MetricLabels): number {\n\t\tconst key = labelsToKey(labels);\n\t\treturn this.values.get(key)?.value || 0;\n\t}\n\n\treset(): void {\n\t\tthis.values.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} gauge`,\n\t\t];\n\t\tif (this.values.size === 0) {\n\t\t\tlines.push(`${this.name} 0`);\n\t\t\treturn lines;\n\t\t}\n\t\tfor (const entry of this.values.values()) {\n\t\t\tlines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class Histogram {\n\tpublic readonly buckets: number[];\n\tprivate observations = new Map<\n\t\tstring,\n\t\t{\n\t\t\tcount: number;\n\t\t\tsum: number;\n\t\t\tbucketCounts: Map<number, number>;\n\t\t\tlabels?: MetricLabels;\n\t\t}\n\t>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t\tbuckets: number[] = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 10000],\n\t) {\n\t\tthis.buckets = [...buckets].sort((a, b) => a - b);\n\t}\n\n\tobserve(labelsOrValue: MetricLabels | number, maybeValue?: number): void {\n\t\tlet labels: MetricLabels | undefined;\n\t\tlet val: number;\n\n\t\tif (typeof labelsOrValue === \"number\") {\n\t\t\tval = labelsOrValue;\n\t\t} else {\n\t\t\tlabels = labelsOrValue;\n\t\t\tval = typeof maybeValue === \"number\" ? maybeValue : 0;\n\t\t}\n\n\t\tconst key = labelsToKey(labels);\n\t\tlet state = this.observations.get(key);\n\t\tif (!state) {\n\t\t\tstate = {\n\t\t\t\tcount: 0,\n\t\t\t\tsum: 0,\n\t\t\t\tbucketCounts: new Map(this.buckets.map((b) => [b, 0])),\n\t\t\t\tlabels,\n\t\t\t};\n\t\t\tthis.observations.set(key, state);\n\t\t}\n\n\t\tstate.count += 1;\n\t\tstate.sum += val;\n\n\t\tfor (const bound of this.buckets) {\n\t\t\tif (val <= bound) {\n\t\t\t\tconst cur = state.bucketCounts.get(bound) || 0;\n\t\t\t\tstate.bucketCounts.set(bound, cur + 1);\n\t\t\t}\n\t\t}\n\t}\n\n\treset(): void {\n\t\tthis.observations.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} histogram`,\n\t\t];\n\t\tif (this.observations.size === 0) {\n\t\t\tlines.push(`${this.name}_count 0`);\n\t\t\tlines.push(`${this.name}_sum 0`);\n\t\t\treturn lines;\n\t\t}\n\n\t\tfor (const state of this.observations.values()) {\n\t\t\tconst baseLabels = state.labels || {};\n\t\t\tfor (const bound of this.buckets) {\n\t\t\t\tconst bucketLabels = { ...baseLabels, le: String(bound) };\n\t\t\t\tlines.push(\n\t\t\t\t\t`${this.name}_bucket${formatLabels(bucketLabels)} ${state.bucketCounts.get(bound) || 0}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst infLabels = { ...baseLabels, le: \"+Inf\" };\n\t\t\tlines.push(\n\t\t\t\t`${this.name}_bucket${formatLabels(infLabels)} ${state.count}`,\n\t\t\t);\n\t\t\tlines.push(`${this.name}_sum${formatLabels(baseLabels)} ${state.sum}`);\n\t\t\tlines.push(\n\t\t\t\t`${this.name}_count${formatLabels(baseLabels)} ${state.count}`,\n\t\t\t);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class MetricsRegistry {\n\tprivate counters = new Map<string, Counter>();\n\tprivate gauges = new Map<string, Gauge>();\n\tprivate histograms = new Map<string, Histogram>();\n\n\tcounter(name: string, help: string): Counter {\n\t\tlet c = this.counters.get(name);\n\t\tif (!c) {\n\t\t\tc = new Counter(name, help);\n\t\t\tthis.counters.set(name, c);\n\t\t}\n\t\treturn c;\n\t}\n\n\tgauge(name: string, help: string): Gauge {\n\t\tlet g = this.gauges.get(name);\n\t\tif (!g) {\n\t\t\tg = new Gauge(name, help);\n\t\t\tthis.gauges.set(name, g);\n\t\t}\n\t\treturn g;\n\t}\n\n\thistogram(name: string, help: string, buckets?: number[]): Histogram {\n\t\tlet h = this.histograms.get(name);\n\t\tif (!h) {\n\t\t\th = new Histogram(name, help, buckets);\n\t\t\tthis.histograms.set(name, h);\n\t\t}\n\t\treturn h;\n\t}\n\n\tcollectProcessMetrics(): void {\n\t\tconst uptime = this.gauge(\n\t\t\t\"liop_process_uptime_seconds\",\n\t\t\t\"Process uptime in seconds\",\n\t\t);\n\t\tuptime.set(Math.floor(process.uptime()));\n\n\t\tif (typeof process.memoryUsage === \"function\") {\n\t\t\tconst mem = process.memoryUsage();\n\t\t\tconst rss = this.gauge(\n\t\t\t\t\"liop_process_memory_rss_bytes\",\n\t\t\t\t\"Resident set size memory in bytes\",\n\t\t\t);\n\t\t\trss.set(mem.rss);\n\n\t\t\tconst heapUsed = this.gauge(\n\t\t\t\t\"liop_process_memory_heap_used_bytes\",\n\t\t\t\t\"Heap memory used in bytes\",\n\t\t\t);\n\t\t\theapUsed.set(mem.heapUsed);\n\t\t}\n\t}\n\n\texportPrometheusText(): string {\n\t\tthis.collectProcessMetrics();\n\n\t\tconst lines: string[] = [];\n\t\tfor (const c of this.counters.values()) {\n\t\t\tlines.push(...c.toPrometheus());\n\t\t}\n\t\tfor (const g of this.gauges.values()) {\n\t\t\tlines.push(...g.toPrometheus());\n\t\t}\n\t\tfor (const h of this.histograms.values()) {\n\t\t\tlines.push(...h.toPrometheus());\n\t\t}\n\t\tlines.push(\"\"); // Trailing newline\n\t\treturn lines.join(\"\\n\");\n\t}\n\n\tresetAll(): void {\n\t\tfor (const c of this.counters.values()) c.reset();\n\t\tfor (const g of this.gauges.values()) g.reset();\n\t\tfor (const h of this.histograms.values()) h.reset();\n\t}\n}\n\n// ── Global Standard Protocol Metrics Instance ──────────────────────────────────\n\nexport const protocolMetrics = new MetricsRegistry();\n\nexport const toolCallsTotal = protocolMetrics.counter(\n\t\"liop_tool_calls_total\",\n\t\"Total number of tool logic-injection executions\",\n);\n\nexport const fuelConsumed = protocolMetrics.histogram(\n\t\"liop_fuel_consumed_total\",\n\t\"Deterministic fuel units consumed by injected logic\",\n\t[100, 500, 1000, 2500, 5000, 10000, 50000, 100000],\n);\n\nexport const meshPeersConnected = protocolMetrics.gauge(\n\t\"liop_mesh_peers_connected\",\n\t\"Active peer connections in the P2P mesh\",\n);\n\nexport const manifestCacheSize = protocolMetrics.gauge(\n\t\"liop_manifest_cache_size\",\n\t\"Number of verified remote tool manifests in cache\",\n);\n\nexport const egressBlocksTotal = protocolMetrics.counter(\n\t\"liop_egress_blocks_total\",\n\t\"Total number of outputs blocked by Egress Shield\",\n);\n\nexport const zkVerificationDurationMs = protocolMetrics.histogram(\n\t\"liop_zk_verification_duration_ms\",\n\t\"Duration of ZK-Receipt and HMAC cryptographic attestation in ms\",\n\t[1, 2, 5, 10, 25, 50, 100],\n);\n","/**\n * LIOP Post-Quantum Digital Signature Wrapper\n * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant\n * manifest attestation, node revocation receipts, and cryptographic integrity.\n *\n * Characteristics:\n * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)\n * - Public Key Length: 1952 bytes\n * - Secret Key Length: 4032 bytes\n * - Signature Length: 3309 bytes\n * - Implementation: Pure TypeScript/JS via @noble/post-quantum\n */\n\nimport { ml_dsa65 } from \"@noble/post-quantum/ml-dsa.js\";\n\nexport const DILITHIUM65_CONSTANTS = {\n\tPUBLIC_KEY_BYTES: 1952,\n\tSECRET_KEY_BYTES: 4032,\n\tSIGNATURE_BYTES: 3309,\n\tDEFAULT_CONTEXT: new TextEncoder().encode(\"LIOP-FIPS204-ML-DSA-65\"),\n} as const;\n\n/**\n * Deterministically normalizes a message into a Uint8Array.\n */\nfunction normalizeMessage(message: Uint8Array | string): Uint8Array {\n\tif (typeof message === \"string\") {\n\t\treturn new TextEncoder().encode(message);\n\t}\n\treturn message;\n}\n\n/**\n * Deterministic canonical JSON serializer to ensure stable cryptographic hashing\n * regardless of key ordering in JavaScript objects.\n */\nfunction canonicalizeJson(obj: unknown): string {\n\tif (obj === null || typeof obj !== \"object\") {\n\t\treturn JSON.stringify(obj);\n\t}\n\tif (Array.isArray(obj)) {\n\t\treturn `[${obj.map(canonicalizeJson).join(\",\")}]`;\n\t}\n\tconst sortedKeys = Object.keys(obj as Record<string, unknown>).sort();\n\tconst entries = sortedKeys.map(\n\t\t(key) =>\n\t\t\t`${JSON.stringify(key)}:${canonicalizeJson((obj as Record<string, unknown>)[key])}`,\n\t);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nexport const Dilithium65Wrapper = {\n\t/** Constants */\n\tPUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,\n\tSECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,\n\tSIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,\n\n\t/**\n\t * Generates a new ML-DSA-65 (FIPS 204) key pair.\n\t * Optionally accepts a 32-byte seed for deterministic key generation.\n\t */\n\tgenerateKeyPair(seed?: Uint8Array): {\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t} {\n\t\tif (seed && seed.length !== 32) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`,\n\t\t\t);\n\t\t}\n\t\tconst keys = ml_dsa65.keygen(seed);\n\t\treturn {\n\t\t\tpublicKey: keys.publicKey,\n\t\t\tsecretKey: keys.secretKey,\n\t\t};\n\t},\n\n\t/**\n\t * Validates and imports a raw ML-DSA-65 public key.\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Signs a message using the post-quantum secret key.\n\t * Supports optional domain separation context (up to 255 bytes).\n\t */\n\tsign(\n\t\tmessage: Uint8Array | string,\n\t\tsecretKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): Uint8Array {\n\t\tif (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`,\n\t\t\t);\n\t\t}\n\t\tconst msgBytes = normalizeMessage(message);\n\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\treturn ml_dsa65.sign(msgBytes, secretKey, { context: ctx });\n\t},\n\n\t/**\n\t * Verifies an ML-DSA-65 post-quantum digital signature.\n\t */\n\tverify(\n\t\tsignature: Uint8Array,\n\t\tmessage: Uint8Array | string,\n\t\tpublicKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): boolean {\n\t\tif (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\tif (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\ttry {\n\t\t\tconst msgBytes = normalizeMessage(message);\n\t\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\t\treturn ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n\n\t/**\n\t * Signs a structured manifest (LiopManifest) using canonical JSON serialization.\n\t * Returns base64-encoded signature and public key for transport over gRPC/MCP.\n\t */\n\tsignManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsecretKey: Uint8Array,\n\t\tpublicKey: Uint8Array,\n\t): { signature: string; publicKey: string } {\n\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\tconst sig = this.sign(canonicalStr, secretKey);\n\t\treturn {\n\t\t\tsignature: Buffer.from(sig).toString(\"base64\"),\n\t\t\tpublicKey: Buffer.from(publicKey).toString(\"base64\"),\n\t\t};\n\t},\n\n\t/**\n\t * Verifies the post-quantum signature of a structured manifest.\n\t */\n\tverifyManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsignatureBase64: string,\n\t\tpublicKeyBase64: string,\n\t): boolean {\n\t\ttry {\n\t\t\tconst sig = Buffer.from(signatureBase64, \"base64\");\n\t\t\tconst pub = Buffer.from(publicKeyBase64, \"base64\");\n\t\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\t\treturn this.verify(sig, canonicalStr, pub);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n};\n","/**\n * LIOP RBAC Engine — Scope-Based Authorization\n *\n * Maps MCP JSON-RPC methods to required LIOP OAuth scopes.\n * Enforces least-privilege access at the router level before\n * any tool execution or resource read occurs.\n *\n * Standards: NIST SP 800-207 §4.3 (least privilege), OWASP LLM06 (Excessive Agency),\n *            OWASP API-A01 (Broken Access Control)\n */\n\nimport type { AuthInfo } from \"./jwt-validator.js\";\n\n/**\n * Maps MCP JSON-RPC methods to the LIOP scopes required to invoke them.\n * Empty array = no authentication required (public endpoints).\n */\nconst SCOPE_MAP: Readonly<Record<string, readonly string[]>> = {\n\t// Protocol lifecycle — unauthenticated (MCP spec compliance)\n\tinitialize: [],\n\t\"notifications/initialized\": [],\n\t\"notifications/cancelled\": [],\n\tping: [],\n\n\t// Tool operations — require explicit authorization\n\t\"tools/list\": [\"liop:tools:list\"],\n\t\"tools/call\": [\"liop:tools:call\"],\n\n\t// Resource operations — read-level access\n\t\"resources/list\": [\"liop:resources:read\"],\n\t\"resources/read\": [\"liop:resources:read\"],\n\n\t// Prompt/schema operations — schema-level access\n\t\"prompts/list\": [\"liop:schema:read\"],\n\t\"prompts/get\": [\"liop:schema:read\"],\n};\n\n/**\n * Authorization result with optional denial reason for audit logging.\n */\nexport interface AuthorizationResult {\n\tallowed: boolean;\n\treason?: string;\n}\n\n/**\n * Evaluates whether a request is authorized based on JWT scopes.\n *\n * Decision logic:\n * 1. Methods with no required scopes (initialize, ping) → always allowed.\n * 2. Methods with required scopes but no auth → denied.\n * 3. Methods with required scopes → all scopes must be present in the JWT.\n * 4. Unknown methods with no auth → denied (fail-closed per NIST SP 800-207).\n *\n * @param method - MCP JSON-RPC method name (e.g., \"tools/call\")\n * @param auth - Validated JWT context, or null if unauthenticated\n * @param additionalScopes - Extra scopes required by specific node configuration\n */\nexport function authorizeRequest(\n\tmethod: string,\n\tauth: AuthInfo | null,\n\tadditionalScopes?: readonly string[],\n): AuthorizationResult {\n\tconst methodScopes = SCOPE_MAP[method];\n\n\t// Methods explicitly marked as public (empty scope array) pass freely\n\tif (methodScopes !== undefined && methodScopes.length === 0) {\n\t\treturn { allowed: true };\n\t}\n\n\t// If no auth context and method requires scopes → deny\n\tif (!auth) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Authentication required for method: ${method}`,\n\t\t};\n\t}\n\n\t// Merge method-level scopes with node-level additional scopes\n\tconst needed = [...(methodScopes ?? []), ...(additionalScopes ?? [])];\n\n\t// If no scopes needed (unknown method, no additional) → fail-closed\n\tif (needed.length === 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Unknown method: ${method}. Access denied (fail-closed).`,\n\t\t};\n\t}\n\n\t// Verify all required scopes are present in the JWT\n\tconst clientScopes = new Set(auth.scopes);\n\tconst missing = needed.filter((s) => !clientScopes.has(s));\n\n\tif (missing.length > 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Insufficient scopes for ${method}. Missing: ${missing.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * All LIOP OAuth scopes supported by the protocol.\n * Used for PRM metadata and client registration.\n */\nexport const LIOP_SCOPES = [\n\t\"liop:tools:list\",\n\t\"liop:tools:call\",\n\t\"liop:resources:read\",\n\t\"liop:schema:read\",\n\t\"liop:mesh:query\",\n] as const;\n\nexport type LiopScope = (typeof LIOP_SCOPES)[number];\n"]}

package/dist/chunk-OLG56LGQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/bridge/stream.ts","../src/bridge/index.ts"],"names":[],"mappings":";;;;;;;AAiCA,IAAM,2BAAA,GAA8B,EAAA;AACpC,IAAM,0BAAA,GAA6B,KAAK,EAAA,GAAK,GAAA;AAC7C,IAAM,uBAAuB,EAAA,GAAK,GAAA;AAgB3B,IAAM,mBAAN,MAAuB;AAAA,EAS7B,WAAA,CACC,cAAA,EACQ,OAAA,GAAmC,EAAC,EAC3C;AADO,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAER,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,IAAA,EAAK;AACpB,IAAA,IAAA,CAAK,WAAA,GAAc,IAAI,aAAA,CAAc,cAAc,CAAA;AACnD,IAAA,IAAA,CAAK,cAAA,uBAAqB,GAAA,EAAI;AAC9B,IAAA,IAAA,CAAK,gBAAA,GACJ,QAAQ,gBAAA,IAAoB,2BAAA;AAC7B,IAAA,IAAA,CAAK,gBAAA,GACJ,QAAQ,gBAAA,IAAoB,0BAAA;AAE7B,IAAA,IAAA,CAAK,WAAA,EAAY;AAAA,EAClB;AAAA,EArBQ,GAAA;AAAA,EACA,UAAA,GAA8C,IAAA;AAAA,EAC9C,WAAA;AAAA,EACA,cAAA;AAAA,EACA,aAAA,GAAuD,IAAA;AAAA,EACvD,gBAAA;AAAA,EACA,gBAAA;AAAA;AAAA;AAAA;AAAA,EAoBR,MAAc,uBACb,QAAA,EACoD;AACpD,IAAA,MAAM,EAAE,wCAAA,EAAyC,GAAI,MAAM,OAC1D,+DACD,CAAA;AACA,IAAA,MAAM,SAAA,GAAY,IAAI,wCAAA,CAAyC;AAAA,MAC9D,kBAAA,EAAoB,MAAM,UAAA,EAAW;AAAA,MACrC,oBAAA,EAAsB,CAAC,SAAA,KAAsB;AAC5C,QAAA,IAAA,CAAK,cAAA,CAAe,IAAI,SAAA,EAAW;AAAA,UAClC,SAAA;AAAA,UACA,YAAA,EAAc,KAAK,GAAA,EAAI;AAAA,UACvB;AAAA,SACA,CAAA;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,oCAAA,EAAuC,SAAS,CAAA,MAAA,EAAS,QAAQ,CAAA,CAAA;AAAA,SAClE;AAAA,MACD;AAAA,KACA,CAAA;AAGD,IAAA,SAAA,CAAU,SAAA,GAAY,OAAO,OAAA,KAA4B;AAExD,MAAA,IAAI,UAAU,SAAA,EAAW;AACxB,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,UAAU,SAAS,CAAA;AACzD,QAAA,IAAI,KAAA,EAAO,KAAA,CAAM,YAAA,GAAe,IAAA,CAAK,GAAA,EAAI;AAAA,MAC1C;AAEA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,WAAA,CAAY,oBAAA;AAAA,UACrC;AAAA,SACD;AAEA,QAAA,IAAI,WAAW,KAAA,CAAA,EAAW;AACzB,UAAA,MAAM,SAAA,CAAU,KAAK,MAAwB,CAAA;AAAA,QAC9C;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA,CAAK,qCAAA,EAAwC,GAAA,CAAc,OAAO,CAAA;AAAA,MACvE;AAAA,IACD,CAAA;AAEA,IAAA,SAAA,CAAU,UAAU,MAAM;AACzB,MAAA,IAAI,UAAU,SAAA,EAAW;AACxB,QAAA,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO,SAAA,CAAU,SAAS,CAAA;AAC9C,QAAA,GAAA,CAAI,IAAA,CAAK,CAAA,oCAAA,EAAuC,SAAA,CAAU,SAAS,CAAA,CAAE,CAAA;AAAA,MACtE;AAAA,IACD,CAAA;AAEA,IAAA,OAAO,SAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,EAAA,EAAoB;AAC7C,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,cAAA,CAAe,MAAA,EAAO,EAAG;AACjD,MAAA,IAAI,KAAA,CAAM,aAAa,EAAA,EAAI,KAAA,EAAA;AAAA,IAC5B;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKQ,YAAY,CAAA,EAET;AACV,IAAA,OACC,EAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,EAAG,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,EAAG,MAAK,IACrD,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW,CAAA,IACxB,SAAA;AAAA,EAEF;AAAA;AAAA;AAAA;AAAA,EAKQ,iBAAA,GAA0B;AACjC,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,SAAA,EAAW,KAAK,CAAA,IAAK,KAAK,cAAA,EAAgB;AACrD,MAAA,IAAI,GAAA,GAAM,KAAA,CAAM,YAAA,GAAe,IAAA,CAAK,gBAAA,EAAkB;AACrD,QAAA,GAAA,CAAI,IAAA,CAAK,CAAA,2CAAA,EAA8C,SAAS,CAAA,CAAE,CAAA;AAClE,QAAA,KAAA,CAAM,SAAA,CAAU,KAAA,EAAM,CAAE,KAAA,CAAM,MAAM;AAAA,QAEpC,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,cAAA,CAAe,OAAO,SAAS,CAAA;AAAA,MACrC;AAAA,IACD;AAAA,EACD;AAAA,EAEQ,WAAA,GAAc;AACrB,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,GAAA,EAAK,IAAA,EAAM,CAAA;AAGxB,IAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,gBAAA,EAAkB;AAClC,MAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,UAAA,EAAW;AAC1C,MAAA,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAC,CAAA;AACvB,MAAA,GAAA,CAAI,KAAK,0DAAsC,CAAA;AAC/C,MAAA,GAAA,CAAI,KAAK,2CAA2C,CAAA;AACpD,MAAA,GAAA,CAAI,KAAK,+DAA+D,CAAA;AACxE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,OAAA,EAAU,OAAA,CAAQ,GAAA,CAAI,gBAAgB,CAAA,CAAE,CAAA;AACjD,MAAA,GAAA,CAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAC,CAAA;AAAA,IACxB;AAGA,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,OAAO,GAAG,IAAA,KAAS;AACvC,MAAA,MAAM,IAAA,GAAO,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,eAAe,CAAA;AACzC,MAAA,IAAI,CAAC,IAAA,EAAM,UAAA,CAAW,SAAS,CAAA,EAAG;AACjC,QAAA,OAAO,CAAA,CAAE,IAAA;AAAA,UACR,EAAE,OAAO,+CAAA,EAAgD;AAAA,UACzD;AAAA,SACD;AAAA,MACD;AAEA,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC1B,MAAA,MAAM,aAAA,GAAgB,QAAQ,GAAA,CAAI,gBAAA;AAGlC,MAAA,IAAI,aAAA,IAAiB,UAAU,aAAA,EAAe;AAC7C,QAAA,MAAM,IAAA,EAAK;AACX,QAAA;AAAA,MACD;AAGA,MAAA,MAAM,YAAA,GAAe,IAAA,CAAK,WAAA,CAAY,SAAA,EAAU,EAAG,YAAA;AACnD,MAAA,IAAI,YAAA,EAAc;AACjB,QAAA,IAAI;AACH,UAAA,MAAM,YAAA,CAAa,SAAS,KAAK,CAAA;AACjC,UAAA,MAAM,IAAA,EAAK;AACX,UAAA;AAAA,QACD,SAAS,CAAA,EAAY;AACpB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,2CAAA,EAA+C,EAAY,OAAO,CAAA;AAAA,WACnE;AACA,UAAA,OAAO,CAAA,CAAE,IAAA;AAAA,YACR;AAAA,cACC,KAAA,EAAO,CAAA,sCAAA,EAA0C,CAAA,CAAY,OAAO,CAAA;AAAA,aACrE;AAAA,YACA;AAAA,WACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH;AAAA,OACD;AACA,MAAA,OAAO,CAAA,CAAE,IAAA;AAAA,QACR,EAAE,OAAO,+CAAA,EAAgD;AAAA,QACzD;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,MAAA,EAAQ,OAAO,CAAA,KAAM;AACjC,MAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,gBAAgB,CAAA;AAG/C,MAAA,IAAI,SAAA,EAAW;AAEd,QAAA,IAAI,CAAC,0BAAA,EAA4B;AAChC,UAAA,OAAO,CAAA,CAAE,IAAA;AAAA,YACR;AAAA,cACC,KAAA,EACC;AAAA,aACF;AAAA,YACA;AAAA,WACD;AAAA,QACD;AAEA,QAAA,MAAM,QAAA,GAAW,IAAA,CAAK,cAAA,CAAe,GAAA,CAAI,SAAS,CAAA;AAClD,QAAA,IAAI,CAAC,QAAA,EAAU;AACd,UAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,mBAAA,IAAuB,GAAG,CAAA;AAAA,QAClD;AAEA,QAAA,QAAA,CAAS,YAAA,GAAe,KAAK,GAAA,EAAI;AAEjC,QAAA,MAAM,WAAW,MAAM,QAAA,CAAS,UAAU,aAAA,CAAc,CAAA,CAAE,IAAI,GAAG,CAAA;AAIjE,QAAA,IAAI,CAAA,CAAE,GAAA,CAAI,MAAA,KAAW,QAAA,EAAU;AAC9B,UAAA,IAAA,CAAK,cAAA,CAAe,OAAO,SAAS,CAAA;AACpC,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6CAAA,EAAgD,SAAS,CAAA,CAAE,CAAA;AAAA,QACrE;AAEA,QAAA,OAAO,QAAA;AAAA,MACR;AAGA,MAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,cAAc,CAAA,IAAK,EAAA;AACpD,MAAA,IAAI,EAAE,GAAA,CAAI,MAAA,KAAW,UAAU,WAAA,CAAY,QAAA,CAAS,kBAAkB,CAAA,EAAG;AACxE,QAAA,IAAI;AACH,UAAA,MAAM,IAAA,GAAQ,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAE/B,UAAA,IACC,KAAK,MAAA,KAAW,iBAAA,IACf,KAAK,MAAA,EAAoC,KAAA,IAC1C,CAAC,0BAAA,EACA;AACD,YAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,WAAA,CAAY,qBAAqB,IAAI,CAAA;AAC/D,YAAA,IAAI,WAAW,KAAA,CAAA,EAAW;AACzB,cAAA,OAAO,CAAA,CAAE,KAAK,MAAM,CAAA;AAAA,YACrB;AACA,YAAA,OAAO,CAAA,CAAE,IAAA,CAAK,IAAA,EAAM,GAAG,CAAA;AAAA,UACxB;AAAA,QACD,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACD;AAIA,MAAA,IAAI,CAAC,0BAAA,EAA4B;AAChC,QAAA,OAAO,CAAA,CAAE,IAAA;AAAA,UACR;AAAA,YACC,KAAA,EACC;AAAA,WACF;AAAA,UACA;AAAA,SACD;AAAA,MACD;AAEA,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,CAAC,CAAA;AACnC,MAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,iBAAA,CAAkB,QAAQ,CAAA;AACvD,MAAA,IAAI,eAAA,IAAmB,KAAK,gBAAA,EAAkB;AAC7C,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,2CAAA,EAA8C,QAAQ,CAAA,EAAA,EAAK,eAAe,CAAA,UAAA;AAAA,SAC3E;AACA,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,wCAAA,IAA4C,GAAG,CAAA;AAAA,MACvE;AAEA,MAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,sBAAA,CAAuB,QAAQ,CAAA;AAC5D,MAAA,OAAO,MAAM,SAAA,CAAU,aAAA,CAAc,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,IAC/C,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,MAAM,IAAA,EAA8B;AAChD,IAAA,MAAM,UAAA,GAAa,IAAA,IAAQ,IAAA,CAAK,OAAA,CAAQ,IAAA,IAAQ,GAAA;AAGhD,IAAA,IAAA,CAAK,aAAA,GAAgB,WAAA;AAAA,MACpB,MAAM,KAAK,iBAAA,EAAkB;AAAA,MAC7B;AAAA,KACD;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY;AAC/B,MAAA,IAAA,CAAK,UAAA,GAAa,KAAA;AAAA,QACjB;AAAA,UACC,KAAA,EAAO,KAAK,GAAA,CAAI,KAAA;AAAA,UAChB,IAAA,EAAM;AAAA,SACP;AAAA,QACA,CAAC,IAAA,KAAS;AACT,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,gEAAA,EAAmE,KAAK,IAAI,CAAA,IAAA;AAAA,WAC7E;AACA,UAAA,OAAA,EAAQ;AAAA,QACT;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,IAAA,GAAsB;AAClC,IAAA,IAAI,KAAK,aAAA,EAAe;AACvB,MAAA,aAAA,CAAc,KAAK,aAAa,CAAA;AAChC,MAAA,IAAA,CAAK,aAAA,GAAgB,IAAA;AAAA,IACtB;AAEA,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,CAAA,IAAK,KAAK,cAAA,EAAgB;AAC9C,MAAA,MAAM,KAAA,CAAM,UAAU,KAAA,EAAM;AAC5B,MAAA,IAAA,CAAK,cAAA,CAAe,OAAO,EAAE,CAAA;AAAA,IAC9B;AAEA,IAAA,IAAI,KAAK,UAAA,EAAY;AACpB,MAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,MAAA,GAAA,CAAI,KAAK,0CAA0C,CAAA;AAAA,IACpD;AAAA,EACD;AACD;;;AC7UO,IAAM,gBAAN,MAAoB;AAAA,EAG1B,WAAA,CAEC,MAAA,EACQ,OAAA,GAA6B,EAAC,EACrC;AADO,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAIR,IAAA,IAAI,MAAA,EAAQ,WAAA,EAAa,IAAA,KAAS,YAAA,EAAc;AAC/C,MAAA,IAAA,CAAK,UAAA,GAAa,MAAA;AAClB,MAAA,GAAA,CAAI,KAAK,gDAAgD,CAAA;AAAA,IAC1D,CAAA,MAAA,IAAW,MAAA,EAAQ,WAAA,EAAa,IAAA,KAAS,WAAA,EAAa;AACrD,MAAA,IAAA,CAAK,eAAA,GAAkB,MAAA;AACvB,MAAA,GAAA,CAAI,KAAK,oDAAoD,CAAA;AAAA,IAC9D,CAAA,MAAO;AAEN,MAAA,IAAA,CAAK,eAAA,GAAkB,MAAA;AACvB,MAAA,GAAA,CAAI,KAAK,6DAA6D,CAAA;AAAA,IACvE;AAAA,EACD;AAAA,EApBQ,UAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAoC,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyB5C,MAAa,qBACZ,OAAA,EACmB;AACnB,IAAA,MAAM,KAAK,OAAA,CAAQ,EAAA;AACnB,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AAEvB,IAAA,IAAI,OAAA,CAAQ,YAAY,KAAA,EAAO;AAC9B,MAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,iBAAiB,CAAA;AAAA,IACxD;AAGA,IAAA,IAAI,KAAK,UAAA,EAAY;AACpB,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC/C;AAGA,IAAA,IAAI,IAAA,CAAK,eAAA,IAAmB,IAAA,CAAK,UAAA,EAAY;AAC5C,MAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,EAAA,EAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC/C;AAEA,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,8BAA8B,CAAA;AAAA,EACrE;AAAA,EAEA,MAAc,eAAA,CACb,EAAA,EACA,MAAA,EACA,MAAA,EACmB;AACnB,IAAA,IAAI,CAAC,IAAA,CAAK,UAAA,EAAY,OAAO,IAAA;AAE7B,IAAA,MAAM,WACL,0BAAA,IAA8B,eAAA,CAAgB,EAAE,MAAA,EAAQ,MAAA,EAAQ,IAAI,CAAA;AAErE,IAAA,IAAI,WAAW,YAAA,EAAc;AAE5B,MAAA,IAAI,CAAC,0BAAA,EAA4B;AAChC,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,4BAA4B,CAAA;AAAA,MACnE;AACA,MAAA,OAAO,IAAA,CAAK,gBAAgB,EAAA,EAAI;AAAA,QAC/B,eAAA,EAAiB,2BAAA;AAAA,QACjB,YAAA,EAAc;AAAA,UACb,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,UAC7B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,UAC/B,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA;AAAK,SAC5B;AAAA,QACA,UAAA,EAAY,IAAA,CAAK,UAAA,CAAW,aAAA;AAAc,OAC1C,CAAA;AAAA,IACF;AAEA,IAAA,IAAI,WAAW,iBAAA,EAAmB;AACjC,MAAA,OAAO,IAAA,CAAK,gBAAgB,EAAA,EAAI;AAAA,QAC/B,UAAA,EAAY,UAAA;AAAA,QACZ,mBAAmB,0BAAA,GAChB,CAAC,sBAAsB,2BAA2B,CAAA,GAClD,CAAC,oBAAoB,CAAA;AAAA,QACxB,YAAA,EAAc;AAAA,UACb,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,UAC7B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,UAC/B,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA;AAAK,SAC5B;AAAA,QACA,UAAA,EAAY,IAAA,CAAK,UAAA,CAAW,aAAA;AAAc,OAC1C,CAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,KAAW,6BAA6B,OAAO,MAAA;AACnD,IAAA,IAAI,WAAW,MAAA,EAAQ,OAAO,KAAK,eAAA,CAAgB,EAAA,EAAI,EAAE,CAAA;AAEzD,IAAA,IAAI,WAAW,YAAA,EAAc;AAC5B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CACjB,SAAA,GACA,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AAC7C,MAAA,OAAO,IAAA,CAAK,eAAA;AAAA,QACX,EAAA;AAAA,QACA,QAAA,GACG,EAAE,KAAA,EAAM,GACR;AAAA,UACA,UAAA,EAAY,UAAA;AAAA,UACZ,KAAA,EAAO,GAAA;AAAA,UACP,UAAA,EAAY,QAAA;AAAA,UACZ;AAAA;AACD,OACH;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,gBAAA,EAAkB;AAChC,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,UAAA,CACrB,aAAA,GACA,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,GAAA,CAAI,aAAA,CAAc,CAAA,CAAE,GAAG,CAAC,CAAA;AAC3C,MAAA,OAAO,IAAA,CAAK,eAAA;AAAA,QACX,EAAA;AAAA,QACA,QAAA,GACG,EAAE,SAAA,EAAU,GACZ;AAAA,UACA,UAAA,EAAY,UAAA;AAAA,UACZ,KAAA,EAAO,GAAA;AAAA,UACP,UAAA,EAAY,QAAA;AAAA,UACZ;AAAA;AACD,OACH;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,cAAA,EAAgB;AAC9B,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,UAAA,CACnB,WAAA,GACA,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AAC7C,MAAA,OAAO,IAAA,CAAK,eAAA;AAAA,QACX,EAAA;AAAA,QACA,QAAA,GACG,EAAE,OAAA,EAAQ,GACV;AAAA,UACA,UAAA,EAAY,UAAA;AAAA,UACZ,KAAA,EAAO,GAAA;AAAA,UACP,UAAA,EAAY,QAAA;AAAA,UACZ;AAAA;AACD,OACH;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,aAAA,EAAe;AAC7B,MAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AAClB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,qBAAqB,CAAA;AAAA,MAC5D;AACA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,CAAW,SAAA,CAAU;AAAA,UAC9C,MAAM,MAAA,CAAO,IAAA;AAAA,UACb,WAAW,MAAA,CAAO;AAAA,SAClB,CAAA;AACD,QAAA,OAAO,IAAA,CAAK,eAAA;AAAA,UACX,EAAA;AAAA,UACA,QAAA,IAAY,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,GAClD,MAAA,GACA,EAAE,UAAA,EAAY,UAAA,EAAY,GAAG,MAAA;AAAO,SACxC;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,gBAAA,EAAkB;AAChC,MAAA,IAAI,CAAC,QAAQ,GAAA,EAAK;AACjB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,sBAAsB,CAAA;AAAA,MAC7D;AACA,MAAA,IAAI;AACH,QAAA,MAAM,SAAS,MAAM,IAAA,CAAK,UAAA,CAAW,YAAA,CAAa,OAAO,GAAa,CAAA;AACtE,QAAA,OAAO,IAAA,CAAK,eAAA;AAAA,UACX,EAAA;AAAA,UACA,WACG,MAAA,GACA,OAAO,MAAA,KAAW,QAAA,IAAY,WAAW,IAAA,GACxC;AAAA,YACA,UAAA,EAAY,UAAA;AAAA,YACZ,KAAA,EAAO,GAAA;AAAA,YACP,UAAA,EAAY,SAAA;AAAA,YACZ,GAAG;AAAA,WACJ,GACC;AAAA,YACA,UAAA,EAAY,UAAA;AAAA,YACZ,KAAA,EAAO,GAAA;AAAA,YACP,UAAA,EAAY,SAAA;AAAA,YACZ,QAAA,EAAU;AAAA;AACX,SACJ;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,IAAI,WAAW,YAAA,EAAc;AAC5B,MAAA,IAAI,CAAC,QAAQ,IAAA,EAAM;AAClB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,mBAAmB,CAAA;AAAA,MAC1D;AACA,MAAA,MAAM,OAAA,GAA2B;AAAA,QAChC,MAAM,MAAA,CAAO,IAAA;AAAA,QACb,SAAA,EAAY,MAAA,CAAO,SAAA,IAAyC;AAAC,OAC9D;AAEA,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAyB,MAAM,IAAA,CAAK,UAAA,CAAW,SAAS,OAAO,CAAA;AAGrE,QAAA,MAAM,UAAA,GAAa,OAAO,OAAA,GACvB,IAAA,GACA,MAAM,IAAA,CAAK,eAAA,CAAgB,SAAS,MAAM,CAAA;AAE7C,QAAA,IAAI,CAAC,UAAA,EAAY;AAChB,UAAA,OAAO,IAAA,CAAK,gBAAgB,EAAA,EAAI;AAAA,YAC/B,OAAA,EAAS;AAAA,cACR;AAAA,gBACC,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM;AAAA;AACP,aACD;AAAA,YACA,OAAA,EAAS;AAAA,WACT,CAAA;AAAA,QACF;AAEA,QAAA,OAAO,IAAA,CAAK,eAAA;AAAA,UACX,EAAA;AAAA,UACA,WACG,MAAA,GACA;AAAA,YACA,UAAA,EAAY,UAAA;AAAA,YACZ,GAAG;AAAA;AACJ,SACH;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,KAAA,EAAS,IAAc,OAAO,CAAA;AAAA,MAC7D;AAAA,IACD;AAEA,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,EAAA,EAAI,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EACzD;AAAA,EAEQ,eAAA,CACP,IACA,MAAA,EACC;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,EAAA,EAAI,MAAA,EAAO;AAAA,EACrC;AAAA,EAEQ,aAAA,CAAc,EAAA,EAAqB,IAAA,EAAc,OAAA,EAAiB;AACzE,IAAA,OAAO,EAAE,SAAS,KAAA,EAAO,EAAA,EAAI,OAAO,EAAE,IAAA,EAAM,SAAQ,EAAE;AAAA,EACvD;AAAA,EAEA,MAAc,eAAA,CACb,OAAA,EACA,MAAA,EACmB;AACnB,IAAA,IACC,CAAC,QAAQ,SAAA,EAAW,OAAA,IACpB,OAAO,OAAA,CAAQ,SAAA,CAAU,YAAY,QAAA,EACpC;AACD,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAU,QAAQ,SAAA,CAAU,OAAA;AAClC,MAAA,MAAM,WAAA,GAAc,MAAA,CAAO,OAAA,CAAQ,CAAC,CAAA,EAAG,IAAA;AAEvC,MAAA,IAAI,WAAA,IAAe,OAAO,WAAA,KAAgB,QAAA,EAAU;AACnD,QAAA,IAAI;AACH,UAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA;AAEnC,UAAA,IAAI,IAAA,CAAK,QAAA,IAAY,IAAA,CAAK,UAAA,EAAY;AAErC,YAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,wBAAuB,CAAA;AAC7D,YAAA,MAAM,QAAA,GAAW,IAAI,YAAA,EAAa;AAGlC,YAAA,MAAM,WAAA,GAAc,MAAM,QAAA,CAAS,eAAA;AAAA,cAClC,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,OAAO,CAAA;AAAA,cAC5B,IAAA,CAAK,QAAA;AAAA,cACL,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,UAAA,IAAc,IAAI,QAAQ,CAAA;AAAA,cAC3C,KAAA,CAAA;AAAA,cACA,IAAA,CAAK;AAAA,aACN;AAEA,YAAA,IAAI,CAAC,WAAA,EAAa;AACjB,cAAA,OAAO,KAAA;AAAA,YACR;AAEA,YAAA,IAAA,CAAK,YAAA,GACJ,yEAAA;AACD,YAAA,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAE,IAAA,GAAO,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,UAC7C;AAAA,QACD,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACD;AACA,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,CAAA,EAAG;AACX,MAAA,GAAA,CAAI,IAAA,CAAK,sCAAsC,CAAC,CAAA;AAChD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,OAAA,GAAyB;AAErC,IAAA,IAAI,KAAK,eAAA,EAAiB;AACzB,MAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,aAAoB,CAAA;AACxD,MAAA,IAAA,CAAK,aAAa,IAAI,UAAA;AAAA,QACrB,IAAA,CAAK,QAAQ,UAAA,IAAc;AAAA,UAC1B,IAAA,EAAM,aAAA;AAAA,UACN,OAAA,EAAS;AAAA,SACV;AAAA,QACA,EAAE,QAAA,EAAU,IAAA,CAAK,OAAA,CAAQ,QAAA;AAAS,OACnC;AAEA,MAAA,IAAI,IAAA,CAAK,QAAQ,aAAA,EAAe;AAC/B,QAAA,MAAM,IAAA,CAAK,WAAW,OAAA,EAAQ;AAI9B,QAAA,MAAM,SAAS,IAAA,CAAK,eAAA;AAGpB,QAAA,IAAI,OAAO,gBAAA,EAAkB;AAC5B,UAAA,KAAA,MAAW,CAAC,MAAM,IAAI,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,gBAAgB,CAAA,EAAG;AAEnE,YAAA,MAAM,CAAA,GAAI,IAAA;AACV,YAAA,IAAA,CAAK,UAAA,CAAW,IAAA;AAAA,cACf,IAAA;AAAA,cACA,EAAE,WAAA,IAAe,EAAA;AAAA,cACjB,CAAA,CAAE,eAAe,EAAC;AAAA;AAAA,cAElB,OAAO,IAAA,KAAc;AACpB,gBAAA,OAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAI,CAAA;AAAA,cAC5B;AAAA,aACD;AAAA,UACD;AAAA,QACD;AAGA,QAAA,IAAI,OAAO,oBAAA,EAAsB;AAChC,UAAA,KAAA,MAAW,CAAC,GAAA,EAAK,QAAQ,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,YACpC,MAAA,CAAO;AAAA,WACR,EAAG;AAEF,YAAA,MAAM,CAAA,GAAI,QAAA;AACV,YAAA,IAAA,CAAK,UAAA,CAAW,QAAA;AAAA,cACf,CAAA,CAAE,IAAA;AAAA,cACF,GAAA;AAAA,cACA,CAAA,CAAE,UAAU,WAAA,IAAe,EAAA;AAAA,cAC3B,CAAA,CAAE,UAAU,QAAA,IAAY,0BAAA;AAAA,cACxB,YAAY;AACX,gBAAA,MAAM,MAAM,MAAM,CAAA,CAAE,aAAa,IAAI,GAAA,CAAI,GAAG,CAAC,CAAA;AAC7C,gBAAA,OAAO,GAAA,CAAI,QAAA,CAAS,CAAC,CAAA,CAAE,IAAA;AAAA,cACxB;AAAA,aACD;AAAA,UACD;AAAA,QACD;AAAA,MACD;AACA,MAAA;AAAA,IACD;AAGA,IAAA,MAAM,QAAA,GAAW,MAAM,OAAO,UAAe,CAAA;AAC7C,IAAA,MAAM,EAAA,GAAK,SAAS,eAAA,CAAgB;AAAA,MACnC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,QAAA,EAAU;AAAA,KACV,CAAA;AAED,IAAA,MAAM,WAAW,YAAY;AAC5B,MAAA,GAAA,CAAI,KAAK,wCAAwC,CAAA;AACjD,MAAA,IAAI,IAAA,CAAK,UAAA,EAAY,MAAM,IAAA,CAAK,WAAW,KAAA,EAAM;AACjD,MAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,IACf,CAAA;AAEA,IAAA,EAAA,CAAG,EAAA,CAAG,SAAS,QAAQ,CAAA;AACvB,IAAA,OAAA,CAAQ,EAAA,CAAG,UAAU,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,EAAA,CAAG,WAAW,QAAQ,CAAA;AAE9B,IAAA,EAAA,CAAG,EAAA,CAAG,MAAA,EAAQ,OAAO,IAAA,KAAS;AAC7B,MAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAK,EAAG;AAClB,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC/B,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,oBAAA,CAAqB,OAAO,CAAA;AACxD,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC;AAAA,CAAI,CAAA;AAAA,QACrD;AAAA,MACD,SAAS,CAAA,EAAY;AACpB,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,qBAAA,EAAyB,CAAA,CAAY,OAAO,CAAA,CAAE,CAAA;AAAA,MACzD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEO,SAAA,GAA+B;AACrC,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AACD","file":"chunk-OLG56LGQ.js","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { serve } from \"@hono/node-server\";\nimport type { WebStandardStreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\";\nimport type { JSONRPCMessage } from \"@modelcontextprotocol/sdk/types.js\";\nimport { Hono } from \"hono\";\nimport { cors } from \"hono/cors\";\nimport { MCP_LEGACY_SUPPORT_ENABLED } from \"../gateway/mcp-compat.js\";\nimport type { LiopServer } from \"../server/index.js\";\nimport { log } from \"../utils/logger.js\";\nimport { LiopMcpBridge } from \"./index.js\";\n\n/**\n * Configuration options for LiopStreamBridge.\n */\nexport interface LiopStreamBridgeOptions {\n\t/** Port to listen on (default: 3000) */\n\tport?: number;\n\t/** Max concurrent sessions per IP (default: 5) */\n\tmaxSessionsPerIp?: number;\n\t/** Session idle timeout in milliseconds (default: 30 min) */\n\tsessionTimeoutMs?: number;\n}\n\n/**\n * @mcp-legacy Internal metadata for tracked legacy sessions (2025-era).\n * Remove when v1 EOL.\n */\ninterface SessionEntry {\n\ttransport: WebStandardStreamableHTTPServerTransport;\n\tlastActivity: number;\n\tclientIp: string;\n}\n\nconst DEFAULT_MAX_SESSIONS_PER_IP = 10;\nconst DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000; // 30 minutes\nconst EVICTION_INTERVAL_MS = 60 * 1000; // Check every minute\n\n/**\n * LiopStreamBridge\n *\n * Exposes a LiopServer over a remote HTTP network using the industry-standard\n * MCP Streamable HTTP Transport + Hono JS.\n *\n * Supports concurrent multi-client connections via per-session transport instances (Map pattern).\n * External agents connect using only a URL + Bearer Token (Zero-Trust).\n *\n * Security hardening:\n * - Zero-Trust Bearer Token enforcement\n * - Per-IP rate limiting on session creation\n * - Automatic eviction of idle sessions (TTL)\n */\nexport class LiopStreamBridge {\n\tprivate app: Hono;\n\tprivate httpServer: ReturnType<typeof serve> | null = null;\n\tprivate bridgeLogic: LiopMcpBridge;\n\tprivate activeSessions: Map<string, SessionEntry>;\n\tprivate evictionTimer: ReturnType<typeof setInterval> | null = null;\n\tprivate maxSessionsPerIp: number;\n\tprivate sessionTimeoutMs: number;\n\n\tconstructor(\n\t\tinternalServer: LiopServer,\n\t\tprivate options: LiopStreamBridgeOptions = {},\n\t) {\n\t\tthis.app = new Hono();\n\t\tthis.bridgeLogic = new LiopMcpBridge(internalServer);\n\t\tthis.activeSessions = new Map();\n\t\tthis.maxSessionsPerIp =\n\t\t\toptions.maxSessionsPerIp ?? DEFAULT_MAX_SESSIONS_PER_IP;\n\t\tthis.sessionTimeoutMs =\n\t\t\toptions.sessionTimeoutMs ?? DEFAULT_SESSION_TIMEOUT_MS;\n\n\t\tthis.setupRoutes();\n\t}\n\n\t/**\n\t * Creates a new per-session transport instance and wires it to the LIOPMcpBridge logic.\n\t */\n\tprivate async createSessionTransport(\n\t\tclientIp: string,\n\t): Promise<WebStandardStreamableHTTPServerTransport> {\n\t\tconst { WebStandardStreamableHTTPServerTransport } = await import(\n\t\t\t\"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\"\n\t\t);\n\t\tconst transport = new WebStandardStreamableHTTPServerTransport({\n\t\t\tsessionIdGenerator: () => randomUUID(),\n\t\t\tonsessioninitialized: (sessionId: string) => {\n\t\t\t\tthis.activeSessions.set(sessionId, {\n\t\t\t\t\ttransport,\n\t\t\t\t\tlastActivity: Date.now(),\n\t\t\t\t\tclientIp,\n\t\t\t\t});\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-StreamBridge] Session opened: ${sessionId} (IP: ${clientIp})`,\n\t\t\t\t);\n\t\t\t},\n\t\t});\n\n\t\t// Wire the transport's incoming messages to the LiopMcpBridge JSON-RPC router\n\t\ttransport.onmessage = async (message: JSONRPCMessage) => {\n\t\t\t// Touch activity timestamp on every message\n\t\t\tif (transport.sessionId) {\n\t\t\t\tconst entry = this.activeSessions.get(transport.sessionId);\n\t\t\t\tif (entry) entry.lastActivity = Date.now();\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst result = await this.bridgeLogic.handleJsonRpcRequest(\n\t\t\t\t\tmessage as unknown as Record<string, unknown>,\n\t\t\t\t);\n\t\t\t\t// Notifications return undefined — no response needed\n\t\t\t\tif (result !== undefined) {\n\t\t\t\t\tawait transport.send(result as JSONRPCMessage);\n\t\t\t\t}\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.info(\"[LIOP-StreamBridge] JSON-RPC error:\", (err as Error).message);\n\t\t\t}\n\t\t};\n\n\t\ttransport.onclose = () => {\n\t\t\tif (transport.sessionId) {\n\t\t\t\tthis.activeSessions.delete(transport.sessionId);\n\t\t\t\tlog.info(`[LIOP-StreamBridge] Session closed: ${transport.sessionId}`);\n\t\t\t}\n\t\t};\n\n\t\treturn transport;\n\t}\n\n\t/**\n\t * Returns the number of active sessions for a given IP.\n\t */\n\tprivate countSessionsByIp(ip: string): number {\n\t\tlet count = 0;\n\t\tfor (const entry of this.activeSessions.values()) {\n\t\t\tif (entry.clientIp === ip) count++;\n\t\t}\n\t\treturn count;\n\t}\n\n\t/**\n\t * Extracts client IP from the request (supports X-Forwarded-For for reverse proxies).\n\t */\n\tprivate getClientIp(c: {\n\t\treq: { header: (name: string) => string | undefined };\n\t}): string {\n\t\treturn (\n\t\t\tc.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ||\n\t\t\tc.req.header(\"x-real-ip\") ||\n\t\t\t\"unknown\"\n\t\t);\n\t}\n\n\t/**\n\t * Evicts sessions that have been idle longer than the configured timeout.\n\t */\n\tprivate evictIdleSessions(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [sessionId, entry] of this.activeSessions) {\n\t\t\tif (now - entry.lastActivity > this.sessionTimeoutMs) {\n\t\t\t\tlog.info(`[LIOP-StreamBridge] Evicting idle session: ${sessionId}`);\n\t\t\t\tentry.transport.close().catch(() => {\n\t\t\t\t\t/* Swallow close errors */\n\t\t\t\t});\n\t\t\t\tthis.activeSessions.delete(sessionId);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate setupRoutes() {\n\t\tthis.app.use(\"*\", cors());\n\n\t\t// Initialize strict zero-trust token if not provided\n\t\tif (!process.env.ZERO_TRUST_TOKEN) {\n\t\t\tprocess.env.ZERO_TRUST_TOKEN = randomUUID();\n\t\t\tlog.info(\"=\".repeat(60));\n\t\t\tlog.info(\"⚠️ STRICT ZERO-TRUST MODE ENABLED ⚠️\");\n\t\t\tlog.info(\"No ZERO_TRUST_TOKEN found in environment.\");\n\t\t\tlog.info(\"A secure ephemeral token has been generated for this session:\");\n\t\t\tlog.info(`Token: ${process.env.ZERO_TRUST_TOKEN}`);\n\t\t\tlog.info(\"=\".repeat(60));\n\t\t}\n\n\t\t// ZTA (Zero-Trust Architecture) Security Middleware\n\t\tthis.app.use(\"/mcp\", async (c, next) => {\n\t\t\tconst auth = c.req.header(\"Authorization\");\n\t\t\tif (!auth?.startsWith(\"Bearer \")) {\n\t\t\t\treturn c.json(\n\t\t\t\t\t{ error: \"Unauthorized: LIOP Zero-Trust Policy Enforced\" },\n\t\t\t\t\t401,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst token = auth.slice(7);\n\t\t\tconst expectedToken = process.env.ZERO_TRUST_TOKEN;\n\n\t\t\t// Check static token fallback first (retrocompatibility)\n\t\t\tif (expectedToken && token === expectedToken) {\n\t\t\t\tawait next();\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Validate with JWT Validator if configured on the server\n\t\t\tconst jwtValidator = this.bridgeLogic.getServer()?.jwtValidator;\n\t\t\tif (jwtValidator) {\n\t\t\t\ttry {\n\t\t\t\t\tawait jwtValidator.validate(token);\n\t\t\t\t\tawait next();\n\t\t\t\t\treturn;\n\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-StreamBridge] JWT Validation failed: ${(e as Error).message}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn c.json(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror: `Unauthorized: JWT Validation failed - ${(e as Error).message}`,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t401,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlog.info(\n\t\t\t\t\"[LIOP-StreamBridge] ALERT: Access denied - Invalid Zero-Trust token.\",\n\t\t\t);\n\t\t\treturn c.json(\n\t\t\t\t{ error: \"Unauthorized: LIOP Zero-Trust Policy Enforced\" },\n\t\t\t\t401,\n\t\t\t);\n\t\t});\n\n\t\t// MCP Streamable HTTP & Stateless Handler\n\t\tthis.app.all(\"/mcp\", async (c) => {\n\t\t\tconst sessionId = c.req.header(\"mcp-session-id\");\n\n\t\t\t// Route to existing session if legacy session ID is present\n\t\t\tif (sessionId) {\n\t\t\t\t/** @mcp-legacy Route to session if legacy session ID present. Remove when v1 EOL. */\n\t\t\t\tif (!MCP_LEGACY_SUPPORT_ENABLED) {\n\t\t\t\t\treturn c.json(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\terror:\n\t\t\t\t\t\t\t\t\"Session-based routing is retired. Use stateless MCP 2026-07-28 requests.\",\n\t\t\t\t\t\t},\n\t\t\t\t\t\t404,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tconst existing = this.activeSessions.get(sessionId);\n\t\t\t\tif (!existing) {\n\t\t\t\t\treturn c.json({ error: \"Session not found\" }, 404);\n\t\t\t\t}\n\t\t\t\t// Touch activity on every routed request\n\t\t\t\texisting.lastActivity = Date.now();\n\n\t\t\t\tconst response = await existing.transport.handleRequest(c.req.raw);\n\n\t\t\t\t// If DELETE, the transport closes internally but onclose may not fire.\n\t\t\t\t// Explicitly clean up the session from the Map.\n\t\t\t\tif (c.req.method === \"DELETE\") {\n\t\t\t\t\tthis.activeSessions.delete(sessionId);\n\t\t\t\t\tlog.info(`[LIOP-StreamBridge] Session closed (DELETE): ${sessionId}`);\n\t\t\t\t}\n\n\t\t\t\treturn response;\n\t\t\t}\n\n\t\t\t// Stateless direct JSON-RPC POST (MCP v2 modern era)\n\t\t\tconst contentType = c.req.header(\"content-type\") || \"\";\n\t\t\tif (c.req.method === \"POST\" && contentType.includes(\"application/json\")) {\n\t\t\t\ttry {\n\t\t\t\t\tconst body = (await c.req.json()) as Record<string, unknown>;\n\t\t\t\t\t// If this is a modern request or non-session JSON-RPC\n\t\t\t\t\tif (\n\t\t\t\t\t\tbody.method === \"server/discover\" ||\n\t\t\t\t\t\t(body.params as Record<string, unknown>)?._meta ||\n\t\t\t\t\t\t!MCP_LEGACY_SUPPORT_ENABLED\n\t\t\t\t\t) {\n\t\t\t\t\t\tconst result = await this.bridgeLogic.handleJsonRpcRequest(body);\n\t\t\t\t\t\tif (result !== undefined) {\n\t\t\t\t\t\t\treturn c.json(result);\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn c.body(null, 204);\n\t\t\t\t\t}\n\t\t\t\t} catch {\n\t\t\t\t\t// Fall through to legacy transport if JSON parsing fails or payload is streaming handshake\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// No session ID → Legacy Client initializing via WebStandardStreamableHTTPServerTransport\n\t\t\t/** @mcp-legacy Create legacy session transport. Remove when v1 EOL. */\n\t\t\tif (!MCP_LEGACY_SUPPORT_ENABLED) {\n\t\t\t\treturn c.json(\n\t\t\t\t\t{\n\t\t\t\t\t\terror:\n\t\t\t\t\t\t\t\"Stateless MCP 2026-07-28 is active. Direct JSON-RPC POST required.\",\n\t\t\t\t\t},\n\t\t\t\t\t400,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst clientIp = this.getClientIp(c);\n\t\t\tconst currentSessions = this.countSessionsByIp(clientIp);\n\t\t\tif (currentSessions >= this.maxSessionsPerIp) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-StreamBridge] Rate limit hit for IP: ${clientIp} (${currentSessions} sessions)`,\n\t\t\t\t);\n\t\t\t\treturn c.json({ error: \"Too Many Sessions: Rate limit exceeded\" }, 429);\n\t\t\t}\n\n\t\t\tconst transport = await this.createSessionTransport(clientIp);\n\t\t\treturn await transport.handleRequest(c.req.raw);\n\t\t});\n\t}\n\n\t/**\n\t * Starts the LiopStreamBridge HTTP server and session eviction timer.\n\t */\n\tpublic async start(port?: number): Promise<void> {\n\t\tconst listenPort = port ?? this.options.port ?? 3000;\n\n\t\t// Start the idle session eviction timer\n\t\tthis.evictionTimer = setInterval(\n\t\t\t() => this.evictIdleSessions(),\n\t\t\tEVICTION_INTERVAL_MS,\n\t\t);\n\n\t\treturn new Promise((resolve) => {\n\t\t\tthis.httpServer = serve(\n\t\t\t\t{\n\t\t\t\t\tfetch: this.app.fetch,\n\t\t\t\t\tport: listenPort,\n\t\t\t\t},\n\t\t\t\t(info) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-StreamBridge] Streamable HTTP Gateway on http://localhost:${info.port}/mcp`,\n\t\t\t\t\t);\n\t\t\t\t\tresolve();\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\t}\n\n\t/**\n\t * Graceful shutdown — closes all active sessions, stops timers, and releases port.\n\t */\n\tpublic async stop(): Promise<void> {\n\t\tif (this.evictionTimer) {\n\t\t\tclearInterval(this.evictionTimer);\n\t\t\tthis.evictionTimer = null;\n\t\t}\n\n\t\tfor (const [id, entry] of this.activeSessions) {\n\t\t\tawait entry.transport.close();\n\t\t\tthis.activeSessions.delete(id);\n\t\t}\n\n\t\tif (this.httpServer) {\n\t\t\tthis.httpServer.close();\n\t\t\tlog.info(\"[LIOP-StreamBridge] HTTP ports released.\");\n\t\t}\n\t}\n}\n","import type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport {\n\tisLegacyRequest,\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"../gateway/mcp-compat.js\";\nimport type { LiopServer, LiopServerOptions } from \"../server/index.js\";\nimport {\n\ttype CallToolRequest,\n\ttype CallToolResult,\n\tMCP_PROTOCOL_VERSION,\n} from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface LiopBridgeOptions {\n\tpublishToMesh?: boolean;\n\tmeshIdentity?: string;\n\tserverInfo?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\tsecurity?: LiopServerOptions[\"security\"];\n}\n\n/**\n * LIOP MCP Bridge\n * A bi-directional bridge that allows legacy MCP servers to join the LIOP mesh,\n * or exposes a LIOP server as an MCP-compatible stdio process for tools like Claude Desktop.\n */\nexport class LiopMcpBridge {\n\tprivate liopServer: LiopServer | null = null;\n\tprivate legacyMcpServer: McpServer | null = null;\n\tconstructor(\n\t\t// biome-ignore lint/suspicious/noExplicitAny: polymorphic source detection\n\t\tsource: LiopServer | McpServer | any,\n\t\tprivate options: LiopBridgeOptions = {},\n\t) {\n\t\t// Determine mode: Exposing LIOP to MCP (Claude) or Wrapping MCP to LIOP (Mesh)\n\t\t// We use constructor name check to avoid hard dependency on optional SDK at runtime start\n\t\tif (source?.constructor?.name === \"LiopServer\") {\n\t\t\tthis.liopServer = source as LiopServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: EXPOSE (LIOP -> MCP Stdio)\");\n\t\t} else if (source?.constructor?.name === \"McpServer\") {\n\t\t\tthis.legacyMcpServer = source as McpServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: WRAP (Legacy MCP -> LIOP Mesh)\");\n\t\t} else {\n\t\t\t// Fallback for inferred legacy MCP servers\n\t\t\tthis.legacyMcpServer = source as McpServer;\n\t\t\tlog.info(\"[LIOP-Bridge] Mode: WRAP (Inferred Legacy MCP -> LIOP Mesh)\");\n\t\t}\n\t}\n\n\t/**\n\t * Handles an incoming standard MCP JSON-RPC 2.0 payload.\n\t * Pipes it to the underlying server (LIOP or Legacy MCP).\n\t */\n\tpublic async handleJsonRpcRequest(\n\t\tpayload: Record<string, unknown>,\n\t): Promise<unknown> {\n\t\tconst id = payload.id as string | number;\n\t\tconst method = payload.method as string;\n\t\tconst params = payload.params as Record<string, unknown> | undefined;\n\n\t\tif (payload.jsonrpc !== \"2.0\") {\n\t\t\treturn this.errorResponse(id, -32600, \"Invalid Request\");\n\t\t}\n\n\t\t// Mode: EXPOSE (Standard behavior used by Claude Desktop)\n\t\tif (this.liopServer) {\n\t\t\treturn this.handleLiopToMcp(id, method, params);\n\t\t}\n\n\t\t// Mode: WRAP (Redirecting via internal LiopServer after connect())\n\t\tif (this.legacyMcpServer && this.liopServer) {\n\t\t\treturn this.handleLiopToMcp(id, method, params);\n\t\t}\n\n\t\treturn this.errorResponse(id, -32601, \"Bridge source not configured\");\n\t}\n\n\tprivate async handleLiopToMcp(\n\t\tid: string | number,\n\t\tmethod: string,\n\t\tparams: Record<string, unknown> | undefined,\n\t): Promise<unknown> {\n\t\tif (!this.liopServer) return null;\n\n\t\tconst isLegacy =\n\t\t\tMCP_LEGACY_SUPPORT_ENABLED && isLegacyRequest({ method, params, id });\n\n\t\tif (method === \"initialize\") {\n\t\t\t/** @mcp-legacy Initialize for stdio bridge. Remove when v1 EOL. */\n\t\t\tif (!MCP_LEGACY_SUPPORT_ENABLED) {\n\t\t\t\treturn this.errorResponse(id, -32601, \"Method retired: initialize\");\n\t\t\t}\n\t\t\treturn this.successResponse(id, {\n\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\t\tcapabilities: {\n\t\t\t\t\tprompts: { listChanged: true },\n\t\t\t\t\tresources: { listChanged: true },\n\t\t\t\t\ttools: { listChanged: true },\n\t\t\t\t},\n\t\t\t\tserverInfo: this.liopServer.getServerInfo(),\n\t\t\t});\n\t\t}\n\n\t\tif (method === \"server/discover\") {\n\t\t\treturn this.successResponse(id, {\n\t\t\t\tresultType: \"complete\",\n\t\t\t\tsupportedVersions: MCP_LEGACY_SUPPORT_ENABLED\n\t\t\t\t\t? [MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION_LEGACY]\n\t\t\t\t\t: [MCP_PROTOCOL_VERSION],\n\t\t\t\tcapabilities: {\n\t\t\t\t\tprompts: { listChanged: true },\n\t\t\t\t\tresources: { listChanged: true },\n\t\t\t\t\ttools: { listChanged: true },\n\t\t\t\t},\n\t\t\t\tserverInfo: this.liopServer.getServerInfo(),\n\t\t\t});\n\t\t}\n\n\t\tif (method === \"notifications/initialized\") return undefined;\n\t\tif (method === \"ping\") return this.successResponse(id, {});\n\n\t\tif (method === \"tools/list\") {\n\t\t\tconst tools = this.liopServer\n\t\t\t\t.listTools()\n\t\t\t\t.sort((a, b) => a.name.localeCompare(b.name));\n\t\t\treturn this.successResponse(\n\t\t\t\tid,\n\t\t\t\tisLegacy\n\t\t\t\t\t? { tools }\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tresultType: \"complete\",\n\t\t\t\t\t\t\tttlMs: 300_000,\n\t\t\t\t\t\t\tcacheScope: \"public\",\n\t\t\t\t\t\t\ttools,\n\t\t\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tif (method === \"resources/list\") {\n\t\t\tconst resources = this.liopServer\n\t\t\t\t.listResources()\n\t\t\t\t.sort((a, b) => a.uri.localeCompare(b.uri));\n\t\t\treturn this.successResponse(\n\t\t\t\tid,\n\t\t\t\tisLegacy\n\t\t\t\t\t? { resources }\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tresultType: \"complete\",\n\t\t\t\t\t\t\tttlMs: 300_000,\n\t\t\t\t\t\t\tcacheScope: \"public\",\n\t\t\t\t\t\t\tresources,\n\t\t\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tif (method === \"prompts/list\") {\n\t\t\tconst prompts = this.liopServer\n\t\t\t\t.listPrompts()\n\t\t\t\t.sort((a, b) => a.name.localeCompare(b.name));\n\t\t\treturn this.successResponse(\n\t\t\t\tid,\n\t\t\t\tisLegacy\n\t\t\t\t\t? { prompts }\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tresultType: \"complete\",\n\t\t\t\t\t\t\tttlMs: 300_000,\n\t\t\t\t\t\t\tcacheScope: \"public\",\n\t\t\t\t\t\t\tprompts,\n\t\t\t\t\t\t},\n\t\t\t);\n\t\t}\n\n\t\tif (method === \"prompts/get\") {\n\t\t\tif (!params?.name) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing prompt name\");\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await this.liopServer.getPrompt({\n\t\t\t\t\tname: params.name as string,\n\t\t\t\t\targuments: params.arguments as Record<string, string> | undefined,\n\t\t\t\t});\n\t\t\t\treturn this.successResponse(\n\t\t\t\t\tid,\n\t\t\t\t\tisLegacy || typeof result !== \"object\" || result === null\n\t\t\t\t\t\t? result\n\t\t\t\t\t\t: { resultType: \"complete\", ...result },\n\t\t\t\t);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\tif (method === \"resources/read\") {\n\t\t\tif (!params?.uri) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing resource URI\");\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst result = await this.liopServer.readResource(params.uri as string);\n\t\t\t\treturn this.successResponse(\n\t\t\t\t\tid,\n\t\t\t\t\tisLegacy\n\t\t\t\t\t\t? result\n\t\t\t\t\t\t: typeof result === \"object\" && result !== null\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tresultType: \"complete\",\n\t\t\t\t\t\t\t\t\tttlMs: 60_000,\n\t\t\t\t\t\t\t\t\tcacheScope: \"private\",\n\t\t\t\t\t\t\t\t\t...result,\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: {\n\t\t\t\t\t\t\t\t\tresultType: \"complete\",\n\t\t\t\t\t\t\t\t\tttlMs: 60_000,\n\t\t\t\t\t\t\t\t\tcacheScope: \"private\",\n\t\t\t\t\t\t\t\t\tcontents: result,\n\t\t\t\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\tif (method === \"tools/call\") {\n\t\t\tif (!params?.name) {\n\t\t\t\treturn this.errorResponse(id, -32602, \"Missing tool name\");\n\t\t\t}\n\t\t\tconst request: CallToolRequest = {\n\t\t\t\tname: params.name as string,\n\t\t\t\targuments: (params.arguments as Record<string, unknown>) || {},\n\t\t\t};\n\n\t\t\ttry {\n\t\t\t\tconst result: CallToolResult = await this.liopServer.callTool(request);\n\t\t\t\t// If the tool execution returned an error (e.g. policy violation), we bypass\n\t\t\t\t// ZK-Receipt verification because no cryptographic proof is generated for errors.\n\t\t\t\tconst isVerified = result.isError\n\t\t\t\t\t? true\n\t\t\t\t\t: await this.verifyZkReceipt(request, result);\n\n\t\t\t\tif (!isVerified) {\n\t\t\t\t\treturn this.successResponse(id, {\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: \"ALERT [LIOP ZERO-TRUST SHIELD] ZK Verification Failed. The mathematical ImageID does not match the original payload.\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tisError: true,\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\treturn this.successResponse(\n\t\t\t\t\tid,\n\t\t\t\t\tisLegacy\n\t\t\t\t\t\t? result\n\t\t\t\t\t\t: {\n\t\t\t\t\t\t\t\tresultType: \"complete\",\n\t\t\t\t\t\t\t\t...result,\n\t\t\t\t\t\t\t},\n\t\t\t\t);\n\t\t\t} catch (err: unknown) {\n\t\t\t\treturn this.errorResponse(id, -32000, (err as Error).message);\n\t\t\t}\n\t\t}\n\n\t\treturn this.errorResponse(id, -32601, \"Method not found\");\n\t}\n\n\tprivate successResponse(\n\t\tid: string | number | null | undefined,\n\t\tresult: unknown,\n\t) {\n\t\treturn { jsonrpc: \"2.0\", id, result };\n\t}\n\n\tprivate errorResponse(id: string | number, code: number, message: string) {\n\t\treturn { jsonrpc: \"2.0\", id, error: { code, message } };\n\t}\n\n\tprivate async verifyZkReceipt(\n\t\trequest: CallToolRequest,\n\t\tresult: CallToolResult,\n\t): Promise<boolean> {\n\t\tif (\n\t\t\t!request.arguments?.payload ||\n\t\t\ttypeof request.arguments.payload !== \"string\"\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\n\t\ttry {\n\t\t\tconst payload = request.arguments.payload as string;\n\t\t\tconst contentText = result.content[0]?.text;\n\n\t\t\tif (contentText && typeof contentText === \"string\") {\n\t\t\t\ttry {\n\t\t\t\t\tconst data = JSON.parse(contentText);\n\n\t\t\t\t\tif (data.image_id || data.zk_receipt) {\n\t\t\t\t\t\t// 1. Instantiate the Industrial Verifier ( backed by Piscina Worker Pool )\n\t\t\t\t\t\tconst { LiopVerifier } = await import(\"../crypto/verifier.js\");\n\t\t\t\t\t\tconst verifier = new LiopVerifier();\n\n\t\t\t\t\t\t// 2. Delegate the heavy mathematical check (ZK Journal + Seal)\n\t\t\t\t\t\tconst isAuthentic = await verifier.verifyZkReceipt(\n\t\t\t\t\t\t\tBuffer.from(payload, \"utf-8\"),\n\t\t\t\t\t\t\tdata.image_id,\n\t\t\t\t\t\t\tBuffer.from(data.zk_receipt || \"\", \"base64\"),\n\t\t\t\t\t\t\tundefined,\n\t\t\t\t\t\t\tdata.computation_result,\n\t\t\t\t\t\t);\n\n\t\t\t\t\t\tif (!isAuthentic) {\n\t\t\t\t\t\t\treturn false;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tdata.audit_status =\n\t\t\t\t\t\t\t\"VERIFIED: ZK-Receipt & ImageID Mathematically Verified by LiopMcpBridge\";\n\t\t\t\t\t\tresult.content[0].text = JSON.stringify(data);\n\t\t\t\t\t}\n\t\t\t\t} catch {\n\t\t\t\t\t// Output not JSON\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn true;\n\t\t} catch (e) {\n\t\t\tlog.info(\"[LIOP-Bridge] ZK-Verifier Failure:\", e);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Connects the bridge via stdio or Mesh depending on mode.\n\t */\n\tpublic async connect(): Promise<void> {\n\t\t// In WRAP mode, we actually need to create a LiopServer and join the mesh\n\t\tif (this.legacyMcpServer) {\n\t\t\tconst { LiopServer } = await import(\"../server/index.js\");\n\t\t\tthis.liopServer = new LiopServer(\n\t\t\t\tthis.options.serverInfo || {\n\t\t\t\t\tname: \"liop-bridge\",\n\t\t\t\t\tversion: \"1.0.0\",\n\t\t\t\t},\n\t\t\t\t{ security: this.options.security },\n\t\t\t);\n\n\t\t\tif (this.options.publishToMesh) {\n\t\t\t\tawait this.liopServer.connect();\n\n\t\t\t\t// Automatically Bridge Legacy Capabilities to LIOP Mesh\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Internal legacy MCP properties are completely opaque and unexported\n\t\t\t\tconst legacy = this.legacyMcpServer as any;\n\n\t\t\t\t// 1. Sync Tools\n\t\t\t\tif (legacy._registeredTools) {\n\t\t\t\t\tfor (const [name, tool] of Object.entries(legacy._registeredTools)) {\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy structure\n\t\t\t\t\t\tconst t = tool as any;\n\t\t\t\t\t\tthis.liopServer.tool(\n\t\t\t\t\t\t\tname,\n\t\t\t\t\t\t\tt.description || \"\",\n\t\t\t\t\t\t\tt.inputSchema || {},\n\t\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy callback args\n\t\t\t\t\t\t\tasync (args: any) => {\n\t\t\t\t\t\t\t\treturn await t.handler(args);\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// 2. Sync Resources\n\t\t\t\tif (legacy._registeredResources) {\n\t\t\t\t\tfor (const [uri, resource] of Object.entries(\n\t\t\t\t\t\tlegacy._registeredResources,\n\t\t\t\t\t)) {\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Opaque legacy structure\n\t\t\t\t\t\tconst r = resource as any;\n\t\t\t\t\t\tthis.liopServer.resource(\n\t\t\t\t\t\t\tr.name,\n\t\t\t\t\t\t\turi,\n\t\t\t\t\t\t\tr.metadata?.description || \"\",\n\t\t\t\t\t\t\tr.metadata?.mimeType || \"application/octet-stream\",\n\t\t\t\t\t\t\tasync () => {\n\t\t\t\t\t\t\t\tconst res = await r.readCallback(new URL(uri));\n\t\t\t\t\t\t\t\treturn res.contents[0].text;\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\n\t\t// In EXPOSE mode, listen to stdio (Claude Desktop)\n\t\tconst readline = await import(\"node:readline\");\n\t\tconst rl = readline.createInterface({\n\t\t\tinput: process.stdin,\n\t\t\toutput: process.stdout,\n\t\t\tterminal: false,\n\t\t});\n\n\t\tconst shutdown = async () => {\n\t\t\tlog.info(\"[LIOP-Bridge] Disconnecting session...\");\n\t\t\tif (this.liopServer) await this.liopServer.close();\n\t\t\tprocess.exit(0);\n\t\t};\n\n\t\trl.on(\"close\", shutdown);\n\t\tprocess.on(\"SIGINT\", shutdown);\n\t\tprocess.on(\"SIGTERM\", shutdown);\n\n\t\trl.on(\"line\", async (line) => {\n\t\t\tif (!line.trim()) return;\n\t\t\ttry {\n\t\t\t\tconst payload = JSON.parse(line);\n\t\t\t\tconst response = await this.handleJsonRpcRequest(payload);\n\t\t\t\tif (response) {\n\t\t\t\t\tprocess.stdout.write(`${JSON.stringify(response)}\\n`);\n\t\t\t\t}\n\t\t\t} catch (e: unknown) {\n\t\t\t\tlog.error(`[LIOP-Bridge] Error: ${(e as Error).message}`);\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic getServer(): LiopServer | null {\n\t\treturn this.liopServer;\n\t}\n}\n\nexport * from \"./stream.js\";\n"]}

package/dist/chunk-OUUTDSOW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/crypto/logic-image-id.ts"],"names":[],"mappings":";;;AAOA,IAAM,kBAAA,GAAqB,4CAAA;AAEpB,SAAS,qBAAqB,SAAA,EAA2B;AAC/D,EAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,kBAAkB,CAAA;AAChD,EAAA,IAAI,KAAA,GAAQ,CAAC,CAAA,KAAM,MAAA,EAAW;AAC7B,IAAA,OAAO,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,EACtB;AACA,EAAA,OAAO,UAAU,IAAA,EAAK;AACvB;AAGO,SAAS,uBAAuB,YAAA,EAAkC;AACxE,EAAA,MAAM,SAAS,YAAA,CAAa,CAAC,MAAM,CAAA,IAAQ,YAAA,CAAa,CAAC,CAAA,KAAM,EAAA;AAC/D,EAAA,IAAI,MAAA,EAAQ;AACX,IAAA,OAAO,OAAO,UAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,YAAY,EAAE,MAAA,EAAO;AAAA,EAChE;AACA,EAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA,CAAE,SAAS,OAAO,CAAA;AACvD,EAAA,MAAM,UAAA,GAAa,qBAAqB,IAAI,CAAA;AAC5C,EAAA,OAAO,MAAA,CACL,UAAA,CAAW,QAAQ,CAAA,CACnB,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,UAAA,EAAY,OAAO,CAAC,CAAA,CACvC,MAAA,EAAO;AACV","file":"chunk-OUUTDSOW.js","sourcesContent":["import crypto from \"node:crypto\";\n\n/**\n * Top-level LIOP v1 envelope only. Must NOT use multiline (^/$) mode:\n * proxy logic embeds a full envelope inside JSON strings; `^` per line would\n * incorrectly treat that as the document root and desync ImageID vs the worker.\n */\nconst TOP_LEVEL_ENVELOPE = /^\\s*@LIOP\\{[^}]+\\}\\n?([\\s\\S]*?)\\n?@END\\s*$/;\n\nexport function normalizeLogicSource(logicUtf8: string): string {\n\tconst match = logicUtf8.match(TOP_LEVEL_ENVELOPE);\n\tif (match?.[1] !== undefined) {\n\t\treturn match[1].trim();\n\t}\n\treturn logicUtf8.trim();\n}\n\n/** SHA-256 digest of logic bytes (WASM raw; JS UTF-8 after top-level envelope strip). */\nexport function deriveLogicImageDigest(logicPayload: Uint8Array): Buffer {\n\tconst isWasm = logicPayload[0] === 0x00 && logicPayload[1] === 0x61;\n\tif (isWasm) {\n\t\treturn crypto.createHash(\"sha256\").update(logicPayload).digest();\n\t}\n\tconst text = Buffer.from(logicPayload).toString(\"utf-8\");\n\tconst normalized = normalizeLogicSource(text);\n\treturn crypto\n\t\t.createHash(\"sha256\")\n\t\t.update(Buffer.from(normalized, \"utf-8\"))\n\t\t.digest();\n}\n"]}

package/dist/chunk-PYKRQAER.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/gateway/mcp-compat.ts","../src/types.ts"],"names":[],"mappings":";;;;;AAcO,IAAM,0BAAA,GAA6B;AAKnC,IAAM,2BAAA,GAA8B;AAKpC,SAAS,6BAAA,CACf,YACA,EAAA,EACc;AACd,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,IAAI,EAAA,IAAM,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,MACP,eAAA,EAAiB,2BAAA;AAAA,MACjB,YAAA,EAAc;AAAA,QACb,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC3B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC/B,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA;AAAK,OAC9B;AAAA,MACA;AAAA;AACD,GACD;AACD;AAOO,SAAS,gBAAgB,OAAA,EAA8B;AAC7D,EAAA,IACC,OAAA,CAAQ,MAAA,KAAW,YAAA,IACnB,OAAA,CAAQ,WAAW,2BAAA,EAClB;AACD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,EAAA,MAAM,OAAO,MAAA,EAAQ,KAAA;AACrB,EAAA,MAAM,OAAA,GAAU,OAAO,yCAAyC,CAAA;AAEhE,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,2BAAA,EAA6B;AACxD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAA;AACR;AAMO,SAAS,6BACf,QAAA,EACc;AACd,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,IAAU,OAAO,QAAA,CAAS,WAAW,QAAA,EAAU;AAC5D,IAAA,OAAO,QAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAA,GAAY,EAAE,GAAI,QAAA,CAAS,MAAA,EAAmC;AAGpE,EAAA,OAAO,SAAA,CAAU,UAAA;AACjB,EAAA,OAAO,SAAA,CAAU,KAAA;AACjB,EAAA,OAAO,SAAA,CAAU,UAAA;AAEjB,EAAA,OAAO;AAAA,IACN,GAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT;AACD;;;ACpFO,IAAM,oBAAA,GAAuB;AAyD7B,IAAM,UAAA,GAAa,EAAE,MAAA,CAAO;AAAA,EAClC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,CAAA,CAAE,SAAS;AAAA;AAC9C,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,EAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EACpC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAW,CAAA,CACT,KAAA;AAAA,IACA,EAAE,MAAA,CAAO;AAAA,MACR,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,MACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAC/B;AAAA,IAED,QAAA;AACH,CAAC","file":"chunk-PYKRQAER.js","sourcesContent":["import type { McpRequest, McpResponse, ServerInfo } from \"../types.js\";\n\n/**\n * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.\n * Remove this file when MCP v1 (2025-11-25) reaches EOL.\n *\n * SUNSET INSTRUCTION: Delete this file, then grep for \"@mcp-legacy\" in the\n * codebase to find and remove all remaining legacy seams.\n */\n\n/**\n * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.\n * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.\n */\nexport const MCP_LEGACY_SUPPORT_ENABLED = true;\n\n/**\n * @mcp-legacy Legacy protocol version constant.\n */\nexport const MCP_PROTOCOL_VERSION_LEGACY = \"2025-11-25\" as const;\n\n/**\n * @mcp-legacy Build the legacy initialize handshake response.\n */\nexport function buildLegacyInitializeResponse(\n\tserverInfo: ServerInfo,\n\tid?: string | number | null,\n): McpResponse {\n\treturn {\n\t\tjsonrpc: \"2.0\",\n\t\tid: id ?? null,\n\t\tresult: {\n\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\tcapabilities: {\n\t\t\t\ttools: { listChanged: true },\n\t\t\t\tresources: { listChanged: true },\n\t\t\t\tprompts: { listChanged: true },\n\t\t\t},\n\t\t\tserverInfo,\n\t\t},\n\t};\n}\n\n/**\n * @mcp-legacy Detect if a request is strictly from a 2025-era legacy client.\n * Legacy requests either invoke 'initialize', 'notifications/initialized',\n * or lack modern '_meta' protocol envelopes.\n */\nexport function isLegacyRequest(request: McpRequest): boolean {\n\tif (\n\t\trequest.method === \"initialize\" ||\n\t\trequest.method === \"notifications/initialized\"\n\t) {\n\t\treturn true;\n\t}\n\n\tconst params = request.params as Record<string, unknown> | undefined;\n\tconst meta = params?._meta as Record<string, unknown> | undefined;\n\tconst version = meta?.[\"io.modelcontextprotocol/protocolVersion\"];\n\n\tif (!version || version === MCP_PROTOCOL_VERSION_LEGACY) {\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * @mcp-legacy Wrap and strip modern-era fields (resultType, ttlMs, cacheScope, etc.)\n * from a response to ensure 100% wire-compatibility with strict 2025 MCP clients.\n */\nexport function adaptResponseForLegacyClient(\n\tresponse: McpResponse,\n): McpResponse {\n\tif (!response.result || typeof response.result !== \"object\") {\n\t\treturn response;\n\t}\n\n\tconst rawResult = { ...(response.result as Record<string, unknown>) };\n\n\t// Strip modern-only envelope tags\n\tdelete rawResult.resultType;\n\tdelete rawResult.ttlMs;\n\tdelete rawResult.cacheScope;\n\n\treturn {\n\t\t...response,\n\t\tresult: rawResult,\n\t};\n}\n","import { z } from \"zod\";\n\n/**\n * Protocol Version Identifiers\n */\nexport const MCP_PROTOCOL_VERSION = \"2026-07-28\" as const;\n\nexport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"./gateway/mcp-compat.js\";\n\n/**\n * Protocol Era Classification\n */\nexport type McpEra = \"legacy\" | \"modern\";\n\n/**\n * Caching Hints for MCP 2026-07-28 Spec\n */\nexport interface CacheableResult {\n\tttlMs?: number;\n\tcacheScope?: \"public\" | \"private\";\n}\n\n/**\n * Multi-Round-Trip Requests (MRTR) Specification Types\n */\nexport interface InputRequest {\n\tid: string;\n\tmessage: string;\n\tschema?: Record<string, unknown>;\n}\n\nexport interface InputResponse {\n\tid: string;\n\tvalue: unknown;\n}\n\nexport interface InputRequiredResult {\n\tresultType: \"input_required\";\n\tinputRequests: InputRequest[];\n\trequestState?: string;\n}\n\n/**\n * Modern Envelope Metadata (_meta)\n */\nexport interface McpRequestMeta {\n\t\"io.modelcontextprotocol/protocolVersion\"?: string;\n\t\"io.modelcontextprotocol/clientInfo\"?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\t\"io.modelcontextprotocol/clientCapabilities\"?: Record<string, unknown>;\n\t[key: string]: unknown;\n}\n\n/**\n * Base Protocol Types representing parity with Model Context Protocol\n */\n\nexport const ToolSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tinputSchema: z.record(z.string(), z.unknown()), // Represents a JSON Schema\n});\n\nexport type Tool = z.infer<typeof ToolSchema>;\n\nexport const ResourceSchema = z.object({\n\turi: z.string(),\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tmimeType: z.string().optional(),\n});\n\nexport type Resource = z.infer<typeof ResourceSchema>;\n\nexport const PromptSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\targuments: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tdescription: z.string().optional(),\n\t\t\t\trequired: z.boolean().optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\nexport type Prompt = z.infer<typeof PromptSchema>;\n\nexport interface CallToolRequest {\n\tname: string;\n\targuments?: Record<string, unknown>;\n}\n\nexport interface CallToolResult {\n\tcontent: Array<{\n\t\ttype: \"text\" | \"image\" | \"resource\";\n\t\ttext?: string;\n\t\tdata?: string;\n\t\tmimeType?: string;\n\t\tresource?: {\n\t\t\turi: string;\n\t\t\ttext?: string;\n\t\t\tblob?: string;\n\t\t};\n\t}>;\n\tisError?: boolean;\n}\n\nexport interface GetPromptRequest {\n\tname: string;\n\targuments?: Record<string, string>;\n}\n\nexport interface GetPromptResult {\n\tdescription?: string;\n\tmessages: Array<{\n\t\trole: \"user\" | \"assistant\";\n\t\tcontent:\n\t\t\t| { type: \"text\"; text: string }\n\t\t\t| { type: \"image\"; data: string; mimeType: string }\n\t\t\t| {\n\t\t\t\t\ttype: \"resource\";\n\t\t\t\t\tresource: { uri: string; text?: string; blob?: string };\n\t\t\t  };\n\t}>;\n}\n\nexport interface ServerInfo {\n\tname: string;\n\tversion: string;\n\tcapabilities?: {\n\t\tprompts?: { listChanged?: boolean };\n\t\tresources?: { subscribe?: boolean; listChanged?: boolean };\n\t\ttools?: { listChanged?: boolean };\n\t\t/** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */\n\t\tlogging?: Record<string, unknown>;\n\t};\n}\n\nexport interface DiscoverResult {\n\tresultType: \"complete\";\n\tsupportedVersions: string[];\n\tcapabilities: ServerInfo[\"capabilities\"];\n\tserverInfo: ServerInfo;\n\tinstructions?: string;\n}\n\nexport interface McpRequest {\n\tmethod: string;\n\tparams?: unknown;\n\tid?: string | number | null;\n\tjsonrpc?: \"2.0\";\n}\n\nexport interface McpResponse {\n\tjsonrpc: \"2.0\";\n\tid?: string | number | null;\n\tresult?: unknown;\n\terror?: {\n\t\tcode: number;\n\t\tmessage: string;\n\t\tdata?: unknown;\n\t};\n}\n\n/**\n * Re-export AuthInfo from the security module for convenience.\n * Compatible with MCP TypeScript SDK AuthInfo interface shape.\n */\nexport type { AuthInfo } from \"./security/jwt-validator.js\";\n"]}

package/dist/chunk-QLCOEP5J.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rpc/crypto/kyber.ts"],"names":[],"mappings":";;;AAcA,IAAI,WAAA,GAAiE,IAAA;AAErE,eAAe,cAAA,GAAiB;AAC/B,EAAA,IAAI,CAAC,WAAA,EAAa;AACjB,IAAA,WAAA,GAAc,MAAM,cAAA,EAAe;AAAA,EACpC;AACA,EAAA,OAAO,WAAA;AACR;AAEO,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,WAAW,IAAA,EAAM;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,0DAAA,EAA6D,OAAO,MAAM,CAAA,CAAA;AAAA,OAC3E;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,sBAAsB,SAAA,EAGzB;AACF,IAAA,IAAI;AACH,MAAA,IAAI,SAAA,CAAU,WAAW,IAAA,EAAM;AAC9B,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MAClE;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,MAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,GAAA,CAAI,MAAM,SAAS,CAAA;AAEpC,MAAA,OAAO;AAAA,QACN,UAAA,EAAY,EAAA;AAAA,QACZ,YAAA,EAAc;AAAA,OACf;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAyC,MAAgB,OAAO,CAAA;AAAA,OACjE;AAAA,IACD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAA,GAGH;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,IAAI,eAAA,EAAgB;AACrC,IAAA,OAAO;AAAA,MACN,SAAA,EAAW,EAAA;AAAA,MACX,SAAA,EAAW;AAAA,KACZ;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CACL,UAAA,EACA,SAAA,EACsB;AACtB,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,EAAY,SAAS,CAAA;AAAA,EACvC;AACD","file":"chunk-QLCOEP5J.js","sourcesContent":["import { createMlKem768 } from \"mlkem\";\n\n/**\n * LIOP Post-Quantum Cryptography Wrapper\n * Implements ML-KEM-768 (NIST FIPS 203) for Zero-Trust secure key encapsulation\n * directly compatible with `pqcrypto-kyber` on the Mesh-Node Backend.\n *\n * Uses the `mlkem` package which provides:\n * - FIPS 203 compliance (ML-KEM standard)\n * - Constant-time validation (KyberSlash patched)\n * - ~3.5x performance improvement over legacy crystals-kyber\n */\n\n/** Lazy-initialized singleton for the ML-KEM-768 engine */\nlet kemInstance: Awaited<ReturnType<typeof createMlKem768>> | null = null;\n\nasync function getKemInstance() {\n\tif (!kemInstance) {\n\t\tkemInstance = await createMlKem768();\n\t}\n\treturn kemInstance;\n}\n\nexport const Kyber768Wrapper = {\n\t/**\n\t * Extracts and validates the 1184-byte Public Key from the Rust LIOP Data Node\n\t * @param buffer Raw buffer sent via gRPC IntentResponse\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== 1184) {\n\t\t\tthrow new Error(\n\t\t\t\t`Kyber768 Public Key must be exactly 1184 bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Encapsulates a shared secret using the server's public key.\n\t * Returns the 1088-byte ciphertext to be sent back, and the 32-byte shared AES secret.\n\t */\n\tasync encapsulateAsymmetric(publicKey: Uint8Array): Promise<{\n\t\tciphertext: Uint8Array;\n\t\tsharedSecret: Uint8Array;\n\t}> {\n\t\ttry {\n\t\t\tif (publicKey.length !== 1184) {\n\t\t\t\tthrow new Error(\"Kyber768 Public Key must be exactly 1184 bytes.\");\n\t\t\t}\n\n\t\t\tconst kem = await getKemInstance();\n\t\t\tconst [ct, ss] = kem.encap(publicKey);\n\n\t\t\treturn {\n\t\t\t\tciphertext: ct,\n\t\t\t\tsharedSecret: ss,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to perform PQC encapsulation: ${(error as Error).message}`,\n\t\t\t);\n\t\t}\n\t},\n\n\t/**\n\t * Generates a Kyber768 KeyPair for the server to accept intents.\n\t */\n\tasync generateKeyPair(): Promise<{\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t}> {\n\t\tconst kem = await getKemInstance();\n\t\tconst [pk, sk] = kem.generateKeyPair();\n\t\treturn {\n\t\t\tpublicKey: pk,\n\t\t\tsecretKey: sk,\n\t\t};\n\t},\n\n\t/**\n\t * Decapsulates the shared secret using the server's secret key.\n\t * Zero-fills the shared secret buffer after extraction for side-channel protection.\n\t */\n\tasync decapsulateSymmetric(\n\t\tciphertext: Uint8Array,\n\t\tsecretKey: Uint8Array,\n\t): Promise<Uint8Array> {\n\t\tconst kem = await getKemInstance();\n\t\treturn kem.decap(ciphertext, secretKey);\n\t},\n};\n"]}

package/dist/chunk-RWRRBYG4.js

@@ -1,3 +0,0 @@
-
-//# sourceMappingURL=chunk-RWRRBYG4.js.map
-//# sourceMappingURL=chunk-RWRRBYG4.js.map

package/dist/chunk-SONUORBT.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sandbox/guardian.ts","../src/sandbox/wasi.ts"],"names":[],"mappings":";;;;;;;;;;AAAO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACxC,YAAY,OAAA,EAAiB;AAC5B,IAAA,KAAA,CAAM,CAAA,0BAAA,EAA6B,OAAO,CAAA,CAAE,CAAA;AAC5C,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACb;AACD,CAAA;AAQO,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1B,QAAQ,MAAA,EAAkC;AACzC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACjD,IAAA,IAAI,YAAA,GAAe,CAAA;AAEnB,IAAA,MAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,MACtC,UAAA;AAAA,MACA,SAAA;AAAA,MACA,UAAA;AAAA,MACA,SAAA;AAAA,MACA,aAAA;AAAA,MACA,mBAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA;AAAA,MACA,gBAAA;AAAA,MACA,YAAA;AAAA,MACA,WAAA;AAAA,MACA,gBAAA;AAAA,MACA,qBAAA;AAAA,MACA;AAAA,KACA,CAAA;AAED,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AAE1B,MAAA,IAAI,GAAA,CAAI,WAAW,wBAAA,EAA0B;AAC5C,QAAA,IAAI,CAAC,sBAAA,CAAuB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1C,UAAA,MAAM,IAAI,aAAA;AAAA,YACT,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,IAAI,CAAA;AAAA,WACvD;AAAA,QACD;AAAA,MACD,CAAA,MAAO;AACN,QAAA,MAAM,IAAI,aAAA;AAAA,UACT,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,SAClD;AAAA,MACD;AACA,MAAA,YAAA,EAAA;AAEA,MAAA,IAAI,eAAe,GAAA,EAAK;AACvB,QAAA,MAAM,IAAI,aAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAAA,IACD;AAAA,EAKD;AACD;ACxDA,IAAM,eAAe,OAAA,CAAQ,IAAA;AAE7B,OAAA,CAAQ,IAAA,GAAO,CAAC,IAAA,EAAM,IAAA,EAAA,GAAS,IAAA,KAAS;AACvC,EAAA,IACE,IAAA,KAAS,aACT,OAAO,IAAA,KAAS,YACf,IAAA,CAAiC,IAAA,KAAS,yBAC3C,MAAA,CAAQ,IAAA,CAAiC,OAAO,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,IAClE,MAAA,CAAQ,KAAiC,OAAO,CAAA,CAAE,QAAA,CAAS,gBAAgB,CAAA,EAC1E;AACD,IAAA,OAAO,KAAA;AAAA,EACR;AACA,EAAA,OAAO,aAAa,IAAA,CAAK,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM,GAAG,IAAI,CAAA;AACtD,CAAA;AAMO,SAAS,qBAAA,GAAgD;AAC/D,EAAA,MAAM,SAAA,GAAY,QAAQ,QAAA,KAAa,OAAA;AACvC,EAAA,MAAM,WAAW,SAAA,GACd;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,cAAA;AAAA,IACA,MAAA;AAAA,IACA,wBAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,MAEA,CAAC,MAAA,EAAQ,WAAW,MAAA,EAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAEtD,EAAA,MAAM,GAAA,GAA8B;AAAA,IACnC,QAAA,EAAU,YAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACZ;AAEA,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC3B,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,IAAI,QAAQ,MAAA,IAAa,CAAC,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AAC/C,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AAAA,IACZ;AAAA,EACD;AAEA,EAAA,OAAO,GAAA;AACR;AAMO,SAAS,4BAA4B,IAAA,EAAsB;AACjE,EAAA,IAAI;AACH,IAAA,MAAM,GAAA,GAAY,YAAM,IAAA,EAAM;AAAA,MAC7B,WAAA,EAAa,IAAA;AAAA,MACb,UAAA,EAAY,QAAA;AAAA,MACZ,0BAAA,EAA4B;AAAA,KAC5B,CAAA;AAED,IAAA,IAAI,KAAA,GAAQ,GAAA;AAEZ,IAAA,MAAA,CAAO,GAAA,EAAK;AAAA,MACX,UAAA,GAAa;AACZ,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,OAAA,GAAU;AACT,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,iBAAA,GAAoB;AACnB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA;AAAA,MAEA,oBAAoB,IAAA,EAAW;AAC9B,QAAA,KAAA,IAAS,CAAA,IAAK,IAAA,CAAK,YAAA,EAAc,MAAA,IAAU,CAAA,CAAA;AAAA,MAC5C,CAAA;AAAA,MACA,oBAAA,GAAuB;AACtB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA;AAAA,MAEA,iBAAiB,IAAA,EAAW;AAC3B,QAAA,KAAA,IAAS,CAAA,GAAA,CAAK,IAAA,CAAK,UAAA,EAAY,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC/C,CAAA;AAAA;AAAA,MAEA,gBAAgB,IAAA,EAAW;AAC1B,QAAA,KAAA,IAAS,CAAA,GAAA,CAAK,IAAA,CAAK,QAAA,EAAU,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC7C,CAAA;AAAA;AAAA,MAEA,eAAe,IAAA,EAAW;AACzB,QAAA,KAAA,IAAS,EAAA,GAAA,CAAM,IAAA,CAAK,SAAA,EAAW,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC/C,CAAA;AAAA,MACA,mBAAA,GAAsB;AACrB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,kBAAA,GAAqB;AACpB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,uBAAA,GAA0B;AACzB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,WAAA,GAAc;AACb,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,YAAA,GAAe;AACd,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,YAAA,GAAe;AACd,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV;AAAA,KACA,CAAA;AAGD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,GAAG,CAAA,GAAI,GAAA;AAAA,EACjC,SAAS,EAAA,EAAI;AAEZ,IAAA,OAAO,GAAA;AAAA,EACR;AACD;AAeO,IAAM,cAAN,MAAkB;AAAA,EAChB,IAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA,GAAqC,IAAA;AAAA,EACrC,YAAA,GAAqC,IAAA;AAAA,EAE7C,WAAA,CAAY,MAAA,GAAwB,EAAC,EAAG;AACvC,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,UAAA,EAAW;AAEnC,IAAA,IAAA,CAAK,UAAA,GAAkB,IAAA,CAAA,IAAA;AAAA,MACnB,EAAA,CAAA,MAAA,EAAO;AAAA,MACV,WAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACN;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,IAAA,GAAsB;AAClC,IAAA,IAAI;AACH,MAAA,MAAS,SAAM,IAAA,CAAK,UAAA,EAAY,EAAE,SAAA,EAAW,MAAM,CAAA;AAGnD,MAAA,IAAA,CAAK,eAAe,MAAS,EAAA,CAAA,IAAA;AAAA,QACvB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAAA,QACvC;AAAA,OACD;AACA,MAAA,IAAA,CAAK,eAAe,MAAS,EAAA,CAAA,IAAA;AAAA,QACvB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAAA,QACvC;AAAA,OACD;AAEA,MAAA,IAAA,CAAK,IAAA,GAAO,IAAI,IAAA,CAAK;AAAA,QACpB,OAAA,EAAS,UAAA;AAAA,QACT,IAAA,EAAM,CAAC,cAAc,CAAA;AAAA,QACrB,GAAA,EAAK,IAAA,CAAK,MAAA,CAAO,QAAA,GACd,EAAE,GAAG,qBAAA,EAAsB,EAAG,UAAA,EAAY,IAAA,CAAK,SAAA,EAAU,GACzD;AAAA,UACA,QAAA,EAAU,YAAA;AAAA,UACV,SAAA,EAAW,MAAA;AAAA,UACX,YAAY,IAAA,CAAK;AAAA,SAClB;AAAA,QACF,QAAA,EAAU;AAAA,UACT,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,GAAG,KAAK,MAAA,CAAO;AAAA,SAChB;AAAA,QACA,MAAA,EAAQ,KAAK,YAAA,CAAa,EAAA;AAAA,QAC1B,MAAA,EAAQ,KAAK,YAAA,CAAa;AAAA,OAC1B,CAAA;AAAA,IACF,SAAS,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,+BAAA,EAAkC,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,UAAU,CAAA;AAAA,OACtF;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QACZ,aAAA,EACA,OAAA,GAAqC,EAAC,EACtC,MAAA,GAAkC,EAAC,EACkB;AACrD,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAElC,IAAA,IAAI,yBAAyB,MAAA,EAAQ;AAEpC,MAAA,IAAI;AACH,QAAA,MAAM,SAAS,MAAM,WAAA,CAAY,QAAQ,IAAI,UAAA,CAAW,aAAa,CAAC,CAAA;AAGtE,QAAA,WAAA,CAAY,QAAQ,MAAM,CAAA;AAE1B,QAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,WAAA;AAAA,UAClC,MAAA;AAAA,UACA,IAAA,CAAK,KAAK,eAAA;AAAgB,SAC3B;AAGA,QAAA,IAAA,CAAK,IAAA,CAAK,MAAM,QAAQ,CAAA;AAGxB,QAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAC1D,QAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAC1D,QAAA,MAAM,MAAA,GAAS,MAAS,EAAA,CAAA,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AACpD,QAAA,MAAM,MAAA,GAAS,MAAS,EAAA,CAAA,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AAEpD,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACrC,QAAA,OAAO;AAAA,UACN,MAAA,EACC,MAAA,KAAW,MAAA,GAAS,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,GAAK,wBAAA,CAAA;AAAA,UAC1C,YAAA,EAAc,IAAA,CAAK,KAAA,CAAM,QAAA,GAAW,GAAI;AAAA,SACzC;AAAA,MACD,SAAS,KAAA,EAAgB;AACxB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,uBAAuB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC9E;AAAA,MACD;AAAA,IACD,CAAA,MAAO;AAKN,MAAA,MAAM,UAAA,mBAAkB,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAC1C,MAAA,MAAM,GAAA,GAAM,EAAE,OAAA,EAAS,GAAG,MAAA,EAAO;AAGjC,MAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,MAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,MAAA,UAAA,CAAW,MAAA,GAAS,MAAA;AACpB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,MAAA,GAAS,MAAA;AACpB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,cAAA,GAAiB,MAAA;AAC5B,MAAA,UAAA,CAAW,IAAA,GAAO,MAAA;AAClB,MAAA,UAAA,CAAW,QAAA,GAAW,MAAA;AACtB,MAAA,UAAA,CAAW,iBAAA,GAAoB,MAAA;AAC/B,MAAA,UAAA,CAAW,IAAA,GAAO,MAAA;AAMlB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,SAAA,GAAY,MAAA;AACvB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,aAAA,GAAgB,MAAA;AAC3B,MAAA,UAAA,CAAW,cAAA,GAAiB,MAAA;AAC5B,MAAA,UAAA,CAAW,QAAA,GAAW,MAAA;AAItB,MAAA,MAAM,eAAA,GAAkB,CAAC,GAAA,KAAkB;AAC1C,QAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AACpC,UAAA,OAAO,GAAA;AAAA,QACR;AACA,QAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,UAAA,OAAO,GAAA,CAAI,IAAI,eAAe,CAAA;AAAA,QAC/B;AACA,QAAA,MAAM,KAAA,mBAAQ,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAChC,QAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC7C,UAAA,KAAA,CAAM,GAAG,CAAA,GAAI,eAAA,CAAgB,GAAG,CAAA;AAAA,QACjC;AACA,QAAA,OAAO,KAAA;AAAA,MACR,CAAA;AAGA,MAAA,UAAA,CAAW,OAAA,GAAU,gBAAgB,IAAA,CAAK,KAAA,CAAM,KAAK,SAAA,CAAU,OAAO,CAAC,CAAC,CAAA;AACxE,MAAA,UAAA,CAAW,GAAA,GAAM,gBAAgB,IAAA,CAAK,KAAA,CAAM,KAAK,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AAEhE,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClD,QAAA,UAAA,CAAW,GAAG,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AAAA,MACpE;AAIA,MAAA,MAAM,UAAA,GAAa,CAAC,GAAA,KAAa;AAChC,QAAA,IAAI,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,EAAG;AAC5D,UAAA,MAAA,CAAO,OAAO,GAAG,CAAA;AACjB,UAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AACnC,YAAA,UAAA,CAAW,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,UACpB;AAAA,QACD;AACA,QAAA,OAAO,GAAA;AAAA,MACR,CAAA;AAEA,MAAA,UAAA,CAAW,WAAW,OAAO,CAAA;AAC7B,MAAA,UAAA,CAAW,WAAW,GAAG,CAAA;AAGzB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1C,QAAA,MAAA,CAAO,cAAA,CAAe,YAAY,GAAA,EAAK;AAAA,UACtC,QAAA,EAAU,KAAA;AAAA,UACV,YAAA,EAAc;AAAA,SACd,CAAA;AAAA,MACF;AAIA,MAAA,IAAI,cAAA,GAAiB,OAAO,aAAa,CAAA;AACzC,MAAA,IACC,eAAA,CAAgB,KAAK,cAAc,CAAA,IACnC,CAAC,cAAA,CAAe,QAAA,CAAS,oBAAoB,CAAA,EAC5C;AACD,QAAA,IAAI,CAAC,cAAA,CAAe,QAAA,CAAS,oBAAoB,CAAA,EAAG;AACnD,UAAA,cAAA,GAAiB,CAAA;AAAA,EAA8B,cAAc;AAAA,CAAA,CAAA;AAAA,QAC9D;AAAA,MACD;AAEA,MAAA,MAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA,MAAA,EAiBd,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAAA,CAAA;AAWnB,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,IAAI,EAAA,CAAG,MAAA,CAAO,UAAA,EAAY;AAAA,UACxC,UAAU,CAAA,aAAA,EAAgB,IAAA,CAAK,UAAU,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA;AAAA,SACpD,CAAA;AAGD,QAAA,IACC,CAAC,OAAA,CAAQ,GAAA,CAAI,MAAA,IACb,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,IAC5B,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAChC;AACD,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAC7B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,UAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,UAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,UAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,QAC9B;AAKA,QAAA,MAAM,OAAA,GAAU,EAAA,CAAG,aAAA,CAAc,UAAA,EAAY;AAAA,UAC5C,IAAA,EAAM,cAAA;AAAA,UACN,MAAA,EAAQ,gBAAA;AAAA,UACR,aAAA,EAAe;AAAA,SACf,CAAA;AAGD,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,CAAa,OAAA,EAAS;AAAA,UAC3C,OAAA,EAAS,GAAA;AAAA,UACT,aAAA,EAAe,IAAA;AAAA,UACf,aAAA,EAAe;AAAA,SACf,CAAA;AAGD,QAAA,MAAM,WACL,OAAO,aAAA,KAAkB,WACtB,aAAA,GACA,aAAA,CAAc,SAAS,OAAO,CAAA;AAClC,QAAA,MAAM,QAAA,GAAW,4BAA4B,QAAQ,CAAA;AAErD,QAAA,IAAI,WAAW,GAAA,EAAS;AACvB,UAAA,MAAM,IAAI,KAAA;AAAA,YACT;AAAA,WACD;AAAA,QACD;AAEA,QAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,QAAA,EAAS;AAAA,MACzC,SAAS,KAAA,EAAO;AACf,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kBAAA,EAAqB,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,mBAAmB,CAAA;AAAA,SAClF;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QAAA,GAA0B;AACtC,IAAA,IAAI;AACH,MAAA,IAAI,IAAA,CAAK,YAAA,EAAc,MAAM,IAAA,CAAK,aAAa,KAAA,EAAM;AACrD,MAAA,IAAI,IAAA,CAAK,YAAA,EAAc,MAAM,IAAA,CAAK,aAAa,KAAA,EAAM;AACrD,MAAA,MAAS,EAAA,CAAA,EAAA,CAAG,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IAC9D,SAAS,EAAA,EAAI;AAAA,IAEb;AAAA,EACD;AACD","file":"chunk-SONUORBT.js","sourcesContent":["export class GuardianError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(`AST Sec-Policy Violation: ${message}`);\n\t\tthis.name = \"GuardianError\";\n\t}\n}\n\n/**\n * The Guardian-TS Module\n * Scans the Abstract Syntax Tree (AST) imports of incoming WASM\n * before it reaches the V8 Wasmtime engine to prevent sandbox-escape\n * zero-days, resource exhaustion bombs, and evasive execution.\n */\nexport const ASTGuardian = {\n\t/**\n\t * Analyzes the WebAssembly Module interface proactively.\n\t *\n\t * @param module - The compiled WebAssembly.Module to inspect\n\t * @throws {GuardianError} If illegal imports or capabilities are detected\n\t */\n\tanalyze(module: WebAssembly.Module): void {\n\t\tconst imports = WebAssembly.Module.imports(module);\n\t\tlet _importCount = 0;\n\n\t\tconst ALLOWED_WASI_FUNCTIONS = new Set([\n\t\t\t\"fd_write\",\n\t\t\t\"fd_read\",\n\t\t\t\"fd_close\",\n\t\t\t\"fd_seek\",\n\t\t\t\"environ_get\",\n\t\t\t\"environ_sizes_get\",\n\t\t\t\"args_get\",\n\t\t\t\"args_sizes_get\",\n\t\t\t\"clock_time_get\",\n\t\t\t\"random_get\",\n\t\t\t\"proc_exit\",\n\t\t\t\"fd_prestat_get\",\n\t\t\t\"fd_prestat_dir_name\",\n\t\t\t\"fd_fdstat_get\",\n\t\t]);\n\n\t\tfor (const imp of imports) {\n\t\t\t// Strict Sandbox Validation: Only allow WASI preview 1 specific whitelisted functions.\n\t\t\tif (imp.module === \"wasi_snapshot_preview1\") {\n\t\t\t\tif (!ALLOWED_WASI_FUNCTIONS.has(imp.name)) {\n\t\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t\t`Banned WASI Import Detected: ${imp.module}/${imp.name}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t`Banned Host Import Module Detected: ${imp.module}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\t_importCount++;\n\n\t\t\tif (_importCount > 128) {\n\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t\"Import limit exceeded. Possible resource exhaustion attack.\",\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// In Node.js / V8, the maximum module size and function limits\n\t\t// are natively enforced by the engine during compilation.\n\t\t// A successfully compiled WebAssembly.Module already passed structural checks.\n\t},\n};\n","import crypto from \"node:crypto\";\nimport * as fs from \"node:fs/promises\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport vm from \"node:vm\";\nimport { WASI } from \"node:wasi\";\nimport * as acorn from \"acorn\";\nimport { simple } from \"acorn-walk\";\nimport { ASTGuardian } from \"./guardian.js\";\n\n// Silence Node.js ExperimentalWarning for WASI (Industrial console parity)\nconst originalEmit = process.emit;\n// @ts-expect-error\nprocess.emit = (name, data, ...args) => {\n\tif (\n\t\t(name === \"warning\" &&\n\t\t\ttypeof data === \"object\" &&\n\t\t\t(data as Record<string, unknown>).name === \"ExperimentalWarning\" &&\n\t\t\tString((data as Record<string, unknown>).message).includes(\"WASI\")) ||\n\t\tString((data as Record<string, unknown>).message).includes(\"importing WASI\")\n\t) {\n\t\treturn false;\n\t}\n\treturn originalEmit.call(process, name, data, ...args);\n};\n\n/**\n * Returns a filtered environment object containing only safe system variables,\n * preventing exposure of sensitive credentials and shell function injection.\n */\nexport function getDefaultEnvironment(): Record<string, string> {\n\tconst isWindows = process.platform === \"win32\";\n\tconst safeKeys = isWindows\n\t\t? [\n\t\t\t\t\"APPDATA\",\n\t\t\t\t\"HOMEDRIVE\",\n\t\t\t\t\"HOMEPATH\",\n\t\t\t\t\"LOCALAPPDATA\",\n\t\t\t\t\"PATH\",\n\t\t\t\t\"PROCESSOR_ARCHITECTURE\",\n\t\t\t\t\"SYSTEMDRIVE\",\n\t\t\t\t\"SYSTEMROOT\",\n\t\t\t\t\"TEMP\",\n\t\t\t\t\"USERNAME\",\n\t\t\t\t\"USERPROFILE\",\n\t\t\t\t\"PROGRAMFILES\",\n\t\t\t]\n\t\t: [\"HOME\", \"LOGNAME\", \"PATH\", \"SHELL\", \"TERM\", \"USER\"];\n\n\tconst env: Record<string, string> = {\n\t\tNODE_ENV: \"production\",\n\t\tLIOP_NODE: \"true\",\n\t};\n\n\tfor (const key of safeKeys) {\n\t\tconst val = process.env[key];\n\t\tif (val !== undefined && !val.startsWith(\"()\")) {\n\t\t\tenv[key] = val;\n\t\t}\n\t}\n\n\treturn env;\n}\n\n/**\n * Calculates deterministic execution fuel units based on AST instruction complexity.\n * Guarantees identical fuel consumption for the same logic across different hardware.\n */\nexport function calculateAstInstructionFuel(code: string): number {\n\ttry {\n\t\tconst ast = acorn.parse(code, {\n\t\t\tecmaVersion: 2022,\n\t\t\tsourceType: \"script\",\n\t\t\tallowReturnOutsideFunction: true,\n\t\t});\n\n\t\tlet score = 100; // Base fuel for VM initialization & envelope parsing\n\n\t\tsimple(ast, {\n\t\t\tIdentifier() {\n\t\t\t\tscore += 1;\n\t\t\t},\n\t\t\tLiteral() {\n\t\t\t\tscore += 1;\n\t\t\t},\n\t\t\tBinaryExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\tUnaryExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\tLogicalExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tVariableDeclaration(node: any) {\n\t\t\t\tscore += 5 * (node.declarations?.length || 1);\n\t\t\t},\n\t\t\tAssignmentExpression() {\n\t\t\t\tscore += 3;\n\t\t\t},\n\t\t\tMemberExpression() {\n\t\t\t\tscore += 3;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tObjectExpression(node: any) {\n\t\t\t\tscore += 5 + (node.properties?.length || 0) * 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tArrayExpression(node: any) {\n\t\t\t\tscore += 5 + (node.elements?.length || 0) * 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tCallExpression(node: any) {\n\t\t\t\tscore += 10 + (node.arguments?.length || 0) * 2;\n\t\t\t},\n\t\t\tFunctionDeclaration() {\n\t\t\t\tscore += 20;\n\t\t\t},\n\t\t\tFunctionExpression() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tArrowFunctionExpression() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tIfStatement() {\n\t\t\t\tscore += 5;\n\t\t\t},\n\t\t\tSwitchStatement() {\n\t\t\t\tscore += 10;\n\t\t\t},\n\t\t\tForStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tForInStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tForOfStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tWhileStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tDoWhileStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tTryStatement() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tReturnStatement() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t});\n\n\t\t// Normalize to buckets of 100 to prevent timing side-channel inference\n\t\treturn Math.ceil(score / 100) * 100;\n\t} catch (_e) {\n\t\t// Fallback for non-JS or unparseable code\n\t\treturn 500;\n\t}\n}\n\nexport interface SandboxConfig {\n\tallowEnv?: boolean;\n\tallowedDirectories?: Record<string, string>; // guestPath -> hostPath\n\tmemoryLimitMb?: number;\n}\n\n/**\n * LIOP WasiSandbox (Industrial Grade)\n *\n * Provides a production-grade isolated environment for executing untrusted logic.\n * Primarily uses WebAssembly (WASI) for byte-code isolation, with a hardened\n * V8 Isolate fallback for dynamic JS-to-WASM logic injection.\n */\nexport class WasiSandbox {\n\tprivate wasi!: WASI;\n\tprivate sandboxId: string;\n\tprivate workingDir: string;\n\tprivate config: SandboxConfig;\n\tprivate stdoutHandle: fs.FileHandle | null = null;\n\tprivate stderrHandle: fs.FileHandle | null = null;\n\n\tconstructor(config: SandboxConfig = {}) {\n\t\tthis.sandboxId = crypto.randomUUID();\n\t\t// Use a dedicated LIOP directory in the OS temp folder\n\t\tthis.workingDir = path.join(\n\t\t\tos.tmpdir(),\n\t\t\t\"liop-mesh\",\n\t\t\t\"sandboxes\",\n\t\t\tthis.sandboxId,\n\t\t);\n\t\tthis.config = config;\n\t}\n\n\t/**\n\t * Initializes the physical sandbox environment with strict directory lockdown.\n\t */\n\tpublic async init(): Promise<void> {\n\t\ttry {\n\t\t\tawait fs.mkdir(this.workingDir, { recursive: true });\n\n\t\t\t// Initialize WASI with explicit limits\n\t\t\tthis.stdoutHandle = await fs.open(\n\t\t\t\tpath.join(this.workingDir, \"stdout.log\"),\n\t\t\t\t\"w+\",\n\t\t\t);\n\t\t\tthis.stderrHandle = await fs.open(\n\t\t\t\tpath.join(this.workingDir, \"stderr.log\"),\n\t\t\t\t\"w+\",\n\t\t\t);\n\n\t\t\tthis.wasi = new WASI({\n\t\t\t\tversion: \"preview1\",\n\t\t\t\targs: [\"liop_runtime\"],\n\t\t\t\tenv: this.config.allowEnv\n\t\t\t\t\t? { ...getDefaultEnvironment(), RUNTIME_ID: this.sandboxId }\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tNODE_ENV: \"production\",\n\t\t\t\t\t\t\tLIOP_NODE: \"true\",\n\t\t\t\t\t\t\tRUNTIME_ID: this.sandboxId,\n\t\t\t\t\t\t},\n\t\t\t\tpreopens: {\n\t\t\t\t\t\"/sandbox\": this.workingDir,\n\t\t\t\t\t...this.config.allowedDirectories,\n\t\t\t\t},\n\t\t\t\tstdout: this.stdoutHandle.fd,\n\t\t\t\tstderr: this.stderrHandle.fd,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Sandbox Initialization Failed: ${error instanceof Error ? error.message : \"FS Error\"}`,\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Executes logic (WASM or JS-Wrapped) with hard resource limits.\n\t */\n\tpublic async execute(\n\t\tcompiledLogic: Buffer | string,\n\t\trecords: Record<string, unknown>[] = [],\n\t\tinputs: Record<string, unknown> = {},\n\t): Promise<{ output: unknown; fuelConsumed: number }> {\n\t\tconst startTime = performance.now();\n\n\t\tif (compiledLogic instanceof Buffer) {\n\t\t\t// Path A: Native WebAssembly Isolation\n\t\t\ttry {\n\t\t\t\tconst module = await WebAssembly.compile(new Uint8Array(compiledLogic));\n\n\t\t\t\t// Tier-0 Guardian: Static analysis to prevent sandbox escapes\n\t\t\t\tASTGuardian.analyze(module);\n\n\t\t\t\tconst instance = await WebAssembly.instantiate(\n\t\t\t\t\tmodule,\n\t\t\t\t\tthis.wasi.getImportObject() as WebAssembly.Imports,\n\t\t\t\t);\n\n\t\t\t\t// Standard entry point\n\t\t\t\tthis.wasi.start(instance);\n\n\t\t\t\t// Capture output from the sandbox\n\t\t\t\tconst stdoutPath = path.join(this.workingDir, \"stdout.log\");\n\t\t\t\tconst stderrPath = path.join(this.workingDir, \"stderr.log\");\n\t\t\t\tconst stdout = await fs.readFile(stdoutPath, \"utf-8\");\n\t\t\t\tconst stderr = await fs.readFile(stderrPath, \"utf-8\");\n\n\t\t\t\tconst duration = performance.now() - startTime;\n\t\t\t\treturn {\n\t\t\t\t\toutput:\n\t\t\t\t\t\tstdout || (stderr ? `Error: ${stderr}` : \"WASM_EXECUTION_SUCCESS\"),\n\t\t\t\t\tfuelConsumed: Math.floor(duration * 1000),\n\t\t\t\t};\n\t\t\t} catch (error: unknown) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`WASM Runtime Error: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\t);\n\t\t\t}\n\t\t} else {\n\t\t\t// Path B: Hardened V8 Isolate Fallback\n\t\t\t// Uses node:vm with zero-prototype objects to prevent prototype pollution escapes.\n\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for Sandbox global poisoning\n\t\t\tconst sandboxEnv: any = Object.create(null); // Isolated global object\n\t\t\tconst env = { records, ...inputs };\n\n\t\t\t// Explicitly poison Node.js escape vectors in the context\n\t\t\tsandboxEnv.require = undefined;\n\t\t\tsandboxEnv.process = undefined;\n\t\t\tsandboxEnv.global = undefined;\n\t\t\tsandboxEnv.globalThis = undefined;\n\t\t\tsandboxEnv.Buffer = undefined;\n\t\t\tsandboxEnv.setTimeout = undefined;\n\t\t\tsandboxEnv.setInterval = undefined;\n\t\t\tsandboxEnv.setImmediate = undefined;\n\t\t\tsandboxEnv.queueMicrotask = undefined;\n\t\t\tsandboxEnv.eval = undefined;\n\t\t\tsandboxEnv.Function = undefined;\n\t\t\tsandboxEnv.SharedArrayBuffer = undefined;\n\t\t\tsandboxEnv.Date = undefined;\n\n\t\t\t// [DoS Defense] Block off-heap memory allocation vectors.\n\t\t\t// Logic-on-Origin operates on JSON data (env.records) — binary buffers\n\t\t\t// serve no legitimate purpose and enable memory exhaustion DoS.\n\t\t\t// (Uint8Array(2GB) bypassed Piscina's maxOldGenerationSizeMb limit)\n\t\t\tsandboxEnv.ArrayBuffer = undefined;\n\t\t\tsandboxEnv.Uint8Array = undefined;\n\t\t\tsandboxEnv.Int8Array = undefined;\n\t\t\tsandboxEnv.Uint16Array = undefined;\n\t\t\tsandboxEnv.Int16Array = undefined;\n\t\t\tsandboxEnv.Uint32Array = undefined;\n\t\t\tsandboxEnv.Int32Array = undefined;\n\t\t\tsandboxEnv.Float32Array = undefined;\n\t\t\tsandboxEnv.Float64Array = undefined;\n\t\t\tsandboxEnv.BigInt64Array = undefined;\n\t\t\tsandboxEnv.BigUint64Array = undefined;\n\t\t\tsandboxEnv.DataView = undefined;\n\n\t\t\t// Recurse and strip prototype chain from host-passed objects to prevent escaping via constructor\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for recursive null prototype mapping\n\t\t\tconst toNullPrototype = (obj: any): any => {\n\t\t\t\tif (!obj || typeof obj !== \"object\") {\n\t\t\t\t\treturn obj;\n\t\t\t\t}\n\t\t\t\tif (Array.isArray(obj)) {\n\t\t\t\t\treturn obj.map(toNullPrototype);\n\t\t\t\t}\n\t\t\t\tconst clone = Object.create(null);\n\t\t\t\tfor (const [key, val] of Object.entries(obj)) {\n\t\t\t\t\tclone[key] = toNullPrototype(val);\n\t\t\t\t}\n\t\t\t\treturn clone;\n\t\t\t};\n\n\t\t\t// Inject strictly monitored globals\n\t\t\tsandboxEnv.records = toNullPrototype(JSON.parse(JSON.stringify(records))); // Deep copy safety + null prototype\n\t\t\tsandboxEnv.env = toNullPrototype(JSON.parse(JSON.stringify(env)));\n\n\t\t\tfor (const [key, value] of Object.entries(inputs)) {\n\t\t\t\tsandboxEnv[key] = toNullPrototype(JSON.parse(JSON.stringify(value)));\n\t\t\t}\n\n\t\t\t// Freeze the sandbox context to prevent mutation (SEC-GAP-1)\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for recursive deep freeze of unknown data\n\t\t\tconst deepFreeze = (obj: any) => {\n\t\t\t\tif (obj && typeof obj === \"object\" && !Object.isFrozen(obj)) {\n\t\t\t\t\tObject.freeze(obj);\n\t\t\t\t\tfor (const key of Object.keys(obj)) {\n\t\t\t\t\t\tdeepFreeze(obj[key]);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn obj;\n\t\t\t};\n\n\t\t\tdeepFreeze(sandboxEnv.records);\n\t\t\tdeepFreeze(sandboxEnv.env);\n\n\t\t\t// Prevent property addition/modification on global scope\n\t\t\tfor (const key of Object.keys(sandboxEnv)) {\n\t\t\t\tObject.defineProperty(sandboxEnv, key, {\n\t\t\t\t\twritable: false,\n\t\t\t\t\tconfigurable: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// LIOP Execution Wrapper\n\t\t\t// Host-side logic transformation to avoid 'new Function' in sandbox\n\t\t\tlet processedLogic = String(compiledLogic);\n\t\t\tif (\n\t\t\t\t/^\\s*return\\s/m.test(processedLogic) ||\n\t\t\t\t!processedLogic.includes(\"function liop_main\")\n\t\t\t) {\n\t\t\t\tif (!processedLogic.includes(\"function liop_main\")) {\n\t\t\t\t\tprocessedLogic = `function liop_main(env) {\\n${processedLogic}\\n}`;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst scriptCode = `\n\t\t\t\t(function() {\n\t\t\t\t\t\"use strict\";\n\t\t\t\t\ttry {\n\t\t\t\t\t\t// Pre-execution prototype freezing (PCI-DSS Compliance)\n\t\t\t\t\t\tObject.freeze(Object.prototype);\n\t\t\t\t\t\tObject.freeze(Array.prototype);\n\t\t\t\t\t\tObject.freeze(String.prototype);\n\t\t\t\t\t\tObject.freeze(Number.prototype);\n\t\t\t\t\t\tObject.freeze(Boolean.prototype);\n\t\t\t\t\t\tObject.freeze(RegExp.prototype);\n\t\t\t\t\t\tObject.freeze(Map.prototype);\n\t\t\t\t\t\tObject.freeze(Set.prototype);\n\t\t\t\t\t\tObject.freeze(Promise.prototype);\n\t\t\t\t\t\tObject.freeze(Error.prototype);\n\t\t\t\t\t\tObject.freeze(Object.getPrototypeOf(function(){}));\n\n\t\t\t\t\t\t${processedLogic}\n\t\t\t\t\t\tif (typeof liop_main === 'function') {\n\t\t\t\t\t\t\treturn liop_main(env);\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn \"ERR_NO_ENTRY_POINT\";\n\t\t\t\t\t} catch(e) {\n\t\t\t\t\t\treturn \"LogicError: \" + e.message;\n\t\t\t\t\t}\n\t\t\t\t})();\n\t\t\t`;\n\n\t\t\ttry {\n\t\t\t\tconst script = new vm.Script(scriptCode, {\n\t\t\t\t\tfilename: `liop-sandbox-${this.sandboxId.slice(0, 8)}.js`,\n\t\t\t\t});\n\n\t\t\t\t// Freeze Host prototypes in production (non-test environments) to completely block Prototype Pollution\n\t\t\t\tif (\n\t\t\t\t\t!process.env.VITEST &&\n\t\t\t\t\ttypeof Object.prototype === \"object\" &&\n\t\t\t\t\t!Object.isFrozen(Object.prototype)\n\t\t\t\t) {\n\t\t\t\t\tObject.freeze(Object.prototype);\n\t\t\t\t\tObject.freeze(Array.prototype);\n\t\t\t\t\tObject.freeze(String.prototype);\n\t\t\t\t\tObject.freeze(Number.prototype);\n\t\t\t\t\tObject.freeze(Boolean.prototype);\n\t\t\t\t\tObject.freeze(RegExp.prototype);\n\t\t\t\t\tObject.freeze(Map.prototype);\n\t\t\t\t\tObject.freeze(Set.prototype);\n\t\t\t\t\tObject.freeze(Promise.prototype);\n\t\t\t\t\tObject.freeze(Error.prototype);\n\t\t\t\t}\n\n\t\t\t\t// microtaskMode: Ensures Promises created inside the sandbox are\n\t\t\t\t// resolved within the timeout/breakOnSigint scope (Node.js ≥14.6).\n\t\t\t\t// Without this, async microtasks could escape the 5s CPU limit.\n\t\t\t\tconst context = vm.createContext(sandboxEnv, {\n\t\t\t\t\tname: \"LIOP Isolate\",\n\t\t\t\t\torigin: \"liop://sandbox\",\n\t\t\t\t\tmicrotaskMode: \"afterEvaluate\",\n\t\t\t\t});\n\n\t\t\t\t// Execution with hard CPU and Memory limits (Fuel)\n\t\t\t\tconst output = script.runInContext(context, {\n\t\t\t\t\ttimeout: 5000,\n\t\t\t\t\tbreakOnSigint: true,\n\t\t\t\t\tdisplayErrors: true,\n\t\t\t\t});\n\n\t\t\t\t// [Phase Beta-3] Deterministic AST Instruction Fuel Metering (SOC 2 / Zero Hardware Drift)\n\t\t\t\tconst logicStr =\n\t\t\t\t\ttypeof compiledLogic === \"string\"\n\t\t\t\t\t\t? compiledLogic\n\t\t\t\t\t\t: compiledLogic.toString(\"utf-8\");\n\t\t\t\tconst fuelUsed = calculateAstInstructionFuel(logicStr);\n\n\t\t\t\tif (fuelUsed > 1000000) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\"LIOP_RESOURCE_EXHAUSTED: Execution fuel limit exceeded.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\treturn { output, fuelConsumed: fuelUsed };\n\t\t\t} catch (error) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`V8 Isolate Fault: ${error instanceof Error ? error.message : \"Execution Timeout\"}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Physically cleans up the sandbox and releases resources.\n\t */\n\tpublic async teardown(): Promise<void> {\n\t\ttry {\n\t\t\tif (this.stdoutHandle) await this.stdoutHandle.close();\n\t\t\tif (this.stderrHandle) await this.stderrHandle.close();\n\t\t\tawait fs.rm(this.workingDir, { recursive: true, force: true });\n\t\t} catch (_e) {\n\t\t\t// Silent fail on teardown to prevent process crashes\n\t\t}\n\t}\n}\n"]}

package/dist/chunk-UCJEK75U.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/security/prm.ts","../src/gateway/grpc-web.ts","../src/gateway/rate-limiter.ts","../src/gateway/hybrid.ts"],"names":[],"mappings":";;;;;;;;AAoCO,SAAS,8BAAA,CACf,QACA,QAAA,EAC4B;AAC5B,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,QAAA;AAAA,IACV,qBAAA,EAAuB,CAAC,MAAM,CAAA;AAAA,IAC9B,gBAAA,EAAkB,WAAA;AAAA,IAClB,wBAAA,EAA0B,CAAC,QAAQ,CAAA;AAAA,IACnC,sBAAA,EAAwB;AAAA,GACzB;AACD;;;AC7BO,IAAM,kBAAA,GAAqB;AAAA,EACjC,SAAA,EAAW,CAAA;AAAA,EACX,aAAA,EAAe,GAAA;AAAA,EACf,aAAA,EAAe,CAAA;AAAA,EACf,mBAAA,EAAqB,sBAAA;AAAA,EACrB,SAAA,EAAW,CAAA;AAAA,EACX,gBAAA,EAAkB,CAAA;AAAA,EAClB,cAAA,EAAgB,CAAA;AAAA,EAChB,uBAAA,EAAyB,CAAA;AAAA,EACzB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,gBAAA,EAAkB,CAAA;AAAA,EAClB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,sBAAA,EAAwB,EAAA;AAAA,EACxB,eAAA,EAAiB;AAClB;AAUO,SAAS,iBAAiB,WAAA,EAA+B;AAC/D,EAAA,IAAI,CAAC,aAAa,OAAO,KAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,YAAY,WAAA,EAAY;AACtC,EAAA,OACC,KAAA,CAAM,UAAA,CAAW,sBAAsB,CAAA,IACvC,KAAA,CAAM,WAAW,4BAA4B,CAAA,IAC7C,KAAA,CAAM,UAAA,CAAW,2BAA2B,CAAA;AAE9C;AAKO,SAAS,gBAAgB,OAAA,EAAsC;AACrE,EAAA,MAAM,GAAA,GAAM,OAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU,MAAA,CAAO,KAAK,OAAO,CAAA;AACpE,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,SAAA,EAAW,CAAC,CAAA;AACjD,EAAA,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,MAAA,EAAQ,CAAC,CAAA;AAClC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAA;AACnC;AAKO,SAAS,kBAAA,CACf,SAAiB,kBAAA,CAAmB,SAAA,EACpC,UAAkB,EAAA,EAClB,cAAA,GAAyC,EAAC,EACjC;AACT,EAAA,MAAM,KAAA,GAAQ;AAAA,IACb,eAAe,MAAM,CAAA,CAAA;AAAA,IACrB,CAAA,aAAA,EAAgB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAAA,GAC5C;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EAAG;AAC1D,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,EAC7B;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,CAAA;AACzC,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,OAAO,CAAA;AAEnD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,aAAA,EAAe,CAAC,CAAA;AACrD,EAAA,MAAA,CAAO,aAAA,CAAc,UAAA,CAAW,MAAA,EAAQ,CAAC,CAAA;AAEzC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,MAAA,EAAgC;AAC5D,EAAA,MAAM,SAAyB,EAAC;AAChC,EAAA,IAAI,MAAA,GAAS,CAAA;AAEb,EAAA,OAAO,MAAA,GAAS,kBAAA,CAAmB,aAAA,IAAiB,MAAA,CAAO,MAAA,EAAQ;AAClE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,CAAa,MAAA,GAAS,CAAC,CAAA;AAC7C,IAAA,MAAM,YAAA,GAAe,SAAS,kBAAA,CAAmB,aAAA;AACjD,IAAA,MAAM,aAAa,YAAA,GAAe,MAAA;AAElC,IAAA,IAAI,UAAA,GAAa,OAAO,MAAA,EAAQ;AAC/B,MAAA;AAAA,IACD;AAEA,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,CAAS,YAAA,EAAc,UAAU,CAAA;AACxD,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACX,SAAA,EAAA,CACE,IAAA,GAAO,kBAAA,CAAmB,aAAA,MAC3B,kBAAA,CAAmB,aAAA;AAAA,MACpB,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAO;AAAA,KAC5B,CAAA;AAED,IAAA,MAAA,GAAS,UAAA;AAAA,EACV;AAEA,EAAA,OAAO,MAAA;AACR;AAMA,eAAsB,sBAAA,CACrB,GAAA,EACA,GAAA,EACA,OAAA,EAIgB;AAChB,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACjC,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EAClB,CAAC,CAAA;AAED,EAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AACzB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AACrC,MAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AACpC,MAAA,MAAM,WAAA,GACL,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,SAAS,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC5D,MAAA,MAAM,WAAA,GAAc,IAAI,GAAA,IAAO,GAAA;AAE/B,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,gCAAA,EAAmC,WAAW,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,CAAA,OAAA;AAAA,OACtE;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,WAAA,EAAa,WAAW,CAAA;AAErD,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,GAAG,CAAA;AAChD,MAAA,GAAA,CAAI,SAAA;AAAA,QACH,+BAAA;AAAA,QACA;AAAA,OACD;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,EAAG;AAC1C,QAAA,GAAA,CAAI,KAAA,CAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,MACvC;AAGA,MAAA,GAAA,CAAI,MAAM,kBAAA,CAAmB,MAAA,CAAO,QAAQ,MAAA,CAAO,OAAA,IAAW,EAAE,CAAC,CAAA;AACjE,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,CAAE,CAAA;AAC/C,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,KAAA;AAAA,QACH,kBAAA;AAAA,UACC,kBAAA,CAAmB,eAAA;AAAA,UAClB,MAAgB,OAAA,IAAW;AAAA;AAC7B,OACD;AACA,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT;AAAA,EACD,CAAC,CAAA;AACF;;;ACzJO,IAAM,sBAAN,MAA0B;AAAA,EACf,QAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA,uBAAyC,GAAA,EAAI;AAAA,EACtD,YAAA;AAAA,EAER,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAG;AAC7C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,GAAA;AACpC,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,GAAA;AAG1C,IAAA,IAAA,CAAK,eAAe,WAAA,CAAY,MAAM,IAAA,CAAK,OAAA,IAAW,GAAM,CAAA;AAC5D,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,KAAU,UAAA,EAAY;AAClD,MAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,IACzB;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,MAAM,GAAA,EAA8B;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAEjC,IAAA,IAAI,CAAC,MAAA,IAAU,GAAA,IAAO,MAAA,CAAO,SAAA,EAAW;AACvC,MAAA,MAAA,GAAS;AAAA,QACR,KAAA,EAAO,CAAA;AAAA,QACP,SAAA,EAAW,MAAM,IAAA,CAAK;AAAA,OACvB;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAC5B,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,KAAK,WAAA,GAAc,CAAA;AAAA,QAC9B,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK;AAAA,OACf;AAAA,IACD;AAEA,IAAA,IAAI,MAAA,CAAO,KAAA,IAAS,IAAA,CAAK,WAAA,EAAa;AACrC,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW,CAAA;AAAA,QACX,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,OAC5C;AAAA,IACD;AAEA,IAAA,MAAA,CAAO,KAAA,EAAA;AACP,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,IAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,WAAA,GAAc,MAAA,CAAO,KAAA;AAAA,MACrC,OAAO,IAAA,CAAK,WAAA;AAAA,MACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,KAC5C;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,MAAM,GAAA,EAAmB;AAC/B,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,KAAK,IAAA,CAAK,OAAA,CAAQ,SAAQ,EAAG;AACnD,MAAA,IAAI,GAAA,IAAO,OAAO,SAAA,EAAW;AAC5B,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,MACxB;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,KAAA,GAAc;AACpB,IAAA,IAAI,KAAK,YAAA,EAAc;AACtB,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,MAAA;AAAA,IACrB;AACA,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACpB;AACD;;;ACzFO,IAAM,oBAAN,MAAwB;AAAA,EAY9B,YACS,UAAA,EACA,QAAA,GAA4B,IAAA,EACpC,OAAA,GAAkB,OAClB,kBAAA,EACC;AAJO,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAIR,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,UAAA,CAAW,YAAA;AACpC,IAAA,IAAA,CAAK,aAAA,GAAgB,KAAK,UAAA,CAAW,aAAA;AACrC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAI,mBAAA,CAAoB,kBAAkB,CAAA;AAG7D,IAAA,IAAA,CAAK,SAAS,IAAI,aAAA,CAAc,KAAK,UAAA,EAAY,IAAA,CAAK,UAAU,OAAO,CAAA;AAGvE,IAAA,IAAA,CAAK,WAAiB,KAAA,CAAA,YAAA,EAAa;AACnC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,WAAgB,IAAA,CAAA,YAAA,EAAa;AAClC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,SAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,CAAC,MAAA,KAAW;AAC7C,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,CAAC,MAAA,KAAW;AAC/B,QAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,EAAS,CAAE,WAAW,gBAAgB,CAAA;AAC7D,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,iDAAA,EAAoD,OAAA,GAAU,eAAA,GAAkB,gBAAgB,CAAA;AAAA,SACjG;AACA,QAAA,IAAI,OAAA,EAAS;AACZ,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC,CAAA,MAAO;AACN,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC;AACA,QAAA,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,MACtB,CAAC,CAAA;AACD,MAAA,MAAA,CAAO,EAAA;AAAA,QAAG,OAAA;AAAA,QAAS,CAAC,GAAA,KACnB,GAAA,CAAI,MAAM,CAAA,uCAAA,EAA0C,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,OAClE;AAAA,IACD,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AACA,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AAEA,IAAA,GAAA,CAAI,KAAK,4CAA4C,CAAA;AAAA,EACtD;AAAA,EA5DQ,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAEA,aAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA,GAAa,KAAA;AAAA,EACb,cAAA,GAAiB,CAAA;AAAA,EAqDjB,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,QAAA,EAAU,CAAC,QAAQ,OAAA,KAAY;AAC/C,MAAA,MAAM,WAAA,GAAc,QAAQ,cAAc,CAAA;AAC1C,MAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,CAAA;AAE5B,MAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACvC,QAAA,IAAA,CAAK,iBAAiB,MAAiC,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC3B,QAAA,IAAA,CAAK,iBAAA,CAAkB,QAAmC,OAAO,CAAA;AAAA,MAClE;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,SAAA,EAAW,OAAO,KAAK,GAAA,KAAQ;AAC/C,MAAA,IAAA,CAAK,cAAA,IAAkB,CAAA;AACvB,MAAA,MAAM,SAAS,MAAM;AACpB,QAAA,GAAA,CAAI,cAAA,CAAe,UAAU,MAAM,CAAA;AACnC,QAAA,GAAA,CAAI,cAAA,CAAe,SAAS,MAAM,CAAA;AAClC,QAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,MAC1D,CAAA;AACA,MAAA,GAAA,CAAI,EAAA,CAAG,UAAU,MAAM,CAAA;AACvB,MAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAEtB,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,IAAO,EAAA;AACvB,MAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AAGnB,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,QAAA,EAAU;AAClB,UAAA,kBAAA,CAAmB,IAAI,EAAC,EAAG,KAAK,QAAA,CAAS,QAAA,GAAW,MAAM,CAAA;AAAA,QAC3D;AACA,QAAA,IAAI,KAAK,MAAA,EAAQ;AAChB,UAAA,iBAAA,CAAkB,IAAI,EAAC,EAAG,IAAA,CAAK,MAAA,CAAO,sBAAsB,CAAA;AAAA,QAC7D;AACA,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,UAClB,cAAA,EAAgB;AAAA,SAChB,CAAA;AACD,QAAA,GAAA,CAAI,GAAA,CAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA;AAC9C,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,IAAA;AAAA,YACR,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA;AAAA,YACnC,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,SAAA,EAAW;AAC1C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,MAAM,cAAc,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,WAAU,GAAI,IAAA;AAChE,QAAA,IAAI,CAAC,WAAA,EAAa;AACjB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,WAAA,EAAa,KAAA;AAAA,cACb,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,OAAA;AAAA,YACR,WAAA,EAAa,IAAA;AAAA,YACb,OAAO,IAAA,CAAK,QAAA,GAAW,KAAK,QAAA,CAAS,QAAA,GAAW,MAAA,GAAS,CAAA;AAAA,YACzD,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,IAAA,CAAK,UAAA,IAAc,GAAA,KAAQ,MAAA,EAAQ;AACtC,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,OAAA,EAAS,KAAA;AAAA,YACT,KAAA,EAAO;AAAA,cACN,IAAA,EAAM,KAAA;AAAA,cACN,OAAA,EAAS;AAAA;AACV,WACA;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,cAAc,CAAA;AAC9C,MAAA,IAAI,gBAAA,CAAiB,WAAW,CAAA,EAAG;AAClC,QAAA,MAAM,sBAAA,CAAuB,GAAA,EAAK,GAAA,EAAK,OAAO,SAAS,OAAA,KAAY;AAClE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,uCAAA,EAA0C,OAAO,CAAA,EAAA,EAAK,OAAA,CAAQ,MAAM,CAAA,OAAA;AAAA,WACrE;AACA,UAAA,OAAO;AAAA,YACN,QAAQ,kBAAA,CAAmB,SAAA;AAAA,YAC3B,OAAA,EAAS,IAAA;AAAA,YACT,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,EAAE;AAAA,WACrB;AAAA,QACD,CAAC,CAAA;AACD,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,IAAK,KAAK,aAAA,EAAe;AAClD,QAAA,MAAM,QAAA,GACL,OAAO,IAAA,CAAK,aAAA,CAAc,QAAA,KAAa,aACpC,IAAA,CAAK,aAAA,CAAc,QAAA,EAAS,GAC5B,IAAA,CAAK,aAAA;AAET,QAAA,MAAM,cAAc,GAAA,CAAI,GAAA;AACxB,QAAA,GAAA,CAAI,GAAA,GAAA,CAAO,WAAA,IAAe,EAAA,EAAI,KAAA,CAAM,CAAC,CAAA,IAAK,GAAA;AAC1C,QAAA,IAAI;AACH,UAAA,OAAO,QAAA,CAAS,KAAK,GAAG,CAAA;AAAA,QACzB,CAAA,SAAE;AACD,UAAA,GAAA,CAAI,GAAA,GAAM,WAAA;AAAA,QACX;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,uCAAA,EAAyC;AACxE,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,GAAA,GAAM,8BAAA;AAAA,YACX,IAAA,CAAK,aAAa,SAAA,EAAU;AAAA,YAC5B,IAAA,CAAK,aAAa,WAAA;AAAY,WAC/B;AACA,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAC3B,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,QAAA;AAAA,MACD;AAEA,MAAA,IACC,WAAW,KAAA,KACV,GAAA,KAAQ,OAAO,GAAA,KAAQ,MAAA,IAAU,QAAQ,SAAA,CAAA,EACzC;AACD,QAAA,IACC,QAAQ,SAAA,IACR,GAAA,CAAI,QAAQ,MAAA,EAAQ,QAAA,CAAS,kBAAkB,CAAA,EAC9C;AACD,UAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB;AAAA,YACA,QAAQ,IAAA,CAAK,QAAA,CAAS,SAAA,EAAU,EAAG,UAAS,IAAK,EAAA;AAAA,YACjD,UAAA,EAAY,IAAA,CAAK,QAAA,CACf,aAAA,EAAc,CACd,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,EAAU;AAAA,WAC1B,GACC,IAAA;AACH,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,EAAc,SAAA,EAAU;AAC5C,UAAA,MAAM,OAAA,GAAU,SACb,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GACtB,MAAA,GACA,CAAA,EAAG,MAAM,CAAA,KAAA,CAAA,GACV,EAAA;AACH,UAAA,MAAM,gBAAA,GACL,IAAA,CAAK,YAAA,IAAgB,MAAA,GAClB;AAAA,YACA,MAAA;AAAA,YACA,QAAA,EAAU,GAAG,OAAO,CAAA,KAAA,CAAA;AAAA,YACpB,GAAI,KAAK,aAAA,GACN;AAAA,cACA,cAAA,EAAgB,GAAG,OAAO,CAAA,MAAA;AAAA,gBAE1B;AAAC,WACL,GACC,MAAA;AAEJ,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,IAAA,EAAM,IAAA,CAAK,UAAA,CAAW,aAAA,EAAc;AAAA,cACpC,IAAA,EAAM,QAAA;AAAA,cACN,KAAA,EAAO,KAAK,UAAA,CAAW,SAAA,GAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA;AAAA,cACpD,IAAA,EAAM,gBAAA;AAAA,cACN,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,4BAA4B,CAAA;AACjE,QAAA,GAAA,CAAI,GAAA,CAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAA,CAWK,CAAA;AACb,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,GAAA,KAAQ,MAAA,IAAU,MAAA,KAAW,MAAA,EAAQ;AACxC,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,aAAA;AAC/B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACjD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AAClD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,IAAI,IAAA,GAAO,EAAA;AACX,QAAA,GAAA,CAAI,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACpD,QAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AAEzB,UAAA,MAAM,QAAA,GAAW,GAAA,CAAI,MAAA,CAAO,aAAA,IAAiB,WAAA;AAC7C,UAAA,MAAM,YAAA,GAAe,UAAU,QAAA,GAC5B,CAAA,OAAA,EAAU,SAAS,QAAQ,CAAA,CAAA,GAC3B,MAAM,QAAQ,CAAA,CAAA;AACjB,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,KAAA,CAAM,YAAY,CAAA;AACtD,UAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACxB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,cAAA,EAAgB,kBAAA;AAAA,cAChB,eAAe,IAAA,CAAK,IAAA,CAAK,WAAW,OAAA,GAAU,GAAI,EAAE,QAAA;AAAS,aAC7D,CAAA;AACD,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,EAAA,EAAI,IAAA;AAAA,gBACJ,KAAA,EAAO;AAAA,kBACN,IAAA,EAAM,MAAA;AAAA,kBACN,OAAA,EAAS;AAAA;AACV,eACA;AAAA,aACF;AACA,YAAA;AAAA,UACD;AAEA,UAAA,IAAI;AACH,YAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAGnC,YAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA;AAC1C,YAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA;AACtC,YAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAIrD,YAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,cAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,gBAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,cAC7B;AACA,cAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CACnB,yCACD,CAAA,EACC;AACD,gBAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,cACL;AAAA,YACD;AAEA,YAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,YAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,YAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,UACjC,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,kDAAA,EAAsD,EAAY,OAAO,CAAA;AAAA,aAC1E;AACA,YAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,aAAA;AAAc,eAC9C;AAAA,aACF;AAAA,UACD;AAAA,QACD,CAAC,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AAAA,MACpB;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,iBAAiB,MAAA,EAAiC;AACzD,IAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAmB;AAErC,MAAA,MAAM,IAAA,GAAO,KAAA;AACb,MAAA,IAAI,IAAA;AACH,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,yCAAA,EAA4C,KAAK,MAAM,CAAA,MAAA;AAAA,SACxD;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,cAAA,EAAgB,oBAAoB,CAAA;AACrE,IAAA,MAAA,CAAO,GAAA,EAAI;AAAA,EACZ;AAAA,EAEQ,iBAAA,CACP,QACA,OAAA,EACC;AACD,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,MAAA,CAAO,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACvD,IAAA,MAAA,CAAO,EAAA,CAAG,OAAO,YAAY;AAC5B,MAAA,IAAI;AACH,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,aAAa,OAAA,CAAQ,aAAA;AAC3B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACpD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AACrD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAGnC,QAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,QAAA,MAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAClC,QAAA,MAAM,UAAA,GAAa,QAAQ,sBAAsB,CAAA;AAIjD,QAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,UAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,YAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,UAC7B;AACA,UAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CAAM,yCAAyC,CAAA,EAClE;AACD,YAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,UACL;AAAA,QACD;AAEA,QAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QACpC,CAAA,aAAc,KAAA,EAAM;AAAA,MACrB,SAAS,EAAA,EAAI;AACZ,QAAA,MAAA,CAAO,OAAA,CAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,CAAA;AACjC,QAAA,MAAA,CAAO,GAAA,EAAI;AAAA,MACZ;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEA,MAAa,MAAA,CAAO,IAAA,EAAc,IAAA,GAAe,SAAA,EAA4B;AAC5E,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAG1B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,SAAA,EAAU;AACxC,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,QAAA,MAAM,IAAA,CAAK,QAAA,CAAS,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAChD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,uDAAA,EAAmD,KAAK,IAAI,CAAA;AAAA,SAC7D;AAAA,MACD;AAAA,IACD;AACA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAmC;AAC9D,QAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,8BAA8B,IAAI,CAAA,sCAAA;AAAA,WACnC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,QACzD;AACA,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,MAAM;AACvC,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,EAAQ;AACpC,QAAA,MAAM,aACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,OAAA,IAAW,IAAA;AACpD,QAAA,MAAM,eACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAEjD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,sEAAA,EAAoE,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SAC/F;AACA,QAAA,OAAA,CAAQ,YAAY,CAAA;AAAA,MACrB,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEO,SAAA,GAAqB;AAC3B,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA,EAEA,MAAa,KAAA,CAAM,SAAA,GAAY,GAAA,EAAqB;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,qDAAA,EAAwD,IAAA,CAAK,cAAc,CAAA,WAAA,EAAc,SAAS,CAAA,MAAA;AAAA,KACnG;AACA,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,OAAO,KAAK,cAAA,GAAiB,CAAA,IAAK,KAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,EAAW;AACjE,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,IACvD;AACA,IAAA,MAAM,KAAK,IAAA,EAAK;AAAA,EACjB;AAAA,EAEA,MAAa,IAAA,GAAO;AACnB,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AACvB,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AAAA,EACrB;AAAA,EAEO,SAAA,GAA2B;AACjC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACb;AACD","file":"chunk-UCJEK75U.js","sourcesContent":["/**\n * LIOP Protected Resource Metadata — RFC 9728\n *\n * Builds the JSON document served at /.well-known/oauth-protected-resource.\n * This enables MCP clients to discover the authorization server and\n * required scopes for accessing LIOP tools and resources.\n *\n * Standards: RFC 9728, MCP Spec 2025-11-25\n */\n\nimport { LIOP_SCOPES } from \"./rbac.js\";\n\n/**\n * RFC 9728 Protected Resource Metadata response.\n *\n * @see https://datatracker.ietf.org/doc/rfc9728\n */\nexport interface ProtectedResourceMetadata {\n\t/** Identifier for the protected resource. */\n\tresource: string;\n\t/** Array of authorization server issuer URLs that can issue tokens for this resource. */\n\tauthorization_servers: string[];\n\t/** OAuth scopes accepted by this resource. */\n\tscopes_supported: readonly string[];\n\t/** Methods of presenting the bearer token (always \"header\" for LIOP). */\n\tbearer_methods_supported: string[];\n\t/** URL to the resource documentation. */\n\tresource_documentation: string;\n}\n\n/**\n * Builds the Protected Resource Metadata document (RFC 9728).\n *\n * @param issuer - OIDC issuer URL of the Nexus authorization server\n * @param audience - JWT audience claim (resource identifier)\n */\nexport function buildProtectedResourceMetadata(\n\tissuer: string,\n\taudience: string,\n): ProtectedResourceMetadata {\n\treturn {\n\t\tresource: audience,\n\t\tauthorization_servers: [issuer],\n\t\tscopes_supported: LIOP_SCOPES,\n\t\tbearer_methods_supported: [\"header\"],\n\t\tresource_documentation: \"https://github.com/nekzus/liop\",\n\t};\n}\n","/**\n * LIOP gRPC-Web Protocol Adapter (HTTP/1.1 Fallback)\n *\n * Implements standard gRPC-Web framing per the official gRPC-Web specification:\n * https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-WEB.md\n *\n * Allows web browsers, corporate Layer 7 HTTP/1.1 proxies, and enterprise WAFs\n * to invoke LIOP nodes over HTTP/1.1 without requiring HTTP/2 streaming or h2c.\n *\n * Frame Format:\n * - 1 byte: Frame Flag (0x00 = Data Frame, 0x80 = Trailers Frame)\n * - 4 bytes: 32-bit Big-Endian Unsigned Integer (payload length in bytes)\n * - N bytes: Message or Trailer payload\n */\n\nimport type * as http from \"node:http\";\nimport { log } from \"../utils/logger.js\";\n\nexport const GRPC_WEB_CONSTANTS = {\n\tFLAG_DATA: 0x00,\n\tFLAG_TRAILERS: 0x80,\n\tHEADER_LENGTH: 5,\n\tCONTENT_TYPE_PREFIX: \"application/grpc-web\",\n\tSTATUS_OK: 0,\n\tSTATUS_CANCELLED: 1,\n\tSTATUS_UNKNOWN: 2,\n\tSTATUS_INVALID_ARGUMENT: 3,\n\tSTATUS_DEADLINE_EXCEEDED: 4,\n\tSTATUS_NOT_FOUND: 5,\n\tSTATUS_PERMISSION_DENIED: 7,\n\tSTATUS_UNAUTHENTICATED: 16,\n\tSTATUS_INTERNAL: 13,\n} as const;\n\nexport interface GrpcWebFrame {\n\tisTrailer: boolean;\n\tpayload: Buffer;\n}\n\n/**\n * Checks if an incoming HTTP request is a gRPC-Web request.\n */\nexport function isGrpcWebRequest(contentType?: string): boolean {\n\tif (!contentType) return false;\n\tconst lower = contentType.toLowerCase();\n\treturn (\n\t\tlower.startsWith(\"application/grpc-web\") ||\n\t\tlower.startsWith(\"application/grpc-web+proto\") ||\n\t\tlower.startsWith(\"application/grpc-web+json\")\n\t);\n}\n\n/**\n * Encodes a binary payload into a standard 5-byte framed gRPC-Web Data Frame.\n */\nexport function encodeDataFrame(payload: Buffer | Uint8Array): Buffer {\n\tconst buf = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_DATA, 0);\n\theader.writeUInt32BE(buf.length, 1);\n\treturn Buffer.concat([header, buf]);\n}\n\n/**\n * Encodes gRPC status and optional message into a 5-byte framed gRPC-Web Trailer Frame.\n */\nexport function encodeTrailerFrame(\n\tstatus: number = GRPC_WEB_CONSTANTS.STATUS_OK,\n\tmessage: string = \"\",\n\tcustomTrailers: Record<string, string> = {},\n): Buffer {\n\tconst lines = [\n\t\t`grpc-status:${status}`,\n\t\t`grpc-message:${encodeURIComponent(message)}`,\n\t];\n\n\tfor (const [key, value] of Object.entries(customTrailers)) {\n\t\tlines.push(`${key}:${value}`);\n\t}\n\n\tconst trailerText = `${lines.join(\"\\r\\n\")}\\r\\n`;\n\tconst trailerBuf = Buffer.from(trailerText, \"utf-8\");\n\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_TRAILERS, 0);\n\theader.writeUInt32BE(trailerBuf.length, 1);\n\n\treturn Buffer.concat([header, trailerBuf]);\n}\n\n/**\n * Parses raw gRPC-Web byte streams into an array of frames.\n */\nexport function decodeFrames(buffer: Buffer): GrpcWebFrame[] {\n\tconst frames: GrpcWebFrame[] = [];\n\tlet offset = 0;\n\n\twhile (offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH <= buffer.length) {\n\t\tconst flag = buffer.readUInt8(offset);\n\t\tconst length = buffer.readUInt32BE(offset + 1);\n\t\tconst payloadStart = offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH;\n\t\tconst payloadEnd = payloadStart + length;\n\n\t\tif (payloadEnd > buffer.length) {\n\t\t\tbreak; // Incomplete frame\n\t\t}\n\n\t\tconst payload = buffer.subarray(payloadStart, payloadEnd);\n\t\tframes.push({\n\t\t\tisTrailer:\n\t\t\t\t(flag & GRPC_WEB_CONSTANTS.FLAG_TRAILERS) ===\n\t\t\t\tGRPC_WEB_CONSTANTS.FLAG_TRAILERS,\n\t\t\tpayload: Buffer.from(payload),\n\t\t});\n\n\t\toffset = payloadEnd;\n\t}\n\n\treturn frames;\n}\n\n/**\n * Dispatches an HTTP/1.1 gRPC-Web request to an underlying protocol handler\n * and serializes data and trailer frames back to the client.\n */\nexport async function dispatchGrpcWebRequest(\n\treq: http.IncomingMessage,\n\tres: http.ServerResponse,\n\thandler: (\n\t\tpath: string,\n\t\tpayload: Buffer,\n\t) => Promise<{ status: number; message?: string; data?: Buffer }>,\n): Promise<void> {\n\tconst chunks: Buffer[] = [];\n\n\treq.on(\"data\", (chunk: Buffer) => {\n\t\tchunks.push(chunk);\n\t});\n\n\treq.on(\"end\", async () => {\n\t\ttry {\n\t\t\tconst fullBody = Buffer.concat(chunks);\n\t\t\tconst frames = decodeFrames(fullBody);\n\t\t\tconst dataPayload =\n\t\t\t\tframes.find((f) => !f.isTrailer)?.payload ?? Buffer.alloc(0);\n\t\t\tconst requestPath = req.url || \"/\";\n\n\t\t\tlog.info(\n\t\t\t\t`[gRPC-Web] Handling request for ${requestPath} (${dataPayload.length} bytes)`,\n\t\t\t);\n\n\t\t\tconst result = await handler(requestPath, dataPayload);\n\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.setHeader(\"access-control-allow-origin\", \"*\");\n\t\t\tres.setHeader(\n\t\t\t\t\"access-control-expose-headers\",\n\t\t\t\t\"grpc-status, grpc-message, content-type\",\n\t\t\t);\n\n\t\t\t// Write Data Frame (if response payload exists)\n\t\t\tif (result.data && result.data.length > 0) {\n\t\t\t\tres.write(encodeDataFrame(result.data));\n\t\t\t}\n\n\t\t\t// Write Trailer Frame (status and message)\n\t\t\tres.write(encodeTrailerFrame(result.status, result.message || \"\"));\n\t\t\tres.end();\n\t\t} catch (error) {\n\t\t\tlog.error(`[gRPC-Web] Dispatch error: ${error}`);\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.write(\n\t\t\t\tencodeTrailerFrame(\n\t\t\t\t\tGRPC_WEB_CONSTANTS.STATUS_INTERNAL,\n\t\t\t\t\t(error as Error).message || \"Internal server error\",\n\t\t\t\t),\n\t\t\t);\n\t\t\tres.end();\n\t\t}\n\t});\n}\n","/**\n * LIOP Sliding-Window Rate Limiter\n *\n * High-performance, zero-dependency in-memory rate limiter designed\n * to protect the LIOP Hybrid Gateway and Mesh Nodes against Denial of Service (DoS),\n * worker pool exhaustion, and brute-force attacks.\n *\n * Conforms to OWASP API Security Top 10 (API4:2023 - Unrestricted Resource Consumption).\n */\n\nexport interface RateLimiterOptions {\n\t/** Window duration in milliseconds (default: 60,000ms = 1 minute) */\n\twindowMs?: number;\n\t/** Maximum number of allowed requests per window (default: 120) */\n\tmaxRequests?: number;\n}\n\nexport interface RateLimitStatus {\n\tallowed: boolean;\n\tremaining: number;\n\tlimit: number;\n\tresetMs: number;\n}\n\ninterface WindowRecord {\n\tcount: number;\n\tresetTime: number;\n}\n\nexport class InMemoryRateLimiter {\n\tprivate readonly windowMs: number;\n\tprivate readonly maxRequests: number;\n\tprivate readonly records: Map<string, WindowRecord> = new Map();\n\tprivate cleanupTimer?: NodeJS.Timeout;\n\n\tconstructor(options: RateLimiterOptions = {}) {\n\t\tthis.windowMs = options.windowMs ?? 60_000;\n\t\tthis.maxRequests = options.maxRequests ?? 120;\n\n\t\t// Clean up expired buckets periodically (every 30s)\n\t\tthis.cleanupTimer = setInterval(() => this.cleanup(), 30_000);\n\t\tif (typeof this.cleanupTimer.unref === \"function\") {\n\t\t\tthis.cleanupTimer.unref();\n\t\t}\n\t}\n\n\t/**\n\t * Evaluates whether a request from the given key (IP, token, or clientId) is permitted.\n\t *\n\t * @param key Identifier for the client (e.g., remote IP or OAuth client ID)\n\t * @returns Status containing allowed boolean, remaining quota, and time until reset\n\t */\n\tpublic check(key: string): RateLimitStatus {\n\t\tconst now = Date.now();\n\t\tlet record = this.records.get(key);\n\n\t\tif (!record || now >= record.resetTime) {\n\t\t\trecord = {\n\t\t\t\tcount: 1,\n\t\t\t\tresetTime: now + this.windowMs,\n\t\t\t};\n\t\t\tthis.records.set(key, record);\n\t\t\treturn {\n\t\t\t\tallowed: true,\n\t\t\t\tremaining: this.maxRequests - 1,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: this.windowMs,\n\t\t\t};\n\t\t}\n\n\t\tif (record.count >= this.maxRequests) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\tremaining: 0,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t\t};\n\t\t}\n\n\t\trecord.count++;\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\tremaining: this.maxRequests - record.count,\n\t\t\tlimit: this.maxRequests,\n\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t};\n\t}\n\n\t/**\n\t * Explicitly resets the rate limit bucket for a given key.\n\t */\n\tpublic reset(key: string): void {\n\t\tthis.records.delete(key);\n\t}\n\n\t/**\n\t * Cleans up expired rate-limiting buckets to prevent memory leaks.\n\t */\n\tpublic cleanup(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [key, record] of this.records.entries()) {\n\t\t\tif (now >= record.resetTime) {\n\t\t\t\tthis.records.delete(key);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Destroys internal timers and clears records.\n\t */\n\tpublic close(): void {\n\t\tif (this.cleanupTimer) {\n\t\t\tclearInterval(this.cleanupTimer);\n\t\t\tthis.cleanupTimer = undefined;\n\t\t}\n\t\tthis.records.clear();\n\t}\n}\n","import * as http from \"node:http\";\nimport * as http2 from \"node:http2\";\nimport * as net from \"node:net\";\nimport type { MeshNode } from \"../mesh/index.js\";\nimport {\n\tmanifestCacheSize,\n\tmeshPeersConnected,\n\tprotocolMetrics,\n} from \"../observability/metrics.js\";\nimport type { AuthInfo, JwtValidator } from \"../security/jwt-validator.js\";\nimport { buildProtectedResourceMetadata } from \"../security/prm.js\";\nimport type { LiopServer } from \"../server/index.js\";\nimport { log } from \"../utils/logger.js\";\nimport {\n\tdispatchGrpcWebRequest,\n\tGRPC_WEB_CONSTANTS,\n\tisGrpcWebRequest,\n} from \"./grpc-web.js\";\nimport {\n\tInMemoryRateLimiter,\n\ttype RateLimiterOptions,\n} from \"./rate-limiter.js\";\nimport { LiopMcpRouter } from \"./router.js\";\n\n/**\n * LIOP Hybrid Gateway\n * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.\n */\nexport class LiopHybridGateway {\n\tprivate netServer: net.Server;\n\tprivate h2Server: http2.Http2Server;\n\tprivate h1Server: http.Server;\n\tprivate router: LiopMcpRouter;\n\tprivate jwtValidator?: JwtValidator;\n\t// biome-ignore lint/suspicious/noExplicitAny: oidc-provider is loaded in Phase C\n\tprivate oauthProvider?: any;\n\tprivate rateLimiter: InMemoryRateLimiter;\n\tprivate isDraining = false;\n\tprivate activeRequests = 0;\n\n\tconstructor(\n\t\tprivate liopServer: LiopServer,\n\t\tprivate meshNode: MeshNode | null = null,\n\t\trpcPort: number = 50051,\n\t\trateLimiterOptions?: RateLimiterOptions,\n\t) {\n\t\tthis.jwtValidator = this.liopServer.jwtValidator;\n\t\tthis.oauthProvider = this.liopServer.oauthProvider;\n\t\tthis.rateLimiter = new InMemoryRateLimiter(rateLimiterOptions);\n\n\t\t// Initialize the Universal Router\n\t\tthis.router = new LiopMcpRouter(this.liopServer, this.meshNode, rpcPort);\n\n\t\t// Internal HTTP/2 Server (for Native gRPC Proxying)\n\t\tthis.h2Server = http2.createServer();\n\t\tthis.setupH2Routes();\n\n\t\t// Internal HTTP/1 Server (for Browser/MCP)\n\t\tthis.h1Server = http.createServer();\n\t\tthis.setupH1Routes();\n\n\t\t// Primary Multiplexer (L4)\n\t\tthis.netServer = net.createServer((socket) => {\n\t\t\tsocket.once(\"data\", (buffer) => {\n\t\t\t\tconst isHttp2 = buffer.toString().startsWith(\"PRI * HTTP/2.0\");\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Incoming L4 Connection. Protocol: ${isHttp2 ? \"HTTP/2 (gRPC)\" : \"HTTP/1.1 (MCP)\"}`,\n\t\t\t\t);\n\t\t\t\tif (isHttp2) {\n\t\t\t\t\tthis.h2Server.emit(\"connection\", socket);\n\t\t\t\t} else {\n\t\t\t\t\tthis.h1Server.emit(\"connection\", socket);\n\t\t\t\t}\n\t\t\t\tsocket.unshift(buffer);\n\t\t\t});\n\t\t\tsocket.on(\"error\", (err) =>\n\t\t\t\tlog.error(`[LIOP-Gateway] NetServer Socket Error: ${err.message}`),\n\t\t\t);\n\t\t});\n\n\t\t// Attach error listeners to sub-servers to catch silent failures\n\t\tthis.h1Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H1 Server Error: ${err.message}`),\n\t\t);\n\t\tthis.h2Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H2 Server Error: ${err.message}`),\n\t\t);\n\n\t\tlog.info(\"[LIOP-Gateway] Hybrid adapter initialized.\");\n\t}\n\n\tprivate setupH2Routes() {\n\t\tthis.h2Server.on(\"stream\", (stream, headers) => {\n\t\t\tconst contentType = headers[\"content-type\"] as string;\n\t\t\tconst path = headers[\":path\"] as string;\n\n\t\t\tif (contentType === \"application/grpc\") {\n\t\t\t\tthis.handleGrpcStream(stream as http2.ServerHttp2Stream);\n\t\t\t} else if (path === \"/mcp\") {\n\t\t\t\tthis.handleMcpH2Stream(stream as http2.ServerHttp2Stream, headers);\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate setupH1Routes() {\n\t\tthis.h1Server.on(\"request\", async (req, res) => {\n\t\t\tthis.activeRequests += 1;\n\t\t\tconst onDone = () => {\n\t\t\t\tres.removeListener(\"finish\", onDone);\n\t\t\t\tres.removeListener(\"close\", onDone);\n\t\t\t\tthis.activeRequests = Math.max(0, this.activeRequests - 1);\n\t\t\t};\n\t\t\tres.on(\"finish\", onDone);\n\t\t\tres.on(\"close\", onDone);\n\n\t\t\tconst url = req.url || \"\";\n\t\t\tconst method = req.method;\n\n\t\t\t// [Phase Beta-3] Prometheus Metrics Endpoint\n\t\t\tif (method === \"GET\" && url === \"/metrics\") {\n\t\t\t\tif (this.meshNode) {\n\t\t\t\t\tmeshPeersConnected.set({}, this.meshNode.getPeers().length);\n\t\t\t\t}\n\t\t\t\tif (this.router) {\n\t\t\t\t\tmanifestCacheSize.set({}, this.router.getManifestCacheSize());\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, {\n\t\t\t\t\t\"Content-Type\": \"text/plain; version=0.0.4; charset=utf-8\",\n\t\t\t\t});\n\t\t\t\tres.end(protocolMetrics.exportPrometheusText());\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Liveness Probe\n\t\t\tif (method === \"GET\" && url === \"/healthz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ok\",\n\t\t\t\t\t\tuptime: Math.floor(process.uptime()),\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Readiness Probe\n\t\t\tif (method === \"GET\" && url === \"/readyz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst meshStarted = this.meshNode ? this.meshNode.isStarted() : true;\n\t\t\t\tif (!meshStarted) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"unready\",\n\t\t\t\t\t\t\tmeshStarted: false,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ready\",\n\t\t\t\t\t\tmeshStarted: true,\n\t\t\t\t\t\tpeers: this.meshNode ? this.meshNode.getPeers().length : 0,\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Reject new MCP requests if draining\n\t\t\tif (this.isDraining && url === \"/mcp\") {\n\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tcode: -32000,\n\t\t\t\t\t\t\tmessage: \"Gateway is draining connections for shutdown\",\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-2] gRPC-Web HTTP/1.1 Framing Fallback\n\t\t\tconst contentType = req.headers[\"content-type\"];\n\t\t\tif (isGrpcWebRequest(contentType)) {\n\t\t\t\tawait dispatchGrpcWebRequest(req, res, async (reqPath, payload) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] gRPC-Web fallback call: ${reqPath} (${payload.length} bytes)`,\n\t\t\t\t\t);\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: GRPC_WEB_CONSTANTS.STATUS_OK,\n\t\t\t\t\t\tmessage: \"OK\",\n\t\t\t\t\t\tdata: Buffer.from(\"\"),\n\t\t\t\t\t};\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [SEC] M2M OAuth 2.1 OIDC Authorization Server Router (Phase C proxy)\n\t\t\tif (url.startsWith(\"/oidc\") && this.oauthProvider) {\n\t\t\t\tconst callback =\n\t\t\t\t\ttypeof this.oauthProvider.callback === \"function\"\n\t\t\t\t\t\t? this.oauthProvider.callback()\n\t\t\t\t\t\t: this.oauthProvider;\n\t\t\t\t// Rewrite req.url to strip the '/oidc' prefix before delegating to oidc-provider\n\t\t\t\tconst originalUrl = req.url;\n\t\t\t\treq.url = (originalUrl || \"\").slice(5) || \"/\";\n\t\t\t\ttry {\n\t\t\t\t\treturn callback(req, res);\n\t\t\t\t} finally {\n\t\t\t\t\treq.url = originalUrl;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// [SEC] RFC 9728 Protected Resource Metadata (PRM) Endpoint\n\t\t\tif (method === \"GET\" && url === \"/.well-known/oauth-protected-resource\") {\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst prm = buildProtectedResourceMetadata(\n\t\t\t\t\t\tthis.jwtValidator.getIssuer(),\n\t\t\t\t\t\tthis.jwtValidator.getAudience(),\n\t\t\t\t\t);\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(JSON.stringify(prm));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\tmethod === \"GET\" &&\n\t\t\t\t(url === \"/\" || url === \"/mcp\" || url === \"/health\")\n\t\t\t) {\n\t\t\t\tif (\n\t\t\t\t\turl === \"/health\" &&\n\t\t\t\t\treq.headers.accept?.includes(\"application/json\")\n\t\t\t\t) {\n\t\t\t\t\tconst meshInfo = this.meshNode\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\tpeerId: this.meshNode.getPeerId()?.toString() || \"\",\n\t\t\t\t\t\t\t\tmultiaddrs: this.meshNode\n\t\t\t\t\t\t\t\t\t.getMultiaddrs()\n\t\t\t\t\t\t\t\t\t.map((m) => m.toString()),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: null;\n\t\t\t\t\tconst issuer = this.jwtValidator?.getIssuer();\n\t\t\t\t\tconst baseUrl = issuer\n\t\t\t\t\t\t? issuer.endsWith(\"/oidc\")\n\t\t\t\t\t\t\t? issuer\n\t\t\t\t\t\t\t: `${issuer}/oidc`\n\t\t\t\t\t\t: \"\";\n\t\t\t\t\tconst authInfoResponse =\n\t\t\t\t\t\tthis.jwtValidator && issuer\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tissuer,\n\t\t\t\t\t\t\t\t\tjwks_uri: `${baseUrl}/jwks`,\n\t\t\t\t\t\t\t\t\t...(this.oauthProvider\n\t\t\t\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\t\t\t\ttoken_endpoint: `${baseUrl}/token`,\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: undefined;\n\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"healthy\",\n\t\t\t\t\t\t\tnode: this.liopServer.getServerInfo(),\n\t\t\t\t\t\t\tmesh: meshInfo,\n\t\t\t\t\t\t\ttools: this.liopServer.listTools().map((t) => t.name),\n\t\t\t\t\t\t\tauth: authInfoResponse,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(`\n                    <body style=\"background:#0f172a;color:#f8fafc;font-family:sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;margin:0\">\n                        <div style=\"background:#1e293b;padding:40px;border-radius:16px;border:1px solid #38bdf8;text-align:center;box-shadow:0 20px 25px -5px rgba(0,0,0,0.1)\">\n                            <h1 style=\"color:#38bdf8;margin-top:0\">LIOP Protocol Transformer</h1>\n                            <p style=\"opacity:0.8;font-weight:600\">L4/L7 Transcoding: JSON-RPC &harr; gRPC</p>\n                            <p style=\"opacity:0.6;font-size:14px\">Active Protections: Kyber768 + AES-256-GCM + ZK-Proof Ready</p>\n                            <div style=\"background:#0f172a;padding:15px;border-radius:8px;margin-top:20px;border:1px dashed #334155\">\n                                <code style=\"color:#10b981\">Endpoint: http://localhost:3000/mcp</code>\n                            </div>\n                        </div>\n                    </body>\n                `);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (url === \"/mcp\" && method === \"POST\") {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = req.headers.authorization;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tlet body = \"\";\n\t\t\t\treq.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\t\t\treq.on(\"end\", async () => {\n\t\t\t\t\t// [SEC] Rate limiting per IP or authenticated client (OWASP API4:2023)\n\t\t\t\t\tconst clientIp = req.socket.remoteAddress || \"127.0.0.1\";\n\t\t\t\t\tconst rateLimitKey = authInfo?.clientId\n\t\t\t\t\t\t? `client:${authInfo.clientId}`\n\t\t\t\t\t\t: `ip:${clientIp}`;\n\t\t\t\t\tconst rateStatus = this.rateLimiter.check(rateLimitKey);\n\t\t\t\t\tif (!rateStatus.allowed) {\n\t\t\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t\t\"Retry-After\": Math.ceil(rateStatus.resetMs / 1000).toString(),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\tid: null,\n\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\tcode: -32029,\n\t\t\t\t\t\t\t\t\tmessage: \"Rate limit exceeded. Too many requests.\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t\t\t// [SEP-2243] Header-based routing validation\n\t\t\t\t\t\tconst mcpMethod = req.headers[\"mcp-method\"] as string | undefined;\n\t\t\t\t\t\tconst mcpName = req.headers[\"mcp-name\"] as string | undefined;\n\t\t\t\t\t\tconst mcpVersion = req.headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t\t\t| string\n\t\t\t\t\t\t\t| undefined;\n\n\t\t\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\tmcpName &&\n\t\t\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\t!jsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\tres.end(JSON.stringify(response));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Gateway] Error processing JSON-RPC payload: ${(e as Error).message}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tres.writeHead(400);\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\terror: { code: -32700, message: \"Parse error\" },\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate handleGrpcStream(stream: http2.ServerHttp2Stream) {\n\t\tstream.on(\"data\", (chunk: unknown) => {\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Standard gRPC stream data is Buffer\n\t\t\tconst data = chunk as any;\n\t\t\tif (data)\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Native gRPC Proxy passing ${data.length} bytes`,\n\t\t\t\t);\n\t\t});\n\t\tstream.respond({ \":status\": 200, \"content-type\": \"application/grpc\" });\n\t\tstream.end();\n\t}\n\n\tprivate handleMcpH2Stream(\n\t\tstream: http2.ServerHttp2Stream,\n\t\theaders: http2.IncomingHttpHeaders,\n\t) {\n\t\tlet body = \"\";\n\t\tstream.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\tstream.on(\"end\", async () => {\n\t\t\ttry {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token over HTTP/2 (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = headers.authorization as string;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t// [SEP-2243] Header-based routing validation in HTTP/2\n\t\t\t\tconst mcpMethod = headers[\"mcp-method\"] as string | undefined;\n\t\t\t\tconst mcpName = headers[\"mcp-name\"] as string | undefined;\n\t\t\t\tconst mcpVersion = headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t| string\n\t\t\t\t\t| undefined;\n\n\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (\n\t\t\t\t\tmcpName &&\n\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t}\n\t\t\t\t\tif (\n\t\t\t\t\t\t!jsonRequest.params._meta[\"io.modelcontextprotocol/protocolVersion\"]\n\t\t\t\t\t) {\n\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\tif (response) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 200,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(JSON.stringify(response));\n\t\t\t\t} else stream.close();\n\t\t\t} catch (_e) {\n\t\t\t\tstream.respond({ \":status\": 400 });\n\t\t\t\tstream.end();\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic async listen(port: number, host: string = \"0.0.0.0\"): Promise<number> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.start();\n\n\t\t\t// Announce all local tools to the DHT\n\t\t\tconst tools = this.liopServer.listTools();\n\t\t\tfor (const tool of tools) {\n\t\t\t\tawait this.meshNode.announceCapability(tool.name);\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] 📡 Announced local tool to Mesh: ${tool.name}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tthis.netServer.on(\"error\", (err: Error & { code?: string }) => {\n\t\t\t\tif (err.code === \"EADDRINUSE\") {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] FATAL: Port ${port} is already in use by another process.`,\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\tlog.error(`[LIOP-Gateway] Binding Error: ${err.message}`);\n\t\t\t\t}\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tthis.netServer.listen(port, host, () => {\n\t\t\t\tconst addr = this.netServer.address();\n\t\t\t\tconst actualHost =\n\t\t\t\t\ttypeof addr === \"string\" ? addr : addr?.address || host;\n\t\t\t\tconst assignedPort =\n\t\t\t\t\ttypeof addr === \"string\" ? port : addr?.port || port;\n\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] ✅ Transformer Mesh Gateway READY and listening on ${actualHost}:${assignedPort}`,\n\t\t\t\t);\n\t\t\t\tresolve(assignedPort);\n\t\t\t});\n\t\t});\n\t}\n\n\tpublic isDrained(): boolean {\n\t\treturn this.isDraining;\n\t}\n\n\tpublic async drain(timeoutMs = 5000): Promise<void> {\n\t\tthis.isDraining = true;\n\t\tlog.info(\n\t\t\t`[LIOP-Gateway] Draining gateway connections (active: ${this.activeRequests}, timeout: ${timeoutMs}ms)...`,\n\t\t);\n\t\tconst start = Date.now();\n\t\twhile (this.activeRequests > 0 && Date.now() - start < timeoutMs) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, 50));\n\t\t}\n\t\tawait this.stop();\n\t}\n\n\tpublic async stop() {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t\tthis.rateLimiter.close();\n\t\tthis.netServer.close();\n\t\tthis.h2Server.close();\n\t\tthis.h1Server.close();\n\t}\n\n\tpublic getRouter(): LiopMcpRouter {\n\t\treturn this.router;\n\t}\n}\n"]}