@nekzus/liop 2.4.0-alpha.24 → 2.4.0-alpha.25

package/dist/chunk-K3DGJLUY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/logger.ts"],"names":[],"mappings":";AAYO,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAe,QAAA;AAAA,EACP,KAAA,GAAkB,MAAA;AAAA,EAClB,WAAA;AAAA,EACA,eAAA,GAAkB,KAAA;AAAA,EAElB,WAAA,GAAc;AACrB,IAAA,IAAA,CAAK,eAAA,EAAgB;AAAA,EACtB;AAAA,EAEA,OAAc,WAAA,GAA0B;AACvC,IAAA,IAAI,CAAC,YAAW,QAAA,EAAU;AACzB,MAAA,WAAA,CAAW,QAAA,GAAW,IAAI,WAAA,EAAW;AAAA,IACtC;AACA,IAAA,OAAO,WAAA,CAAW,QAAA;AAAA,EACnB;AAAA,EAEQ,eAAA,GAAkB;AACzB,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,cAAA,EAAgB,WAAA,EAAY;AACzD,IAAA,IACC,QAAA,KAAa,YACb,QAAA,KAAa,OAAA,IACb,aAAa,MAAA,IACb,QAAA,KAAa,MAAA,IACb,QAAA,KAAa,OAAA,EACZ;AACD,MAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AAAA,IACd,CAAA,MAAO;AAEN,MAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAA,IACd;AAAA,EACD;AAAA,EAEO,SAAS,KAAA,EAAiB;AAChC,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,eAAe,WAAA,EAAyC;AAC9D,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA;AAAA,EACpB;AAAA,EAEQ,UAAU,WAAA,EAAgC;AACjD,IAAA,MAAM,MAAA,GAAmC;AAAA,MACxC,MAAA,EAAQ,CAAA;AAAA,MACR,KAAA,EAAO,CAAA;AAAA,MACP,IAAA,EAAM,CAAA;AAAA,MACN,IAAA,EAAM,CAAA;AAAA,MACN,KAAA,EAAO;AAAA,KACR;AACA,IAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,IAAK,OAAO,WAAW,CAAA;AAAA,EAChD;AAAA,EAEQ,aAAA,CAAc,OAAe,OAAA,EAAyB;AAC7D,IAAA,MAAM,EAAA,GAAA,iBAAK,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAClC,IAAA,OAAO,CAAA,CAAA,EAAI,EAAE,CAAA,GAAA,EAAM,KAAK,KAAK,OAAO,CAAA,CAAA;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,iBAAA,CACP,KAAA,EACA,gBAAA,EACA,IAAA,EACO;AACP,IAAA,IAAI,CAAC,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,eAAA,EAAiB;AAC/C,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA;AACvB,IAAA,MAAM,KAAA,GAKD,OAAO,MAAA,CAAO;AAAA,MAClB,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,MAClC,KAAA;AAAA,MACA,OAAA,EAAS,gBAAA;AAAA,MACT,MAAM,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,IAAI,CAAC;AAAA,KAC7B,CAAA;AACD,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,WAAA,CAAY,KAAK,CAAA;AACrC,MAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,WAAW,MAAA,EAAQ;AAC9D,QAAC,MAAA,CAAyB,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MACzC;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER,CAAA,SAAE;AACD,MAAA,IAAA,CAAK,eAAA,GAAkB,KAAA;AAAA,IACxB;AAAA,EACD;AAAA,EAEO,KAAA,CAAM,YAAoB,IAAA,EAAiB;AACjD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAC5B,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,aAAA,CAAc,OAAA,EAAS,OAAO,CAAA;AACrD,MAAA,OAAA,CAAQ,KAAA,CAAM,SAAA,EAAW,GAAG,IAAI,CAAA;AAChC,MAAA,IAAA,CAAK,iBAAA,CAAkB,OAAA,EAAS,SAAA,EAAW,IAAI,CAAA;AAAA,IAChD;AAAA,EACD;AAAA,EAEO,IAAA,CAAK,YAAoB,IAAA,EAAiB;AAChD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG;AAC3B,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AACpD,MAAA,OAAA,CAAQ,KAAA,CAAM,SAAA,EAAW,GAAG,IAAI,CAAA;AAChC,MAAA,IAAA,CAAK,iBAAA,CAAkB,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AAAA,IAC/C;AAAA,EACD;AAAA,EAEO,IAAA,CAAK,YAAoB,IAAA,EAAiB;AAChD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG;AAC3B,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,aAAA,CAAc,MAAA,EAAQ,OAAO,CAAA;AACpD,MAAA,OAAA,CAAQ,KAAA,CAAM,SAAA,EAAW,GAAG,IAAI,CAAA;AAChC,MAAA,IAAA,CAAK,iBAAA,CAAkB,MAAA,EAAQ,SAAA,EAAW,IAAI,CAAA;AAAA,IAC/C;AAAA,EACD;AAAA,EAEO,KAAA,CAAM,YAAoB,IAAA,EAAiB;AACjD,IAAA,IAAI,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAC5B,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,aAAA,CAAc,OAAA,EAAS,OAAO,CAAA;AACrD,MAAA,OAAA,CAAQ,KAAA,CAAM,SAAA,EAAW,GAAG,IAAI,CAAA;AAChC,MAAA,IAAA,CAAK,iBAAA,CAAkB,OAAA,EAAS,SAAA,EAAW,IAAI,CAAA;AAAA,IAChD;AAAA,EACD;AACD;AAEO,IAAM,GAAA,GAAM,WAAW,WAAA","file":"chunk-K3DGJLUY.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { LogInterceptor } from \"../interceptors/log-interceptor.js\";\n\nexport type LogLevel = \"silent\" | \"error\" | \"warn\" | \"info\" | \"debug\";\n\n/**\n * LiopLogger - Structured Logging Abstraction\n * Configurable via `process.env.LIOP_LOG_LEVEL`.\n * Emits strictly to stderr to comply with MCP stdio protocols.\n */\nexport class LiopLogger {\n\tprivate static instance: LiopLogger;\n\tprivate level: LogLevel = \"info\";\n\tprivate interceptor?: LogInterceptor;\n\tprivate _isIntercepting = false;\n\n\tprivate constructor() {\n\t\tthis.setLevelFromEnv();\n\t}\n\n\tpublic static getInstance(): LiopLogger {\n\t\tif (!LiopLogger.instance) {\n\t\t\tLiopLogger.instance = new LiopLogger();\n\t\t}\n\t\treturn LiopLogger.instance;\n\t}\n\n\tprivate setLevelFromEnv() {\n\t\tconst envLevel = process.env.LIOP_LOG_LEVEL?.toLowerCase();\n\t\tif (\n\t\t\tenvLevel === \"silent\" ||\n\t\t\tenvLevel === \"error\" ||\n\t\t\tenvLevel === \"warn\" ||\n\t\t\tenvLevel === \"info\" ||\n\t\t\tenvLevel === \"debug\"\n\t\t) {\n\t\t\tthis.level = envLevel as LogLevel;\n\t\t} else {\n\t\t\t// Default level: info\n\t\t\tthis.level = \"info\";\n\t\t}\n\t}\n\n\tpublic setLevel(level: LogLevel) {\n\t\tthis.level = level;\n\t}\n\n\t/**\n\t * Registers a technology-agnostic log interceptor.\n\t * Pass `undefined` to disable interception (zero overhead).\n\t */\n\tpublic setInterceptor(interceptor: LogInterceptor | undefined) {\n\t\tthis.interceptor = interceptor;\n\t}\n\n\tprivate shouldLog(targetLevel: LogLevel): boolean {\n\t\tconst levels: Record<LogLevel, number> = {\n\t\t\tsilent: 0,\n\t\t\terror: 1,\n\t\t\twarn: 2,\n\t\t\tinfo: 3,\n\t\t\tdebug: 4,\n\t\t};\n\t\treturn levels[this.level] >= levels[targetLevel];\n\t}\n\n\tprivate formatMessage(level: string, message: string): string {\n\t\tconst ts = new Date().toISOString();\n\t\treturn `[${ts}] [${level}] ${message}`;\n\t}\n\n\t/**\n\t * Fire-and-forget async dispatch to the registered interceptor.\n\t * Recursion guard prevents infinite loops when the interceptor\n\t * itself triggers logging (directly or transitively).\n\t */\n\tprivate emitToInterceptor(\n\t\tlevel: LogLevel,\n\t\tformattedMessage: string,\n\t\targs: unknown[],\n\t): void {\n\t\tif (!this.interceptor || this._isIntercepting) return;\n\t\tthis._isIntercepting = true;\n\t\tconst event: Readonly<{\n\t\t\ttimestamp: string;\n\t\t\tlevel: LogLevel;\n\t\t\tmessage: string;\n\t\t\targs: readonly unknown[];\n\t\t}> = Object.freeze({\n\t\t\ttimestamp: new Date().toISOString(),\n\t\t\tlevel,\n\t\t\tmessage: formattedMessage,\n\t\t\targs: Object.freeze([...args]),\n\t\t});\n\t\ttry {\n\t\t\tconst result = this.interceptor(event);\n\t\t\tif (result && typeof result === \"object\" && \"catch\" in result) {\n\t\t\t\t(result as Promise<void>).catch(() => {});\n\t\t\t}\n\t\t} catch {\n\t\t\t// Interceptor errors are silenced to protect protocol throughput\n\t\t} finally {\n\t\t\tthis._isIntercepting = false;\n\t\t}\n\t}\n\n\tpublic error(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"error\")) {\n\t\t\tconst formatted = this.formatMessage(\"ERROR\", message);\n\t\t\tconsole.error(formatted, ...args);\n\t\t\tthis.emitToInterceptor(\"error\", formatted, args);\n\t\t}\n\t}\n\n\tpublic warn(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"warn\")) {\n\t\t\tconst formatted = this.formatMessage(\"WARN\", message);\n\t\t\tconsole.error(formatted, ...args);\n\t\t\tthis.emitToInterceptor(\"warn\", formatted, args);\n\t\t}\n\t}\n\n\tpublic info(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"info\")) {\n\t\t\tconst formatted = this.formatMessage(\"INFO\", message);\n\t\t\tconsole.error(formatted, ...args);\n\t\t\tthis.emitToInterceptor(\"info\", formatted, args);\n\t\t}\n\t}\n\n\tpublic debug(message: string, ...args: unknown[]) {\n\t\tif (this.shouldLog(\"debug\")) {\n\t\t\tconst formatted = this.formatMessage(\"DEBUG\", message);\n\t\t\tconsole.error(formatted, ...args);\n\t\t\tthis.emitToInterceptor(\"debug\", formatted, args);\n\t\t}\n\t}\n}\n\nexport const log = LiopLogger.getInstance();\n"]}

package/dist/chunk-KR5UZUEY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/gateway/mcp-compat.ts","../src/types.ts"],"names":[],"mappings":";;;;;AAiBO,IAAM,0BAAA,GAA6B;AAKnC,IAAM,2BAAA,GAA8B;AAKpC,SAAS,6BAAA,CACf,YACA,EAAA,EACc;AACd,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,IAAI,EAAA,IAAM,IAAA;AAAA,IACV,MAAA,EAAQ;AAAA,MACP,eAAA,EAAiB,2BAAA;AAAA,MACjB,YAAA,EAAc;AAAA,QACb,KAAA,EAAO,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC3B,SAAA,EAAW,EAAE,WAAA,EAAa,IAAA,EAAK;AAAA,QAC/B,OAAA,EAAS,EAAE,WAAA,EAAa,IAAA;AAAK,OAC9B;AAAA,MACA;AAAA;AACD,GACD;AACD;AAOO,SAAS,gBAAgB,OAAA,EAA8B;AAC7D,EAAA,IACC,OAAA,CAAQ,MAAA,KAAW,YAAA,IACnB,OAAA,CAAQ,WAAW,2BAAA,EAClB;AACD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA;AACvB,EAAA,MAAM,OAAO,MAAA,EAAQ,KAAA;AACrB,EAAA,MAAM,OAAA,GAAU,OAAO,yCAAyC,CAAA;AAEhE,EAAA,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,2BAAA,EAA6B;AACxD,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAA;AACR;AAMO,SAAS,6BACf,QAAA,EACc;AACd,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,IAAU,OAAO,QAAA,CAAS,WAAW,QAAA,EAAU;AAC5D,IAAA,OAAO,QAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAA,GAAY,EAAE,GAAI,QAAA,CAAS,MAAA,EAAmC;AAGpE,EAAA,OAAO,SAAA,CAAU,UAAA;AACjB,EAAA,OAAO,SAAA,CAAU,KAAA;AACjB,EAAA,OAAO,SAAA,CAAU,UAAA;AAEjB,EAAA,OAAO;AAAA,IACN,GAAG,QAAA;AAAA,IACH,MAAA,EAAQ;AAAA,GACT;AACD;AAMO,IAAM,YAAA,GAAuC;AAAA,EACnD,SAAA,EAAW,qCAAA;AAAA,EACX,cAAA,EAAgB,qCAAA;AAAA,EAChB,UAAA,EAAY,mCAAA;AAAA,EACZ,eAAA,EAAiB,mCAAA;AAAA,EACjB,WAAA,EAAa,yBAAA;AAAA,EACb,iBAAA,EAAmB;AACpB;AAMO,SAAS,uBACf,IAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,MAAM,UAAA,GAAa,EAAE,GAAG,IAAA,EAAK;AAC7B,EAAA,IAAI,UAAA,CAAW,SAAS,MAAA,EAAW;AAClC,IAAA,IAAI,UAAA,CAAW,YAAY,MAAA,EAAW;AACrC,MAAA,UAAA,CAAW,UAAU,UAAA,CAAW,IAAA;AAAA,IACjC;AACA,IAAA,IAAI,UAAA,CAAW,aAAa,MAAA,EAAW;AACtC,MAAA,UAAA,CAAW,WAAW,UAAA,CAAW,IAAA;AAAA,IAClC;AAAA,EACD;AACA,EAAA,OAAO,UAAA;AACR;;;ACrHO,IAAM,oBAAA,GAAuB;AAyD7B,IAAM,UAAA,GAAa,EAAE,MAAA,CAAO;AAAA,EAClC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,EAAE,MAAA,CAAO,CAAA,CAAE,QAAO,EAAG,CAAA,CAAE,SAAS;AAAA;AAC9C,CAAC;AAIM,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EACtC,GAAA,EAAK,EAAE,MAAA,EAAO;AAAA,EACd,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACtB,CAAC;AAIM,IAAM,YAAA,GAAe,EAAE,MAAA,CAAO;AAAA,EACpC,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,EACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,WAAW,CAAA,CACT,KAAA;AAAA,IACA,EAAE,MAAA,CAAO;AAAA,MACR,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,MACf,WAAA,EAAa,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,MACjC,QAAA,EAAU,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS,KAC/B;AAAA,IAED,QAAA;AACH,CAAC","file":"chunk-KR5UZUEY.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { McpRequest, McpResponse, ServerInfo } from \"../types.js\";\n\n/**\n * @mcp-legacy ENTIRE FILE — MCP 2025-era backward compatibility layer.\n * Remove this file when MCP v1 (2025-11-25) reaches EOL.\n *\n * SUNSET INSTRUCTION: Delete this file, then grep for \"@mcp-legacy\" in the\n * codebase to find and remove all remaining legacy seams.\n */\n\n/**\n * @mcp-legacy Master kill switch for MCP 2025-era backward compatibility.\n * Set to `false` when MCP v1 reaches End-of-Life (EOL) to disable all legacy seams.\n */\nexport const MCP_LEGACY_SUPPORT_ENABLED = true;\n\n/**\n * @mcp-legacy Legacy protocol version constant.\n */\nexport const MCP_PROTOCOL_VERSION_LEGACY = \"2025-11-25\" as const;\n\n/**\n * @mcp-legacy Build the legacy initialize handshake response.\n */\nexport function buildLegacyInitializeResponse(\n\tserverInfo: ServerInfo,\n\tid?: string | number | null,\n): McpResponse {\n\treturn {\n\t\tjsonrpc: \"2.0\",\n\t\tid: id ?? null,\n\t\tresult: {\n\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\tcapabilities: {\n\t\t\t\ttools: { listChanged: true },\n\t\t\t\tresources: { listChanged: true },\n\t\t\t\tprompts: { listChanged: true },\n\t\t\t},\n\t\t\tserverInfo,\n\t\t},\n\t};\n}\n\n/**\n * @mcp-legacy Detect if a request is strictly from a 2025-era legacy client.\n * Legacy requests either invoke 'initialize', 'notifications/initialized',\n * or lack modern '_meta' protocol envelopes.\n */\nexport function isLegacyRequest(request: McpRequest): boolean {\n\tif (\n\t\trequest.method === \"initialize\" ||\n\t\trequest.method === \"notifications/initialized\"\n\t) {\n\t\treturn true;\n\t}\n\n\tconst params = request.params as Record<string, unknown> | undefined;\n\tconst meta = params?._meta as Record<string, unknown> | undefined;\n\tconst version = meta?.[\"io.modelcontextprotocol/protocolVersion\"];\n\n\tif (!version || version === MCP_PROTOCOL_VERSION_LEGACY) {\n\t\treturn true;\n\t}\n\n\treturn false;\n}\n\n/**\n * @mcp-legacy Wrap and strip modern-era fields (resultType, ttlMs, cacheScope, etc.)\n * from a response to ensure 100% wire-compatibility with strict 2025 MCP clients.\n */\nexport function adaptResponseForLegacyClient(\n\tresponse: McpResponse,\n): McpResponse {\n\tif (!response.result || typeof response.result !== \"object\") {\n\t\treturn response;\n\t}\n\n\tconst rawResult = { ...(response.result as Record<string, unknown>) };\n\n\t// Strip modern-only envelope tags\n\tdelete rawResult.resultType;\n\tdelete rawResult.ttlMs;\n\tdelete rawResult.cacheScope;\n\n\treturn {\n\t\t...response,\n\t\tresult: rawResult,\n\t};\n}\n\n/**\n * Canonical tool aliases mapping legacy or shorthand tool names\n * to production enclave capabilities.\n */\nexport const TOOL_ALIASES: Record<string, string> = {\n\tbank_tool: \"Analyze_Synthetic_Bank_Transactions\",\n\tbank_tool_XDwd: \"Analyze_Synthetic_Bank_Transactions\",\n\tvault_tool: \"Analyze_Synthetic_Medical_Records\",\n\tvault_tool_E8wP: \"Analyze_Synthetic_Medical_Records\",\n\toracle_tool: \"Analyze_HFT_Market_Data\",\n\tcompute_aggregate: \"Analyze_Synthetic_Bank_Transactions\",\n};\n\n/**\n * Normalizes tool invocation parameters to satisfy dual parameter conventions.\n * If data is passed instead of payload or envelope, maps data to both fields.\n */\nexport function normalizeToolArguments(\n\targs?: Record<string, unknown>,\n): Record<string, unknown> {\n\tif (!args) return {};\n\tconst normalized = { ...args };\n\tif (normalized.data !== undefined) {\n\t\tif (normalized.payload === undefined) {\n\t\t\tnormalized.payload = normalized.data;\n\t\t}\n\t\tif (normalized.envelope === undefined) {\n\t\t\tnormalized.envelope = normalized.data;\n\t\t}\n\t}\n\treturn normalized;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { z } from \"zod\";\n\n/**\n * Protocol Version Identifiers\n */\nexport const MCP_PROTOCOL_VERSION = \"2026-07-28\" as const;\n\nexport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"./gateway/mcp-compat.js\";\n\n/**\n * Protocol Era Classification\n */\nexport type McpEra = \"legacy\" | \"modern\";\n\n/**\n * Caching Hints for MCP 2026-07-28 Spec\n */\nexport interface CacheableResult {\n\tttlMs?: number;\n\tcacheScope?: \"public\" | \"private\";\n}\n\n/**\n * Multi-Round-Trip Requests (MRTR) Specification Types\n */\nexport interface InputRequest {\n\tid: string;\n\tmessage: string;\n\tschema?: Record<string, unknown>;\n}\n\nexport interface InputResponse {\n\tid: string;\n\tvalue: unknown;\n}\n\nexport interface InputRequiredResult {\n\tresultType: \"input_required\";\n\tinputRequests: InputRequest[];\n\trequestState?: string;\n}\n\n/**\n * Modern Envelope Metadata (_meta)\n */\nexport interface McpRequestMeta {\n\t\"io.modelcontextprotocol/protocolVersion\"?: string;\n\t\"io.modelcontextprotocol/clientInfo\"?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\t\"io.modelcontextprotocol/clientCapabilities\"?: Record<string, unknown>;\n\t[key: string]: unknown;\n}\n\n/**\n * Base Protocol Types representing parity with Model Context Protocol\n */\n\nexport const ToolSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tinputSchema: z.record(z.string(), z.unknown()), // Represents a JSON Schema\n});\n\nexport type Tool = z.infer<typeof ToolSchema>;\n\nexport const ResourceSchema = z.object({\n\turi: z.string(),\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\tmimeType: z.string().optional(),\n});\n\nexport type Resource = z.infer<typeof ResourceSchema>;\n\nexport const PromptSchema = z.object({\n\tname: z.string(),\n\tdescription: z.string().optional(),\n\targuments: z\n\t\t.array(\n\t\t\tz.object({\n\t\t\t\tname: z.string(),\n\t\t\t\tdescription: z.string().optional(),\n\t\t\t\trequired: z.boolean().optional(),\n\t\t\t}),\n\t\t)\n\t\t.optional(),\n});\n\nexport type Prompt = z.infer<typeof PromptSchema>;\n\nexport interface CallToolRequest {\n\tname: string;\n\targuments?: Record<string, unknown>;\n}\n\nexport interface CallToolResult {\n\tcontent: Array<{\n\t\ttype: \"text\" | \"image\" | \"resource\";\n\t\ttext?: string;\n\t\tdata?: string;\n\t\tmimeType?: string;\n\t\tresource?: {\n\t\t\turi: string;\n\t\t\ttext?: string;\n\t\t\tblob?: string;\n\t\t};\n\t}>;\n\tisError?: boolean;\n\tzkVerified?: boolean;\n\tzkProofType?: import(\"./security/zk.js\").ProofType;\n}\n\nexport interface GetPromptRequest {\n\tname: string;\n\targuments?: Record<string, string>;\n}\n\nexport interface GetPromptResult {\n\tdescription?: string;\n\tmessages: Array<{\n\t\trole: \"user\" | \"assistant\";\n\t\tcontent:\n\t\t\t| { type: \"text\"; text: string }\n\t\t\t| { type: \"image\"; data: string; mimeType: string }\n\t\t\t| {\n\t\t\t\t\ttype: \"resource\";\n\t\t\t\t\tresource: { uri: string; text?: string; blob?: string };\n\t\t\t  };\n\t}>;\n}\n\nexport interface ServerInfo {\n\tname: string;\n\tversion: string;\n\tcapabilities?: {\n\t\tprompts?: { listChanged?: boolean };\n\t\tresources?: { subscribe?: boolean; listChanged?: boolean };\n\t\ttools?: { listChanged?: boolean };\n\t\t/** @mcp-legacy @deprecated Deprecated in MCP 2026-07-28 spec */\n\t\tlogging?: Record<string, unknown>;\n\t};\n}\n\nexport interface DiscoverResult {\n\tresultType: \"complete\";\n\tsupportedVersions: string[];\n\tcapabilities: ServerInfo[\"capabilities\"];\n\tserverInfo: ServerInfo;\n\tinstructions?: string;\n}\n\nexport interface McpRequest {\n\tmethod: string;\n\tparams?: unknown;\n\tid?: string | number | null;\n\tjsonrpc?: \"2.0\";\n}\n\nexport interface McpResponse {\n\tjsonrpc: \"2.0\";\n\tid?: string | number | null;\n\tresult?: unknown;\n\terror?: {\n\t\tcode: number;\n\t\tmessage: string;\n\t\tdata?: unknown;\n\t};\n}\n\n/**\n * Re-export Gateway Interceptor types for consumer convenience.\n */\nexport type {\n\tGatewayAdmissionResult,\n\tGatewayInterceptor,\n\tGatewayInterceptorContext,\n\tGatewayInterceptorOptions,\n} from \"./gateway/interceptor.js\";\nexport type { AuditInterceptor } from \"./interceptors/audit-interceptor.js\";\n/**\n * Re-export Log & Audit Interceptor types for consumer convenience.\n */\nexport type {\n\tLogEvent,\n\tLogInterceptor,\n} from \"./interceptors/log-interceptor.js\";\n/**\n * Re-export AuthInfo from the security module for convenience.\n * Compatible with MCP TypeScript SDK AuthInfo interface shape.\n */\nexport type { AuthInfo } from \"./security/jwt-validator.js\";\nexport type {\n\tZkJournalV2,\n\tZkPolicy,\n\tZkReceipt,\n} from \"./security/zk.js\";\n/**\n * Re-export Zero-Knowledge Proof & Verification types for consumer convenience.\n */\nexport {\n\tProofType,\n\tRECEIPT_VERSION_V1,\n\tRECEIPT_VERSION_V2,\n\tZK_JOURNAL_V2_SIZE,\n} from \"./security/zk.js\";\n"]}

package/dist/chunk-OHMZZMMC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/crypto/groth16-verifier.ts"],"names":[],"mappings":";;;AAWO,IAAM,8BAAA,GAAiC;AAQvC,SAAS,kBAAA,CACf,MACA,gBAAA,EACU;AACV,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,gBAAA,EAAkB,KAAA,EAAO;AACtC,IAAA,OAAO,KAAA;AAAA,EACR;AAEA,EAAA,IAAI;AACH,IAAA,OAAO,KAAA,CAAM,KAAA,CAAM,WAAA,CAAY,IAAA,EAAM,gBAAgB,CAAA;AAAA,EACtD,SAAS,MAAA,EAAQ;AAEhB,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAKO,SAAS,cAAc,IAAA,EAA+B;AAC5D,EAAA,IAAI;AACH,IAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,CAAO,IAAI,CAAA;AACzC,IAAA,OAAO,OAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,GAAG,OAAO,CAAA;AAAA,EACpD,SAAS,KAAA,EAAO;AACf,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,wCAAwC,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,KAC/F;AAAA,EACD;AACD;AAKO,SAAS,gBAAgB,GAAA,EAA8B;AAC7D,EAAA,IAAI;AACH,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AAC/C,IAAA,OAAO,aAAA,CAAc,OAAO,MAAM,CAAA;AAAA,EACnC,SAAS,KAAA,EAAO;AACf,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,0CAA0C,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,KACjG;AAAA,EACD;AACD;AAKO,SAAS,oBACf,gBAAA,EACS;AACT,EAAA,IAAI;AACH,IAAA,MAAM,OAAA,GAAU,aAAA,CAAc,MAAA,CAAO,gBAAgB,CAAA;AACrD,IAAA,OAAO,OAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,GAAG,OAAO,CAAA;AAAA,EACpD,SAAS,KAAA,EAAO;AACf,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,mCAAmC,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,KAC1F;AAAA,EACD;AACD;AAKO,SAAS,sBAAsB,GAAA,EAA+B;AACpE,EAAA,IAAI;AACH,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAA,CAAS,OAAO,CAAC,CAAA;AAC/C,IAAA,OAAO,aAAA,CAAc,OAAO,MAAM,CAAA;AAAA,EACnC,SAAS,KAAA,EAAO;AACf,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,qCAAqC,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,KAC5F;AAAA,EACD;AACD","file":"chunk-OHMZZMMC.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport {\n\tbn254,\n\ttype ProofWithSignals,\n\tstringBigints,\n\ttype VerificationKey,\n} from \"micro-zk-proofs\";\nimport { ZkVerificationError } from \"../security/zk.js\";\n\nexport const VERIFICATION_LATENCY_BUDGET_MS = 250;\n\nexport type { ProofWithSignals, VerificationKey };\n\n/**\n * Verifies a Groth16 Zero-Knowledge proof against a verification key.\n * Traps curve validation errors gracefully to ensure safe verification.\n */\nexport function verifyGroth16Proof(\n\tvkey: VerificationKey,\n\tproofWithSignals: ProofWithSignals,\n): boolean {\n\tif (!vkey || !proofWithSignals?.proof) {\n\t\treturn false;\n\t}\n\n\ttry {\n\t\treturn bn254.groth.verifyProof(vkey, proofWithSignals);\n\t} catch (_error) {\n\t\t// Curve point validation or pairing failure (e.g. invalid curve point, subgroup violation)\n\t\treturn false;\n\t}\n}\n\n/**\n * Serializes a VerificationKey into a Buffer.\n */\nexport function serializeVKey(vkey: VerificationKey): Buffer {\n\ttry {\n\t\tconst encoded = stringBigints.encode(vkey);\n\t\treturn Buffer.from(JSON.stringify(encoded), \"utf-8\");\n\t} catch (error) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Failed to serialize VerificationKey: ${error instanceof Error ? error.message : String(error)}`,\n\t\t);\n\t}\n}\n\n/**\n * Deserializes a Buffer into a typed VerificationKey.\n */\nexport function deserializeVKey(buf: Buffer): VerificationKey {\n\ttry {\n\t\tconst parsed = JSON.parse(buf.toString(\"utf-8\"));\n\t\treturn stringBigints.decode(parsed) as VerificationKey;\n\t} catch (error) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Failed to deserialize VerificationKey: ${error instanceof Error ? error.message : String(error)}`,\n\t\t);\n\t}\n}\n\n/**\n * Serializes a ProofWithSignals into a Buffer.\n */\nexport function serializeGrothProof(\n\tproofWithSignals: ProofWithSignals,\n): Buffer {\n\ttry {\n\t\tconst encoded = stringBigints.encode(proofWithSignals);\n\t\treturn Buffer.from(JSON.stringify(encoded), \"utf-8\");\n\t} catch (error) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Failed to serialize GrothProof: ${error instanceof Error ? error.message : String(error)}`,\n\t\t);\n\t}\n}\n\n/**\n * Deserializes a Buffer into a typed ProofWithSignals.\n */\nexport function deserializeGrothProof(buf: Buffer): ProofWithSignals {\n\ttry {\n\t\tconst parsed = JSON.parse(buf.toString(\"utf-8\"));\n\t\treturn stringBigints.decode(parsed) as ProofWithSignals;\n\t} catch (error) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Failed to deserialize GrothProof: ${error instanceof Error ? error.message : String(error)}`,\n\t\t);\n\t}\n}\n"]}

package/dist/chunk-P34HDRN5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/security/zk.ts"],"names":["ProofType"],"mappings":";;;AAKO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,UAAAA,CAAAA,UAAAA,CAAA,iBAAc,CAAA,CAAA,GAAd,aAAA;AACA,EAAAA,UAAAA,CAAAA,UAAAA,CAAA,aAAU,CAAA,CAAA,GAAV,SAAA;AAFW,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAKL,IAAM,kBAAA,GAAqB;AAC3B,IAAM,kBAAA,GAAqB;AAC3B,IAAM,kBAAA,GAAqB;AAgC3B,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC9C,YAAY,OAAA,EAAiB;AAC5B,IAAA,KAAA,CAAM,CAAA,wBAAA,EAA2B,OAAO,CAAA,CAAE,CAAA;AAC1C,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACb;AACD;AAKO,SAAS,gBAAgB,MAAA,EAA6B;AAC5D,EAAA,IAAI,MAAA,CAAO,YAAA,CAAa,MAAA,KAAW,EAAA,EAAI;AACtC,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,CAAA,kDAAA,EAAqD,MAAA,CAAO,YAAA,CAAa,MAAM,CAAA;AAAA,KAChF;AAAA,EACD;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,CAAY,MAAA,KAAW,EAAA,EAAI;AACrC,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,CAAA,iDAAA,EAAoD,MAAA,CAAO,WAAA,CAAY,MAAM,CAAA;AAAA,KAC9E;AAAA,EACD;AACA,EAAA,IAAI,MAAA,CAAO,aAAA,CAAc,MAAA,KAAW,EAAA,EAAI;AACvC,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,CAAA,mDAAA,EAAsD,MAAA,CAAO,aAAA,CAAc,MAAM,CAAA;AAAA,KAClF;AAAA,EACD;AACA,EAAA,IAAI,MAAA,CAAO,YAAA,CAAa,MAAA,KAAW,EAAA,EAAI;AACtC,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,CAAA,kDAAA,EAAqD,MAAA,CAAO,YAAA,CAAa,MAAM,CAAA;AAAA,KAChF;AAAA,EACD;AAEA,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,kBAAkB,CAAA;AAC3C,EAAA,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,GAAA,EAAK,CAAC,CAAA;AAC/B,EAAA,MAAA,CAAO,WAAA,CAAY,IAAA,CAAK,GAAA,EAAK,EAAE,CAAA;AAC/B,EAAA,MAAA,CAAO,aAAA,CAAc,IAAA,CAAK,GAAA,EAAK,EAAE,CAAA;AACjC,EAAA,MAAA,CAAO,YAAA,CAAa,IAAA,CAAK,GAAA,EAAK,EAAE,CAAA;AAChC,EAAA,GAAA,CAAI,gBAAA,CAAiB,MAAA,CAAO,MAAA,CAAO,YAAY,GAAG,GAAG,CAAA;AACrD,EAAA,GAAA,CAAI,gBAAA,CAAiB,MAAA,CAAO,MAAA,CAAO,kBAAkB,GAAG,GAAG,CAAA;AAE3D,EAAA,OAAO,GAAA;AACR;AAKO,SAAS,gBAAgB,GAAA,EAA0B;AACzD,EAAA,IAAI,GAAA,CAAI,WAAW,kBAAA,EAAoB;AACtC,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,CAAA,mCAAA,EAAsC,kBAAkB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAClF;AAAA,EACD;AAEA,EAAA,OAAO;AAAA,IACN,cAAc,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,CAAS,CAAA,EAAG,EAAE,CAAC,CAAA;AAAA,IAC7C,aAAa,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,CAAS,EAAA,EAAI,EAAE,CAAC,CAAA;AAAA,IAC7C,eAAe,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,CAAS,EAAA,EAAI,EAAE,CAAC,CAAA;AAAA,IAC/C,cAAc,MAAA,CAAO,IAAA,CAAK,IAAI,QAAA,CAAS,EAAA,EAAI,GAAG,CAAC,CAAA;AAAA,IAC/C,YAAA,EAAc,GAAA,CAAI,eAAA,CAAgB,GAAG,CAAA;AAAA,IACrC,kBAAA,EAAoB,GAAA,CAAI,eAAA,CAAgB,GAAG;AAAA,GAC5C;AACD;AAUO,IAAM,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3B,QAAA,CAAS,SAAA,EAAsB,OAAA,EAAiB,KAAA,EAAuB;AACtE,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,IAAA,MAAA,CAAO,UAAA,CAAW,oBAAoB,CAAC,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,CAAW,WAAW,CAAC,CAAA;AAC9B,IAAA,MAAA,CAAO,aAAA,CAAc,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAEtC,IAAA,MAAM,UAAU,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,OAAA,EAAS,KAAK,CAAC,CAAA;AACtD,IAAA,MAAM,QAAA,GAAW,OAAO,UAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,OAAO,EAAE,MAAA,EAAO;AAEpE,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,OAAA,EAAS,QAAQ,CAAC,CAAA;AAAA,EACzC,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,GAAA,EAA6B;AACnC,IAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG;AAC7B,MAAA,MAAM,IAAI,mBAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,OAAA,GAAU,IAAI,CAAC,CAAA;AAErB,IAAA,IAAI,YAAY,kBAAA,EAAoB;AACnC,MAAA,IAAI,GAAA,CAAI,SAAS,EAAA,EAAI;AACpB,QAAA,MAAM,IAAI,mBAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,CAAa,CAAC,CAAA;AACrC,MAAA,IAAI,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,UAAA,GAAa,EAAA,EAAI;AACrC,QAAA,MAAM,IAAI,mBAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AACA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA,EAAG,CAAA,GAAI,UAAU,CAAC,CAAA;AAC3D,MAAA,MAAM,OAAO,MAAA,CAAO,IAAA;AAAA,QACnB,IAAI,QAAA,CAAS,CAAA,GAAI,UAAA,EAAY,CAAA,GAAI,aAAa,EAAE;AAAA,OACjD;AAEA,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,kBAAA;AAAA,QACT,SAAA,EAAW,CAAA;AAAA,QACX,OAAA;AAAA,QACA,KAAA,EAAO,IAAA;AAAA,QACP;AAAA,OACD;AAAA,IACD;AAEA,IAAA,IAAI,YAAY,kBAAA,EAAoB;AAEnC,MAAA,IAAI,GAAA,CAAI,SAAS,EAAA,EAAI;AACpB,QAAA,MAAM,IAAI,mBAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,MAAM,SAAA,GAAY,IAAI,CAAC,CAAA;AACvB,MAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,CAAa,CAAC,CAAA;AAErC,MAAA,IAAI,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,UAAA,GAAa,EAAA,EAAI;AACrC,QAAA,MAAM,IAAI,mBAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAEA,MAAA,MAAM,UAAU,GAAA,CAAI,QAAA,CAAS,CAAA,EAAG,GAAA,CAAI,SAAS,EAAE,CAAA;AAC/C,MAAA,MAAM,gBAAA,GAAmB,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,SAAS,EAAE,CAAA;AACrD,MAAA,MAAM,cAAA,GAAiB,OACrB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,OAAO,EACd,MAAA,EAAO;AAET,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,gBAAA,EAAkB,cAAc,CAAA,EAAG;AAC9D,QAAA,MAAM,IAAI,oBAAoB,uCAAuC,CAAA;AAAA,MACtE;AAEA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,GAAA,CAAI,SAAS,CAAA,EAAG,CAAA,GAAI,UAAU,CAAC,CAAA;AAC3D,MAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,IAAI,UAAA,EAAY,GAAA,CAAI,MAAA,GAAS,EAAE,CAAC,CAAA;AAEvE,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,kBAAA;AAAA,QACT,SAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA;AAAA,QACA;AAAA,OACD;AAAA,IACD;AAEA,IAAA,MAAM,IAAI,mBAAA;AAAA,MACT,CAAA,+BAAA,EAAkC,OAAA,CAAQ,QAAA,CAAS,EAAE,CAAC,CAAA;AAAA,KACvD;AAAA,EACD;AACD;AASO,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUzB,MAAA,CACC,OAAA,EACA,eAAA,EACA,aAAA,EACU;AAEV,IAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,eAAe,CAAA,EAAG;AAC7C,MAAA,MAAM,IAAI,mBAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,IAAI,OAAA,CAAQ,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG;AAC/B,MAAA,MAAM,IAAI,mBAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,OAAA,CAAQ,KAAK,CAAA;AAC1C,IAAA,IAAI,SAAS,MAAA,GAAS,EAAA,IAAM,QAAA,CAAS,CAAC,MAAM,CAAA,EAAM;AACjD,MAAA,MAAM,IAAI,mBAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AACA,IAAA,MAAM,UAAA,GAAa,QAAA,CAAS,YAAA,CAAa,CAAC,CAAA;AAC1C,IAAA,MAAM,OAAA,GAAU,QAAA,CAAS,QAAA,CAAS,CAAA,EAAG,IAAI,UAAU,CAAA;AACnD,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,QAAA,CAAS,CAAA,GAAI,UAAU,CAAA;AAE7C,IAAA,IAAI,IAAA,CAAK,WAAW,EAAA,EAAI;AACvB,MAAA,MAAM,IAAI,mBAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,UAAU,CAAA;AACjD,MAAA,IAAI,YAAY,QAAA,KAAa,OAAA,CAAQ,OAAA,CAAQ,QAAA,CAAS,KAAK,CAAA,EAAG;AAC7D,QAAA,MAAM,IAAI,mBAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAAA,IACD,SAAS,EAAA,EAAI;AACZ,MAAA,MAAM,IAAI,oBAAoB,+BAA+B,CAAA;AAAA,IAC9D;AAGA,IAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC9C,MAAA,MAAM,YAAA,GAAe,OACnB,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,MAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,YAAY,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,mBAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,SAAA,EAA2B;AACxC,IAAA,OAAO,OAAO,UAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,SAAS,EAAE,MAAA,EAAO;AAAA,EAC7D;AACD","file":"chunk-P34HDRN5.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport crypto from \"node:crypto\";\n\nexport enum ProofType {\n\tHMAC_LEGACY = 0x00,\n\tGROTH16 = 0x02,\n}\n\nexport const RECEIPT_VERSION_V1 = 0x01;\nexport const RECEIPT_VERSION_V2 = 0x02;\nexport const ZK_JOURNAL_V2_SIZE = 144;\n\nexport interface ZkJournalV2 {\n\t/** Image ID (SHA-256) of the guest interpreter */\n\tguestImageId: Buffer;\n\t/** SHA-256 digest of injected logic */\n\tlogicDigest: Buffer;\n\t/** SHA-256 digest of dataset records */\n\tdatasetDigest: Buffer;\n\t/** SHA-256 digest of sanitized output */\n\toutputDigest: Buffer;\n\t/** Micro-instruction fuel consumed */\n\tfuelConsumed: bigint;\n\t/** Timestamp in milliseconds since unix epoch */\n\texecutionTimestamp: bigint;\n}\n\nexport type ZkPolicy = \"none\" | \"optimistic\" | \"required\";\n\nexport interface ZkReceipt {\n\t/** Cryptographic proof generated by a zero-knowledge VM (e.g., RISC Zero, SP1) or Groth16 */\n\tproof: Buffer;\n\t/** The public inputs/outputs of the execution (the \"Journal\" in RISC Zero terminology) */\n\tjournal: Buffer;\n\t/** The expected image ID / verification key of the WASM binary that was executed */\n\timageId: Buffer;\n\t/** Type of cryptographic proof (HMAC legacy or Groth16) */\n\tproofType?: ProofType;\n\t/** Binary receipt version (0x01 or 0x02) */\n\tversion?: number;\n}\n\nexport class ZkVerificationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(`ZK Verification Failed: ${message}`);\n\t\tthis.name = \"ZkVerificationError\";\n\t}\n}\n\n/**\n * Serializes a structured ZkJournalV2 into a strictly validated 144-byte binary layout.\n */\nexport function encodeJournalV2(fields: ZkJournalV2): Buffer {\n\tif (fields.guestImageId.length !== 32) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Invalid guestImageId size: expected 32 bytes, got ${fields.guestImageId.length}`,\n\t\t);\n\t}\n\tif (fields.logicDigest.length !== 32) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Invalid logicDigest size: expected 32 bytes, got ${fields.logicDigest.length}`,\n\t\t);\n\t}\n\tif (fields.datasetDigest.length !== 32) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Invalid datasetDigest size: expected 32 bytes, got ${fields.datasetDigest.length}`,\n\t\t);\n\t}\n\tif (fields.outputDigest.length !== 32) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Invalid outputDigest size: expected 32 bytes, got ${fields.outputDigest.length}`,\n\t\t);\n\t}\n\n\tconst buf = Buffer.alloc(ZK_JOURNAL_V2_SIZE);\n\tfields.guestImageId.copy(buf, 0);\n\tfields.logicDigest.copy(buf, 32);\n\tfields.datasetDigest.copy(buf, 64);\n\tfields.outputDigest.copy(buf, 96);\n\tbuf.writeBigUInt64BE(BigInt(fields.fuelConsumed), 128);\n\tbuf.writeBigUInt64BE(BigInt(fields.executionTimestamp), 136);\n\n\treturn buf;\n}\n\n/**\n * Deserializes and validates a 144-byte binary buffer into a typed ZkJournalV2.\n */\nexport function decodeJournalV2(buf: Buffer): ZkJournalV2 {\n\tif (buf.length !== ZK_JOURNAL_V2_SIZE) {\n\t\tthrow new ZkVerificationError(\n\t\t\t`Invalid ZkJournalV2 size: expected ${ZK_JOURNAL_V2_SIZE} bytes, got ${buf.length}`,\n\t\t);\n\t}\n\n\treturn {\n\t\tguestImageId: Buffer.from(buf.subarray(0, 32)),\n\t\tlogicDigest: Buffer.from(buf.subarray(32, 64)),\n\t\tdatasetDigest: Buffer.from(buf.subarray(64, 96)),\n\t\toutputDigest: Buffer.from(buf.subarray(96, 128)),\n\t\tfuelConsumed: buf.readBigUInt64BE(128),\n\t\texecutionTimestamp: buf.readBigUInt64BE(136),\n\t};\n}\n\nexport interface DecodedReceipt {\n\tversion: number;\n\tproofType: ProofType;\n\tjournal: Buffer;\n\tproof: Buffer;\n\traw: Buffer;\n}\n\nexport const receiptCodec = {\n\t/**\n\t * Encodes a version 2 Binary Receipt with trailing SHA-256 checksum.\n\t * Layout: [0x02][proofType: 1B][journalLen: 4B UInt32BE][journal][proof][checksum: 32B]\n\t */\n\tencodeV2(proofType: ProofType, journal: Buffer, proof: Buffer): Buffer {\n\t\tconst header = Buffer.alloc(6);\n\t\theader.writeUInt8(RECEIPT_VERSION_V2, 0);\n\t\theader.writeUInt8(proofType, 1);\n\t\theader.writeUInt32BE(journal.length, 2);\n\n\t\tconst payload = Buffer.concat([header, journal, proof]);\n\t\tconst checksum = crypto.createHash(\"sha256\").update(payload).digest();\n\n\t\treturn Buffer.concat([payload, checksum]);\n\t},\n\n\t/**\n\t * Decodes any LIOP Binary Receipt (v1 HMAC or v2 ZK).\n\t */\n\tdecode(raw: Buffer): DecodedReceipt {\n\t\tif (!raw || raw.length === 0) {\n\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\"Empty or malformed zero-knowledge proof array.\",\n\t\t\t);\n\t\t}\n\n\t\tconst version = raw[0];\n\n\t\tif (version === RECEIPT_VERSION_V1) {\n\t\t\tif (raw.length < 35) {\n\t\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\t\"Malformed receipt: invalid header or length.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst journalLen = raw.readUInt16BE(1);\n\t\t\tif (raw.length < 3 + journalLen + 32) {\n\t\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\t\"Malformed receipt: truncated journal or seal.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst journal = Buffer.from(raw.subarray(3, 3 + journalLen));\n\t\t\tconst seal = Buffer.from(\n\t\t\t\traw.subarray(3 + journalLen, 3 + journalLen + 32),\n\t\t\t);\n\n\t\t\treturn {\n\t\t\t\tversion: RECEIPT_VERSION_V1,\n\t\t\t\tproofType: ProofType.HMAC_LEGACY,\n\t\t\t\tjournal,\n\t\t\t\tproof: seal,\n\t\t\t\traw,\n\t\t\t};\n\t\t}\n\n\t\tif (version === RECEIPT_VERSION_V2) {\n\t\t\t// Minimum size: 1 (version) + 1 (proofType) + 4 (journalLen) + 0 (journal) + 0 (proof) + 32 (checksum) = 38\n\t\t\tif (raw.length < 38) {\n\t\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\t\"Malformed receipt v2: buffer too short (< 38 bytes).\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst proofType = raw[1] as ProofType;\n\t\t\tconst journalLen = raw.readUInt32BE(2);\n\n\t\t\tif (raw.length < 6 + journalLen + 32) {\n\t\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\t\"Malformed receipt v2: truncated payload.\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst payload = raw.subarray(0, raw.length - 32);\n\t\t\tconst expectedChecksum = raw.subarray(raw.length - 32);\n\t\t\tconst actualChecksum = crypto\n\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t.update(payload)\n\t\t\t\t.digest();\n\n\t\t\tif (!crypto.timingSafeEqual(expectedChecksum, actualChecksum)) {\n\t\t\t\tthrow new ZkVerificationError(\"Receipt checksum verification failed.\");\n\t\t\t}\n\n\t\t\tconst journal = Buffer.from(raw.subarray(6, 6 + journalLen));\n\t\t\tconst proof = Buffer.from(raw.subarray(6 + journalLen, raw.length - 32));\n\n\t\t\treturn {\n\t\t\t\tversion: RECEIPT_VERSION_V2,\n\t\t\t\tproofType,\n\t\t\t\tjournal,\n\t\t\t\tproof,\n\t\t\t\traw,\n\t\t\t};\n\t\t}\n\n\t\tthrow new ZkVerificationError(\n\t\t\t`Unsupported receipt version: 0x${version.toString(16)}`,\n\t\t);\n\t},\n};\n\n/**\n * ZK-Proofs Verifier for Logic-Injection-on-Origin Protocol (LIOP)\n *\n * Validates that an executed Logic (WASM) actually produced the reported output,\n * verifying the Zero-Knowledge receipt generated by the remote host's Trusted Execution\n * Environment (TEE) or zkVM (Zero-Knowledge Virtual Machine).\n */\nexport const ZkVerifier = {\n\t/**\n\t * Validates a ZK receipt using structural Binary Receipt verification.\n\t * Parses the HMAC-SHA256 commitment format (v1) and verifies journal integrity.\n\t *\n\t * @param receipt - Complete ZkReceipt to verify\n\t * @param expectedImageId - Hash or ImageID of the WASM file dispatched to the host\n\t * @throws ZkVerificationError if the proof is invalid or image IDs mismatch\n\t * @returns true if the proof mathematically verifies the execution\n\t */\n\tverify(\n\t\treceipt: ZkReceipt,\n\t\texpectedImageId: Buffer,\n\t\tsessionSecret?: Buffer,\n\t): boolean {\n\t\t// 1. Verify Image ID (Ensures the host executed the exact logic we sent, not a malicious one)\n\t\tif (!receipt.imageId.equals(expectedImageId)) {\n\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\"ImageID mismatch. The remote origin executed a different WASM payload.\",\n\t\t\t);\n\t\t}\n\n\t\t// 2. Validate Proof Structure\n\t\tif (receipt.proof.length === 0) {\n\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\"Empty or malformed zero-knowledge proof array.\",\n\t\t\t);\n\t\t}\n\n\t\t// 3. Cryptographic Validation (Binary Receipt)\n\t\tconst proofBuf = Buffer.from(receipt.proof);\n\t\tif (proofBuf.length < 35 || proofBuf[0] !== 0x01) {\n\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\"Malformed receipt: invalid header or length.\",\n\t\t\t);\n\t\t}\n\t\tconst journalLen = proofBuf.readUInt16BE(1);\n\t\tconst journal = proofBuf.subarray(3, 3 + journalLen);\n\t\tconst seal = proofBuf.subarray(3 + journalLen);\n\n\t\tif (seal.length !== 32) {\n\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\"Invalid seal: expected 32-byte HMAC-SHA256.\",\n\t\t\t);\n\t\t}\n\n\t\t// Verify journal contains matching imageId\n\t\ttry {\n\t\t\tconst journalData = JSON.parse(journal.toString());\n\t\t\tif (journalData.image_id !== receipt.imageId.toString(\"hex\")) {\n\t\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\t\"Journal imageId does not match receipt header.\",\n\t\t\t\t);\n\t\t\t}\n\t\t} catch (_e) {\n\t\t\tthrow new ZkVerificationError(\"Failed to parse journal data.\");\n\t\t}\n\n\t\t// 4. Mathematical Verification (HMAC-SHA256)\n\t\tif (sessionSecret && sessionSecret.length > 0) {\n\t\t\tconst expectedSeal = crypto\n\t\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t\t.update(journal)\n\t\t\t\t.digest();\n\t\t\tif (!crypto.timingSafeEqual(seal, expectedSeal)) {\n\t\t\t\tthrow new ZkVerificationError(\n\t\t\t\t\t\"Invalid seal: HMAC verification failed.\",\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\treturn true;\n\t},\n\n\t/**\n\t * Derives a predictable ImageID (usually a Hash) from a raw WASM binary.\n\t *\n\t * @param wasmBytes - The raw bytes of the WASM logic file\n\t * @returns The SHA-256 ImageID of the logic\n\t */\n\tderiveImageId(wasmBytes: Buffer): Buffer {\n\t\treturn crypto.createHash(\"sha256\").update(wasmBytes).digest();\n\t},\n};\n"]}

package/dist/chunk-Q3FKHJ3B.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/observability/metrics.ts"],"names":[],"mappings":";AAkBA,SAAS,aAAa,MAAA,EAA+B;AACpD,EAAA,IAAI,CAAC,MAAA,IAAU,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,EAAG;AAChD,IAAA,OAAO,EAAA;AAAA,EACR;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,MAAM,EACnC,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,cAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAA,EAAG,CAAC,CAAA,EAAA,EAAK,MAAA,CAAO,CAAC,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA;AAC5D,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEA,SAAS,YAAY,MAAA,EAA+B;AACnD,EAAA,IAAI,CAAC,QAAQ,OAAO,EAAA;AACpB,EAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAC1B,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA,KAAM,EAAE,aAAA,CAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,CAC3B,KAAK,GAAG,CAAA;AACX;AAEO,IAAM,UAAN,MAAc;AAAA,EAGpB,WAAA,CACiB,MACA,IAAA,EACf;AAFe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EACd;AAAA,EAFc,IAAA;AAAA,EACA,IAAA;AAAA,EAJT,MAAA,uBAAa,GAAA,EAAsD;AAAA,EAO3E,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,IAAI,QAAQ,CAAA,EAAG;AACd,MAAA,MAAM,IAAI,MAAM,yCAAyC,CAAA;AAAA,IAC1D;AACA,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,IAAI,MAAA,EAA+B;AAClC,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,KAAA,IAAS,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,QAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,KAAS,CAAA,EAAG;AAC3B,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,CAAI,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,YAAA,CAAa,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA,CAAE,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,QAAN,MAAY;AAAA,EAGlB,WAAA,CACiB,MACA,IAAA,EACf;AAFe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EACd;AAAA,EAFc,IAAA;AAAA,EACA,IAAA;AAAA,EAJT,MAAA,uBAAa,GAAA,EAAsD;AAAA,EAO3E,GAAA,CAAI,eAAsC,UAAA,EAA2B;AACpE,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACtC,MAAA,IAAA,CAAK,OAAO,GAAA,CAAI,EAAA,EAAI,EAAE,KAAA,EAAO,eAAe,CAAA;AAC5C,MAAA;AAAA,IACD;AACA,IAAA,MAAM,MAAA,GAAS,aAAA;AACf,IAAA,MAAM,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,CAAA;AAC1D,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,OAAO,GAAA,CAAI,GAAA,EAAK,EAAE,KAAA,EAAO,GAAA,EAAK,QAAQ,CAAA;AAAA,EAC5C;AAAA,EAEA,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,GAAA,CAAI,MAAA,EAAuB,KAAA,GAAQ,CAAA,EAAS;AAC3C,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,MAAM,OAAA,GAAU,KAAK,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,IAAK,EAAE,KAAA,EAAO,CAAA,EAAG,MAAA,EAAO;AAC3D,IAAA,OAAA,CAAQ,KAAA,IAAS,KAAA;AACjB,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC7B;AAAA,EAEA,IAAI,MAAA,EAA+B;AAClC,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,GAAG,GAAG,KAAA,IAAS,CAAA;AAAA,EACvC;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,MAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,KAAS,CAAA,EAAG;AAC3B,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAA,CAAI,CAAA;AAC3B,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,EAAG,YAAA,CAAa,KAAA,CAAM,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA,CAAE,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,YAAN,MAAgB;AAAA,EAYtB,YACiB,IAAA,EACA,IAAA,EAChB,OAAA,GAAoB,CAAC,GAAG,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,KAAK,GAAA,EAAK,GAAA,EAAM,IAAA,EAAM,GAAA,EAAM,GAAK,CAAA,EACzE;AAHe,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAGhB,IAAA,IAAA,CAAK,OAAA,GAAU,CAAC,GAAG,OAAO,CAAA,CAAE,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,GAAI,CAAC,CAAA;AAAA,EACjD;AAAA,EALiB,IAAA;AAAA,EACA,IAAA;AAAA,EAbD,OAAA;AAAA,EACR,YAAA,uBAAmB,GAAA,EAQzB;AAAA,EAUF,OAAA,CAAQ,eAAsC,UAAA,EAA2B;AACxE,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,GAAA;AAEJ,IAAA,IAAI,OAAO,kBAAkB,QAAA,EAAU;AACtC,MAAA,GAAA,GAAM,aAAA;AAAA,IACP,CAAA,MAAO;AACN,MAAA,MAAA,GAAS,aAAA;AACT,MAAA,GAAA,GAAM,OAAO,UAAA,KAAe,QAAA,GAAW,UAAA,GAAa,CAAA;AAAA,IACrD;AAEA,IAAA,MAAM,GAAA,GAAM,YAAY,MAAM,CAAA;AAC9B,IAAA,IAAI,KAAA,GAAQ,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,KAAA,GAAQ;AAAA,QACP,KAAA,EAAO,CAAA;AAAA,QACP,GAAA,EAAK,CAAA;AAAA,QACL,YAAA,EAAc,IAAI,GAAA,CAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,EAAG,CAAC,CAAC,CAAC,CAAA;AAAA,QACrD;AAAA,OACD;AACA,MAAA,IAAA,CAAK,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IACjC;AAEA,IAAA,KAAA,CAAM,KAAA,IAAS,CAAA;AACf,IAAA,KAAA,CAAM,GAAA,IAAO,GAAA;AAEb,IAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AACjC,MAAA,IAAI,OAAO,KAAA,EAAO;AACjB,QAAA,MAAM,GAAA,GAAM,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA,IAAK,CAAA;AAC7C,QAAA,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAA,EAAO,GAAA,GAAM,CAAC,CAAA;AAAA,MACtC;AAAA,IACD;AAAA,EACD;AAAA,EAEA,KAAA,GAAc;AACb,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EACzB;AAAA,EAEA,YAAA,GAAyB;AACxB,IAAA,MAAM,KAAA,GAAkB;AAAA,MACvB,CAAA,OAAA,EAAU,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAAA,MAChC,CAAA,OAAA,EAAU,KAAK,IAAI,CAAA,UAAA;AAAA,KACpB;AACA,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,IAAA,KAAS,CAAA,EAAG;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,QAAA,CAAU,CAAA;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,MAAA,CAAQ,CAAA;AAC/B,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,YAAA,CAAa,MAAA,EAAO,EAAG;AAC/C,MAAA,MAAM,UAAA,GAAa,KAAA,CAAM,MAAA,IAAU,EAAC;AACpC,MAAA,KAAA,MAAW,KAAA,IAAS,KAAK,OAAA,EAAS;AACjC,QAAA,MAAM,eAAe,EAAE,GAAG,YAAY,EAAA,EAAI,MAAA,CAAO,KAAK,CAAA,EAAE;AACxD,QAAA,KAAA,CAAM,IAAA;AAAA,UACL,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,OAAA,EAAU,YAAA,CAAa,YAAY,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,EAAE,GAAG,UAAA,EAAY,IAAI,MAAA,EAAO;AAC9C,MAAA,KAAA,CAAM,IAAA;AAAA,QACL,CAAA,EAAG,KAAK,IAAI,CAAA,OAAA,EAAU,aAAa,SAAS,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA;AAAA,OAC7D;AACA,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,IAAA,EAAO,YAAA,CAAa,UAAU,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAE,CAAA;AACrE,MAAA,KAAA,CAAM,IAAA;AAAA,QACL,CAAA,EAAG,KAAK,IAAI,CAAA,MAAA,EAAS,aAAa,UAAU,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,KAAK,CAAA;AAAA,OAC7D;AAAA,IACD;AACA,IAAA,OAAO,KAAA;AAAA,EACR;AACD;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACpB,QAAA,uBAAe,GAAA,EAAqB;AAAA,EACpC,MAAA,uBAAa,GAAA,EAAmB;AAAA,EAChC,UAAA,uBAAiB,GAAA,EAAuB;AAAA,EAEhD,OAAA,CAAQ,MAAc,IAAA,EAAuB;AAC5C,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA;AAC9B,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,OAAA,CAAQ,IAAA,EAAM,IAAI,CAAA;AAC1B,MAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IAC1B;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,KAAA,CAAM,MAAc,IAAA,EAAqB;AACxC,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC5B,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AACxB,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,SAAA,CAAU,IAAA,EAAc,IAAA,EAAc,OAAA,EAA+B;AACpE,IAAA,IAAI,CAAA,GAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA;AAChC,IAAA,IAAI,CAAC,CAAA,EAAG;AACP,MAAA,CAAA,GAAI,IAAI,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,OAAO,CAAA;AACrC,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAA,EAAM,CAAC,CAAA;AAAA,IAC5B;AACA,IAAA,OAAO,CAAA;AAAA,EACR;AAAA,EAEA,qBAAA,GAA8B;AAC7B,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MACnB,6BAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,MAAA,CAAO,IAAI,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAEvC,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,MACnB,yBAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,MAAA,CAAO,IAAI,CAAC,CAAA;AAEZ,IAAA,IAAI,OAAO,OAAA,CAAQ,WAAA,KAAgB,UAAA,EAAY;AAC9C,MAAA,MAAM,GAAA,GAAM,QAAQ,WAAA,EAAY;AAChC,MAAA,MAAM,MAAM,IAAA,CAAK,KAAA;AAAA,QAChB,+BAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,GAAA,CAAI,GAAA,CAAI,IAAI,GAAG,CAAA;AAEf,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AAAA,QACrB,qCAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,QAAA,CAAS,GAAA,CAAI,IAAI,QAAQ,CAAA;AAEzB,MAAA,MAAM,YAAY,IAAA,CAAK,KAAA;AAAA,QACtB,sCAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,SAAA,CAAU,GAAA,CAAI,IAAI,SAAS,CAAA;AAE3B,MAAA,MAAM,WAAW,IAAA,CAAK,KAAA;AAAA,QACrB,oCAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,QAAA,CAAS,GAAA,CAAI,IAAI,QAAQ,CAAA;AAAA,IAC1B;AAAA,EACD;AAAA,EAEA,oBAAA,GAA+B;AAC9B,IAAA,IAAA,CAAK,qBAAA,EAAsB;AAE3B,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,EAAG;AACvC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACrC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,EAAG;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,YAAA,EAAc,CAAA;AAAA,IAC/B;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AAAA,EACvB;AAAA,EAEA,QAAA,GAAiB;AAChB,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,QAAA,CAAS,MAAA,EAAO,IAAK,KAAA,EAAM;AAChD,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,IAAK,KAAA,EAAM;AAC9C,IAAA,KAAA,MAAW,KAAK,IAAA,CAAK,UAAA,CAAW,MAAA,EAAO,IAAK,KAAA,EAAM;AAAA,EACnD;AACD;AAIO,IAAM,eAAA,GAAkB,IAAI,eAAA;AAE5B,IAAM,iBAAiB,eAAA,CAAgB,OAAA;AAAA,EAC7C,uBAAA;AAAA,EACA;AACD;AAEO,IAAM,sBAAsB,eAAA,CAAgB,OAAA;AAAA,EAClD,6BAAA;AAAA,EACA;AACD;AAEO,IAAM,eAAe,eAAA,CAAgB,SAAA;AAAA,EAC3C,0BAAA;AAAA,EACA,qDAAA;AAAA,EACA,CAAC,KAAK,GAAA,EAAK,GAAA,EAAM,MAAM,GAAA,EAAM,GAAA,EAAO,KAAO,GAAM;AAClD;AAEO,IAAM,qBAAqB,eAAA,CAAgB,KAAA;AAAA,EACjD,2BAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,KAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,OAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,2BAA2B,eAAA,CAAgB,SAAA;AAAA,EACvD,kCAAA;AAAA,EACA,iEAAA;AAAA,EACA,CAAC,GAAG,CAAA,EAAG,CAAA,EAAG,IAAI,EAAA,EAAI,EAAA,EAAI,GAAA,EAAK,GAAA,EAAK,GAAG;AACpC;AAEO,IAAM,uBAAuB,eAAA,CAAgB,OAAA;AAAA,EACnD,6BAAA;AAAA,EACA;AACD;AAEO,IAAM,sBAAsB,eAAA,CAAgB,OAAA;AAAA,EAClD,8BAAA;AAAA,EACA;AACD;AAEO,IAAM,sBAAsB,eAAA,CAAgB,SAAA;AAAA,EAClD,6BAAA;AAAA,EACA,8CAAA;AAAA,EACA,CAAC,IAAI,EAAA,EAAI,EAAA,EAAI,KAAK,GAAA,EAAK,GAAA,EAAK,KAAM,IAAI;AACvC;AAEO,IAAM,kBAAkB,eAAA,CAAgB,KAAA;AAAA,EAC9C,yBAAA;AAAA,EACA;AACD;AAEO,IAAM,mBAAmB,eAAA,CAAgB,OAAA;AAAA,EAC/C,yBAAA;AAAA,EACA;AACD;AAEO,IAAM,oBAAoB,eAAA,CAAgB,OAAA;AAAA,EAChD,0BAAA;AAAA,EACA;AACD;AAEO,IAAM,mBAAmB,eAAA,CAAgB,OAAA;AAAA,EAC/C,yBAAA;AAAA,EACA;AACD;AAEO,IAAM,sBAAsB,eAAA,CAAgB,SAAA;AAAA,EAClD,4BAAA;AAAA,EACA,qCAAA;AAAA,EACA,CAAC,CAAA,EAAG,EAAA,EAAI,EAAA,EAAI,EAAA,EAAI,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAM,IAAA,EAAM,GAAI;AAChD;AAEO,IAAM,yBAAyB,eAAA,CAAgB,SAAA;AAAA,EACrD,gCAAA;AAAA,EACA,2EAAA;AAAA,EACA,CAAC,GAAG,CAAA,EAAG,EAAA,EAAI,IAAI,EAAA,EAAI,GAAA,EAAK,KAAK,GAAG;AACjC;AAEO,IAAM,qBAAqB,eAAA,CAAgB,OAAA;AAAA,EACjD,2BAAA;AAAA,EACA;AACD;AAEO,IAAM,uBAAuB,eAAA,CAAgB,OAAA;AAAA,EACnD,8BAAA;AAAA,EACA;AACD;AAEO,IAAM,sBAAsB,eAAA,CAAgB,OAAA;AAAA,EAClD,6BAAA;AAAA,EACA;AACD","file":"chunk-Q3FKHJ3B.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Prometheus Metrics Registry (Phase Beta-3)\n * Lightweight, zero-dependency, high-performance metrics collector\n * complying with Prometheus and OpenMetrics exposition format.\n */\n\nexport type MetricLabels = Record<string, string | number>;\n\nexport interface MetricDefinition {\n\tname: string;\n\thelp: string;\n\ttype: \"counter\" | \"gauge\" | \"histogram\";\n\tbuckets?: number[];\n}\n\nfunction formatLabels(labels?: MetricLabels): string {\n\tif (!labels || Object.keys(labels).length === 0) {\n\t\treturn \"\";\n\t}\n\tconst entries = Object.entries(labels)\n\t\t.sort(([a], [b]) => a.localeCompare(b))\n\t\t.map(([k, v]) => `${k}=\"${String(v).replace(/\"/g, '\\\\\"')}\"`);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nfunction labelsToKey(labels?: MetricLabels): string {\n\tif (!labels) return \"\";\n\treturn Object.entries(labels)\n\t\t.sort(([a], [b]) => a.localeCompare(b))\n\t\t.map(([k, v]) => `${k}:${v}`)\n\t\t.join(\"|\");\n}\n\nexport class Counter {\n\tprivate values = new Map<string, { value: number; labels?: MetricLabels }>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t) {}\n\n\tinc(labels?: MetricLabels, value = 1): void {\n\t\tif (value < 0) {\n\t\t\tthrow new Error(\"Counter increments must be non-negative\");\n\t\t}\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value += value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tget(labels?: MetricLabels): number {\n\t\tconst key = labelsToKey(labels);\n\t\treturn this.values.get(key)?.value || 0;\n\t}\n\n\treset(): void {\n\t\tthis.values.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} counter`,\n\t\t];\n\t\tif (this.values.size === 0) {\n\t\t\tlines.push(`${this.name} 0`);\n\t\t\treturn lines;\n\t\t}\n\t\tfor (const entry of this.values.values()) {\n\t\t\tlines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class Gauge {\n\tprivate values = new Map<string, { value: number; labels?: MetricLabels }>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t) {}\n\n\tset(labelsOrValue: MetricLabels | number, maybeValue?: number): void {\n\t\tif (typeof labelsOrValue === \"number\") {\n\t\t\tthis.values.set(\"\", { value: labelsOrValue });\n\t\t\treturn;\n\t\t}\n\t\tconst labels = labelsOrValue;\n\t\tconst val = typeof maybeValue === \"number\" ? maybeValue : 0;\n\t\tconst key = labelsToKey(labels);\n\t\tthis.values.set(key, { value: val, labels });\n\t}\n\n\tinc(labels?: MetricLabels, value = 1): void {\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value += value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tdec(labels?: MetricLabels, value = 1): void {\n\t\tconst key = labelsToKey(labels);\n\t\tconst current = this.values.get(key) || { value: 0, labels };\n\t\tcurrent.value -= value;\n\t\tthis.values.set(key, current);\n\t}\n\n\tget(labels?: MetricLabels): number {\n\t\tconst key = labelsToKey(labels);\n\t\treturn this.values.get(key)?.value || 0;\n\t}\n\n\treset(): void {\n\t\tthis.values.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} gauge`,\n\t\t];\n\t\tif (this.values.size === 0) {\n\t\t\tlines.push(`${this.name} 0`);\n\t\t\treturn lines;\n\t\t}\n\t\tfor (const entry of this.values.values()) {\n\t\t\tlines.push(`${this.name}${formatLabels(entry.labels)} ${entry.value}`);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class Histogram {\n\tpublic readonly buckets: number[];\n\tprivate observations = new Map<\n\t\tstring,\n\t\t{\n\t\t\tcount: number;\n\t\t\tsum: number;\n\t\t\tbucketCounts: Map<number, number>;\n\t\t\tlabels?: MetricLabels;\n\t\t}\n\t>();\n\n\tconstructor(\n\t\tpublic readonly name: string,\n\t\tpublic readonly help: string,\n\t\tbuckets: number[] = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 10000],\n\t) {\n\t\tthis.buckets = [...buckets].sort((a, b) => a - b);\n\t}\n\n\tobserve(labelsOrValue: MetricLabels | number, maybeValue?: number): void {\n\t\tlet labels: MetricLabels | undefined;\n\t\tlet val: number;\n\n\t\tif (typeof labelsOrValue === \"number\") {\n\t\t\tval = labelsOrValue;\n\t\t} else {\n\t\t\tlabels = labelsOrValue;\n\t\t\tval = typeof maybeValue === \"number\" ? maybeValue : 0;\n\t\t}\n\n\t\tconst key = labelsToKey(labels);\n\t\tlet state = this.observations.get(key);\n\t\tif (!state) {\n\t\t\tstate = {\n\t\t\t\tcount: 0,\n\t\t\t\tsum: 0,\n\t\t\t\tbucketCounts: new Map(this.buckets.map((b) => [b, 0])),\n\t\t\t\tlabels,\n\t\t\t};\n\t\t\tthis.observations.set(key, state);\n\t\t}\n\n\t\tstate.count += 1;\n\t\tstate.sum += val;\n\n\t\tfor (const bound of this.buckets) {\n\t\t\tif (val <= bound) {\n\t\t\t\tconst cur = state.bucketCounts.get(bound) || 0;\n\t\t\t\tstate.bucketCounts.set(bound, cur + 1);\n\t\t\t}\n\t\t}\n\t}\n\n\treset(): void {\n\t\tthis.observations.clear();\n\t}\n\n\ttoPrometheus(): string[] {\n\t\tconst lines: string[] = [\n\t\t\t`# HELP ${this.name} ${this.help}`,\n\t\t\t`# TYPE ${this.name} histogram`,\n\t\t];\n\t\tif (this.observations.size === 0) {\n\t\t\tlines.push(`${this.name}_count 0`);\n\t\t\tlines.push(`${this.name}_sum 0`);\n\t\t\treturn lines;\n\t\t}\n\n\t\tfor (const state of this.observations.values()) {\n\t\t\tconst baseLabels = state.labels || {};\n\t\t\tfor (const bound of this.buckets) {\n\t\t\t\tconst bucketLabels = { ...baseLabels, le: String(bound) };\n\t\t\t\tlines.push(\n\t\t\t\t\t`${this.name}_bucket${formatLabels(bucketLabels)} ${state.bucketCounts.get(bound) || 0}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst infLabels = { ...baseLabels, le: \"+Inf\" };\n\t\t\tlines.push(\n\t\t\t\t`${this.name}_bucket${formatLabels(infLabels)} ${state.count}`,\n\t\t\t);\n\t\t\tlines.push(`${this.name}_sum${formatLabels(baseLabels)} ${state.sum}`);\n\t\t\tlines.push(\n\t\t\t\t`${this.name}_count${formatLabels(baseLabels)} ${state.count}`,\n\t\t\t);\n\t\t}\n\t\treturn lines;\n\t}\n}\n\nexport class MetricsRegistry {\n\tprivate counters = new Map<string, Counter>();\n\tprivate gauges = new Map<string, Gauge>();\n\tprivate histograms = new Map<string, Histogram>();\n\n\tcounter(name: string, help: string): Counter {\n\t\tlet c = this.counters.get(name);\n\t\tif (!c) {\n\t\t\tc = new Counter(name, help);\n\t\t\tthis.counters.set(name, c);\n\t\t}\n\t\treturn c;\n\t}\n\n\tgauge(name: string, help: string): Gauge {\n\t\tlet g = this.gauges.get(name);\n\t\tif (!g) {\n\t\t\tg = new Gauge(name, help);\n\t\t\tthis.gauges.set(name, g);\n\t\t}\n\t\treturn g;\n\t}\n\n\thistogram(name: string, help: string, buckets?: number[]): Histogram {\n\t\tlet h = this.histograms.get(name);\n\t\tif (!h) {\n\t\t\th = new Histogram(name, help, buckets);\n\t\t\tthis.histograms.set(name, h);\n\t\t}\n\t\treturn h;\n\t}\n\n\tcollectProcessMetrics(): void {\n\t\tconst uptime = this.gauge(\n\t\t\t\"liop_process_uptime_seconds\",\n\t\t\t\"Process uptime in seconds\",\n\t\t);\n\t\tuptime.set(Math.floor(process.uptime()));\n\n\t\tconst health = this.gauge(\n\t\t\t\"liop_node_health_status\",\n\t\t\t\"Operational health status of the LIOP node (1 = healthy, 0 = degraded)\",\n\t\t);\n\t\thealth.set(1);\n\n\t\tif (typeof process.memoryUsage === \"function\") {\n\t\t\tconst mem = process.memoryUsage();\n\t\t\tconst rss = this.gauge(\n\t\t\t\t\"liop_process_memory_rss_bytes\",\n\t\t\t\t\"Resident set size memory in bytes\",\n\t\t\t);\n\t\t\trss.set(mem.rss);\n\n\t\t\tconst heapUsed = this.gauge(\n\t\t\t\t\"liop_process_memory_heap_used_bytes\",\n\t\t\t\t\"Heap memory used in bytes\",\n\t\t\t);\n\t\t\theapUsed.set(mem.heapUsed);\n\n\t\t\tconst heapTotal = this.gauge(\n\t\t\t\t\"liop_process_memory_heap_total_bytes\",\n\t\t\t\t\"Total V8 allocated heap memory in bytes\",\n\t\t\t);\n\t\t\theapTotal.set(mem.heapTotal);\n\n\t\t\tconst external = this.gauge(\n\t\t\t\t\"liop_process_memory_external_bytes\",\n\t\t\t\t\"External memory bound to C++ objects and buffers in bytes\",\n\t\t\t);\n\t\t\texternal.set(mem.external);\n\t\t}\n\t}\n\n\texportPrometheusText(): string {\n\t\tthis.collectProcessMetrics();\n\n\t\tconst lines: string[] = [];\n\t\tfor (const c of this.counters.values()) {\n\t\t\tlines.push(...c.toPrometheus());\n\t\t}\n\t\tfor (const g of this.gauges.values()) {\n\t\t\tlines.push(...g.toPrometheus());\n\t\t}\n\t\tfor (const h of this.histograms.values()) {\n\t\t\tlines.push(...h.toPrometheus());\n\t\t}\n\t\tlines.push(\"\"); // Trailing newline\n\t\treturn lines.join(\"\\n\");\n\t}\n\n\tresetAll(): void {\n\t\tfor (const c of this.counters.values()) c.reset();\n\t\tfor (const g of this.gauges.values()) g.reset();\n\t\tfor (const h of this.histograms.values()) h.reset();\n\t}\n}\n\n// ── Global Standard Protocol Metrics Instance ──────────────────────────────────\n\nexport const protocolMetrics = new MetricsRegistry();\n\nexport const toolCallsTotal = protocolMetrics.counter(\n\t\"liop_tool_calls_total\",\n\t\"Total number of tool logic-injection executions\",\n);\n\nexport const toolCallErrorsTotal = protocolMetrics.counter(\n\t\"liop_tool_call_errors_total\",\n\t\"Total number of failed tool logic-injection executions or policy rejections\",\n);\n\nexport const fuelConsumed = protocolMetrics.histogram(\n\t\"liop_fuel_consumed_total\",\n\t\"Deterministic fuel units consumed by injected logic\",\n\t[100, 500, 1000, 2500, 5000, 10000, 50000, 100000],\n);\n\nexport const meshPeersConnected = protocolMetrics.gauge(\n\t\"liop_mesh_peers_connected\",\n\t\"Active peer connections in the P2P mesh\",\n);\n\nexport const manifestCacheSize = protocolMetrics.gauge(\n\t\"liop_manifest_cache_size\",\n\t\"Number of verified remote tool manifests in cache\",\n);\n\nexport const egressBlocksTotal = protocolMetrics.counter(\n\t\"liop_egress_blocks_total\",\n\t\"Total number of outputs blocked by Egress Shield\",\n);\n\nexport const zkVerificationDurationMs = protocolMetrics.histogram(\n\t\"liop_zk_verification_duration_ms\",\n\t\"Duration of ZK-Receipt and HMAC cryptographic attestation in ms\",\n\t[1, 2, 5, 10, 25, 50, 100, 250, 500],\n);\n\nexport const zkVerificationsTotal = protocolMetrics.counter(\n\t\"liop_zk_verifications_total\",\n\t\"Total number of ZK-Receipt cryptographic attestation checks\",\n);\n\nexport const zkProofsByTypeTotal = protocolMetrics.counter(\n\t\"liop_zk_proofs_by_type_total\",\n\t\"Total number of verified ZK receipts partitioned by proof type (groth16, hmac)\",\n);\n\nexport const zkProvingDurationMs = protocolMetrics.histogram(\n\t\"liop_zk_proving_duration_ms\",\n\t\"Duration of native ZK proof generation in ms\",\n\t[10, 25, 50, 100, 250, 500, 1000, 2500],\n);\n\nexport const zkVkeyCacheSize = protocolMetrics.gauge(\n\t\"liop_zk_vkey_cache_size\",\n\t\"Number of registered verification keys in memory cache\",\n);\n\nexport const tokensInputTotal = protocolMetrics.counter(\n\t\"liop_tokens_input_total\",\n\t\"Total BPE input tokens processed by LIOP\",\n);\n\nexport const tokensOutputTotal = protocolMetrics.counter(\n\t\"liop_tokens_output_total\",\n\t\"Total BPE output tokens emitted by LIOP\",\n);\n\nexport const tokensSavedTotal = protocolMetrics.counter(\n\t\"liop_tokens_saved_total\",\n\t\"Estimated tokens saved compared to MCP context-pulling baseline\",\n);\n\nexport const operationDurationMs = protocolMetrics.histogram(\n\t\"liop_operation_duration_ms\",\n\t\"End-to-end operation duration in ms\",\n\t[5, 15, 30, 50, 100, 250, 500, 1000, 2500, 5000],\n);\n\nexport const pqcHandshakeDurationMs = protocolMetrics.histogram(\n\t\"liop_pqc_handshake_duration_ms\",\n\t\"Duration of ML-KEM-768 post-quantum cryptographic key encapsulation in ms\",\n\t[1, 5, 10, 25, 50, 100, 250, 500],\n);\n\nexport const pqcHandshakesTotal = protocolMetrics.counter(\n\t\"liop_pqc_handshakes_total\",\n\t\"Total number of ML-KEM-768 key encapsulation operations\",\n);\n\nexport const wireEgressBytesTotal = protocolMetrics.counter(\n\t\"liop_wire_egress_bytes_total\",\n\t\"Total wire egress bytes emitted by logic executions\",\n);\n\nexport const wireSavedBytesTotal = protocolMetrics.counter(\n\t\"liop_wire_saved_bytes_total\",\n\t\"Estimated wire egress bytes saved compared to MCP context extraction baseline\",\n);\n"]}

package/dist/chunk-V47P2AQR.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/runtime/routing-table.ts","../src/runtime/topology-probe.ts"],"names":[],"mappings":";;;;AAqCO,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA,EACjB,MAAA,uBAAa,GAAA,EAAuB;AAAA,EAC5C,OAAwB,YAAA,GAAe,CAAA;AAAA;AAAA;AAAA;AAAA,EAKhC,oBAAA,CACN,KAAA,EACA,WAAA,EACA,YAAA,GAAe,IAAA,EACR;AACP,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,IAAI,CAAA;AAC1C,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,QAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,QAAA,EAAU,cAAA;AAAA,QACV,QAAA,EAAU,WAAA;AAAA,QACV,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,SAAA,EAAW,UAAU,SAAA,IAAa,CAAA;AAAA,QAClC,SAAA,EAAW,CAAA;AAAA,QACX,WAAA,EAAa,QAAA,EAAU,WAAA,IAAe,IAAA,CAAK,GAAA,EAAI;AAAA,QAC/C;AAAA,OACA,CAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0BAAA,EAA6B,KAAA,CAAM,MAAM,CAAA,2BAAA,EAA8B,WAAW,CAAA,CAAA;AAAA,KACnF;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,iBAAA,CACN,KAAA,EACA,UAAA,EACA,YAAA,GAAe,KAAA,EACR;AACP,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,IAAI,CAAA;AAE1C,MAAA,IACC,YACA,QAAA,CAAS,QAAA,KAAa,cAAA,IACtB,QAAA,CAAS,cAAc,CAAA,EACtB;AACD,QAAA;AAAA,MACD;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,QAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,QAAA,EAAU,UAAA;AAAA,QACV,QAAA,EAAU,UAAA;AAAA,QACV,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,WAAA,EAAa,IAAA,CAAK,WAAA,IAAe,QAAA,EAAU,WAAA;AAAA,QAC3C,SAAA,EAAW,UAAU,SAAA,IAAa,CAAA;AAAA,QAClC,SAAA,EAAW,CAAA;AAAA,QACX,WAAA,EAAa,QAAA,EAAU,WAAA,IAAe,IAAA,CAAK,GAAA,EAAI;AAAA,QAC/C;AAAA,OACA,CAAA;AAAA,IACF;AACA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0BAAA,EAA6B,KAAA,CAAM,MAAM,CAAA,4BAAA,EAA+B,UAAU,CAAA,CAAA;AAAA,KACnF;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAkB,IAAA,EAA4B;AACpD,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA,MAC1B,MAAM,IAAA,CAAK,IAAA;AAAA,MACX,QAAA,EAAU,OAAA;AAAA,MACV,QAAA,EAAU,YAAA;AAAA,MACV,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,SAAA,EAAW,CAAA;AAAA,MACX,SAAA,EAAW,CAAA;AAAA,MACX,WAAA,EAAa,KAAK,GAAA,EAAI;AAAA,MACtB,YAAA,EAAc;AAAA,KACd,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKO,QAAQ,QAAA,EAAyC;AACvD,IAAA,MAAM,UAAA,GAAa,YAAA,CAAa,QAAQ,CAAA,IAAK,QAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,KAAK,MAAA,CAAO,GAAA,CAAI,UAAU,CAAA,IAAK,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACrE,IAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AAGnB,IAAA,IAAI,KAAA,CAAM,SAAA,IAAa,aAAA,CAAa,YAAA,EAAc;AACjD,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,qBAAA,EAAwB,QAAQ,CAAA,qCAAA,EAAwC,KAAA,CAAM,SAAS,CAAA,uBAAA;AAAA,OACxF;AAAA,IACD;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKO,aAAA,CAAc,UAAkB,SAAA,EAAyB;AAC/D,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,KAAA,CAAM,SAAA,GAAY,CAAA;AAClB,MAAA,KAAA,CAAM,SAAA,GAAY,SAAA;AAClB,MAAA,KAAA,CAAM,WAAA,GAAc,KAAK,GAAA,EAAI;AAAA,IAC9B;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,QAAA,EAAwB;AAC5C,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AACtC,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,KAAA,CAAM,SAAA,IAAa,CAAA;AACnB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0CAAA,EAA6C,QAAQ,CAAA,cAAA,EAAiB,KAAA,CAAM,SAAS,CAAA,CAAA;AAAA,OACtF;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,qBAAA,GAA0C;AAChD,IAAA,MAAM,OAAyB,EAAC;AAChC,IAAA,KAAA,MAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,MAAA,EAAO,EAAG;AACzC,MAAA,IAAA,CAAK,IAAA,CAAK;AAAA,QACT,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,aAAa,KAAA,CAAM,WAAA;AAAA,QACnB,aAAa,KAAA,CAAM;AAAA,OACnB,CAAA;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EACxD;AAAA,EAEO,SAAS,QAAA,EAAyC;AACxD,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AAAA,EAChC;AAAA,EAEO,IAAA,GAAe;AACrB,IAAA,OAAO,KAAK,MAAA,CAAO,IAAA;AAAA,EACpB;AAAA,EAEO,KAAA,GAAc;AACpB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AACD;;;ACvIA,eAAe,eAAA,CACd,cACA,OAAA,EACsC;AACtC,EAAA,MAAM,UAAA,GAAa,YAAA,CAAa,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,GAAG,UAAU,CAAA,OAAA,CAAA;AAE/B,EAAA,IAAI;AACH,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,8CAAA,EAAiD,SAAS,CAAA,CAAE,CAAA;AACrE,IAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,MACxC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,MACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,KAChC,CAAA;AAED,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AAClB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,gCAAA,EAAmC,SAAS,CAAA,OAAA,EAAU,SAAA,CAAU,MAAM,CAAA,CAAA;AAAA,OACvE;AACA,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,UAAA,GAAc,MAAM,SAAA,CAAU,IAAA,EAAK;AAazC,IAAA,IAAI,UAAA,CAAW,WAAW,SAAA,EAAW;AACpC,MAAA,OAAO,IAAA;AAAA,IACR;AAGA,IAAA,IAAI,MAAA,GAAS,UAAA,CAAW,IAAA,EAAM,MAAA,IAAU,EAAA;AACxC,IAAA,IAAI,aAAA,GAAgB,UAAA,CAAW,IAAA,EAAM,cAAA,IAAkB,EAAA;AACvD,IAAA,IAAI,QAAA,GAAW,QAAQ,QAAA,IAAY,mBAAA;AACnC,IAAA,IAAI,MAAA,GAAmB;AAAA,MACtB,iBAAA;AAAA,MACA,iBAAA;AAAA,MACA,qBAAA;AAAA,MACA,kBAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,GAAG,UAAU,CAAA,qCAAA,CAAA;AAC5B,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,QAClC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OAChC,CAAA;AACD,MAAA,IAAI,OAAO,EAAA,EAAI;AACd,QAAA,MAAM,OAAA,GAAW,MAAM,MAAA,CAAO,IAAA,EAAK;AAKnC,QAAA,IAAI,OAAA,CAAQ,QAAA,EAAU,QAAA,GAAW,OAAA,CAAQ,QAAA;AACzC,QAAA,IAAI,OAAA,CAAQ,uBAAuB,MAAA,EAAQ;AAC1C,UAAA,MAAA,GAAS,OAAA,CAAQ,sBAAsB,CAAC,CAAA;AAAA,QACzC;AACA,QAAA,IAAI,OAAA,CAAQ,kBAAkB,MAAA,EAAQ;AACrC,UAAA,MAAA,GAAS,OAAA,CAAQ,gBAAA;AAAA,QAClB;AAAA,MACD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAGA,IAAA,IAAI,CAAC,iBAAiB,MAAA,EAAQ;AAC7B,MAAA,MAAM,aAAa,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GAAI,MAAA,GAAS,GAAG,MAAM,CAAA,KAAA,CAAA;AAChE,MAAA,aAAA,GAAgB,GAAG,UAAU,CAAA,MAAA,CAAA;AAAA,IAC9B;AAGA,IAAA,IAAI,aAAA,EAAe;AAClB,MAAA,IAAI;AACH,QAAA,MAAM,cAAA,GAAiB,IAAI,GAAA,CAAI,aAAa,CAAA;AAC5C,QAAA,IAAI,QAAQ,QAAA,EAAU;AACrB,UAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACrD,UAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,SAAS,CAAA,CAAE,IAAA;AACrC,UAAA,cAAA,CAAe,IAAA,GAAO,SAAA;AACtB,UAAA,aAAA,GAAgB,eAAe,QAAA,EAAS;AAAA,QACzC,CAAA,MAAA,IAAA,CACE,cAAA,CAAe,QAAA,KAAa,OAAA,IAC5B,eAAe,QAAA,KAAa,YAAA,IAC5B,cAAA,CAAe,QAAA,CAAS,WAAW,MAAM,CAAA,KAC1C,UAAA,CAAW,QAAA,CAAS,WAAW,CAAA,EAC9B;AACD,UAAA,cAAA,CAAe,IAAA,GAAO,iBAAA;AACtB,UAAA,aAAA,GAAgB,eAAe,QAAA,EAAS;AAAA,QACzC;AAAA,MACD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,2CAAA,EAAyC,UAAU,CAAA,SAAA,EAAY,UAAA,CAAW,KAAA,EAAO,MAAA,IAAU,CAAC,CAAA,QAAA,EAAW,UAAA,CAAW,QAAA,EAAU,IAAA,IAAQ,CAAC,CAAA,CAAA;AAAA,KACtI;AAEA,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,UAAA;AAAA,MACT,WAAA,EAAa,GAAG,UAAU,CAAA,IAAA,CAAA;AAAA,MAC1B,cAAA,EAAgB,GAAG,UAAU,CAAA,OAAA,CAAA;AAAA,MAC7B,aAAA;AAAA,MACA,MAAA;AAAA,MACA,QAAA;AAAA,MACA,MAAA;AAAA,MACA,KAAA,EAAO,UAAA,CAAW,KAAA,IAAS,EAAC;AAAA,MAC5B,IAAA,EAAM,UAAA,CAAW,QAAA,EAAU,IAAA,IAAQ;AAAA,KACpC;AAAA,EACD,SAAS,GAAA,EAAK;AACb,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,6CAAA,EAAgD,UAAU,CAAA,EAAA,EAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KAChH;AACA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAKA,eAAsB,aAAA,CACrB,OAAA,GAAgC,EAAC,EACF;AAC/B,EAAA,GAAA,CAAI,KAAK,iEAAiE,CAAA;AAE1E,EAAA,IAAI,WAAA,GAA0C,IAAA;AAG9C,EAAA,IAAI,QAAQ,MAAA,EAAQ;AACnB,IAAA,WAAA,GAAc,MAAM,eAAA,CAAgB,OAAA,CAAQ,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC5D;AAGA,EAAA,IAAI,CAAC,WAAA,KAAgB,OAAA,CAAQ,cAAA,IAAkB,IAAA,CAAA,EAAO;AACrD,IAAA,MAAM,aAAA,GAAgB;AAAA,MACrB,wBAAA;AAAA;AAAA,MACA,wBAAA;AAAA;AAAA,MACA;AAAA;AAAA,KACD;AAEA,IAAA,KAAA,MAAW,OAAO,aAAA,EAAe;AAEhC,MAAA,IAAI,OAAA,CAAQ,UAAU,GAAA,CAAI,QAAA,CAAS,IAAI,GAAA,CAAI,OAAA,CAAQ,MAAM,CAAA,CAAE,IAAI,CAAA;AAC9D,QAAA;AAED,MAAA,WAAA,GAAc,MAAM,eAAA,CAAgB,GAAA,EAAK,OAAO,CAAA;AAChD,MAAA,IAAI,WAAA,EAAa;AAAA,IAClB;AAAA,EACD;AAGA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,cAAA,IAAkB,EAAC;AAClD,EAAA,MAAM,iBAAA,GAAoB,eAAe,MAAA,GAAS,CAAA;AAGlD,EAAA,IAAI,eAAe,iBAAA,EAAmB;AACrC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,yDAAA,EAAuD,WAAA,CAAY,OAAO,CAAA,GAAA,EAAM,eAAe,MAAM,CAAA,gBAAA;AAAA,KACtG;AACA,IAAA,OAAO;AAAA,MACN,IAAA,EAAM,QAAA;AAAA,MACN,OAAA,EAAS,WAAA;AAAA,MACT,IAAA,EAAM;AAAA,QACL,cAAA;AAAA,QACA,cAAc,OAAA,CAAQ;AAAA;AACvB,KACD;AAAA,EACD;AAEA,EAAA,IAAI,WAAA,EAAa;AAChB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,iFAAA,EAA6E,YAAY,OAAO,CAAA,CAAA;AAAA,KACjG;AACA,IAAA,OAAO;AAAA,MACN,IAAA,EAAM,SAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,GAAA,CAAI,IAAA;AAAA,IACH,CAAA,+EAAA,EAA2E,eAAe,MAAM,CAAA,CAAA;AAAA,GACjG;AACA,EAAA,OAAO;AAAA,IACN,IAAA,EAAM,MAAA;AAAA,IACN,IAAA,EAAM;AAAA,MACL,cAAA;AAAA,MACA,cAAc,OAAA,CAAQ;AAAA;AACvB,GACD;AACD","file":"chunk-V47P2AQR.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Routing Table — Per-Tool Hybrid Routing & Resilience\n *\n * Maintains deterministic per-tool routes across heterogeneous transports:\n * - \"http-gateway\": Route through Border LIO Gateway or reverse proxy via HTTP/JSON-RPC.\n * - \"p2p-grpc\": Route directly to sovereign node via libp2p + gRPC (Kyber768/ZK-Receipt).\n * - \"local\": Handled in-process (e.g. LiopMeshStatus, diagnostic probes).\n *\n * Implements per-route latency tracking, failure backoff, and circuit breaking.\n */\n\nimport { TOOL_ALIASES } from \"../gateway/mcp-compat.js\";\nimport { log } from \"../utils/logger.js\";\n\nexport type TransportProvider = \"http-gateway\" | \"p2p-grpc\" | \"local\";\n\nexport interface ToolDefinition {\n\tname: string;\n\tdescription?: string;\n\tinputSchema?: Record<string, unknown>;\n}\n\nexport interface ToolRoute {\n\tname: string;\n\tprovider: TransportProvider;\n\tendpoint: string;\n\tdescription?: string;\n\tinputSchema?: Record<string, unknown>;\n\tlatencyMs: number;\n\tfailCount: number;\n\tlastSuccess: number;\n\tauthRequired?: boolean;\n}\n\nexport class RoutingTable {\n\tprivate routes = new Map<string, ToolRoute>();\n\tprivate static readonly MAX_FAILURES = 5;\n\n\t/**\n\t * Registers or updates a collection of tools exposed via an HTTP Gateway.\n\t */\n\tpublic registerGatewayTools(\n\t\ttools: ToolDefinition[],\n\t\tmcpEndpoint: string,\n\t\tauthRequired = true,\n\t): void {\n\t\tfor (const tool of tools) {\n\t\t\tconst existing = this.routes.get(tool.name);\n\t\t\tthis.routes.set(tool.name, {\n\t\t\t\tname: tool.name,\n\t\t\t\tprovider: \"http-gateway\",\n\t\t\t\tendpoint: mcpEndpoint,\n\t\t\t\tdescription: tool.description ?? existing?.description,\n\t\t\t\tinputSchema: tool.inputSchema ?? existing?.inputSchema,\n\t\t\t\tlatencyMs: existing?.latencyMs ?? 0,\n\t\t\t\tfailCount: 0,\n\t\t\t\tlastSuccess: existing?.lastSuccess ?? Date.now(),\n\t\t\t\tauthRequired,\n\t\t\t});\n\t\t}\n\t\tlog.info(\n\t\t\t`[RoutingTable] Registered ${tools.length} tool(s) via HTTP Gateway (${mcpEndpoint})`,\n\t\t);\n\t}\n\n\t/**\n\t * Registers tools discovered directly over the P2P Mesh (gRPC).\n\t */\n\tpublic registerMeshTools(\n\t\ttools: ToolDefinition[],\n\t\tgrpcTarget: string,\n\t\tauthRequired = false,\n\t): void {\n\t\tfor (const tool of tools) {\n\t\t\tconst existing = this.routes.get(tool.name);\n\t\t\t// Do not overwrite healthy gateway routes unless explicitly preferred\n\t\t\tif (\n\t\t\t\texisting &&\n\t\t\t\texisting.provider === \"http-gateway\" &&\n\t\t\t\texisting.failCount === 0\n\t\t\t) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tthis.routes.set(tool.name, {\n\t\t\t\tname: tool.name,\n\t\t\t\tprovider: \"p2p-grpc\",\n\t\t\t\tendpoint: grpcTarget,\n\t\t\t\tdescription: tool.description ?? existing?.description,\n\t\t\t\tinputSchema: tool.inputSchema ?? existing?.inputSchema,\n\t\t\t\tlatencyMs: existing?.latencyMs ?? 0,\n\t\t\t\tfailCount: 0,\n\t\t\t\tlastSuccess: existing?.lastSuccess ?? Date.now(),\n\t\t\t\tauthRequired,\n\t\t\t});\n\t\t}\n\t\tlog.info(\n\t\t\t`[RoutingTable] Registered ${tools.length} tool(s) via P2P Mesh gRPC (${grpcTarget})`,\n\t\t);\n\t}\n\n\t/**\n\t * Registers an in-process local tool (e.g. LiopMeshStatus).\n\t */\n\tpublic registerLocalTool(tool: ToolDefinition): void {\n\t\tthis.routes.set(tool.name, {\n\t\t\tname: tool.name,\n\t\t\tprovider: \"local\",\n\t\t\tendpoint: \"in-process\",\n\t\t\tdescription: tool.description,\n\t\t\tinputSchema: tool.inputSchema,\n\t\t\tlatencyMs: 0,\n\t\t\tfailCount: 0,\n\t\t\tlastSuccess: Date.now(),\n\t\t\tauthRequired: false,\n\t\t});\n\t}\n\n\t/**\n\t * Resolves the optimal route for a specific tool.\n\t */\n\tpublic resolve(toolName: string): ToolRoute | undefined {\n\t\tconst targetName = TOOL_ALIASES[toolName] || toolName;\n\t\tconst route = this.routes.get(targetName) ?? this.routes.get(toolName);\n\t\tif (!route) return undefined;\n\n\t\t// If circuit is tripped (excessive failures), still return route but log warning\n\t\tif (route.failCount >= RoutingTable.MAX_FAILURES) {\n\t\t\tlog.warn(\n\t\t\t\t`[RoutingTable] Tool '${toolName}' route has tripped circuit breaker (${route.failCount} consecutive failures).`,\n\t\t\t);\n\t\t}\n\n\t\treturn route;\n\t}\n\n\t/**\n\t * Records a successful invocation on a route, resetting failures and updating latency.\n\t */\n\tpublic recordSuccess(toolName: string, latencyMs: number): void {\n\t\tconst route = this.routes.get(toolName);\n\t\tif (route) {\n\t\t\troute.failCount = 0;\n\t\t\troute.latencyMs = latencyMs;\n\t\t\troute.lastSuccess = Date.now();\n\t\t}\n\t}\n\n\t/**\n\t * Records a failed invocation on a route.\n\t */\n\tpublic recordFailure(toolName: string): void {\n\t\tconst route = this.routes.get(toolName);\n\t\tif (route) {\n\t\t\troute.failCount += 1;\n\t\t\tlog.warn(\n\t\t\t\t`[RoutingTable] Failure recorded for tool '${toolName}' (failCount: ${route.failCount})`,\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Lists all registered tools in sorted format for tools/list.\n\t */\n\tpublic getAllToolDefinitions(): ToolDefinition[] {\n\t\tconst list: ToolDefinition[] = [];\n\t\tfor (const route of this.routes.values()) {\n\t\t\tlist.push({\n\t\t\t\tname: route.name,\n\t\t\t\tdescription: route.description,\n\t\t\t\tinputSchema: route.inputSchema,\n\t\t\t});\n\t\t}\n\t\treturn list.sort((a, b) => a.name.localeCompare(b.name));\n\t}\n\n\tpublic getRoute(toolName: string): ToolRoute | undefined {\n\t\treturn this.routes.get(toolName);\n\t}\n\n\tpublic size(): number {\n\t\treturn this.routes.size;\n\t}\n\n\tpublic clear(): void {\n\t\tthis.routes.clear();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Topology Probe — RFC 9728 PRM Chain & Adaptive Network Detection\n *\n * Implements single-URL auto-discovery of multi-tier mesh environments:\n * 1. Probes RFC 9728 Protected Resource Metadata (PRM) or /health endpoint.\n * 2. Chains discovery to obtain OAuth 2.1 authorization server endpoints.\n * 3. Identifies whether the node should operate in \"gateway\", \"mesh\", or \"hybrid\" mode.\n *\n * Standards: RFC 9728, RFC 8414, RFC 8707, NIST SP 800-207\n */\n\nimport { log } from \"../utils/logger.js\";\n\nexport interface GatewayTopologyInfo {\n\tbaseUrl: string;\n\tmcpEndpoint: string;\n\thealthEndpoint: string;\n\ttokenEndpoint: string;\n\tissuer: string;\n\taudience: string;\n\tscopes: string[];\n\ttools: string[];\n\ttier: number;\n}\n\nexport interface MeshTopologyInfo {\n\tbootstrapNodes: string[];\n\tidentityPath?: string;\n}\n\nexport interface TopologyProbeResult {\n\tmode: \"gateway\" | \"mesh\" | \"hybrid\";\n\tgateway?: GatewayTopologyInfo;\n\tmesh?: MeshTopologyInfo;\n}\n\nexport interface TopologyProbeOptions {\n\tblgUrl?: string;\n\tnexusUrl?: string;\n\tclientId?: string;\n\tclientSecret?: string;\n\taudience?: string;\n\tstaticToken?: string;\n\tbootstrapNodes?: string[];\n\tidentityPath?: string;\n\tautoProbeLocal?: boolean;\n}\n\n/**\n * Executes the RFC 9728 PRM chain and health probe on a candidate Gateway URL.\n */\nasync function probeGatewayUrl(\n\tcandidateUrl: string,\n\toptions: TopologyProbeOptions,\n): Promise<GatewayTopologyInfo | null> {\n\tconst trimmedUrl = candidateUrl.replace(/\\/+$/, \"\");\n\tconst healthUrl = `${trimmedUrl}/health`;\n\n\ttry {\n\t\tlog.info(`[TopologyProbe] Probing candidate Gateway at: ${healthUrl}`);\n\t\tconst healthRes = await fetch(healthUrl, {\n\t\t\theaders: { Accept: \"application/json\" },\n\t\t\tsignal: AbortSignal.timeout(3000),\n\t\t});\n\n\t\tif (!healthRes.ok) {\n\t\t\tlog.info(\n\t\t\t\t`[TopologyProbe] Probe failed at ${healthUrl} [HTTP ${healthRes.status}]`,\n\t\t\t);\n\t\t\treturn null;\n\t\t}\n\n\t\tconst healthData = (await healthRes.json()) as {\n\t\t\tstatus?: string;\n\t\t\ttools?: string[];\n\t\t\tauth?: {\n\t\t\t\tissuer?: string;\n\t\t\t\ttoken_endpoint?: string;\n\t\t\t\tjwks_uri?: string;\n\t\t\t};\n\t\t\ttopology?: {\n\t\t\t\ttier?: number;\n\t\t\t};\n\t\t};\n\n\t\tif (healthData.status !== \"healthy\") {\n\t\t\treturn null;\n\t\t}\n\n\t\t// Discover OAuth metadata via PRM (RFC 9728)\n\t\tlet issuer = healthData.auth?.issuer || \"\";\n\t\tlet tokenEndpoint = healthData.auth?.token_endpoint || \"\";\n\t\tlet audience = options.audience || \"urn:liop:mesh:api\";\n\t\tlet scopes: string[] = [\n\t\t\t\"liop:tools:list\",\n\t\t\t\"liop:tools:call\",\n\t\t\t\"liop:resources:read\",\n\t\t\t\"liop:schema:read\",\n\t\t\t\"liop:mesh:query\",\n\t\t];\n\n\t\ttry {\n\t\t\tconst prmUrl = `${trimmedUrl}/.well-known/oauth-protected-resource`;\n\t\t\tconst prmRes = await fetch(prmUrl, {\n\t\t\t\theaders: { Accept: \"application/json\" },\n\t\t\t\tsignal: AbortSignal.timeout(2000),\n\t\t\t});\n\t\t\tif (prmRes.ok) {\n\t\t\t\tconst prmData = (await prmRes.json()) as {\n\t\t\t\t\tresource?: string;\n\t\t\t\t\tauthorization_servers?: string[];\n\t\t\t\t\tscopes_supported?: string[];\n\t\t\t\t};\n\t\t\t\tif (prmData.resource) audience = prmData.resource;\n\t\t\t\tif (prmData.authorization_servers?.length) {\n\t\t\t\t\tissuer = prmData.authorization_servers[0];\n\t\t\t\t}\n\t\t\t\tif (prmData.scopes_supported?.length) {\n\t\t\t\t\tscopes = prmData.scopes_supported;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch {\n\t\t\t// Non-fatal if PRM endpoint is not present\n\t\t}\n\n\t\t// If token endpoint is not explicitly given, resolve from issuer\n\t\tif (!tokenEndpoint && issuer) {\n\t\t\tconst baseIssuer = issuer.endsWith(\"/oidc\") ? issuer : `${issuer}/oidc`;\n\t\t\ttokenEndpoint = `${baseIssuer}/token`;\n\t\t}\n\n\t\t// Normalize tokenEndpoint for Docker-to-Host bridge environments\n\t\tif (tokenEndpoint) {\n\t\t\ttry {\n\t\t\t\tconst parsedEndpoint = new URL(tokenEndpoint);\n\t\t\t\tif (options.nexusUrl) {\n\t\t\t\t\tconst nexusBase = options.nexusUrl.replace(/\\/+$/, \"\");\n\t\t\t\t\tconst nexusHost = new URL(nexusBase).host;\n\t\t\t\t\tparsedEndpoint.host = nexusHost;\n\t\t\t\t\ttokenEndpoint = parsedEndpoint.toString();\n\t\t\t\t} else if (\n\t\t\t\t\t(parsedEndpoint.hostname === \"nexus\" ||\n\t\t\t\t\t\tparsedEndpoint.hostname === \"nexus-prod\" ||\n\t\t\t\t\t\tparsedEndpoint.hostname.startsWith(\"172.\")) &&\n\t\t\t\t\ttrimmedUrl.includes(\"127.0.0.1\")\n\t\t\t\t) {\n\t\t\t\t\tparsedEndpoint.host = \"127.0.0.1:15000\";\n\t\t\t\t\ttokenEndpoint = parsedEndpoint.toString();\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t/* keep original tokenEndpoint */\n\t\t\t}\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[TopologyProbe] ✅ Verified Gateway at ${trimmedUrl} (Tools: ${healthData.tools?.length ?? 0}, Tier: ${healthData.topology?.tier ?? 2})`,\n\t\t);\n\n\t\treturn {\n\t\t\tbaseUrl: trimmedUrl,\n\t\t\tmcpEndpoint: `${trimmedUrl}/mcp`,\n\t\t\thealthEndpoint: `${trimmedUrl}/health`,\n\t\t\ttokenEndpoint,\n\t\t\tissuer,\n\t\t\taudience,\n\t\t\tscopes,\n\t\t\ttools: healthData.tools || [],\n\t\t\ttier: healthData.topology?.tier ?? 2,\n\t\t};\n\t} catch (err) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] Gateway probe unreachable at ${trimmedUrl}: ${err instanceof Error ? err.message : String(err)}`,\n\t\t);\n\t\treturn null;\n\t}\n}\n\n/**\n * Probes the runtime environment and determines the optimal architecture mode.\n */\nexport async function probeTopology(\n\toptions: TopologyProbeOptions = {},\n): Promise<TopologyProbeResult> {\n\tlog.info(\"[TopologyProbe] Starting adaptive network topology discovery...\");\n\n\tlet gatewayInfo: GatewayTopologyInfo | null = null;\n\n\t// 1. Check explicit Border LIO Gateway URL (Highest priority)\n\tif (options.blgUrl) {\n\t\tgatewayInfo = await probeGatewayUrl(options.blgUrl, options);\n\t}\n\n\t// 2. Auto-probing known local infrastructure ports if enabled/unspecified\n\tif (!gatewayInfo && (options.autoProbeLocal ?? true)) {\n\t\tconst candidateUrls = [\n\t\t\t\"http://127.0.0.1:15018\", // Production BLG port\n\t\t\t\"http://127.0.0.1:15000\", // Production Nexus port\n\t\t\t\"http://127.0.0.1:13000\", // Demo Nexus port\n\t\t];\n\n\t\tfor (const url of candidateUrls) {\n\t\t\t// Skip if already probed\n\t\t\tif (options.blgUrl && url.includes(new URL(options.blgUrl).port))\n\t\t\t\tcontinue;\n\n\t\t\tgatewayInfo = await probeGatewayUrl(url, options);\n\t\t\tif (gatewayInfo) break;\n\t\t}\n\t}\n\n\t// 3. Evaluate P2P Mesh connectivity\n\tconst bootstrapNodes = options.bootstrapNodes || [];\n\tconst hasMeshBootstraps = bootstrapNodes.length > 0;\n\n\t// 4. Decide runtime mode\n\tif (gatewayInfo && hasMeshBootstraps) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] ⚡ Mode Determined: HYBRID (Gateway: ${gatewayInfo.baseUrl} + ${bootstrapNodes.length} P2P bootstraps)`,\n\t\t);\n\t\treturn {\n\t\t\tmode: \"hybrid\",\n\t\t\tgateway: gatewayInfo,\n\t\t\tmesh: {\n\t\t\t\tbootstrapNodes,\n\t\t\t\tidentityPath: options.identityPath,\n\t\t\t},\n\t\t};\n\t}\n\n\tif (gatewayInfo) {\n\t\tlog.info(\n\t\t\t`[TopologyProbe] 🚀 Mode Determined: GATEWAY (Zero-P2P overhead, direct to ${gatewayInfo.baseUrl})`,\n\t\t);\n\t\treturn {\n\t\t\tmode: \"gateway\",\n\t\t\tgateway: gatewayInfo,\n\t\t};\n\t}\n\n\tlog.info(\n\t\t`[TopologyProbe] 🌐 Mode Determined: MESH (Standard P2P DHT, Bootstraps: ${bootstrapNodes.length})`,\n\t);\n\treturn {\n\t\tmode: \"mesh\",\n\t\tmesh: {\n\t\t\tbootstrapNodes,\n\t\t\tidentityPath: options.identityPath,\n\t\t},\n\t};\n}\n"]}

package/dist/chunk-WPTOJYN5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rpc/crypto/dilithium.ts","../src/security/rbac.ts"],"names":[],"mappings":";;;AAkBO,IAAM,qBAAA,GAAwB;AAAA,EACpC,gBAAA,EAAkB,IAAA;AAAA,EAClB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB,IAAA;AAAA,EACjB,eAAA,EAAiB,IAAI,WAAA,EAAY,CAAE,OAAO,wBAAwB;AACnE;AAKA,SAAS,iBAAiB,OAAA,EAA0C;AACnE,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAChC,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,OAAA;AACR;AAOA,SAAS,iBAAiB,GAAA,EAAsB;AAC/C,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC5C,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,IAAI,GAAA,CAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,MAAA,GAAS,GAAA;AACf,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CACnC,MAAA,CAAO,CAAC,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA,KAAM,MAAS,EACzC,IAAA,EAAK;AACP,EAAA,MAAM,UAAU,UAAA,CAAW,GAAA;AAAA,IAC1B,CAAC,GAAA,KAAQ,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAiB,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,GACjE;AACA,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEO,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEjC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,iBAAiB,qBAAA,CAAsB,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvC,gBAAgB,IAAA,EAGd;AACD,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,mDAAA,EAAsD,KAAK,MAAM,CAAA,CAAA;AAAA,OAClE;AAAA,IACD;AACA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA;AACjC,IAAA,OAAO;AAAA,MACN,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KACjB;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAC7D,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,OAAO,MAAM,CAAA,CAAA;AAAA,OACjH;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CACC,OAAA,EACA,SAAA,EACA,OAAA,EACa;AACb,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,UAAU,MAAM,CAAA,CAAA;AAAA,OACpH;AAAA,IACD;AACA,IAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,IAAA,OAAO,SAAS,IAAA,CAAK,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,EAC3D,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,CACC,SAAA,EACA,OAAA,EACA,SAAA,EACA,OAAA,EACU;AACV,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,eAAA,EAAiB;AAC/D,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,MAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,MAAA,OAAO,QAAA,CAAS,OAAO,SAAA,EAAW,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CACC,QAAA,EACA,SAAA,EACA,SAAA,EAC2C;AAC3C,IAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,IAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAS,CAAA;AAC7C,IAAA,OAAO;AAAA,MACN,WAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,MAC7C,WAAW,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,QAAQ;AAAA,KACpD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,QAAA,EACA,eAAA,EACA,eAAA,EACU;AACV,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,MAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,MAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK,YAAA,EAAc,GAAG,CAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AACD;;;AC1JA,IAAM,SAAA,GAAyD;AAAA;AAAA,EAE9D,YAAY,EAAC;AAAA,EACb,6BAA6B,EAAC;AAAA,EAC9B,2BAA2B,EAAC;AAAA,EAC5B,MAAM,EAAC;AAAA,EACP,mBAAmB,EAAC;AAAA,EACpB,wBAAwB,EAAC;AAAA;AAAA,EAGzB,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA,EAChC,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA;AAAA,EAGhC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,0BAAA,EAA4B,CAAC,qBAAqB,CAAA;AAAA;AAAA,EAGlD,cAAA,EAAgB,CAAC,kBAAkB,CAAA;AAAA,EACnC,aAAA,EAAe,CAAC,kBAAkB;AACnC,CAAA;AAuBO,SAAS,gBAAA,CACf,MAAA,EACA,IAAA,EACA,gBAAA,EACsB;AACtB,EAAA,MAAM,YAAA,GAAe,UAAU,MAAM,CAAA;AAGrC,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AAC5D,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACxB;AAGA,EAAA,IAAI,CAAC,IAAA,EAAM;AACV,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,uCAAuC,MAAM,CAAA;AAAA,KACtD;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GAAS,CAAC,GAAI,YAAA,IAAgB,EAAC,EAAI,GAAI,gBAAA,IAAoB,EAAG,CAAA;AAGpE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACxB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,mBAAmB,MAAM,CAAA,8BAAA;AAAA,KAClC;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,GAAA,CAAI,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACvB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,QAAQ,CAAA,wBAAA,EAA2B,MAAM,cAAc,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC1E;AAAA,EACD;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACxB;AAMO,IAAM,WAAA,GAAc;AAAA,EAC1B,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACD","file":"chunk-WPTOJYN5.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Post-Quantum Digital Signature Wrapper\n * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant\n * manifest attestation, node revocation receipts, and cryptographic integrity.\n *\n * Characteristics:\n * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)\n * - Public Key Length: 1952 bytes\n * - Secret Key Length: 4032 bytes\n * - Signature Length: 3309 bytes\n * - Implementation: Pure TypeScript/JS via @noble/post-quantum\n */\n\nimport { ml_dsa65 } from \"@noble/post-quantum/ml-dsa.js\";\n\nexport const DILITHIUM65_CONSTANTS = {\n\tPUBLIC_KEY_BYTES: 1952,\n\tSECRET_KEY_BYTES: 4032,\n\tSIGNATURE_BYTES: 3309,\n\tDEFAULT_CONTEXT: new TextEncoder().encode(\"LIOP-FIPS204-ML-DSA-65\"),\n} as const;\n\n/**\n * Deterministically normalizes a message into a Uint8Array.\n */\nfunction normalizeMessage(message: Uint8Array | string): Uint8Array {\n\tif (typeof message === \"string\") {\n\t\treturn new TextEncoder().encode(message);\n\t}\n\treturn message;\n}\n\n/**\n * Deterministic canonical JSON serializer to ensure stable cryptographic hashing\n * regardless of key ordering in JavaScript objects (per RFC 8785 JCS).\n * Keys with undefined values are strictly excluded per RFC 8785 section 3.2.2.\n */\nfunction canonicalizeJson(obj: unknown): string {\n\tif (obj === null || typeof obj !== \"object\") {\n\t\treturn JSON.stringify(obj);\n\t}\n\tif (Array.isArray(obj)) {\n\t\treturn `[${obj.map(canonicalizeJson).join(\",\")}]`;\n\t}\n\tconst record = obj as Record<string, unknown>;\n\tconst sortedKeys = Object.keys(record)\n\t\t.filter((key) => record[key] !== undefined)\n\t\t.sort();\n\tconst entries = sortedKeys.map(\n\t\t(key) => `${JSON.stringify(key)}:${canonicalizeJson(record[key])}`,\n\t);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nexport const Dilithium65Wrapper = {\n\t/** Constants */\n\tPUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,\n\tSECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,\n\tSIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,\n\n\t/**\n\t * Generates a new ML-DSA-65 (FIPS 204) key pair.\n\t * Optionally accepts a 32-byte seed for deterministic key generation.\n\t */\n\tgenerateKeyPair(seed?: Uint8Array): {\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t} {\n\t\tif (seed && seed.length !== 32) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`,\n\t\t\t);\n\t\t}\n\t\tconst keys = ml_dsa65.keygen(seed);\n\t\treturn {\n\t\t\tpublicKey: keys.publicKey,\n\t\t\tsecretKey: keys.secretKey,\n\t\t};\n\t},\n\n\t/**\n\t * Validates and imports a raw ML-DSA-65 public key.\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Signs a message using the post-quantum secret key.\n\t * Supports optional domain separation context (up to 255 bytes).\n\t */\n\tsign(\n\t\tmessage: Uint8Array | string,\n\t\tsecretKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): Uint8Array {\n\t\tif (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`,\n\t\t\t);\n\t\t}\n\t\tconst msgBytes = normalizeMessage(message);\n\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\treturn ml_dsa65.sign(msgBytes, secretKey, { context: ctx });\n\t},\n\n\t/**\n\t * Verifies an ML-DSA-65 post-quantum digital signature.\n\t */\n\tverify(\n\t\tsignature: Uint8Array,\n\t\tmessage: Uint8Array | string,\n\t\tpublicKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): boolean {\n\t\tif (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\tif (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\ttry {\n\t\t\tconst msgBytes = normalizeMessage(message);\n\t\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\t\treturn ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n\n\t/**\n\t * Signs a structured manifest (LiopManifest) using canonical JSON serialization.\n\t * Returns base64-encoded signature and public key for transport over gRPC/MCP.\n\t */\n\tsignManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsecretKey: Uint8Array,\n\t\tpublicKey: Uint8Array,\n\t): { signature: string; publicKey: string } {\n\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\tconst sig = this.sign(canonicalStr, secretKey);\n\t\treturn {\n\t\t\tsignature: Buffer.from(sig).toString(\"base64\"),\n\t\t\tpublicKey: Buffer.from(publicKey).toString(\"base64\"),\n\t\t};\n\t},\n\n\t/**\n\t * Verifies the post-quantum signature of a structured manifest.\n\t */\n\tverifyManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsignatureBase64: string,\n\t\tpublicKeyBase64: string,\n\t): boolean {\n\t\ttry {\n\t\t\tconst sig = Buffer.from(signatureBase64, \"base64\");\n\t\t\tconst pub = Buffer.from(publicKeyBase64, \"base64\");\n\t\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\t\treturn this.verify(sig, canonicalStr, pub);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP RBAC Engine — Scope-Based Authorization\n *\n * Maps MCP JSON-RPC methods to required LIOP OAuth scopes.\n * Enforces least-privilege access at the router level before\n * any tool execution or resource read occurs.\n *\n * Standards: NIST SP 800-207 §4.3 (least privilege), OWASP LLM06 (Excessive Agency),\n *            OWASP API-A01 (Broken Access Control)\n */\n\nimport type { AuthInfo } from \"./jwt-validator.js\";\n\n/**\n * Maps MCP JSON-RPC methods to the LIOP scopes required to invoke them.\n * Empty array = no authentication required (public endpoints).\n */\nconst SCOPE_MAP: Readonly<Record<string, readonly string[]>> = {\n\t// Protocol lifecycle — unauthenticated (MCP spec compliance)\n\tinitialize: [],\n\t\"notifications/initialized\": [],\n\t\"notifications/cancelled\": [],\n\tping: [],\n\t\"server/discover\": [],\n\t\"subscriptions/listen\": [],\n\n\t// Tool operations — require explicit authorization\n\t\"tools/list\": [\"liop:tools:list\"],\n\t\"tools/call\": [\"liop:tools:call\"],\n\n\t// Resource operations — read-level access\n\t\"resources/list\": [\"liop:resources:read\"],\n\t\"resources/read\": [\"liop:resources:read\"],\n\t\"resources/templates/list\": [\"liop:resources:read\"],\n\n\t// Prompt/schema operations — schema-level access\n\t\"prompts/list\": [\"liop:schema:read\"],\n\t\"prompts/get\": [\"liop:schema:read\"],\n};\n\n/**\n * Authorization result with optional denial reason for audit logging.\n */\nexport interface AuthorizationResult {\n\tallowed: boolean;\n\treason?: string;\n}\n\n/**\n * Evaluates whether a request is authorized based on JWT scopes.\n *\n * Decision logic:\n * 1. Methods with no required scopes (initialize, ping) → always allowed.\n * 2. Methods with required scopes but no auth → denied.\n * 3. Methods with required scopes → all scopes must be present in the JWT.\n * 4. Unknown methods with no auth → denied (fail-closed per NIST SP 800-207).\n *\n * @param method - MCP JSON-RPC method name (e.g., \"tools/call\")\n * @param auth - Validated JWT context, or null if unauthenticated\n * @param additionalScopes - Extra scopes required by specific node configuration\n */\nexport function authorizeRequest(\n\tmethod: string,\n\tauth: AuthInfo | null,\n\tadditionalScopes?: readonly string[],\n): AuthorizationResult {\n\tconst methodScopes = SCOPE_MAP[method];\n\n\t// Methods explicitly marked as public (empty scope array) pass freely\n\tif (methodScopes !== undefined && methodScopes.length === 0) {\n\t\treturn { allowed: true };\n\t}\n\n\t// If no auth context and method requires scopes → deny\n\tif (!auth) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Authentication required for method: ${method}`,\n\t\t};\n\t}\n\n\t// Merge method-level scopes with node-level additional scopes\n\tconst needed = [...(methodScopes ?? []), ...(additionalScopes ?? [])];\n\n\t// If no scopes needed (unknown method, no additional) → fail-closed\n\tif (needed.length === 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Unknown method: ${method}. Access denied (fail-closed).`,\n\t\t};\n\t}\n\n\t// Verify all required scopes are present in the JWT\n\tconst clientScopes = new Set(auth.scopes);\n\tconst missing = needed.filter((s) => !clientScopes.has(s));\n\n\tif (missing.length > 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Insufficient scopes for ${method}. Missing: ${missing.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * All LIOP OAuth scopes supported by the protocol.\n * Used for PRM metadata and client registration.\n */\nexport const LIOP_SCOPES = [\n\t\"liop:tools:list\",\n\t\"liop:tools:call\",\n\t\"liop:resources:read\",\n\t\"liop:schema:read\",\n\t\"liop:mesh:query\",\n] as const;\n\nexport type LiopScope = (typeof LIOP_SCOPES)[number];\n"]}

package/dist/chunk-Y62GORQF.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/output-sanitizer.ts"],"names":[],"mappings":";AAkBA,IAAM,cAAA,GAAkD;AAAA,EACvD,gBAAA,EAAkB,CAAA;AAAA,EAClB,gBAAA,EAAkB;AACnB,CAAA;AASO,SAAS,cAAA,CACf,QACA,MAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,MAAA,EAAO;AAC9C,EAAA,MAAM,IAAA,uBAAW,OAAA,EAAgB;AAEjC,EAAA,SAAS,KAAK,IAAA,EAAwB;AACrC,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACxC,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,QAAA,OAAO,IAAA;AAAA,MACR;AAEA,MAAA,IAAI,KAAA,GAAQ,IAAA;AAGZ,MAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,KAAA,GAAQ,CAAA,EAAG;AACzC,QAAA,KAAA,GAAQ,CAAA;AAAA,MACT;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,gBAAA;AAC5B,MAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA,GAAI,MAAA;AAErC,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,SAAS,SAAA,EAAW;AAC1D,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE7B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAc,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACR;AACA,MAAA,IAAA,CAAK,IAAI,IAAc,CAAA;AAEvB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,QAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MACrC;AAEA,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,QAC/B;AAAA,OACD,EAAG;AACF,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,MAAM,CAAA;AACnB","file":"chunk-Y62GORQF.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Egress Shield Output Sanitizer (NIST SP 800-226 and OWASP DLP 2025 compliant)\n * Recursively sanitizes execution outputs by rounding floating-point numbers\n * and clamping negative values to zero floor where appropriate.\n *\n * Implements absolute immutability, returning a fresh copy of the data.\n */\n\nexport interface OutputSanitizerConfig {\n\t/** Maximum decimal places for floating-point values (default: 4) */\n\tmaxDecimalPlaces?: number;\n\t/** Clamp negative values to zero floor (default: true) */\n\tclampNonNegative?: boolean;\n}\n\nconst DEFAULT_CONFIG: Required<OutputSanitizerConfig> = {\n\tmaxDecimalPlaces: 4,\n\tclampNonNegative: true,\n};\n\n/**\n * Recursively walks a JSON-like tree, rounding floats and clamping negative values.\n *\n * @param output - The raw or DP-modified output object/value to sanitize\n * @param config - Sanitization parameters (rounding depth, negative clamping)\n * @returns A sanitized deep copy of the output\n */\nexport function sanitizeOutput(\n\toutput: unknown,\n\tconfig?: OutputSanitizerConfig,\n): unknown {\n\tconst merged = { ...DEFAULT_CONFIG, ...config };\n\tconst seen = new WeakSet<object>();\n\n\tfunction walk(node: unknown): unknown {\n\t\tif (node === null || node === undefined) {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"number\") {\n\t\t\tif (!Number.isFinite(node)) {\n\t\t\t\treturn node;\n\t\t\t}\n\n\t\t\tlet value = node;\n\n\t\t\t// 1. Clamp negative values to 0 if configured\n\t\t\tif (merged.clampNonNegative && value < 0) {\n\t\t\t\tvalue = 0;\n\t\t\t}\n\n\t\t\t// 2. Round to maximum decimal places\n\t\t\tconst factor = 10 ** merged.maxDecimalPlaces;\n\t\t\tvalue = Math.round(value * factor) / factor;\n\n\t\t\treturn value;\n\t\t}\n\n\t\tif (typeof node === \"string\" || typeof node === \"boolean\") {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"object\") {\n\t\t\t// Circular reference protection\n\t\t\tif (seen.has(node as object)) {\n\t\t\t\treturn node;\n\t\t\t}\n\t\t\tseen.add(node as object);\n\n\t\t\tif (Array.isArray(node)) {\n\t\t\t\treturn node.map((item) => walk(item));\n\t\t\t}\n\n\t\t\tconst result: Record<string, unknown> = {};\n\t\t\tfor (const [key, val] of Object.entries(\n\t\t\t\tnode as Record<string, unknown>,\n\t\t\t)) {\n\t\t\t\tresult[key] = walk(val);\n\t\t\t}\n\t\t\treturn result;\n\t\t}\n\n\t\treturn node;\n\t}\n\n\treturn walk(output);\n}\n"]}

package/dist/chunk-ZJGVKM7G.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rpc/client.ts","../src/rpc/crypto/aes.ts","../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;AAsBO,IAAM,gBAAN,MAAoB;AAAA;AAAA,EAElB,MAAA;AAAA,EACA,KAAA;AAAA,EACA,iBAAA;AAAA,EACQ,OAAA;AAAA,EAEhB,WAAA,CAAY,OAAA,EAAiB,GAAA,EAAsB,KAAA,EAAuB;AACzE,IAAA,MAAM,WAAA,GAAc,yBAAyB,GAAG,CAAA;AAChD,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,MAAA,CAAO,SAAA;AAAA,MACxB,OAAA;AAAA,MACA,WAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EAChB;AAAA,EAEO,SAAS,KAAA,EAA6B;AAC5C,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAAA,IAC1B;AAAA,EACD;AAAA,EAEA,MAAc,YAAA,GAA4C;AACzD,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,UAAA,EAAY;AACrC,MAAA,IAAA,CAAK,iBAAA,GAAoB,MAAM,IAAA,CAAK,KAAA,EAAM;AAC1C,MAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,IACb;AACA,IAAA,IAAA,CAAK,oBAAoB,IAAA,CAAK,KAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,gBACZ,OAAA,EAC0B;AAC1B,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,YAAA,EAAa;AAC5C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,MAAM,QAAA,GAAW,IAAS,IAAA,CAAA,QAAA,EAAS;AACnC,MAAA,IAAI,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,WAAW,CAAA,CAAE,CAAA;AAAA,MACtD;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,eAAA;AAAA,QACX,OAAA;AAAA,QACA,QAAA;AAAA,QACA,CAAC,OAAiC,QAAA,KAA6B;AAC9D,UAAA,IAAI,KAAA,EAAO;AACV,YAAA,MAAA,CAAO,KAAK,CAAA;AAAA,UACb,CAAA,MAAO;AACN,YAAA,OAAA,CAAQ,QAAQ,CAAA;AAAA,UACjB;AAAA,QACD;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,aACN,OAAA,EAC2C;AAC3C,IAAA,MAAM,QAAA,GAAW,IAAS,IAAA,CAAA,QAAA,EAAS;AACnC,IAAA,MAAM,WAAA,GACL,KAAK,iBAAA,KACJ,OAAO,KAAK,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,MAAA,CAAA;AAChD,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,QAAA,CAAS,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,WAAW,CAAA,CAAE,CAAA;AAAA,IACtD;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEO,KAAA,GAAc;AACpB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AACD;AChGO,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5B,cAAA,CACC,SACA,YAAA,EAIC;AACD,IAAA,IAAI,YAAA,CAAa,WAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AAGA,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,aAAA,EAAe,YAAA,EAAc,KAAK,CAAA;AAGhE,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACxE,IAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAIlC,IAAA,MAAM,kBAAkB,MAAA,CAAO,MAAA,CAAO,CAAC,SAAA,EAAW,OAAO,CAAC,CAAA;AAE1D,IAAA,OAAO;AAAA,MACN,UAAA,EAAY,eAAA;AAAA,MACZ;AAAA,KACD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,gBAAA,EACA,KAAA,EACA,YAAA,EACS;AACT,IAAA,IAAI,gBAAA,CAAiB,SAAS,EAAA,EAAI;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,MAAM,aAAA,GAAgB,gBAAA,CAAiB,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AACtD,IAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,QAAA,CAAS,GAAG,CAAA;AAE7C,IAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,aAAA,EAAe,YAAA,EAAc,KAAK,CAAA;AACpE,IAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAE3B,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAAA,EACxE;AACD;;;AC/BO,IAAM,aAAN,MAAiB;AAAA,EACf,QAAA,GAA4B,IAAA;AAAA,EAC5B,UAAA,uBAA6C,GAAA,EAAI;AAAA,EACjD,SAAA,uBAA2C,GAAA,EAAI;AAAA,EAC/C,UAAA;AAAA,EACA,UAAA;AAAA,EACD,QAAA,GAAyB,IAAI,YAAA,EAAa;AAAA,EACzC,UAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAGD,GAAA,GAAc,QAAA;AAAA;AAAA,EAEd,eAAA,GAA0B,oBAAA;AAAA,EAEjC,YAAY,GAAA,EAAsB;AACjC,IAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,OAAA,CACZ,OAAA,EACA,OAAA,EAWgB;AAEhB,IAAA,MAAM,QAAA,GACL,SAAS,IAAA,EAAM,QAAA,IACf,QAAQ,GAAA,CAAI,oBAAA,IACZ,QAAQ,GAAA,CAAI,cAAA;AACb,IAAA,MAAM,YAAA,GACL,SAAS,IAAA,EAAM,YAAA,IACf,QAAQ,GAAA,CAAI,wBAAA,IACZ,QAAQ,GAAA,CAAI,kBAAA;AACb,IAAA,MAAM,WACL,OAAA,EAAS,IAAA,EAAM,QAAA,IACf,OAAA,CAAQ,IAAI,cAAA,IACZ,uBAAA;AACD,IAAA,MAAM,WACL,OAAA,EAAS,IAAA,EAAM,QAAA,IACf,OAAA,CAAQ,IAAI,mBAAA,IACZ,mBAAA;AACD,IAAA,MAAM,QACL,OAAA,EAAS,IAAA,EAAM,KAAA,IACf,OAAA,CAAQ,IAAI,gBAAA,IACZ,sFAAA;AAED,IAAA,IAAA,CAAK,UAAA,GACJ,SAAS,IAAA,EAAM,KAAA,IACf,QAAQ,GAAA,CAAI,gBAAA,IACZ,QAAQ,GAAA,CAAI,UAAA;AAEb,IAAA,IAAI,YAAY,YAAA,EAAc;AAC7B,MAAA,MAAM,OAAA,GAAA,CAAW,QAAY,EAAyB,QAAA,CAAS,OAAO,IACnE,QAAY,GACZ,CAAA,EAAG,QAAmC,CAAA,KAAA,CAAA;AACzC,MAAA,MAAM,aAAA,GAAgB,GAAG,OAAO,CAAA,MAAA,CAAA;AAEhC,MAAA,IAAA,CAAK,YAAA,GAAe,IAAI,YAAA,CAAa;AAAA,QACpC,aAAA;AAAA,QACA,QAAA;AAAA,QACA,YAAA;AAAA,QACA,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACR,CAAA;AAED,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACnD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH;AAAA,SACD;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,mDACC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAChD,CAAA;AAAA,SACD;AAAA,MAED;AAAA,IACD;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,OAAA,EAAS,UAAU,CAAA;AAChD,IAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAC1B,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,6CAAA,EAAgD,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,CAAA;AAAA,KAC1E;AAEA,IAAA,IAAI,OAAA,EAAS;AACZ,MAAA,MAAM,gBAAgB,YAAY;AACjC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AAAA,QACzC;AACA,QAAA,OAAO,IAAA,CAAK,UAAA;AAAA,MACb,CAAA;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA;AAAA,QACf,QAAA;AAAA,QACA,IAAI,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,YAAY,aAAa;AAAA,OAC1D;AACA,MAAA,IAAA,CAAK,aAAa,EAAE,IAAA,EAAM,eAAe,OAAO,CAAA,CAAA,CAAA,EAAK,SAAS,OAAA,EAAQ;AACtE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,yCAAA,EAA4C,OAAO,CAAA,CAAE,CAAA;AAAA,IAC/D,CAAA,MAAO;AACN,MAAA,IAAA,CAAK,UAAA,GAAa,EAAE,IAAA,EAAM,yBAAA,EAA2B,SAAS,OAAA,EAAQ;AAAA,IACvE;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gBAAgB,KAAA,EAAgC;AAEvD,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACjC,MAAA,IAAI,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,CAAA,GAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,MAAM,EAAA,GAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC1B,QAAA,IACC,EAAA,KAAO,WAAA,IACP,CAAC,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,IACrB,EAAA,KAAO,SAAA,IACP,EAAA,KAAO,WAAA,EACN;AACD,UAAA,OAAO,EAAA;AAAA,QACR;AAAA,MACD;AAAA,IACD;AAGA,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACjC,MAAA,IAAI,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,CAAA,GAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,MACvB;AAAA,IACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,kBAAkB,QAAA,EAAmC;AACjE,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAED,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6CAAA,EAAgD,QAAQ,CAAA,GAAA,CAAK,CAAA;AACtE,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,QAAQ,CAAA;AAE5D,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,qDAAqD,QAAQ,CAAA;AAAA,OAC9D;AAAA,IACD;AAEA,IAAA,MAAM,UAAA,GAAa,UAAU,CAAC,CAAA;AAC9B,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AAEvE,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,UAAU,CAAA;AAC7D,IAAA,IAAI,QAAA,EAAU;AACb,MAAA,QAAA,GAAW,QAAA,CAAS,QAAA;AACpB,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACvC,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0CAAA,EAA6C,QAAQ,CAAA,6BAAA,EAAgC,UAAU,CAAA;AAAA,OAChG;AAAA,IACD;AAEA,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,UAAU,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC5C,IAAA,IAAI,SAAA,EAAW;AACd,MAAA,MAAM,QAAA,GAAW,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACzC,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,6DAA6D,QAAQ,CAAA;AAAA,OACtE;AACA,MAAA,OAAO,QAAA;AAAA,IACR;AAEA,IAAA,OAAO,aAAa,QAAQ,CAAA,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,oBAAoB,MAAA,EAI9B;AACF,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAkC;AAAA,QACvC,cAAA,EAAgB,kBAAA;AAAA,QAChB,YAAA,EAAc;AAAA,OACf;AACA,MAAA,IAAI,KAAK,UAAA,EAAY;AACpB,QAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,MAClD;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,QAC/B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACpB,OAAA,EAAS,KAAA;AAAA,UACT,EAAA,EAAI,CAAA;AAAA,UACJ,MAAA,EAAQ,iBAAA;AAAA,UACR,QAAQ;AAAC,SACT;AAAA,OACD,CAAA;AAED,MAAA,IAAI,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAG7B,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,EAAQ,iBAAA,IAAqB,EAAC;AACrD,QAAA,IAAI,SAAA,CAAU,QAAA,CAAS,oBAAoB,CAAA,EAAG;AAC7C,UAAA,IAAA,CAAK,GAAA,GAAM,QAAA;AACX,UAAA,IAAA,CAAK,eAAA,GAAkB,oBAAA;AACvB,UAAA,OAAO;AAAA,YACN,GAAA,EAAK,QAAA;AAAA,YACL,eAAA,EAAiB,oBAAA;AAAA,YACjB,iBAAA,EAAmB;AAAA,WACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD,SAAS,IAAA,EAAM;AAAA,IAEf;AAGA,IAAA,IAAI,0BAAA,EAA4B;AAC/B,MAAA,IAAA,CAAK,GAAA,GAAM,QAAA;AACX,MAAA,IAAA,CAAK,eAAA,GAAkB,2BAAA;AACvB,MAAA,OAAO;AAAA,QACN,GAAA,EAAK,QAAA;AAAA,QACL,eAAA,EAAiB,2BAAA;AAAA,QACjB,iBAAA,EAAmB,CAAC,2BAA2B;AAAA,OAChD;AAAA,IACD;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,aAAA,CACZ,YAAA,GAAe,KAAA,EACqC;AACpD,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AAEA,IAAA,MAAM,kBAAA,GAAqB,KAAK,GAAA,EAAI;AAEpC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iDAAiD,YAAY,CAAA,IAAA;AAAA,KAC9D;AACA,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,yBAAA,EAA0B;AAClE,IAAA,MAAM,QAAkD,EAAC;AACzD,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAY;AAElC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AACjC,MAAA,IAAI;AACH,QAAA,IAAI,WAA4C,CAAC,YAAA,GAC9C,KAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA,GACzB,KAAA,CAAA;AAEH,QAAA,IAAI,CAAC,QAAA,EAAU;AACd,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,qCAAA,EAAwC,MAAM,CAAA,CAAE,CAAA;AACzD,UAAA,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,aAAA,CAAc,MAAM,CAAA;AACnD,UAAA,IAAI,QAAA,EAAU;AACb,YAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAAA,UACpC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,wCAAA,EAA2C,MAAM,CAAA,CAAE,CAAA;AAAA,QAC7D;AAEA,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,KAAA,EAAO;AAClC,YAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AAC9B,cAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,WAAA,EAAa,IAAA,CAAK,aAAa,CAAA;AAC7D,cAAA,SAAA,CAAU,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,YACxB;AAAA,UACD;AAAA,QACD;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,6CAA6C,MAAM,CAAA,CAAA,CAAA;AAAA,UACnD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,SAChD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,uCAAA,EAA0C,MAAM,MAAM,CAAA,cAAA;AAAA,KACvD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,MAAA,MAAM,YAAA,GAAe,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACzC,MAAA,MAAM,oBAAA,GAAuB,IAAA,CAAK,SAAA,CAAU,EAAE,OAAO,CAAA;AACrD,MAAA,SAAA,CAAU,MAAA,CAAO;AAAA,QAChB,IAAA,EAAM,YAAA;AAAA,QACN,MAAA,EAAQ,eAAA;AAAA,QACR,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,YAAY,CAAA;AAAA,QACxD,qBAAA,EAAuB,SAAA,CAAU,WAAA,CAAY,oBAAoB,CAAA;AAAA,QACjE,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB,CAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QAAA,CACZ,OAAA,EACA,YAAA,EACA,OAAA,EAC0B;AAC1B,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,aAAA,GAAgB,KAAK,GAAA,EAAI;AAC/B,IAAA,MAAM,WAAW,OAAA,CAAQ,IAAA;AACzB,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAE,CAAA;AAGnD,IAAA,IAAI,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,IAAI,eAAA,GAAkB,QAAA;AAEtB,IAAA,IAAI,CAAC,SAAA,EAAW;AAEf,MAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA,EAAG;AAClC,QAAA,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AACxC,QAAA,eAAA,GAAkB,QAAA;AAAA,MACnB;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,SAAA,EAAW;AAEf,MAAA,IAAI,YAAA,GAA8B,IAAA;AAClC,MAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,QAAQ,KAAK,IAAA,CAAK,SAAA,CAAU,SAAQ,EAAG;AAC1D,QAAA,IAAI,QAAA,CAAS,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,QAAQ,CAAA,EAAG;AAEpD,UAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,YAAA,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACtC,YAAA,eAAA,GAAkB,MAAA;AAClB,YAAA;AAAA,UACD;AAEA,UAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,MAAM,CAAA;AACpD,UAAA,MAAM,SAAA,GAAY,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC5C,UAAA,IAAI,SAAA,EAAW;AACd,YAAA,YAAA,GAAe,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAA,CAAS,QAAQ,CAAA,CAAA;AAChD,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,iCAAA,EAAoC,QAAQ,CAAA,uCAAA,EAA0C,YAAY,CAAA;AAAA,aACnG;AACA,YAAA,eAAA,GAAkB,MAAA;AAClB,YAAA,SAAA,GAAY,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,YAAY,CAAA;AAC1D,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,SAAA,EAAW;AACf,QAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,iBAAA,CAAkB,QAAQ,CAAA;AAC5D,QAAA,eAAA,GAAkB,QAAA;AAClB,QAAA,SAAA,GAAY,IAAA,CAAK,oBAAA,CAAqB,QAAA,EAAU,cAAc,CAAA;AAAA,MAC/D;AAAA,IACD,CAAA,MAAO;AACN,MAAA,eAAA,GAAkB,QAAA;AAClB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,0DAA0D,QAAQ,CAAA,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,oCAAA,EAAuC,QAAQ,CAAA,GAAA,CAAK,CAAA;AAC7D,IAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB,CAAA,SAAA,EAAY,KAAK,QAAA,CAAS,SAAA,EAAW,CAAA,CAAA,GACrC,oBAAA;AACH,IAAA,MAAM,aAAA,GAAgB,OAAO,IAAA,CAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,CAAA;AAC7D,IAAA,MAAM,aAAA,GAAgB,KAAK,QAAA,GACxB,MAAM,KAAK,QAAA,CAAS,IAAA,CAAK,aAAa,CAAA,GACtC,aAAA;AAEH,IAAA,IAAI,cAAA;AASJ,IAAA,IAAI;AACH,MAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,QACjD,SAAA,EAAW,QAAA;AAAA,QACX,eAAA,EAAiB,QAAA;AAAA,QACjB,eAAA,EAAiB;AAAA,OACjB,CAAA;AAAA,IACF,SAAS,GAAA,EAAc;AACtB,MAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,MAAA,IACC,KAAK,YAAA,KACJ,MAAA,CAAO,QAAA,CAAS,iBAAiB,KACjC,MAAA,CAAO,QAAA,CAAS,aAAa,CAAA,IAC7B,OAAO,QAAA,CAAS,wBAAwB,KACxC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,CAAA,EACzB;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,kDAAkD,QAAQ,CAAA,qEAAA;AAAA,SAC3D;AACA,QAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACpD,QAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,QAAA,SAAA,CAAU,SAAS,UAAU,CAAA;AAC7B,QAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,UACjD,SAAA,EAAW,QAAA;AAAA,UACX,eAAA,EAAiB,QAAA;AAAA,UACjB,eAAA,EAAiB;AAAA,SACjB,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,MAAM,GAAA;AAAA,MACP;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,eAAe,QAAA,EAAU;AAC7B,MAAA,IACC,IAAA,CAAK,iBACJ,cAAA,CAAe,aAAA,EAAe,SAAS,OAAO,CAAA,IAC9C,eAAe,aAAA,EAAe,QAAA,CAAS,iBAAiB,CAAA,IACxD,cAAA,CAAe,eAAe,QAAA,CAAS,SAAS,KAChD,cAAA,CAAe,aAAA,EAAe,QAAA,CAAS,wBAAwB,CAAA,CAAA,EAC/D;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,+CAAA,EAAkD,eAAe,aAAa,CAAA,mCAAA;AAAA,SAC/E;AACA,QAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACpD,QAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,QAAA,SAAA,CAAU,SAAS,UAAU,CAAA;AAC7B,QAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,UACjD,SAAA,EAAW,QAAA;AAAA,UACX,eAAA,EAAiB,QAAA;AAAA,UACjB,eAAA,EAAiB;AAAA,SACjB,CAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,eAAe,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,uBAAA,EAA0B,eAAe,aAAa,CAAA;AAAA,SACvD;AAAA,MACD;AAAA,IACD;AAGA,IAAA,MAAM,SAAA,GACL,cAAA,CAAe,gBAAA,IAAoB,cAAA,CAAe,cAAA;AACnD,IAAA,MAAM,YAAA,GACL,cAAA,CAAe,aAAA,IAAiB,cAAA,CAAe,YAAA;AAEhD,IAAA,IAAI,CAAC,SAAA,EAAW;AACf,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4EAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,IAAI;AACH,QAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,UACtB,SAAA,EAAW,YAAA;AAAA,UACX,MAAA,EAAQ;AAAA,SACR,CAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,QAAQ,IAAI,CAAA,GAAA;AAAA,KAC1E;AACA,IAAA,MAAM,QAAA,GAAW,YAAY,GAAA,EAAI;AACjC,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAM,eAAA,CAAgB,qBAAA,CAAsB,SAAS,CAAA;AACjE,MAAA,eAAA,GAAkB,GAAA,CAAI,UAAA;AACtB,MAAA,YAAA,GAAe,GAAA,CAAI,YAAA;AACnB,MAAA,MAAM,WAAA,GAAc,WAAA,CAAY,GAAA,EAAI,GAAI,QAAA;AACxC,MAAA,sBAAA,CAAuB,QAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA;AAClE,MAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,QACtB,SAAA,EAAW,YAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACR,CAAA;AAAA,IACF,SAAS,UAAA,EAAY;AACpB,MAAA,IAAI;AACH,QAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,UACtB,SAAA,EAAW,YAAA;AAAA,UACX,MAAA,EAAQ;AAAA,SACR,CAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,UAAA;AAAA,IACP;AAGA,IAAA,GAAA,CAAI,KAAK,CAAA,+CAAA,CAAiD,CAAA;AAE1D,IAAA,MAAM,YAAA,GAAe,YAAA,IAAgB,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA;AAGnD,IAAA,MAAM,EAAE,YAAY,aAAA,EAAe,KAAA,EAAO,UAAS,GAClD,aAAA,CAAc,cAAA,CAAe,YAAA,EAAc,YAAY,CAAA;AAGxD,IAAA,MAAM,kBAA8C,EAAC;AACrD,IAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAa,CAAA;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,MAAA,CAAO,QAAQ,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA,EAAG;AACnE,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,WAAA,CAAY,EAAE,CAAA;AACxC,MAAA,MAAM,SAAS,MAAA,CAAO,cAAA;AAAA,QACrB,aAAA;AAAA,QACA,YAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,MAAM,SAAA,GAAY,OAAO,MAAA,CAAO;AAAA,QAC/B,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,QACnC,OAAO,KAAA;AAAM,OACb,CAAA;AACD,MAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,MAAA,eAAA,CAAgB,GAAG,IAAI,MAAA,CAAO,MAAA,CAAO,CAAC,UAAA,EAAY,SAAA,EAAW,OAAO,CAAC,CAAA;AAAA,IACtE;AAGA,IAAA,MAAM,YAAA,GAA6B;AAAA,MAClC,aAAA,EAAe,YAAA;AAAA,MACf,WAAA,EAAa,aAAA;AAAA,MACb,MAAA,EAAQ,eAAA;AAAA,MACR,cAAA,EAAgB,eAAA;AAAA,MAChB,SAAA,EAAW;AAAA,KACZ;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,YAAA,CAAa,YAAY,CAAA;AAClD,MAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,oDAAoD,CAAC,CAAA;AACtE,QAAA;AAAA,MACD;AACA,MAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,MAAA,IAAI,eAAA,GAAkB,KAAA;AAEtB,MAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,OAAO,QAAA,KAA4B;AACpD,QAAA,IAAI,eAAA,EAAiB;AACrB,QAAA,eAAA,GAAkB,IAAA;AAElB,QAAA,GAAA,CAAI,KAAK,0DAA0D,CAAA;AAEnE,QAAA,IAAI;AAIH,UAAA,IAAI,IAAA,GAAO,KAAA;AACX,UAAA,IAAI,CAAC,SAAS,QAAA,EAAU;AACvB,YAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,UAAU,CAAA;AAClD,YAAA,IAAA,GAAO,UAAA,CAAW,MAAA,GAAS,CAAA,IAAK,UAAA,CAAW,CAAC,CAAA,KAAM,CAAA;AAElD,YAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,KAAa,IAAA,GAAO,UAAA,GAAa,MAAA,CAAA;AAE3D,YAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,QAAA,CAAS,eAAA;AAAA,cACnC,YAAA;AAAA,cACA,OAAO,IAAA,CAAK,QAAA,CAAS,mBAAmB,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,cACxD,UAAA;AAAA,cACA;AAAA,gBACC,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA;AAAA,gBACvC,gBAAgB,QAAA,CAAS,iBAAA;AAAA,gBACzB,aAAa,OAAA,EAAS,WAAA;AAAA,gBACtB;AAAA;AACD,aACD;AAEA,YAAA,IAAI;AACH,cAAA,oBAAA,CAAqB,GAAA,CAAI;AAAA,gBACxB,MAAA,EAAQ,UAAU,OAAA,GAAU;AAAA,eAC5B,CAAA;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAEA,YAAA,IAAI,CAAC,OAAA,EAAS;AACb,cAAA,IAAI;AACH,gBAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,kBACvB,UAAA,EAAY,QAAA;AAAA,kBACZ,UAAA,EAAY;AAAA,iBACZ,CAAA;AAAA,cACF,CAAA,CAAA,MAAQ;AAAA,cAAC;AACT,cAAA,MAAA;AAAA,gBACC,IAAI,KAAA;AAAA,kBACH;AAAA;AACD,eACD;AACA,cAAA;AAAA,YACD;AAAA,UACD,CAAA,MAAO;AACN,YAAA,IAAI;AACH,cAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,gBACvB,UAAA,EAAY,QAAA;AAAA,gBACZ,UAAA,EAAY;AAAA,eACZ,CAAA;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAAC;AAAA,UACV;AAEA,UAAA,eAAA,GAAkB,IAAA;AAGlB,UAAA,IAAI;AACH,YAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,YAAA,MAAM,eAAe,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA;AAC3D,YAAA,SAAA,CAAU,MAAA,CAAO;AAAA,cAChB,IAAA,EAAM,WAAA;AAAA,cACN,MAAA,EAAQ,UAAA;AAAA,cACR,QAAA;AAAA,cACA,MAAA,EACC,eAAA,KAAoB,QAAA,GAAW,eAAA,GAAkB,KAAA,CAAA;AAAA,cAClD,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,YAAY,CAAA;AAAA,cACxD,uBAAuB,SAAA,CAAU,WAAA;AAAA,gBAChC,QAAA,CAAS;AAAA,eACV;AAAA,cACA,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,aACzB,CAAA;AAED,YAAA,MAAM,cACL,MAAA,CAAO,UAAA,CAAW,QAAA,CAAS,iBAAA,IAAqB,EAAE,CAAA,IACjD,QAAA,CAAS,mBAAA,GACP,QAAA,CAAS,oBAAoB,MAAA,GAC7B,CAAA,CAAA,IACF,SAAS,UAAA,GAAa,QAAA,CAAS,WAAW,MAAA,GAAS,CAAA,CAAA;AACrD,YAAA,oBAAA,CAAqB,GAAA,CAAI,EAAE,UAAA,EAAY,QAAA,IAAY,WAAW,CAAA;AAAA,UAC/D,CAAA,CAAA,MAAQ;AAAA,UAER;AAEA,UAAA,OAAA,CAAQ;AAAA,YACP,OAAA,EAAS;AAAA,cACR;AAAA,gBACC,IAAA,EAAM,MAAA;AAAA,gBACN,MAAM,QAAA,CAAS;AAAA;AAChB,aACD;AAAA,YACA,SAAS,QAAA,CAAS,QAAA;AAAA,YAClB,UAAA,EAAY,CAAC,QAAA,CAAS,QAAA;AAAA,YACtB,WAAA,EAAa,IAAA,GAAA,CAAA,iBAAA,CAAA;AAAA,WACb,CAAA;AAAA,QACF,SAAS,GAAA,EAAK;AACb,UAAA,IAAI;AACH,YAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,cACvB,UAAA,EAAY,QAAA;AAAA,cACZ,UAAA,EAAY;AAAA,aACZ,CAAA;AAAA,UACF,CAAA,CAAA,MAAQ;AAAA,UAAC;AACT,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACX;AAAA,MACD,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AAE3B,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,eAAe,CAAA;AACtC,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAC/B,QAAA,IAAI;AACH,UAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,YACvB,UAAA,EAAY,QAAA;AAAA,YACZ,UAAA,EAAY;AAAA,WACZ,CAAA;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAAC;AACT,QAAA,IAAI,eAAA,EAAiB;AACrB,QAAA,GAAA,CAAI,KAAA,CAAM,8BAA8B,GAAG,CAAA;AAC3C,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,EAAA,CAAG,OAAO,MAAM;AAGtB,QAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,eAAA,EAAiB;AACzC,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gDAAgD,CAAC,CAAA;AAAA,QACnE;AAAA,MACD,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,oBAAA,CAAqB,QAAgB,OAAA,EAAgC;AAC5E,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,MAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACxC,MAAA,IAAI,UAAA,GAAa,MAAA;AAIjB,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,wBAAwB,MAAM,CAAA,+EAAA;AAAA,SAC/B;AACA,QAAA,KAAA,MAAW,CAAC,GAAA,EAAK,CAAC,KAAK,IAAA,CAAK,SAAA,CAAU,SAAQ,EAAG;AAChD,UAAA,IAAI,CAAA,CAAE,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,CAAA,EAAG;AAC3C,YAAA,QAAA,GAAW,CAAA;AACX,YAAA,UAAA,GAAa,GAAA;AACb,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,+BAA+B,MAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,sBAAA;AAAA,aAC5E;AACA,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,MAAM,YAAA,GAAe,QAAA,EAAU,UAAA,EAAY,IAAA,EAAM,aAAY,IAAK,EAAA;AAClE,MAAA,IAAI,QAAA;AAGJ,MAAA,MAAM,OAAO,QAAA,EAAU,SAAA;AACvB,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,IAAI,CAAA,CAAE,KAChC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,IAAI,CAAA,CAAE,CAAA;AACvC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,wCAAwC,IAAI,CAAA,cAAA,EAAiB,IAAI,CAAA,YAAA,EAAe,CAAC,CAAC,QAAQ,CAAA;AAAA,SAC3F;AAAA,MACD,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,gDAAgD,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,2BAA2B,KAAA,CAAM,IAAA;AAAA,YACpG,IAAA,CAAK,UAAU,IAAA;AAAK,WACrB,CACE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,EAAE,CAAC,CAAA,CACtB,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,SACb;AAAA,MACD;AAGA,MAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC5B,QAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,EAAE,EAAE,WAAA,EAAY;AACjD,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,CAAE,KACnC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAAA,MAC3C;AAGA,MAAA,IAAI,CAAC,YAAY,YAAA,EAAc;AAC9B,QAAA,MAAM,YAAY,YAAA,CAChB,WAAA,EAAY,CACZ,OAAA,CAAQ,eAAe,GAAG,CAAA;AAC5B,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,KACrC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAE,CAAA;AAAA,MAC7C;AAEA,MAAA,IAAI,QAAA,EAAU;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,sDAAsD,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,CAAA,EAAA,EAAK,gBAAgB,SAAS,CAAA,CAAA;AAAA,SACzG;AAAA,MACD;AAEA,MAAA,MAAM,gBAAgB,YAAY;AACjC,QAAA,IAAI,UAAU,OAAO,QAAA;AACrB,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AAAA,QACzC;AACA,QAAA,OAAO,IAAA,CAAK,UAAA;AAAA,MACb,CAAA;AAEA,MAAA,MAAA,GAAS,IAAI,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,YAAY,aAAa,CAAA;AAClE,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,aAAa,GAAA,EAEvB;AACF,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AACA,IAAA,MAAM,aAAA,GAAgB,KAAK,GAAA,EAAI;AAC/B,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,yCAAA,EAA4C,GAAG,CAAA,GAAA,CAAK,CAAA;AAG7D,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,GAAG,CAAA;AACvD,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,GAAG,CAAA,CAAE,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,SAAS,aAAA,CAAc,SAAA,CAAU,CAAC,CAAC,CAAA;AAC/D,IAAA,IAAI,CAAC,QAAA,EAAU;AACd,MAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,IACpE;AAGA,IAAA,MAAM,WAAA,GAAc,SAAS,SAAA,EAAW,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AACjE,IAAA,IAAI,CAAC,WAAA,EAAa;AACjB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,IACjE;AAGA,IAAA,MAAM,MAAA,GAAS;AAAA,MACd,QAAA,EAAU;AAAA,QACT;AAAA,UACC,GAAA;AAAA,UACA,QAAA,EAAU,YAAY,QAAA,IAAY,kBAAA;AAAA,UAClC,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,WAAA,EAAa,MAAM,CAAC;AAAA;AAC1C;AACD,KACD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAC3C,MAAA,SAAA,CAAU,MAAA,CAAO;AAAA,QAChB,IAAA,EAAM,eAAA;AAAA,QACN,MAAA,EAAQ,cAAA;AAAA,QACR,QAAA,EAAU,GAAA;AAAA,QACV,MAAA,EAAQ,UAAU,CAAC,CAAA;AAAA,QACnB,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,GAAG,CAAA;AAAA,QAC/C,qBAAA,EAAuB,SAAA,CAAU,WAAA,CAAY,aAAa,CAAA;AAAA,QAC1D,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB,CAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,MAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,MAAA,GAAwB;AAClC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU,IAAK,IAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,YAAA,GAAwB;AAClC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU,IAAK,KAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,eAAA,GAA0B;AACpC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,QAAA,EAAS,CAAE,MAAA,IAAU,CAAA;AAAA,EAC5C;AAAA,EAEO,aAAA,GAA+D;AACrE,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,KAAA,GAAuB;AACnC,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AAAA,EACD;AACD","file":"chunk-ZJGVKM7G.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as grpc from \"@grpc/grpc-js\";\nimport { GRPC_CHANNEL_OPTIONS } from \"./channel-options.js\";\nimport { liopV1 } from \"./proto.js\";\nimport { createChannelCredentials, type LiopTlsOptions } from \"./tls.js\";\nimport type {\n\tIntentRequest,\n\tIntentResponse,\n\tLogicRequest,\n\tLogicResponse,\n} from \"./types.js\";\n\nexport type TokenProvider =\n\t| string\n\t| (() => Promise<string | undefined> | string | undefined);\n\n/**\n * LIOP gRPC Client Implementation\n * Provides a high-level interface for secure intent negotiation and logic execution.\n */\nexport class LiopRpcClient {\n\t// biome-ignore lint/suspicious/noExplicitAny: internal gRPC client type\n\tprivate client: any;\n\tprivate token?: TokenProvider;\n\tprivate lastResolvedToken?: string;\n\tpublic readonly address: string;\n\n\tconstructor(address: string, tls?: LiopTlsOptions, token?: TokenProvider) {\n\t\tconst credentials = createChannelCredentials(tls);\n\t\tthis.client = new liopV1.LogicMesh(\n\t\t\taddress,\n\t\t\tcredentials,\n\t\t\tGRPC_CHANNEL_OPTIONS,\n\t\t);\n\t\tthis.token = token;\n\t\tif (typeof token === \"string\") {\n\t\t\tthis.lastResolvedToken = token;\n\t\t}\n\t\tthis.address = address;\n\t}\n\n\tpublic setToken(token?: TokenProvider): void {\n\t\tthis.token = token;\n\t\tif (typeof token === \"string\") {\n\t\t\tthis.lastResolvedToken = token;\n\t\t}\n\t}\n\n\tprivate async resolveToken(): Promise<string | undefined> {\n\t\tif (typeof this.token === \"function\") {\n\t\t\tthis.lastResolvedToken = await this.token();\n\t\t\treturn this.lastResolvedToken;\n\t\t}\n\t\tthis.lastResolvedToken = this.token;\n\t\treturn this.token;\n\t}\n\n\t/**\n\t * Negotiates intent with the remote host.\n\t * Returns the ephemeral Kyber public key for payload encryption.\n\t */\n\tpublic async negotiateIntent(\n\t\trequest: IntentRequest,\n\t): Promise<IntentResponse> {\n\t\tconst activeToken = await this.resolveToken();\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst metadata = new grpc.Metadata();\n\t\t\tif (activeToken) {\n\t\t\t\tmetadata.add(\"authorization\", `Bearer ${activeToken}`);\n\t\t\t}\n\t\t\tthis.client.NegotiateIntent(\n\t\t\t\trequest,\n\t\t\t\tmetadata,\n\t\t\t\t(error: grpc.ServiceError | null, response: IntentResponse) => {\n\t\t\t\t\tif (error) {\n\t\t\t\t\t\treject(error);\n\t\t\t\t\t} else {\n\t\t\t\t\t\tresolve(response);\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\t}\n\n\t/**\n\t * Pushes the encrypted Logic-on-Origin payload to the origin.\n\t * Returns a stream of semantic responses and ZK proofs.\n\t */\n\tpublic executeLogic(\n\t\trequest: LogicRequest,\n\t): grpc.ClientReadableStream<LogicResponse> {\n\t\tconst metadata = new grpc.Metadata();\n\t\tconst activeToken =\n\t\t\tthis.lastResolvedToken ||\n\t\t\t(typeof this.token === \"string\" ? this.token : undefined);\n\t\tif (activeToken) {\n\t\t\tmetadata.add(\"authorization\", `Bearer ${activeToken}`);\n\t\t}\n\t\treturn this.client.ExecuteLogic(request, metadata);\n\t}\n\n\tpublic close(): void {\n\t\tthis.client.close();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\n/**\n * LIOP Symmetric Payload Encryption Wrapper\n * Uses AES-256-GCM to secure WASM Code transport over Zero-Trust networks.\n * Fully compatible with the `aes-gcm` Rust crate used by Wasmtime.\n */\nexport const AesGcmWrapper = {\n\t/**\n\t * Encrypts a raw WASM payload using the shared secret negotiated via Kyber768.\n\t *\n\t * @param payload Raw incoming WASM byte array or string.\n\t * @param sharedSecret A perfectly derived 32-byte (256-bit) shared secret array\n\t * @returns The encrypted buffer to push to the GRPc stream, along with the 12-byte initialization vector natively generated.\n\t */\n\tencryptPayload(\n\t\tpayload: Uint8Array | Buffer,\n\t\tsharedSecret: Uint8Array,\n\t): {\n\t\tciphertext: Buffer;\n\t\tnonce: Buffer;\n\t} {\n\t\tif (sharedSecret.length !== 32) {\n\t\t\tthrow new Error(\"Symmetric Key must be exactly 32 bytes (256 bits).\");\n\t\t}\n\n\t\t// LIOP standard demands 96-bit (12 byte) IVs/Nonces for AES-GCM\n\t\tconst nonce = randomBytes(12);\n\n\t\tconst cipher = createCipheriv(\"aes-256-gcm\", sharedSecret, nonce);\n\n\t\t// Encrypt the payload and seal the tag\n\t\tconst encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);\n\t\tconst authTag = cipher.getAuthTag(); // 16 bytes for GCM integrity\n\n\t\t// In LIOP, the auth tag is strictly appended to the end of the ciphertext bytes\n\t\t// mirroring the default serialization logic within `aes_gcm::Aes256Gcm` in Rust\n\t\tconst finalCiphertext = Buffer.concat([encrypted, authTag]);\n\n\t\treturn {\n\t\t\tciphertext: finalCiphertext,\n\t\t\tnonce: nonce,\n\t\t};\n\t},\n\n\t/**\n\t * Decrypts a remote Zero-Knowledge receipt using AES-256-GCM.\n\t */\n\tdecryptPayload(\n\t\tciphertextBuffer: Buffer,\n\t\tnonce: Buffer,\n\t\tsharedSecret: Uint8Array,\n\t): Buffer {\n\t\tif (ciphertextBuffer.length < 16) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Invalid GCM Ciphertext; missing authentication tag length\",\n\t\t\t);\n\t\t}\n\n\t\t// The last 16 bytes represent the AuthTag appended by rust-aes-gcm\n\t\tconst encryptedData = ciphertextBuffer.subarray(0, -16);\n\t\tconst authTag = ciphertextBuffer.subarray(-16);\n\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", sharedSecret, nonce);\n\t\tdecipher.setAuthTag(authTag);\n\n\t\treturn Buffer.concat([decipher.update(encryptedData), decipher.final()]);\n\t},\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { LiopVerifier } from \"../crypto/verifier.js\";\nimport { TokenTelemetryEngine } from \"../economy/telemetry.js\";\nimport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"../gateway/mcp-compat.js\";\nimport {\n\ttype LiopManifest,\n\tMeshNode,\n\ttype MeshNodeConfig,\n} from \"../mesh/node.js\";\nimport {\n\tpqcHandshakeDurationMs,\n\tpqcHandshakesTotal,\n\ttoolCallErrorsTotal,\n\twireEgressBytesTotal,\n\tzkVerificationsTotal,\n} from \"../observability/metrics.js\";\nimport { LiopRpcClient } from \"../rpc/client.js\";\nimport { AesGcmWrapper } from \"../rpc/crypto/aes.js\";\nimport { Kyber768Wrapper } from \"../rpc/crypto/kyber.js\";\nimport type { LiopTlsOptions } from \"../rpc/tls.js\";\nimport type { LogicRequest, LogicResponse } from \"../rpc/types.js\";\nimport { TokenManager } from \"../runtime/token-manager.js\";\nimport { ProofType, type ZkPolicy } from \"../security/zk.js\";\nimport {\n\ttype CallToolRequest,\n\ttype CallToolResult,\n\tMCP_PROTOCOL_VERSION,\n\ttype McpEra,\n} from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\n/**\n * LIOP Client\n * High-level orchestration for discovery and execution in the Logic-Injection-on-Origin mesh.\n */\nexport class LiopClient {\n\tprivate meshNode: MeshNode | null = null;\n\tprivate rpcClients: Map<string, LiopRpcClient> = new Map();\n\tprivate manifests: Map<string, LiopManifest> = new Map();\n\tprivate tlsOptions?: LiopTlsOptions;\n\tprivate serverInfo?: { name: string; version: string };\n\tpublic verifier: LiopVerifier = new LiopVerifier();\n\tprivate oauthToken?: string;\n\tprivate tokenManager?: TokenManager;\n\n\t/** Protocol negotiation era */\n\tpublic era: McpEra = \"modern\";\n\t/** Negotiated protocol version */\n\tpublic protocolVersion: string = MCP_PROTOCOL_VERSION;\n\n\tconstructor(tls?: LiopTlsOptions) {\n\t\tthis.tlsOptions = tls;\n\t}\n\n\t/**\n\t * Discovers and connects to the target server or mesh capability.\n\t * If address is omitted, it sets up the MeshNode to act purely dynamically.\n\t */\n\tpublic async connect(\n\t\taddress?: string,\n\t\toptions?: {\n\t\t\tmeshConfig?: MeshNodeConfig;\n\t\t\tauth?: {\n\t\t\t\tclientId?: string;\n\t\t\t\tclientSecret?: string;\n\t\t\t\tnexusUrl?: string;\n\t\t\t\taudience?: string;\n\t\t\t\tscope?: string;\n\t\t\t\ttoken?: string;\n\t\t\t};\n\t\t},\n\t): Promise<void> {\n\t\t// Attempt to acquire OAuth M2M access token if credentials are provided\n\t\tconst clientId =\n\t\t\toptions?.auth?.clientId ||\n\t\t\tprocess.env.LIOP_OAUTH_CLIENT_ID ||\n\t\t\tprocess.env.LIOP_CLIENT_ID;\n\t\tconst clientSecret =\n\t\t\toptions?.auth?.clientSecret ||\n\t\t\tprocess.env.LIOP_OAUTH_CLIENT_SECRET ||\n\t\t\tprocess.env.LIOP_CLIENT_SECRET;\n\t\tconst nexusUrl =\n\t\t\toptions?.auth?.nexusUrl ||\n\t\t\tprocess.env.LIOP_NEXUS_URL ||\n\t\t\t\"http://localhost:3000\";\n\t\tconst audience =\n\t\t\toptions?.auth?.audience ||\n\t\t\tprocess.env.LIOP_OAUTH_AUDIENCE ||\n\t\t\t\"urn:liop:mesh:api\";\n\t\tconst scope =\n\t\t\toptions?.auth?.scope ||\n\t\t\tprocess.env.LIOP_OAUTH_SCOPE ||\n\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\";\n\n\t\tthis.oauthToken =\n\t\t\toptions?.auth?.token ||\n\t\t\tprocess.env.LIOP_OAUTH_TOKEN ||\n\t\t\tprocess.env.LIOP_TOKEN;\n\n\t\tif (clientId && clientSecret) {\n\t\t\tconst baseUrl = (nexusUrl || \"http://127.0.0.1:3000\").endsWith(\"/oidc\")\n\t\t\t\t? nexusUrl || \"http://127.0.0.1:3000\"\n\t\t\t\t: `${nexusUrl || \"http://127.0.0.1:3000\"}/oidc`;\n\t\t\tconst tokenEndpoint = `${baseUrl}/token`;\n\n\t\t\tthis.tokenManager = new TokenManager({\n\t\t\t\ttokenEndpoint,\n\t\t\t\tclientId,\n\t\t\t\tclientSecret,\n\t\t\t\taudience,\n\t\t\t\tscopes: scope,\n\t\t\t});\n\n\t\t\ttry {\n\t\t\t\tthis.oauthToken = await this.tokenManager.getToken();\n\t\t\t\tlog.info(\n\t\t\t\t\t\"[LiopClient] Dynamic TokenManager configured and initial token acquired.\",\n\t\t\t\t);\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.error(\n\t\t\t\t\t`[LiopClient] Failed to acquire OAuth M2M Token: ${\n\t\t\t\t\t\terr instanceof Error ? err.message : String(err)\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t\t// In development or when using static local token, allow connection to proceed\n\t\t\t}\n\t\t}\n\n\t\tthis.meshNode = new MeshNode(options?.meshConfig);\n\t\tawait this.meshNode.start();\n\t\tlog.info(\n\t\t\t`[LiopClient] Mesh Node synchronized. PeerID: ${this.meshNode.getPeerId()}`,\n\t\t);\n\n\t\tif (address) {\n\t\t\tconst tokenResolver = async () => {\n\t\t\t\tif (this.tokenManager) {\n\t\t\t\t\treturn await this.tokenManager.getToken();\n\t\t\t\t}\n\t\t\t\treturn this.oauthToken;\n\t\t\t};\n\t\t\tthis.rpcClients.set(\n\t\t\t\t\"static\",\n\t\t\t\tnew LiopRpcClient(address, this.tlsOptions, tokenResolver),\n\t\t\t);\n\t\t\tthis.serverInfo = { name: `LiopServer (${address})`, version: \"1.0.0\" };\n\t\t\tlog.info(`[LiopClient] Static gRPC configured for: ${address}`);\n\t\t} else {\n\t\t\tthis.serverInfo = { name: \"LiopServer (Mesh Alpha)\", version: \"1.0.0\" };\n\t\t}\n\t}\n\n\t/**\n\t * Selects the optimal IP from an array of multiaddrs.\n\t * Prioritizes routable non-loopback IPv4 addresses (e.g. Docker bridge, LAN, WAN)\n\t * over loopback (127.0.0.1) to prevent inter-container connection failures.\n\t */\n\tprivate selectOptimalIp(addrs: string[]): string | null {\n\t\t// Pass 1: Non-loopback, routable IPv4 addresses\n\t\tfor (const maddr of addrs) {\n\t\t\tconst parts = maddr.split(\"/\");\n\t\t\tconst ipIdx = parts.indexOf(\"ip4\");\n\t\t\tif (ipIdx !== -1 && ipIdx + 1 < parts.length) {\n\t\t\t\tconst ip = parts[ipIdx + 1];\n\t\t\t\tif (\n\t\t\t\t\tip !== \"127.0.0.1\" &&\n\t\t\t\t\t!ip.startsWith(\"127.\") &&\n\t\t\t\t\tip !== \"0.0.0.0\" &&\n\t\t\t\t\tip !== \"localhost\"\n\t\t\t\t) {\n\t\t\t\t\treturn ip;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Pass 2: Fallback to loopback if no external IP is announced\n\t\tfor (const maddr of addrs) {\n\t\t\tconst parts = maddr.split(\"/\");\n\t\t\tconst ipIdx = parts.indexOf(\"ip4\");\n\t\t\tif (ipIdx !== -1 && ipIdx + 1 < parts.length) {\n\t\t\t\treturn parts[ipIdx + 1];\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t}\n\n\t/**\n\t * Dynamically queries Kademlia DHT to find the optimal PeerID providing the Capability\n\t * and returns the physical gRPC target (host:port) resolved from the provider's manifest.\n\t */\n\tpublic async resolveCapability(toolName: string): Promise<string> {\n\t\tif (!this.meshNode)\n\t\t\tthrow new Error(\n\t\t\t\t\"Client must be connected to Mesh to resolve capabilities.\",\n\t\t\t);\n\n\t\tlog.info(`[LiopClient] Querying Mesh DHT for Provider: ${toolName}...`);\n\t\tconst providers = await this.meshNode.findProviders(toolName);\n\n\t\tif (providers.length === 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Kademlia DHT found zero providers for capability: ${toolName}`,\n\t\t\t);\n\t\t}\n\n\t\tconst providerId = providers[0];\n\t\tlog.info(`[LiopClient] Identified Alpha Provider PeerID: ${providerId}`);\n\n\t\tlet grpcPort = 50051;\n\t\tconst manifest = await this.meshNode.queryManifest(providerId);\n\t\tif (manifest) {\n\t\t\tgrpcPort = manifest.grpcPort;\n\t\t\tthis.manifests.set(providerId, manifest);\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Manifest resolved: gRPC port ${grpcPort}. Cached manifest for PeerID ${providerId}`,\n\t\t\t);\n\t\t}\n\n\t\tconst addrs = await this.meshNode.resolvePeer(providerId);\n\t\tconst optimalIp = this.selectOptimalIp(addrs);\n\t\tif (optimalIp) {\n\t\t\tconst grpcHost = `${optimalIp}:${grpcPort}`;\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Translated Multiaddr to optimal gRPC Target: ${grpcHost}`,\n\t\t\t);\n\t\t\treturn grpcHost;\n\t\t}\n\n\t\treturn `127.0.0.1:${grpcPort}`;\n\t}\n\n\t/**\n\t * Probes a remote MCP endpoint using 'server/discover' to negotiate protocol era.\n\t * Falls back to legacy initialize handshake if server/discover fails.\n\t */\n\tpublic async probeServerDiscover(mcpUrl: string): Promise<{\n\t\tera: McpEra;\n\t\tprotocolVersion: string;\n\t\tsupportedVersions: string[];\n\t}> {\n\t\ttry {\n\t\t\tconst headers: Record<string, string> = {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Mcp-Method\": \"server/discover\",\n\t\t\t};\n\t\t\tif (this.oauthToken) {\n\t\t\t\theaders.Authorization = `Bearer ${this.oauthToken}`;\n\t\t\t}\n\n\t\t\tconst res = await fetch(mcpUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders,\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\tid: 1,\n\t\t\t\t\tmethod: \"server/discover\",\n\t\t\t\t\tparams: {},\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (res.ok) {\n\t\t\t\tconst json = (await res.json()) as {\n\t\t\t\t\tresult?: { supportedVersions?: string[] };\n\t\t\t\t};\n\t\t\t\tconst supported = json.result?.supportedVersions || [];\n\t\t\t\tif (supported.includes(MCP_PROTOCOL_VERSION)) {\n\t\t\t\t\tthis.era = \"modern\";\n\t\t\t\t\tthis.protocolVersion = MCP_PROTOCOL_VERSION;\n\t\t\t\t\treturn {\n\t\t\t\t\t\tera: \"modern\",\n\t\t\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION,\n\t\t\t\t\t\tsupportedVersions: supported,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (_err) {\n\t\t\t// Ignore discovery network probe failures and fallback to legacy if enabled\n\t\t}\n\n\t\t/** @mcp-legacy Fallback to legacy era. Remove when v1 EOL. */\n\t\tif (MCP_LEGACY_SUPPORT_ENABLED) {\n\t\t\tthis.era = \"legacy\";\n\t\t\tthis.protocolVersion = MCP_PROTOCOL_VERSION_LEGACY;\n\t\t\treturn {\n\t\t\t\tera: \"legacy\",\n\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\t\tsupportedVersions: [MCP_PROTOCOL_VERSION_LEGACY],\n\t\t\t};\n\t\t}\n\n\t\tthrow new Error(\n\t\t\t\"Server does not support MCP 2026-07-28 and legacy support is disabled.\",\n\t\t);\n\t}\n\n\t/**\n\t * Discovers remote capabilities via the LIOP Manifest Protocol.\n\t * Utilizes a memory cache to avoid redundant network dials against live peers.\n\t */\n\tpublic async discoverTools(\n\t\tforceRefresh = false,\n\t): Promise<{ name: string; description?: string }[]> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before discovering tools.\");\n\t\t}\n\n\t\tconst discoveryStartTime = Date.now();\n\n\t\tlog.info(\n\t\t\t`[LiopClient] Discovery started (forceRefresh: ${forceRefresh})...`,\n\t\t);\n\t\tconst providerIds = await this.meshNode.discoverManifestProviders();\n\t\tconst tools: { name: string; description?: string }[] = [];\n\t\tconst seenNames = new Set<string>();\n\n\t\tfor (const peerId of providerIds) {\n\t\t\ttry {\n\t\t\t\tlet manifest: LiopManifest | null | undefined = !forceRefresh\n\t\t\t\t\t? this.manifests.get(peerId)\n\t\t\t\t\t: undefined;\n\n\t\t\t\tif (!manifest) {\n\t\t\t\t\tlog.info(`[LiopClient] Querying manifest from: ${peerId}`);\n\t\t\t\t\tmanifest = await this.meshNode.queryManifest(peerId);\n\t\t\t\t\tif (manifest) {\n\t\t\t\t\t\tthis.manifests.set(peerId, manifest);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tlog.info(`[LiopClient] Using cached manifest for: ${peerId}`);\n\t\t\t\t}\n\n\t\t\t\tif (manifest) {\n\t\t\t\t\tfor (const tool of manifest.tools) {\n\t\t\t\t\t\tif (!seenNames.has(tool.name)) {\n\t\t\t\t\t\t\ttools.push({ name: tool.name, description: tool.description });\n\t\t\t\t\t\t\tseenNames.add(tool.name);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Error querying manifest from ${peerId}:`,\n\t\t\t\t\terr instanceof Error ? err.message : String(err),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[LiopClient] Discovery finished. Found ${tools.length} unique tools.`,\n\t\t);\n\n\t\t// [Token Economy] Record telemetry for discoverTools\n\t\ttry {\n\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\tconst toolsPayload = JSON.stringify(tools);\n\t\t\tconst toolsResponsePayload = JSON.stringify({ tools });\n\t\t\ttelemetry.record({\n\t\t\t\ttype: \"tools_list\",\n\t\t\t\tmethod: \"discoverTools\",\n\t\t\t\testimatedInputTokens: telemetry.countTokens(toolsPayload),\n\t\t\t\testimatedOutputTokens: telemetry.countTokens(toolsResponsePayload),\n\t\t\t\tdurationMs: Date.now() - discoveryStartTime,\n\t\t\t});\n\t\t} catch {\n\t\t\t// Telemetry error isolation\n\t\t}\n\n\t\treturn tools;\n\t}\n\n\t/**\n\t * Invokes a tool.\n\t */\n\tpublic async callTool(\n\t\trequest: CallToolRequest,\n\t\t_wasmPayload?: Buffer,\n\t\toptions?: { zkPolicy?: ZkPolicy; circuitName?: string },\n\t): Promise<CallToolResult> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before calling tools.\");\n\t\t}\n\n\t\tconst callStartTime = Date.now();\n\t\tconst toolName = request.name;\n\t\tlog.info(`[LiopClient] Resolving Tool: ${toolName}`);\n\n\t\t// [ALPHA-FIX] Bypass DHT discovery if we are already statically connected to a provider (Enterprise/Test mode)\n\t\tlet rpcClient = this.rpcClients.get(\"static\");\n\t\tlet targetClientKey = toolName;\n\n\t\tif (!rpcClient) {\n\t\t\t// 1. If an RPC client was already registered for this toolName, reuse it\n\t\t\tif (this.rpcClients.has(toolName)) {\n\t\t\t\trpcClient = this.rpcClients.get(toolName);\n\t\t\t\ttargetClientKey = toolName;\n\t\t\t}\n\t\t}\n\n\t\tif (!rpcClient) {\n\t\t\t// 2. Fast-path: Check if capability already exists in cached manifests to bypass DHT walk\n\t\t\tlet resolvedHost: string | null = null;\n\t\t\tfor (const [peerId, manifest] of this.manifests.entries()) {\n\t\t\t\tif (manifest.tools.some((t) => t.name === toolName)) {\n\t\t\t\t\t// If we already have a client registered for this peerId, reuse it immediately\n\t\t\t\t\tif (this.rpcClients.has(peerId)) {\n\t\t\t\t\t\trpcClient = this.rpcClients.get(peerId);\n\t\t\t\t\t\ttargetClientKey = peerId;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tconst addrs = await this.meshNode.resolvePeer(peerId);\n\t\t\t\t\tconst optimalIp = this.selectOptimalIp(addrs);\n\t\t\t\t\tif (optimalIp) {\n\t\t\t\t\t\tresolvedHost = `${optimalIp}:${manifest.grpcPort}`;\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LiopClient] Fast-path: Resolved ${toolName} from manifest cache to optimal target ${resolvedHost}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\ttargetClientKey = peerId;\n\t\t\t\t\t\trpcClient = this.getOrCreateRpcClient(peerId, resolvedHost);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!rpcClient) {\n\t\t\t\tconst dynamicAddress = await this.resolveCapability(toolName);\n\t\t\t\ttargetClientKey = toolName;\n\t\t\t\trpcClient = this.getOrCreateRpcClient(toolName, dynamicAddress);\n\t\t\t}\n\t\t} else {\n\t\t\ttargetClientKey = \"static\";\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Using existing static gRPC connection for ${toolName}.`,\n\t\t\t);\n\t\t}\n\n\t\tlog.info(`[LiopClient] Negotiating intent for ${toolName}...`);\n\t\tconst agentDid = this.meshNode\n\t\t\t? `did:liop:${this.meshNode.getPeerId()}`\n\t\t\t: \"did:liop:ephemeral\";\n\t\tconst intentPayload = Buffer.from(`${toolName}:${Date.now()}`);\n\t\tconst proofOfIntent = this.meshNode\n\t\t\t? await this.meshNode.sign(intentPayload)\n\t\t\t: intentPayload;\n\n\t\tlet intentResponse: {\n\t\t\taccepted: boolean;\n\t\t\terror_message: string;\n\t\t\tkyber_public_key: Uint8Array;\n\t\t\tkyberPublicKey: Uint8Array;\n\t\t\tsession_token: string;\n\t\t\tsessionToken: string;\n\t\t};\n\n\t\ttry {\n\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\tagent_did: agentDid,\n\t\t\t\tcapability_hash: toolName,\n\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t})) as unknown as typeof intentResponse;\n\t\t} catch (err: unknown) {\n\t\t\tconst errMsg = err instanceof Error ? err.message : String(err);\n\t\t\tif (\n\t\t\t\tthis.tokenManager &&\n\t\t\t\t(errMsg.includes(\"UNAUTHENTICATED\") ||\n\t\t\t\t\terrMsg.includes(\"Invalid JWT\") ||\n\t\t\t\t\terrMsg.includes(\"timestamp check failed\") ||\n\t\t\t\t\terrMsg.includes(\"expired\"))\n\t\t\t) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[LiopClient] Token expired/unauthenticated for ${toolName}. Preemptively refreshing OAuth token and retrying negotiateIntent...`,\n\t\t\t\t);\n\t\t\t\tthis.tokenManager.invalidate();\n\t\t\t\tconst freshToken = await this.tokenManager.getToken();\n\t\t\t\tthis.oauthToken = freshToken;\n\t\t\t\trpcClient.setToken(freshToken);\n\t\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\t\tagent_did: agentDid,\n\t\t\t\t\tcapability_hash: toolName,\n\t\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t\t})) as unknown as typeof intentResponse;\n\t\t\t} else {\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t}\n\n\t\tif (!intentResponse.accepted) {\n\t\t\tif (\n\t\t\t\tthis.tokenManager &&\n\t\t\t\t(intentResponse.error_message?.includes(\"token\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"UNAUTHENTICATED\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"expired\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"timestamp check failed\"))\n\t\t\t) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[LiopClient] Intent rejected with auth error: \"${intentResponse.error_message}\". Refreshing token and retrying...`,\n\t\t\t\t);\n\t\t\t\tthis.tokenManager.invalidate();\n\t\t\t\tconst freshToken = await this.tokenManager.getToken();\n\t\t\t\tthis.oauthToken = freshToken;\n\t\t\t\trpcClient.setToken(freshToken);\n\t\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\t\tagent_did: agentDid,\n\t\t\t\t\tcapability_hash: toolName,\n\t\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t\t})) as unknown as typeof intentResponse;\n\t\t\t}\n\t\t\tif (!intentResponse.accepted) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Intent denied by host: ${intentResponse.error_message}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// LIOP Robust Field Extraction (Supports both snake_case and camelCase via gRPC-JS)\n\t\tconst publicKey =\n\t\t\tintentResponse.kyber_public_key || intentResponse.kyberPublicKey;\n\t\tconst sessionToken =\n\t\t\tintentResponse.session_token || intentResponse.sessionToken;\n\n\t\tif (!publicKey) {\n\t\t\tlog.info(\n\t\t\t\t\"[LiopClient] Critical Error: Kyber Public Key not found in IntentResponse.\",\n\t\t\t\tintentResponse,\n\t\t\t);\n\t\t\ttry {\n\t\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\t\tstatus: \"failure\",\n\t\t\t\t});\n\t\t\t} catch {}\n\t\t\tthrow new Error(\n\t\t\t\t\"Handshake failed: Remote host did not provide a valid Kyber Public Key.\",\n\t\t\t);\n\t\t}\n\n\t\t// 2. Post-Quantum Encapsulation (ML-KEM-768)\n\t\tlog.info(\n\t\t\t`[LiopClient] Encapsulating Post-Quantum Shared Secret for ${request.name}...`,\n\t\t);\n\t\tconst pqcStart = performance.now();\n\t\tlet kyberCiphertext: Uint8Array;\n\t\tlet sharedSecret: Uint8Array;\n\t\ttry {\n\t\t\tconst res = await Kyber768Wrapper.encapsulateAsymmetric(publicKey);\n\t\t\tkyberCiphertext = res.ciphertext;\n\t\t\tsharedSecret = res.sharedSecret;\n\t\t\tconst pqcDuration = performance.now() - pqcStart;\n\t\t\tpqcHandshakeDurationMs.observe({ tool: request.name }, pqcDuration);\n\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\tstatus: \"success\",\n\t\t\t});\n\t\t} catch (encapError) {\n\t\t\ttry {\n\t\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\t\tstatus: \"failure\",\n\t\t\t\t});\n\t\t\t} catch {}\n\t\t\tthrow encapError;\n\t\t}\n\n\t\t// 3. Symmetric Sealing (AES-256-GCM)\n\t\tlog.info(`[LiopClient] Sealing WASM Payload and Inputs...`);\n\n\t\tconst _safePayload = _wasmPayload || Buffer.from(\"\");\n\n\t\t// Encrypt WASM binary\n\t\tconst { ciphertext: encryptedWasm, nonce: aesNonce } =\n\t\t\tAesGcmWrapper.encryptPayload(_safePayload, sharedSecret);\n\n\t\t// Encrypt inputs using a fresh random nonce per input to prevent AES-GCM nonce reuse\n\t\tconst encryptedInputs: Record<string, Uint8Array> = {};\n\t\tconst crypto = await import(\"node:crypto\");\n\t\tfor (const [key, value] of Object.entries(request.arguments || {})) {\n\t\t\tconst inputNonce = crypto.randomBytes(12);\n\t\t\tconst cipher = crypto.createCipheriv(\n\t\t\t\t\"aes-256-gcm\",\n\t\t\t\tsharedSecret,\n\t\t\t\tinputNonce,\n\t\t\t);\n\t\t\tconst encrypted = Buffer.concat([\n\t\t\t\tcipher.update(JSON.stringify(value)),\n\t\t\t\tcipher.final(),\n\t\t\t]);\n\t\t\tconst authTag = cipher.getAuthTag();\n\t\t\t// Prepend the 12-byte nonce to the ciphertext\n\t\t\tencryptedInputs[key] = Buffer.concat([inputNonce, encrypted, authTag]);\n\t\t}\n\n\t\t// 4. Assemble and Execute gRPC LogicRequest\n\t\tconst logicRequest: LogicRequest = {\n\t\t\tsession_token: sessionToken,\n\t\t\twasm_binary: encryptedWasm,\n\t\t\tinputs: encryptedInputs,\n\t\t\tpqc_ciphertext: kyberCiphertext,\n\t\t\taes_nonce: aesNonce,\n\t\t};\n\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst stream = rpcClient.executeLogic(logicRequest);\n\t\t\tif (!stream) {\n\t\t\t\treject(new Error(\"RPC Client unavailable or failed to create stream.\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlet resultFulfilled = false;\n\t\t\tlet hasReceivedData = false;\n\n\t\t\tstream.on(\"data\", async (response: LogicResponse) => {\n\t\t\t\tif (resultFulfilled) return;\n\t\t\t\thasReceivedData = true;\n\n\t\t\t\tlog.info(\"[LiopClient] Logic Executed. Verification in progress...\");\n\n\t\t\t\ttry {\n\t\t\t\t\t// Only verify ZK-Receipt if the remote execution succeeded.\n\t\t\t\t\t// If the remote execution failed due to a policy error (e.g. Egress Shield),\n\t\t\t\t\t// the ZK proof is empty and we should bypass validation to propagate the original error.\n\t\t\t\t\tlet isV2 = false;\n\t\t\t\t\tif (!response.is_error) {\n\t\t\t\t\t\tconst receiptBuf = Buffer.from(response.zk_receipt);\n\t\t\t\t\t\tisV2 = receiptBuf.length > 0 && receiptBuf[0] === 0x02;\n\n\t\t\t\t\t\tconst zkPolicy = options?.zkPolicy ?? (isV2 ? \"required\" : \"none\");\n\n\t\t\t\t\t\tconst isValid = await this.verifier.verifyZkReceipt(\n\t\t\t\t\t\t\t_safePayload,\n\t\t\t\t\t\t\tBuffer.from(response.cryptographic_proof).toString(\"hex\"),\n\t\t\t\t\t\t\treceiptBuf,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tsessionSecret: Buffer.from(sharedSecret),\n\t\t\t\t\t\t\t\texpectedOutput: response.semantic_evidence,\n\t\t\t\t\t\t\t\tcircuitName: options?.circuitName,\n\t\t\t\t\t\t\t\tzkPolicy,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tzkVerificationsTotal.inc({\n\t\t\t\t\t\t\t\tstatus: isValid ? \"valid\" : \"invalid\",\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\t// Metrics isolation\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (!isValid) {\n\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\t\t\terror_type: \"zk_verification_failed\",\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t} catch {}\n\t\t\t\t\t\t\treject(\n\t\t\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t\t\t\"PROTOCOL INTEGRITY VIOLATION: ZK-Receipt verification failed.\",\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\t\terror_type: \"remote_execution_error\",\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} catch {}\n\t\t\t\t\t}\n\n\t\t\t\t\tresultFulfilled = true;\n\n\t\t\t\t\t// [Token Economy & Wire Telemetry] Record telemetry for callTool\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\t\t\t\tconst inputPayload = JSON.stringify(request.arguments ?? {});\n\t\t\t\t\t\ttelemetry.record({\n\t\t\t\t\t\t\ttype: \"tool_call\",\n\t\t\t\t\t\t\tmethod: \"callTool\",\n\t\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\t\tpeerId:\n\t\t\t\t\t\t\t\ttargetClientKey !== toolName ? targetClientKey : undefined,\n\t\t\t\t\t\t\testimatedInputTokens: telemetry.countTokens(inputPayload),\n\t\t\t\t\t\t\testimatedOutputTokens: telemetry.countTokens(\n\t\t\t\t\t\t\t\tresponse.semantic_evidence,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tdurationMs: Date.now() - callStartTime,\n\t\t\t\t\t\t});\n\n\t\t\t\t\t\tconst egressBytes =\n\t\t\t\t\t\t\tBuffer.byteLength(response.semantic_evidence || \"\") +\n\t\t\t\t\t\t\t(response.cryptographic_proof\n\t\t\t\t\t\t\t\t? response.cryptographic_proof.length\n\t\t\t\t\t\t\t\t: 0) +\n\t\t\t\t\t\t\t(response.zk_receipt ? response.zk_receipt.length : 0);\n\t\t\t\t\t\twireEgressBytesTotal.inc({ capability: toolName }, egressBytes);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\t// Telemetry error isolation\n\t\t\t\t\t}\n\n\t\t\t\t\tresolve({\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: response.semantic_evidence,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tisError: response.is_error,\n\t\t\t\t\t\tzkVerified: !response.is_error,\n\t\t\t\t\t\tzkProofType: isV2 ? ProofType.GROTH16 : ProofType.HMAC_LEGACY,\n\t\t\t\t\t});\n\t\t\t\t} catch (err) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\terror_type: \"verification_exception\",\n\t\t\t\t\t\t});\n\t\t\t\t\t} catch {}\n\t\t\t\t\treject(err);\n\t\t\t\t}\n\t\t\t});\n\n\t\t\tstream.on(\"error\", (err) => {\n\t\t\t\t// Evict faulted client from cache so subsequent requests reconnect cleanly\n\t\t\t\tthis.rpcClients.delete(targetClientKey);\n\t\t\t\tthis.rpcClients.delete(toolName);\n\t\t\t\ttry {\n\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\terror_type: \"stream_error\",\n\t\t\t\t\t});\n\t\t\t\t} catch {}\n\t\t\t\tif (resultFulfilled) return;\n\t\t\t\tlog.error(\"[LiopClient] Stream Error:\", err);\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tstream.on(\"end\", () => {\n\t\t\t\t// We don't throw here if we already received a response block that is currently\n\t\t\t\t// undergoing ZK Verification in the Piscina worker pool.\n\t\t\t\tif (!hasReceivedData && !resultFulfilled) {\n\t\t\t\t\treject(new Error(\"Logic-on-Origin stream closed without results.\"));\n\t\t\t\t}\n\t\t\t});\n\t\t});\n\t}\n\n\tprivate getOrCreateRpcClient(peerId: string, address: string): LiopRpcClient {\n\t\tlet client = this.rpcClients.get(peerId);\n\t\tif (!client) {\n\t\t\tlet manifest = this.manifests.get(peerId);\n\t\t\tlet realPeerId = peerId;\n\n\t\t\t// If peerId is actually a toolName (which happens when called from callTool),\n\t\t\t// resolve the real PeerID and its manifest from the manifest cache.\n\t\t\tif (!manifest) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] PeerID \"${peerId}\" not found in manifest cache as PeerID. Searching tools in cached manifests...`,\n\t\t\t\t);\n\t\t\t\tfor (const [pId, m] of this.manifests.entries()) {\n\t\t\t\t\tif (m.tools.some((t) => t.name === peerId)) {\n\t\t\t\t\t\tmanifest = m;\n\t\t\t\t\t\trealPeerId = pId;\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LiopClient] Resolved tool \"${peerId}\" to provider PeerID \"${pId.slice(-8)}\" from manifest cache.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst providerName = manifest?.serverInfo?.name?.toLowerCase() || \"\";\n\t\t\tlet envToken: string | undefined;\n\n\t\t\t// 0. Deterministic tokenSlug resolution (highest priority, zero heuristic)\n\t\t\tconst slug = manifest?.tokenSlug;\n\t\t\tif (slug) {\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${slug}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${slug}`];\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Resolved via tokenSlug \"${slug}\" (LIOP_TOKEN_${slug}) -> found: ${!!envToken}`,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] No tokenSlug available for peer ${realPeerId.slice(-8)}. Available cache keys: ${Array.from(\n\t\t\t\t\t\tthis.manifests.keys(),\n\t\t\t\t\t)\n\t\t\t\t\t\t.map((k) => k.slice(-8))\n\t\t\t\t\t\t.join(\", \")}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// 1. PeerID-specific resolution: LIOP_TOKEN_<last 8 chars of PeerID in uppercase>\n\t\t\tif (!envToken && realPeerId) {\n\t\t\t\tconst shortId = realPeerId.slice(-8).toUpperCase();\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${shortId}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${shortId}`];\n\t\t\t}\n\n\t\t\t// 2. Provider-name resolution: LIOP_TOKEN_<CLEAN_PROVIDER_NAME_UPPERCASE>\n\t\t\tif (!envToken && providerName) {\n\t\t\t\tconst cleanName = providerName\n\t\t\t\t\t.toUpperCase()\n\t\t\t\t\t.replace(/[^A-Z0-9_]/g, \"_\");\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${cleanName}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${cleanName}`];\n\t\t\t}\n\n\t\t\tif (envToken) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Resolved node-specific token for peer ${realPeerId.slice(-8)} (${providerName || \"unknown\"})`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst tokenResolver = async () => {\n\t\t\t\tif (envToken) return envToken;\n\t\t\t\tif (this.tokenManager) {\n\t\t\t\t\treturn await this.tokenManager.getToken();\n\t\t\t\t}\n\t\t\t\treturn this.oauthToken;\n\t\t\t};\n\n\t\t\tclient = new LiopRpcClient(address, this.tlsOptions, tokenResolver);\n\t\t\tthis.rpcClients.set(peerId, client);\n\t\t}\n\t\treturn client;\n\t}\n\n\t/**\n\t * Reads a specific resource by URI.\n\t * In LIOP, resources can be static definitions or dynamic streams.\n\t */\n\tpublic async readResource(uri: string): Promise<{\n\t\tcontents: Array<{ uri: string; mimeType?: string; text: string }>;\n\t}> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before reading resources.\");\n\t\t}\n\t\tconst readStartTime = Date.now();\n\t\tlog.info(`[LiopClient] Querying Mesh for Resource: ${uri}...`);\n\n\t\t// We search for the peer hosting the resource in the P2P Mesh\n\t\tconst providers = await this.meshNode.findProviders(uri);\n\t\tif (providers.length === 0) {\n\t\t\tthrow new Error(`No mesh providers found for resource: ${uri}`);\n\t\t}\n\n\t\t// Query the remote peer's manifest\n\t\tconst manifest = await this.meshNode.queryManifest(providers[0]);\n\t\tif (!manifest) {\n\t\t\tthrow new Error(\"Target peer did not return a valid LIOP Manifest.\");\n\t\t}\n\n\t\t// Locate the exact resource metadata\n\t\tconst resourceDef = manifest.resources?.find((r) => r.uri === uri);\n\t\tif (!resourceDef) {\n\t\t\tthrow new Error(`Resource ${uri} not listed in remote manifest.`);\n\t\t}\n\n\t\t// Return the declarative metadata (Logic-Injection is required for actual data extraction)\n\t\tconst result = {\n\t\t\tcontents: [\n\t\t\t\t{\n\t\t\t\t\turi,\n\t\t\t\t\tmimeType: resourceDef.mimeType || \"application/json\",\n\t\t\t\t\ttext: JSON.stringify(resourceDef, null, 2),\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\n\t\t// [Token Economy] Record telemetry for readResource\n\t\ttry {\n\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\tconst outputPayload = JSON.stringify(result);\n\t\t\ttelemetry.record({\n\t\t\t\ttype: \"resource_read\",\n\t\t\t\tmethod: \"readResource\",\n\t\t\t\ttoolName: uri,\n\t\t\t\tpeerId: providers[0],\n\t\t\t\testimatedInputTokens: telemetry.countTokens(uri),\n\t\t\t\testimatedOutputTokens: telemetry.countTokens(outputPayload),\n\t\t\t\tdurationMs: Date.now() - readStartTime,\n\t\t\t});\n\t\t} catch {\n\t\t\t// Telemetry error isolation\n\t\t}\n\n\t\treturn result;\n\t}\n\n\t/**\n\t * Returns the local PeerId string if the mesh node is active, null otherwise.\n\t * PeerIds are public identifiers by libp2p protocol design (Ed25519 public key hash).\n\t */\n\tpublic get peerId(): string | null {\n\t\treturn this.meshNode?.getPeerId() ?? null;\n\t}\n\n\t/**\n\t * Returns true if the mesh node is initialized and running.\n\t */\n\tpublic get isMeshActive(): boolean {\n\t\treturn this.meshNode?.isStarted() ?? false;\n\t}\n\n\t/**\n\t * Returns the number of active P2P connections, or 0 if the mesh is inactive.\n\t */\n\tpublic get connectionCount(): number {\n\t\treturn this.meshNode?.getPeers().length ?? 0;\n\t}\n\n\tpublic getServerInfo(): { name: string; version: string } | undefined {\n\t\treturn this.serverInfo;\n\t}\n\n\t/**\n\t * Destroys the active Mesh Node resources.\n\t */\n\tpublic async close(): Promise<void> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t}\n}\n"]}

package/dist/chunk-ZP3VVXOI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mesh/swarm-key.ts"],"names":[],"mappings":";;;;;;AAQO,IAAM,qBAAA,GAAwB;AAM9B,SAAS,cAAA,GAA6B;AAC5C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,qBAAqB,CAAA;AAChD,EAAA,WAAA,CAAY,GAAG,CAAA;AACf,EAAA,OAAO,GAAA;AACR;AAKO,SAAS,kBAAkB,GAAA,EAAyB;AAC1D,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,mCAAA,EAAsC,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KACrF;AAAA,EACD;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC1C;AAKO,SAAS,oBAAoB,SAAA,EAA+B;AAClE,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AACzC,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,yCAAA,EAA4C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC3F;AAAA,EACD;AACA,EAAA,OAAO,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,GAAA,CAAI,UAAA,EAAY,IAAI,UAAU,CAAA;AACjE;AAMO,SAAS,cAAc,OAAA,EAA6B;AAC1D,EAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAK;AAE7B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,iBAAiB,CAAA,EAAG;AAC1C,IAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,OAAA,EAAS,IAAI,EAAE,OAAA,EAAQ;AAC1D,IAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AACjD,IAAA,IAAI,KAAA,CAAM,WAAW,qBAAA,EAAuB;AAC3C,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAEA,EAAA,OAAO,oBAAoB,OAAO,CAAA;AACnC;AAKA,eAAsB,YAAA,CACrB,KACA,QAAA,EACgB;AAChB,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,wCAAA,EAA2C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC1F;AAAA,EACD;AACA,EAAA,MAAM,MAAM,OAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,EAAA,MAAM,SAAA,CAAU,UAAU,GAAG,CAAA;AAC9B;AAMA,eAAsB,aAAa,QAAA,EAAuC;AACzE,EAAA,MAAM,UAAA,GAAa,MAAM,QAAA,CAAS,QAAQ,CAAA;AAC1C,EAAA,IAAI,UAAA,CAAW,WAAW,qBAAA,EAAuB;AAChD,IAAA,OAAO,IAAI,UAAA;AAAA,MACV,UAAA,CAAW,MAAA;AAAA,MACX,UAAA,CAAW,UAAA;AAAA,MACX,UAAA,CAAW;AAAA,KACZ;AAAA,EACD;AACA,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA;AACxC,EAAA,OAAO,cAAc,IAAI,CAAA;AAC1B","file":"chunk-ZP3VVXOI.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Buffer } from \"node:buffer\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { generateKey } from \"@libp2p/pnet\";\n\nexport const SWARM_KEY_BYTE_LENGTH = 95;\n\n/**\n * Creates a freshly generated 95-byte Pre-Shared Key (PSK) for libp2p Private Networks (pnet).\n * Follows the canonical format `/key/swarm/psk/1.0.0/\\n/base16/\\n<hex>\\n`.\n */\nexport function createSwarmKey(): Uint8Array {\n\tconst psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);\n\tgenerateKey(psk);\n\treturn psk;\n}\n\n/**\n * Serializes a 95-byte PSK into a Base64 string for safe environment variable passing or JSON config.\n */\nexport function serializeSwarmKey(psk: Uint8Array): string {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\treturn Buffer.from(psk).toString(\"base64\");\n}\n\n/**\n * Deserializes a Base64-encoded string into a 95-byte PSK Uint8Array.\n */\nexport function deserializeSwarmKey(base64Str: string): Uint8Array {\n\tconst trimmed = base64Str.trim();\n\tconst buf = Buffer.from(trimmed, \"base64\");\n\tif (buf.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`,\n\t\t);\n\t}\n\treturn new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);\n}\n\n/**\n * Parses raw text format PSK or Base64 string into a 95-byte PSK Uint8Array.\n * Allows loading either the canonical multiline text (`/key/swarm/psk/1.0.0/...`) or Base64.\n */\nexport function parseSwarmKey(rawText: string): Uint8Array {\n\tconst trimmed = rawText.trim();\n\t// Check if this is canonical raw text format\n\tif (trimmed.startsWith(\"/key/swarm/psk/\")) {\n\t\tconst normalized = trimmed.replace(/\\r\\n/g, \"\\n\").trimEnd();\n\t\tconst bytes = new TextEncoder().encode(normalized);\n\t\tif (bytes.length === SWARM_KEY_BYTE_LENGTH) {\n\t\t\treturn bytes;\n\t\t}\n\t}\n\t// Fallback to Base64 deserialization\n\treturn deserializeSwarmKey(trimmed);\n}\n\n/**\n * Saves a 95-byte Swarm Key to a file on disk (written as canonical text).\n */\nexport async function saveSwarmKey(\n\tpsk: Uint8Array,\n\tfilePath: string,\n): Promise<void> {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\tawait mkdir(dirname(filePath), { recursive: true });\n\tawait writeFile(filePath, psk);\n}\n\n/**\n * Loads a 95-byte Swarm Key from a file on disk.\n * Supports both raw binary/canonical format and Base64-encoded text.\n */\nexport async function loadSwarmKey(filePath: string): Promise<Uint8Array> {\n\tconst fileBuffer = await readFile(filePath);\n\tif (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {\n\t\treturn new Uint8Array(\n\t\t\tfileBuffer.buffer,\n\t\t\tfileBuffer.byteOffset,\n\t\t\tfileBuffer.byteLength,\n\t\t);\n\t}\n\tconst text = fileBuffer.toString(\"utf-8\");\n\treturn parseSwarmKey(text);\n}\n"]}

package/dist/chunk-ZRWNMP5L.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/crypto/verifier.ts"],"names":["__filename","__dirname"],"mappings":";;;;;;;;;AAgBA,IAAMA,YAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,WAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,YAAU,CAAA;AAkBlC,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA;AAAA,EAEzB,OAAe,YAAA,GAA+B,IAAA;AAAA;AAAA,EAE9C,OAAe,YAAA,mBAAe,IAAI,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA,EAKtD,OAAc,YAAA,CAAa,WAAA,EAAqB,OAAA,EAAuB;AACtE,IAAA,aAAA,CAAa,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,OAAO,CAAA;AAClD,IAAA,IAAI;AACH,MAAA,eAAA,CAAgB,GAAA,CAAI,aAAA,CAAa,YAAA,CAAa,IAAI,CAAA;AAAA,IACnD,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAKA,OAAc,kBAAkB,WAAA,EAAyC;AACxE,IAAA,OAAO,aAAA,CAAa,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA;AAAA,EACjD;AAAA,EAEQ,SAAA,GAAY;AACnB,IAAA,IAAI,CAAC,cAAa,YAAA,EAAc;AAC/B,MAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA,CAAY,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAC3C,MAAA,MAAM,SAAA,GAAY,OAAO,KAAA,GAAQ,KAAA;AAEjC,MAAA,IAAI,WAAqB,EAAC;AAC1B,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACzC,UAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,kBAAkB,CAAA;AAC7C,UAAA,MAAM,WAAA,GAAc,aAAA;AAAA,YACnB,KAAK,IAAA,CAAK,IAAA,CAAK,QAAQ,MAAM,CAAA,EAAG,QAAQ,YAAY;AAAA,WACrD,CAAE,IAAA;AACF,UAAA,QAAA,GAAW,CAAC,YAAY,WAAW,CAAA;AAAA,QACpC,SAAS,EAAA,EAAI;AACZ,UAAA,QAAA,GAAW,CAAC,YAAY,KAAK,CAAA;AAAA,QAC9B;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QACnB,IAAA,CAAK,OAAA,CAAQC,WAAA,EAAW,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAE,CAAA;AAAA;AAAA,QAC3D,IAAA,CAAK,OAAA,CAAQA,WAAA,EAAW,CAAA,sBAAA,EAAyB,SAAS,CAAA,CAAE;AAAA;AAAA,OAC7D;AAEA,MAAA,MAAM,cAAA,GACL,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAS,cAAW,CAAC,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA;AAE3D,MAAA,aAAA,CAAa,YAAA,GAAe,IAAI,OAAA,CAAQ;AAAA,QACvC,QAAA,EAAU,cAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY,CAAA;AAAA;AAAA,QACZ,WAAA,EAAa,GAAA;AAAA,QACb;AAAA,OACA,CAAA;AAGD,MAAA,aAAA,CAAa,YAAA,CAAa,IAAI,EAAE,MAAA,EAAQ,UAAU,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAClE,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,CAAA,sDAAA,EAAyD,IAAI,OAAO,CAAA;AAAA,SACrE;AAAA,MACD,CAAC,CAAA;AAAA,IACF;AACA,IAAA,OAAO,aAAA,CAAa,YAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,eAAA,CACZ,YAAA,EACA,gBAAA,EACA,SAAA,EACA,wBACA,cAAA,EACmB;AACnB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAE9D,IAAA,IAAI,aAAA;AACJ,IAAA,IAAI,oBAAA,GAAgC,cAAA;AACpC,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,QAAA;AAEJ,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,sBAAsB,CAAA,EAAG;AAC5C,MAAA,aAAA,GAAgB,sBAAA;AAAA,IACjB,CAAA,MAAA,IACC,sBAAA,IACA,OAAO,sBAAA,KAA2B,QAAA,EACjC;AACD,MAAA,aAAA,GAAgB,sBAAA,CAAuB,aAAA;AACvC,MAAA,IAAI,sBAAA,CAAuB,mBAAmB,MAAA,EAAW;AACxD,QAAA,oBAAA,GAAuB,sBAAA,CAAuB,cAAA;AAAA,MAC/C;AACA,MAAA,eAAA,GAAkB,sBAAA,CAAuB,eAAA;AACzC,MAAA,OAAA,GAAU,sBAAA,CAAuB,OAAA;AACjC,MAAA,QAAA,GAAW,sBAAA,CAAuB,QAAA;AAElC,MAAA,IAAI,CAAC,OAAA,IAAW,sBAAA,CAAuB,WAAA,EAAa;AACnD,QAAA,OAAA,GAAU,aAAA,CAAa,iBAAA;AAAA,UACtB,sBAAA,CAAuB;AAAA,SACxB;AAAA,MACD;AAAA,IACD;AAEA,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI;AAAA,MAC7B,MAAA,EAAQ,gBAAA;AAAA,MACR,YAAA,EAAc,IAAI,UAAA,CAAW,YAAY,CAAA;AAAA,MACzC,gBAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA,EAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AAAA,MACnC,aAAA,EAAe,aAAA,GAAgB,IAAI,UAAA,CAAW,aAAa,CAAA,GAAI,MAAA;AAAA,MAC/D,OAAA,EAAS,OAAA,GAAU,IAAI,UAAA,CAAW,OAAO,CAAA,GAAI,MAAA;AAAA,MAC7C,cAAA,EAAgB,oBAAA;AAAA,MAChB;AAAA,KACA,CAAA;AACD,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAEvC,IAAA,IAAI;AACH,MAAA,wBAAA,CAAyB,OAAA;AAAA,QACxB;AAAA,UACC,MAAA,EAAQ,MAAA,CAAO,QAAA,GAAW,UAAA,GAAa,QAAA;AAAA,UACvC,UAAA,EAAY,OAAO,SAAA,IAAa;AAAA,SACjC;AAAA,QACA;AAAA,OACD;AACA,MAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,SAAA,EAAW;AACxC,QAAA,mBAAA,CAAoB,GAAA,CAAI,EAAE,UAAA,EAAY,MAAA,CAAO,WAAW,CAAA;AAAA,MACzD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,OAAO,QAAA,EAAU;AACpB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,qBACZ,iBAAA,EACmB;AACnB,IAAA,IAAI,iBAAA,CAAkB,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE3C,IAAA,IAAI;AAKH,MAAA,GAAA,CAAI,KAAK,yDAAyD,CAAA;AAClE,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,GAAA,EAAK;AACb,MAAA,GAAA,CAAI,KAAA,CAAM,2CAA2C,GAAG,CAAA;AACxD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,YAAA,EAA8B;AAClD,IAAA,OAAO,uBAAuB,YAAY,CAAA;AAAA,EAC3C;AACD","file":"chunk-ZRWNMP5L.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Piscina } from \"piscina\";\nimport {\n\tzkProofsByTypeTotal,\n\tzkVerificationDurationMs,\n\tzkVkeyCacheSize,\n} from \"../observability/metrics.js\";\nimport { log } from \"../utils/logger.js\";\nimport { deriveLogicImageDigest } from \"./logic-image-id.js\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nexport interface VerifyZkOptions {\n\tsessionSecret?: Buffer;\n\texpectedOutput?: unknown;\n\tguestImageIdHex?: string;\n\tvkeyRaw?: Buffer;\n\tzkPolicy?: import(\"../security/zk.js\").ZkPolicy;\n\tcircuitName?: string;\n}\n\n/**\n * LIOP Tier-0 Industrial Verifier\n *\n * This engine is responsible for the trustless verification of remote logic execution.\n * It validates both the integrity of the code (ZkImageID) and the mathematical proof\n * of its execution (ZkSeal/Groth16), as well as hardware-level attestation (TEE).\n */\nexport class LiopVerifier {\n\t// Singleton Worker Pool for heavy ZK verification\n\tprivate static zkWorkerPool: Piscina | null = null;\n\t// Static registry of embedded verification keys for canonical circuits\n\tprivate static vkeyRegistry = new Map<string, Buffer>();\n\n\t/**\n\t * Registers a verification key for a canonical analytical circuit.\n\t */\n\tpublic static registerVKey(circuitName: string, vkeyRaw: Buffer): void {\n\t\tLiopVerifier.vkeyRegistry.set(circuitName, vkeyRaw);\n\t\ttry {\n\t\t\tzkVkeyCacheSize.set(LiopVerifier.vkeyRegistry.size);\n\t\t} catch {}\n\t}\n\n\t/**\n\t * Retrieves a registered verification key by circuit name.\n\t */\n\tpublic static getRegisteredVKey(circuitName: string): Buffer | undefined {\n\t\treturn LiopVerifier.vkeyRegistry.get(circuitName);\n\t}\n\n\tprivate getZkPool() {\n\t\tif (!LiopVerifier.zkWorkerPool) {\n\t\t\tconst isTS = import.meta.url.endsWith(\".ts\");\n\t\t\tconst workerExt = isTS ? \".ts\" : \".js\";\n\n\t\t\tlet execArgv: string[] = [];\n\t\t\tif (isTS) {\n\t\t\t\ttry {\n\t\t\t\t\tconst req = createRequire(import.meta.url);\n\t\t\t\t\tconst tsxPkg = req.resolve(\"tsx/package.json\");\n\t\t\t\t\tconst absoluteTsx = pathToFileURL(\n\t\t\t\t\t\tpath.join(path.dirname(tsxPkg), \"dist\", \"loader.mjs\"),\n\t\t\t\t\t).href;\n\t\t\t\t\texecArgv = [\"--import\", absoluteTsx];\n\t\t\t\t} catch (_e) {\n\t\t\t\t\texecArgv = [\"--import\", \"tsx\"];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Support both flat dist/ and original src/ structure\n\t\t\tconst workerPaths = [\n\t\t\t\tpath.resolve(__dirname, `./workers/zk-verifier${workerExt}`), // Flat dist/ (tsup)\n\t\t\t\tpath.resolve(__dirname, `../workers/zk-verifier${workerExt}`), // Original src/\n\t\t\t];\n\n\t\t\tconst workerFilename =\n\t\t\t\tworkerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];\n\n\t\t\tLiopVerifier.zkWorkerPool = new Piscina({\n\t\t\t\tfilename: workerFilename,\n\t\t\t\tminThreads: 1,\n\t\t\t\tmaxThreads: 2, // Minimal footprint since verification is fast compared to generation\n\t\t\t\tidleTimeout: 30000,\n\t\t\t\texecArgv,\n\t\t\t});\n\n\t\t\t// Pre-warm the verification worker\n\t\t\tLiopVerifier.zkWorkerPool.run({ action: \"warmup\" }).catch((err) => {\n\t\t\t\tlog.debug(\n\t\t\t\t\t`[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`,\n\t\t\t\t);\n\t\t\t});\n\t\t}\n\t\treturn LiopVerifier.zkWorkerPool;\n\t}\n\n\t/**\n\t * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.\n\t * Supports both legacy positional arguments and structured options.\n\t *\n\t * @param logicPayload The raw WASM or JS logic that was sent to the provider.\n\t * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).\n\t * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM or Groth16.\n\t * @param sessionSecretOrOptions Shared secret (Buffer) or structured VerifyZkOptions.\n\t * @param expectedOutput Optional expected output value for anti-replay verification.\n\t */\n\tpublic async verifyZkReceipt(\n\t\tlogicPayload: Buffer,\n\t\tremoteImageIdHex: string,\n\t\tzkReceipt: Buffer,\n\t\tsessionSecretOrOptions?: Buffer | VerifyZkOptions,\n\t\texpectedOutput?: unknown,\n\t): Promise<boolean> {\n\t\tconst pool = this.getZkPool();\n\t\tif (!pool) throw new Error(\"Worker pool initialization failed\");\n\n\t\tlet sessionSecret: Buffer | undefined;\n\t\tlet actualExpectedOutput: unknown = expectedOutput;\n\t\tlet guestImageIdHex: string | undefined;\n\t\tlet vkeyRaw: Buffer | undefined;\n\t\tlet zkPolicy: import(\"../security/zk.js\").ZkPolicy | undefined;\n\n\t\tif (Buffer.isBuffer(sessionSecretOrOptions)) {\n\t\t\tsessionSecret = sessionSecretOrOptions;\n\t\t} else if (\n\t\t\tsessionSecretOrOptions &&\n\t\t\ttypeof sessionSecretOrOptions === \"object\"\n\t\t) {\n\t\t\tsessionSecret = sessionSecretOrOptions.sessionSecret;\n\t\t\tif (sessionSecretOrOptions.expectedOutput !== undefined) {\n\t\t\t\tactualExpectedOutput = sessionSecretOrOptions.expectedOutput;\n\t\t\t}\n\t\t\tguestImageIdHex = sessionSecretOrOptions.guestImageIdHex;\n\t\t\tvkeyRaw = sessionSecretOrOptions.vkeyRaw;\n\t\t\tzkPolicy = sessionSecretOrOptions.zkPolicy;\n\n\t\t\tif (!vkeyRaw && sessionSecretOrOptions.circuitName) {\n\t\t\t\tvkeyRaw = LiopVerifier.getRegisteredVKey(\n\t\t\t\t\tsessionSecretOrOptions.circuitName,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tconst startTime = performance.now();\n\t\tconst result = await pool.run({\n\t\t\taction: \"verify_receipt\",\n\t\t\tlogicPayload: new Uint8Array(logicPayload),\n\t\t\tremoteImageIdHex,\n\t\t\tguestImageIdHex,\n\t\t\tzkReceipt: new Uint8Array(zkReceipt),\n\t\t\tsessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : undefined,\n\t\t\tvkeyRaw: vkeyRaw ? new Uint8Array(vkeyRaw) : undefined,\n\t\t\texpectedOutput: actualExpectedOutput,\n\t\t\tzkPolicy,\n\t\t});\n\t\tconst durationMs = performance.now() - startTime;\n\n\t\ttry {\n\t\t\tzkVerificationDurationMs.observe(\n\t\t\t\t{\n\t\t\t\t\tstatus: result.verified ? \"verified\" : \"failed\",\n\t\t\t\t\tproof_type: result.proofType || \"unknown\",\n\t\t\t\t},\n\t\t\t\tdurationMs,\n\t\t\t);\n\t\t\tif (result.verified && result.proofType) {\n\t\t\t\tzkProofsByTypeTotal.inc({ proof_type: result.proofType });\n\t\t\t}\n\t\t} catch {\n\t\t\t// Metrics observation failure must never disrupt cryptographic verification\n\t\t}\n\n\t\tif (result.verified) {\n\t\t\tlog.info(`[LiopVerifier] ${result.message}`);\n\t\t\treturn true;\n\t\t}\n\n\t\tlog.error(`[LiopVerifier] FAILED: ${result.message}`);\n\t\treturn false;\n\t}\n\n\t/**\n\t * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).\n\t *\n\t * @param attestationReport The COSE-signed attestation document from the hardware.\n\t */\n\tpublic async verifyTeeAttestation(\n\t\tattestationReport: Buffer,\n\t): Promise<boolean> {\n\t\tif (attestationReport.length === 0) return true; // Optional in Mesh Alpha\n\n\t\ttry {\n\t\t\t// Architecture for AWS Nitro Enclaves:\n\t\t\t// 1. Decode CBOR/COSE\n\t\t\t// 2. Verify Signature against AWS Nitro Root CA\n\t\t\t// 3. Compare PCRs\n\t\t\tlog.info(\"[LiopVerifier] TEE Attestation: Not configured (no-op).\");\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tlog.error(\"[LiopVerifier] TEE Verification Failed:\", err);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Derives the ImageID of a logic payload following the LIOP v1 Standard.\n\t */\n\tpublic deriveImageId(logicPayload: Buffer): Buffer {\n\t\treturn deriveLogicImageDigest(logicPayload);\n\t}\n}\n"]}

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"client.js"}

package/dist/gateway.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"gateway.js"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/errors.ts","../src/observability/tracing.ts","../src/prompts/adapters.ts","../src/security/cert-manager.ts"],"names":["ErrorCode","crypto2"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;ACQA,IAAM,iBAAA,GACL,6DAAA;AAEM,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAc,eAAA,GAA0B;AACvC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC3C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,cAAA,GAAyB;AACtC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC1C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,MAAA,EACA,UAAU,IAAA,EACD;AACT,IAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,GAAO,IAAA;AAC/B,IAAA,OAAO,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,EAAI,MAAM,IAAI,KAAK,CAAA,CAAA;AAAA,EACxC;AAAA,EAEA,OAAc,iBAAiB,MAAA,EAA4C;AAC1E,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,MAAA,OAAO,IAAA;AAAA,IACR;AACA,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,GAAG,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,GAAI,KAAA;AAE5C,IAAA,IAAI,YAAY,IAAA,EAAM;AACrB,MAAA,IAAI,OAAA,KAAY,IAAI,MAAA,CAAO,EAAE,KAAK,MAAA,KAAW,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AAC5D,QAAA,OAAO,IAAA;AAAA,MACR;AAAA,IACD;AAEA,IAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,IAAI,CAAA,MAAU,CAAA;AACxD,IAAA,OAAO;AAAA,MACN,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,OAAA,EACO;AACP,IAAA,OAAA,CAAQ,cAAc,WAAA,CAAW,iBAAA;AAAA,MAChC,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACT;AAAA,EACD;AAAA,EAEA,OAAc,mBACb,OAAA,EACqB;AACrB,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,WAAA,CAAW,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,WAAA,CAAW,iBAAiB,GAAG,CAAA;AAAA,EACvC;AAAA,EAEO,SAAA,CACN,IAAA,EACA,MAAA,EACA,UAAA,GAAwD,EAAC,EAC9C;AACX,IAAA,MAAM,OAAA,GAAU,MAAA,EAAQ,OAAA,IAAW,WAAA,CAAW,eAAA,EAAgB;AAC9D,IAAA,MAAM,MAAA,GAAS,YAAW,cAAA,EAAe;AACzC,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,MAAA,CAAO,OAAA,GAAU,IAAA;AAE1C,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC5B,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,MAAM,IAAA,GAAiB;AAAA,MACtB,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,MACpB,UAAA,EAAY,EAAE,GAAG,UAAA,EAAW;AAAA,MAC5B,MAAA,EAAQ,IAAA;AAAA,MACR,YAAA,CAAa,KAAK,KAAA,EAAO;AACxB,QAAA,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,gBAAgB,GAAA,EAAK;AACpB,QAAA,IAAA,CAAK,MAAA,GAAS,OAAA;AACd,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAO,GAAA,KAAQ,QAAA,GAAW,MAAM,GAAA,CAAI,OAAA;AACjD,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,GAAA,GAAM;AACL,QAAA,IAAA,CAAK,OAAA,GAAU,KAAK,GAAA,EAAI;AAAA,MACzB;AAAA,KACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAEO,IAAM,aAAA,GAAgB,IAAI,UAAA;;;AChIjC,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR;ACrCO,IAAM,WAAA,GAAN,cAA0B,YAAA,CAAa;AAAA,EAS7C,YAA6B,OAAA,EAA6B;AACzD,IAAA,KAAA,EAAM;AADsB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAE5B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,EAAA;AAC1C,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,GAAA;AACxC,IAAA,IAAA,CAAK,gBAAA,EAAiB;AAEtB,IAAA,IAAI,OAAA,CAAQ,eAAe,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,aAAA,EAAc;AAAA,IACpB;AAAA,EACD;AAAA,EAT6B,OAAA;AAAA,EARrB,cAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAiC,IAAA;AAAA,EACjC,gBAAA,GAAkC,IAAA;AAAA,EAClC,WAA2B,EAAC;AAAA,EAC5B,mBAAA,GAA6C,IAAA;AAAA,EACpC,WAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA,EAgBV,gBAAA,GAAyB;AAC/B,IAAA,IAAI;AACH,MAAA,IACC,KAAK,OAAA,CAAQ,YAAA,IACV,cAAW,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA,EACtC;AACD,QAAA,IAAA,CAAK,cAAA,GAAoB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA;AAAA,MAChE;AAEA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC/C,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kCAAA,EAAqC,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAAA,SAChE;AAAA,MACD;AACA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAAA,SAC3D;AAAA,MACD;AAEA,MAAA,IAAA,CAAK,eAAA,GAAqB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AACjE,MAAA,IAAA,CAAK,gBAAA,GAAsB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAEnE,MAAA,GAAA,CAAI,KAAK,iDAAiD,CAAA;AAAA,IAC3D,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,KAAA;AAAA,IACP;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAA,GAA+B;AACrC,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,IAAA,GAAO,IAAWC,MAAA,CAAA,eAAA,CAAgB,IAAA,CAAK,eAAe,CAAA;AAC5D,IAAA,MAAM,WAAA,GAAc,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,MAAM,WAAA,GAAc,WAAA,CAAY,OAAA,EAAQ,GAAI,IAAI,OAAA,EAAQ;AACxD,IAAA,MAAM,gBAAgB,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA;AAAA,MACA,KAAK,KAAA,CAAM,WAAA,IAAe,GAAA,GAAO,EAAA,GAAK,KAAK,EAAA,CAAG;AAAA,KAC/C;AACA,IAAA,MAAM,YAAY,WAAA,IAAe,CAAA;AACjC,IAAA,MAAM,cAAA,GAAiB,iBAAiB,IAAA,CAAK,WAAA;AAE7C,IAAA,OAAO;AAAA,MACN,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,aAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC7B,IAAA,MAAM,YAAA,GAAe;AAAA,MACpB,KAAK,OAAA,CAAQ,aAAA;AAAA,MACb,KAAK,OAAA,CAAQ,cAAA;AAAA,MACb,KAAK,OAAA,CAAQ;AAAA,KACd,CAAE,OAAO,CAAC,CAAA,KAAmB,QAAQ,CAAA,IAAQ,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AAE3D,IAAA,KAAA,MAAW,YAAY,YAAA,EAAc;AACpC,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAa,EAAA,CAAA,KAAA,CAAM,QAAA,EAAU,MAAM;AACxC,UAAA,IAAA,CAAK,cAAA,EAAe;AAAA,QACrB,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,MAC3B,SAAS,GAAA,EAAK;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,8BAAA,EAAiC,QAAQ,CAAA,oBAAA,EAAuB,GAAG,CAAA;AAAA,SACpE;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAA,GAAuB;AAC9B,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AAAA,IACtC;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,WAAW,MAAM;AAC3C,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,QAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,SACpF;AACA,QAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACf,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAE,CAAA;AACrD,QAAA,IAAA,CAAK,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,MACzB;AAAA,IACD,CAAA,EAAG,KAAK,UAAU,CAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKO,MAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,KACpF;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAC5B,IAAA,OAAO,QAAA;AAAA,EACR;AAAA,EAEO,WAAA,GAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC9D;AACA,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACb;AAAA,EAEO,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC3B,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACxD;AACA,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AACrC,MAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA;AAAA,IAC5B;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACpC,MAAA,IAAI;AACH,QAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,MACf,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AACA,IAAA,IAAA,CAAK,WAAW,EAAC;AACjB,IAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,EACzB;AACD","file":"index.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)\n * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.\n * Spec: https://www.w3.org/TR/trace-context/\n */\n\nimport * as crypto from \"node:crypto\";\n\nexport interface SpanContext {\n\ttraceId: string;\n\tspanId: string;\n\tsampled: boolean;\n}\n\nexport interface LiopSpan {\n\treadonly name: string;\n\treadonly context: SpanContext;\n\treadonly startTime: number;\n\tendTime?: number;\n\tattributes: Record<string, string | number | boolean>;\n\tstatus: \"OK\" | \"ERROR\";\n\terror?: string;\n\tsetAttribute(key: string, value: string | number | boolean): LiopSpan;\n\trecordException(error: Error | string): LiopSpan;\n\tend(): void;\n}\n\nconst TRACEPARENT_REGEX =\n\t/^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;\n\nexport class LiopTracer {\n\tpublic static generateTraceId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(16).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(32));\n\t\treturn id;\n\t}\n\n\tpublic static generateSpanId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(8).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(16));\n\t\treturn id;\n\t}\n\n\tpublic static formatTraceparent(\n\t\ttraceId: string,\n\t\tspanId: string,\n\t\tsampled = true,\n\t): string {\n\t\tconst flags = sampled ? \"01\" : \"00\";\n\t\treturn `00-${traceId}-${spanId}-${flags}`;\n\t}\n\n\tpublic static parseTraceparent(header?: string | null): SpanContext | null {\n\t\tif (!header || typeof header !== \"string\") {\n\t\t\treturn null;\n\t\t}\n\t\tconst trimmed = header.trim();\n\t\tconst match = TRACEPARENT_REGEX.exec(trimmed);\n\t\tif (!match) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst [, version, traceId, spanId, flags] = match;\n\t\t// Version 00 cannot have all-zeros traceId or spanId\n\t\tif (version === \"00\") {\n\t\t\tif (traceId === \"0\".repeat(32) || spanId === \"0\".repeat(16)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t}\n\n\t\tconst sampled = (Number.parseInt(flags, 16) & 0x01) === 1;\n\t\treturn {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\t}\n\n\tpublic static injectTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t\tcontext: SpanContext,\n\t): void {\n\t\tcarrier.traceparent = LiopTracer.formatTraceparent(\n\t\t\tcontext.traceId,\n\t\t\tcontext.spanId,\n\t\t\tcontext.sampled,\n\t\t);\n\t}\n\n\tpublic static extractTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t): SpanContext | null {\n\t\tconst val = carrier.traceparent || carrier.Traceparent;\n\t\tif (Array.isArray(val)) {\n\t\t\treturn LiopTracer.parseTraceparent(val[0]);\n\t\t}\n\t\treturn LiopTracer.parseTraceparent(val);\n\t}\n\n\tpublic startSpan(\n\t\tname: string,\n\t\tparent?: SpanContext | null,\n\t\tattributes: Record<string, string | number | boolean> = {},\n\t): LiopSpan {\n\t\tconst traceId = parent?.traceId || LiopTracer.generateTraceId();\n\t\tconst spanId = LiopTracer.generateSpanId();\n\t\tconst sampled = parent ? parent.sampled : true;\n\n\t\tconst context: SpanContext = {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\n\t\tconst span: LiopSpan = {\n\t\t\tname,\n\t\t\tcontext,\n\t\t\tstartTime: Date.now(),\n\t\t\tattributes: { ...attributes },\n\t\t\tstatus: \"OK\",\n\t\t\tsetAttribute(key, value) {\n\t\t\t\tthis.attributes[key] = value;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\trecordException(err) {\n\t\t\t\tthis.status = \"ERROR\";\n\t\t\t\tthis.error = typeof err === \"string\" ? err : err.message;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\tend() {\n\t\t\t\tthis.endTime = Date.now();\n\t\t\t},\n\t\t};\n\n\t\treturn span;\n\t}\n}\n\nexport const defaultTracer = new LiopTracer();\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Certificate Manager (CertManager)\n * Provides automated certificate monitoring, X.509 validity inspection,\n * and hot-reloading for mutual TLS (mTLS) without node restarts.\n *\n * Compliance:\n * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS\n * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification\n */\n\nimport * as crypto from \"node:crypto\";\nimport { EventEmitter } from \"node:events\";\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface CertManagerOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCertPath?: string;\n\t/** Path to the server/client certificate chain (PEM format) */\n\tcertChainPath: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKeyPath: string;\n\t/** Expiration warning threshold in days (default: 30) */\n\twarningDays?: number;\n\t/** Enable file watching for automatic hot-reloading (default: true) */\n\twatchFiles?: boolean;\n\t/** Debounce delay in ms for hot reloading (default: 150) */\n\tdebounceMs?: number;\n}\n\nexport interface CertInfo {\n\tsubject: string;\n\tissuer: string;\n\tvalidFrom: string;\n\tvalidTo: string;\n\tfingerprint256: string;\n\tdaysRemaining: number;\n\tisExpired: boolean;\n\tisExpiringSoon: boolean;\n}\n\nexport class CertManager extends EventEmitter {\n\tprivate rootCertBuffer: Buffer | null = null;\n\tprivate certChainBuffer: Buffer | null = null;\n\tprivate privateKeyBuffer: Buffer | null = null;\n\tprivate watchers: fs.FSWatcher[] = [];\n\tprivate reloadDebounceTimer: NodeJS.Timeout | null = null;\n\tprivate readonly warningDays: number;\n\tprivate readonly debounceMs: number;\n\n\tconstructor(private readonly options: CertManagerOptions) {\n\t\tsuper();\n\t\tthis.warningDays = options.warningDays ?? 30;\n\t\tthis.debounceMs = options.debounceMs ?? 150;\n\t\tthis.loadCertificates();\n\n\t\tif (options.watchFiles !== false) {\n\t\t\tthis.setupWatchers();\n\t\t}\n\t}\n\n\t/**\n\t * Synchronously loads or reloads certificates from filesystem into memory.\n\t */\n\tpublic loadCertificates(): void {\n\t\ttry {\n\t\t\tif (\n\t\t\t\tthis.options.rootCertPath &&\n\t\t\t\tfs.existsSync(this.options.rootCertPath)\n\t\t\t) {\n\t\t\t\tthis.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);\n\t\t\t}\n\n\t\t\tif (!fs.existsSync(this.options.certChainPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Certificate chain file not found: ${this.options.certChainPath}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!fs.existsSync(this.options.privateKeyPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Private key file not found: ${this.options.privateKeyPath}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tthis.certChainBuffer = fs.readFileSync(this.options.certChainPath);\n\t\t\tthis.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);\n\n\t\t\tlog.info(\"[CertManager] Certificates loaded successfully.\");\n\t\t} catch (error) {\n\t\t\tlog.error(`[CertManager] Failed to load certificates: ${error}`);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.\n\t */\n\tpublic inspectCertificate(): CertInfo {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] No certificate loaded to inspect.\");\n\t\t}\n\n\t\tconst x509 = new crypto.X509Certificate(this.certChainBuffer);\n\t\tconst validToDate = new Date(x509.validTo);\n\t\tconst now = new Date();\n\t\tconst msRemaining = validToDate.getTime() - now.getTime();\n\t\tconst daysRemaining = Math.max(\n\t\t\t0,\n\t\t\tMath.floor(msRemaining / (1000 * 60 * 60 * 24)),\n\t\t);\n\t\tconst isExpired = msRemaining <= 0;\n\t\tconst isExpiringSoon = daysRemaining <= this.warningDays;\n\n\t\treturn {\n\t\t\tsubject: x509.subject,\n\t\t\tissuer: x509.issuer,\n\t\t\tvalidFrom: x509.validFrom,\n\t\t\tvalidTo: x509.validTo,\n\t\t\tfingerprint256: x509.fingerprint256,\n\t\t\tdaysRemaining,\n\t\t\tisExpired,\n\t\t\tisExpiringSoon,\n\t\t};\n\t}\n\n\t/**\n\t * Sets up non-blocking filesystem watchers to detect certificate renewals\n\t * and trigger hot-reloading without process restarts.\n\t */\n\tprivate setupWatchers(): void {\n\t\tconst filesToWatch = [\n\t\t\tthis.options.certChainPath,\n\t\t\tthis.options.privateKeyPath,\n\t\t\tthis.options.rootCertPath,\n\t\t].filter((p): p is string => Boolean(p && fs.existsSync(p)));\n\n\t\tfor (const filePath of filesToWatch) {\n\t\t\ttry {\n\t\t\t\tconst watcher = fs.watch(filePath, () => {\n\t\t\t\t\tthis.scheduleReload();\n\t\t\t\t});\n\t\t\t\tthis.watchers.push(watcher);\n\t\t\t} catch (err) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[CertManager] Could not watch ${filePath} for hot reloading: ${err}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Debounces reload events to ensure files have finished writing.\n\t */\n\tprivate scheduleReload(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t}\n\n\t\tthis.reloadDebounceTimer = setTimeout(() => {\n\t\t\ttry {\n\t\t\t\tthis.loadCertificates();\n\t\t\t\tconst certInfo = this.inspectCertificate();\n\t\t\t\tlog.info(\n\t\t\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t\t\t);\n\t\t\t\tthis.emit(\"reload\", certInfo);\n\t\t\t} catch (error) {\n\t\t\t\tlog.error(`[CertManager] Hot reload failed: ${error}`);\n\t\t\t\tthis.emit(\"error\", error);\n\t\t\t}\n\t\t}, this.debounceMs);\n\t}\n\n\t/**\n\t * Manually triggers a reload of certificates and emits the 'reload' event.\n\t */\n\tpublic reload(): CertInfo {\n\t\tthis.loadCertificates();\n\t\tconst certInfo = this.inspectCertificate();\n\t\tlog.info(\n\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t);\n\t\tthis.emit(\"reload\", certInfo);\n\t\treturn certInfo;\n\t}\n\n\tpublic getRootCert(): Buffer | null {\n\t\treturn this.rootCertBuffer;\n\t}\n\n\tpublic getCertChain(): Buffer {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Certificate chain not loaded.\");\n\t\t}\n\t\treturn this.certChainBuffer;\n\t}\n\n\tpublic getPrivateKey(): Buffer {\n\t\tif (!this.privateKeyBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Private key not loaded.\");\n\t\t}\n\t\treturn this.privateKeyBuffer;\n\t}\n\n\t/**\n\t * Stops all active file watchers and releases resources.\n\t */\n\tpublic dispose(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t\tthis.reloadDebounceTimer = null;\n\t\t}\n\t\tfor (const watcher of this.watchers) {\n\t\t\ttry {\n\t\t\t\twatcher.close();\n\t\t\t} catch {\n\t\t\t\t// Ignore watcher close errors\n\t\t\t}\n\t\t}\n\t\tthis.watchers = [];\n\t\tthis.removeAllListeners();\n\t}\n}\n"]}

package/dist/kyber-CGOA7Q6A.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"kyber-CGOA7Q6A.js"}

package/dist/mesh.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"mesh.js"}

package/dist/server.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"server.js"}

package/dist/types.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"types.js"}

package/dist/verifier-UBJTZQSA.js

@@ -1,6 +0,0 @@
-export { LiopVerifier } from './chunk-ZRWNMP5L.js';
-import './chunk-IK7CGWAZ.js';
-import './chunk-Q3FKHJ3B.js';
-import './chunk-K3DGJLUY.js';
-//# sourceMappingURL=verifier-UBJTZQSA.js.map
-//# sourceMappingURL=verifier-UBJTZQSA.js.map

package/dist/verifier-UBJTZQSA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-UBJTZQSA.js"}