@nekzus/liop 2.4.0-alpha.24 → 2.4.0-alpha.26

package/dist/chunk-ZJGVKM7G.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/rpc/client.ts","../src/rpc/crypto/aes.ts","../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;AAsBO,IAAM,gBAAN,MAAoB;AAAA;AAAA,EAElB,MAAA;AAAA,EACA,KAAA;AAAA,EACA,iBAAA;AAAA,EACQ,OAAA;AAAA,EAEhB,WAAA,CAAY,OAAA,EAAiB,GAAA,EAAsB,KAAA,EAAuB;AACzE,IAAA,MAAM,WAAA,GAAc,yBAAyB,GAAG,CAAA;AAChD,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,MAAA,CAAO,SAAA;AAAA,MACxB,OAAA;AAAA,MACA,WAAA;AAAA,MACA;AAAA,KACD;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EAChB;AAAA,EAEO,SAAS,KAAA,EAA6B;AAC5C,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,MAAA,IAAA,CAAK,iBAAA,GAAoB,KAAA;AAAA,IAC1B;AAAA,EACD;AAAA,EAEA,MAAc,YAAA,GAA4C;AACzD,IAAA,IAAI,OAAO,IAAA,CAAK,KAAA,KAAU,UAAA,EAAY;AACrC,MAAA,IAAA,CAAK,iBAAA,GAAoB,MAAM,IAAA,CAAK,KAAA,EAAM;AAC1C,MAAA,OAAO,IAAA,CAAK,iBAAA;AAAA,IACb;AACA,IAAA,IAAA,CAAK,oBAAoB,IAAA,CAAK,KAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,gBACZ,OAAA,EAC0B;AAC1B,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,YAAA,EAAa;AAC5C,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,MAAM,QAAA,GAAW,IAAS,IAAA,CAAA,QAAA,EAAS;AACnC,MAAA,IAAI,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,WAAW,CAAA,CAAE,CAAA;AAAA,MACtD;AACA,MAAA,IAAA,CAAK,MAAA,CAAO,eAAA;AAAA,QACX,OAAA;AAAA,QACA,QAAA;AAAA,QACA,CAAC,OAAiC,QAAA,KAA6B;AAC9D,UAAA,IAAI,KAAA,EAAO;AACV,YAAA,MAAA,CAAO,KAAK,CAAA;AAAA,UACb,CAAA,MAAO;AACN,YAAA,OAAA,CAAQ,QAAQ,CAAA;AAAA,UACjB;AAAA,QACD;AAAA,OACD;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,aACN,OAAA,EAC2C;AAC3C,IAAA,MAAM,QAAA,GAAW,IAAS,IAAA,CAAA,QAAA,EAAS;AACnC,IAAA,MAAM,WAAA,GACL,KAAK,iBAAA,KACJ,OAAO,KAAK,KAAA,KAAU,QAAA,GAAW,KAAK,KAAA,GAAQ,MAAA,CAAA;AAChD,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,QAAA,CAAS,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,WAAW,CAAA,CAAE,CAAA;AAAA,IACtD;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,YAAA,CAAa,OAAA,EAAS,QAAQ,CAAA;AAAA,EAClD;AAAA,EAEO,KAAA,GAAc;AACpB,IAAA,IAAA,CAAK,OAAO,KAAA,EAAM;AAAA,EACnB;AACD;AChGO,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5B,cAAA,CACC,SACA,YAAA,EAIC;AACD,IAAA,IAAI,YAAA,CAAa,WAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AAGA,IAAA,MAAM,KAAA,GAAQ,YAAY,EAAE,CAAA;AAE5B,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,aAAA,EAAe,YAAA,EAAc,KAAK,CAAA;AAGhE,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG,MAAA,CAAO,KAAA,EAAO,CAAC,CAAA;AACxE,IAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAIlC,IAAA,MAAM,kBAAkB,MAAA,CAAO,MAAA,CAAO,CAAC,SAAA,EAAW,OAAO,CAAC,CAAA;AAE1D,IAAA,OAAO;AAAA,MACN,UAAA,EAAY,eAAA;AAAA,MACZ;AAAA,KACD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,gBAAA,EACA,KAAA,EACA,YAAA,EACS;AACT,IAAA,IAAI,gBAAA,CAAiB,SAAS,EAAA,EAAI;AACjC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,MAAM,aAAA,GAAgB,gBAAA,CAAiB,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AACtD,IAAA,MAAM,OAAA,GAAU,gBAAA,CAAiB,QAAA,CAAS,GAAG,CAAA;AAE7C,IAAA,MAAM,QAAA,GAAW,gBAAA,CAAiB,aAAA,EAAe,YAAA,EAAc,KAAK,CAAA;AACpE,IAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAE3B,IAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA,EAAG,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AAAA,EACxE;AACD;;;AC/BO,IAAM,aAAN,MAAiB;AAAA,EACf,QAAA,GAA4B,IAAA;AAAA,EAC5B,UAAA,uBAA6C,GAAA,EAAI;AAAA,EACjD,SAAA,uBAA2C,GAAA,EAAI;AAAA,EAC/C,UAAA;AAAA,EACA,UAAA;AAAA,EACD,QAAA,GAAyB,IAAI,YAAA,EAAa;AAAA,EACzC,UAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAGD,GAAA,GAAc,QAAA;AAAA;AAAA,EAEd,eAAA,GAA0B,oBAAA;AAAA,EAEjC,YAAY,GAAA,EAAsB;AACjC,IAAA,IAAA,CAAK,UAAA,GAAa,GAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,OAAA,CACZ,OAAA,EACA,OAAA,EAWgB;AAEhB,IAAA,MAAM,QAAA,GACL,SAAS,IAAA,EAAM,QAAA,IACf,QAAQ,GAAA,CAAI,oBAAA,IACZ,QAAQ,GAAA,CAAI,cAAA;AACb,IAAA,MAAM,YAAA,GACL,SAAS,IAAA,EAAM,YAAA,IACf,QAAQ,GAAA,CAAI,wBAAA,IACZ,QAAQ,GAAA,CAAI,kBAAA;AACb,IAAA,MAAM,WACL,OAAA,EAAS,IAAA,EAAM,QAAA,IACf,OAAA,CAAQ,IAAI,cAAA,IACZ,uBAAA;AACD,IAAA,MAAM,WACL,OAAA,EAAS,IAAA,EAAM,QAAA,IACf,OAAA,CAAQ,IAAI,mBAAA,IACZ,mBAAA;AACD,IAAA,MAAM,QACL,OAAA,EAAS,IAAA,EAAM,KAAA,IACf,OAAA,CAAQ,IAAI,gBAAA,IACZ,sFAAA;AAED,IAAA,IAAA,CAAK,UAAA,GACJ,SAAS,IAAA,EAAM,KAAA,IACf,QAAQ,GAAA,CAAI,gBAAA,IACZ,QAAQ,GAAA,CAAI,UAAA;AAEb,IAAA,IAAI,YAAY,YAAA,EAAc;AAC7B,MAAA,MAAM,OAAA,GAAA,CAAW,QAAY,EAAyB,QAAA,CAAS,OAAO,IACnE,QAAY,GACZ,CAAA,EAAG,QAAmC,CAAA,KAAA,CAAA;AACzC,MAAA,MAAM,aAAA,GAAgB,GAAG,OAAO,CAAA,MAAA,CAAA;AAEhC,MAAA,IAAA,CAAK,YAAA,GAAe,IAAI,YAAA,CAAa;AAAA,QACpC,aAAA;AAAA,QACA,QAAA;AAAA,QACA,YAAA;AAAA,QACA,QAAA;AAAA,QACA,MAAA,EAAQ;AAAA,OACR,CAAA;AAED,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACnD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH;AAAA,SACD;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,mDACC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAChD,CAAA;AAAA,SACD;AAAA,MAED;AAAA,IACD;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAI,QAAA,CAAS,OAAA,EAAS,UAAU,CAAA;AAChD,IAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAC1B,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,6CAAA,EAAgD,IAAA,CAAK,QAAA,CAAS,SAAA,EAAW,CAAA;AAAA,KAC1E;AAEA,IAAA,IAAI,OAAA,EAAS;AACZ,MAAA,MAAM,gBAAgB,YAAY;AACjC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AAAA,QACzC;AACA,QAAA,OAAO,IAAA,CAAK,UAAA;AAAA,MACb,CAAA;AACA,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA;AAAA,QACf,QAAA;AAAA,QACA,IAAI,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,YAAY,aAAa;AAAA,OAC1D;AACA,MAAA,IAAA,CAAK,aAAa,EAAE,IAAA,EAAM,eAAe,OAAO,CAAA,CAAA,CAAA,EAAK,SAAS,OAAA,EAAQ;AACtE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,yCAAA,EAA4C,OAAO,CAAA,CAAE,CAAA;AAAA,IAC/D,CAAA,MAAO;AACN,MAAA,IAAA,CAAK,UAAA,GAAa,EAAE,IAAA,EAAM,yBAAA,EAA2B,SAAS,OAAA,EAAQ;AAAA,IACvE;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gBAAgB,KAAA,EAAgC;AAEvD,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACjC,MAAA,IAAI,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,CAAA,GAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,MAAM,EAAA,GAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA;AAC1B,QAAA,IACC,EAAA,KAAO,WAAA,IACP,CAAC,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,IACrB,EAAA,KAAO,SAAA,IACP,EAAA,KAAO,WAAA,EACN;AACD,UAAA,OAAO,EAAA;AAAA,QACR;AAAA,MACD;AAAA,IACD;AAGA,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AAC1B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA;AACjC,MAAA,IAAI,KAAA,KAAU,EAAA,IAAM,KAAA,GAAQ,CAAA,GAAI,MAAM,MAAA,EAAQ;AAC7C,QAAA,OAAO,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,MACvB;AAAA,IACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,kBAAkB,QAAA,EAAmC;AACjE,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAED,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6CAAA,EAAgD,QAAQ,CAAA,GAAA,CAAK,CAAA;AACtE,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,QAAQ,CAAA;AAE5D,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,qDAAqD,QAAQ,CAAA;AAAA,OAC9D;AAAA,IACD;AAEA,IAAA,MAAM,UAAA,GAAa,UAAU,CAAC,CAAA;AAC9B,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,+CAAA,EAAkD,UAAU,CAAA,CAAE,CAAA;AAEvE,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,UAAU,CAAA;AAC7D,IAAA,IAAI,QAAA,EAAU;AACb,MAAA,QAAA,GAAW,QAAA,CAAS,QAAA;AACpB,MAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,UAAA,EAAY,QAAQ,CAAA;AACvC,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0CAAA,EAA6C,QAAQ,CAAA,6BAAA,EAAgC,UAAU,CAAA;AAAA,OAChG;AAAA,IACD;AAEA,IAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,UAAU,CAAA;AACxD,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC5C,IAAA,IAAI,SAAA,EAAW;AACd,MAAA,MAAM,QAAA,GAAW,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AACzC,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,6DAA6D,QAAQ,CAAA;AAAA,OACtE;AACA,MAAA,OAAO,QAAA;AAAA,IACR;AAEA,IAAA,OAAO,aAAa,QAAQ,CAAA,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,oBAAoB,MAAA,EAI9B;AACF,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAkC;AAAA,QACvC,cAAA,EAAgB,kBAAA;AAAA,QAChB,YAAA,EAAc;AAAA,OACf;AACA,MAAA,IAAI,KAAK,UAAA,EAAY;AACpB,QAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,IAAA,CAAK,UAAU,CAAA,CAAA;AAAA,MAClD;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,MAAA,EAAQ;AAAA,QAC/B,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA;AAAA,QACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACpB,OAAA,EAAS,KAAA;AAAA,UACT,EAAA,EAAI,CAAA;AAAA,UACJ,MAAA,EAAQ,iBAAA;AAAA,UACR,QAAQ;AAAC,SACT;AAAA,OACD,CAAA;AAED,MAAA,IAAI,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAG7B,QAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,EAAQ,iBAAA,IAAqB,EAAC;AACrD,QAAA,IAAI,SAAA,CAAU,QAAA,CAAS,oBAAoB,CAAA,EAAG;AAC7C,UAAA,IAAA,CAAK,GAAA,GAAM,QAAA;AACX,UAAA,IAAA,CAAK,eAAA,GAAkB,oBAAA;AACvB,UAAA,OAAO;AAAA,YACN,GAAA,EAAK,QAAA;AAAA,YACL,eAAA,EAAiB,oBAAA;AAAA,YACjB,iBAAA,EAAmB;AAAA,WACpB;AAAA,QACD;AAAA,MACD;AAAA,IACD,SAAS,IAAA,EAAM;AAAA,IAEf;AAGA,IAAA,IAAI,0BAAA,EAA4B;AAC/B,MAAA,IAAA,CAAK,GAAA,GAAM,QAAA;AACX,MAAA,IAAA,CAAK,eAAA,GAAkB,2BAAA;AACvB,MAAA,OAAO;AAAA,QACN,GAAA,EAAK,QAAA;AAAA,QACL,eAAA,EAAiB,2BAAA;AAAA,QACjB,iBAAA,EAAmB,CAAC,2BAA2B;AAAA,OAChD;AAAA,IACD;AAEA,IAAA,MAAM,IAAI,KAAA;AAAA,MACT;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,aAAA,CACZ,YAAA,GAAe,KAAA,EACqC;AACpD,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AAEA,IAAA,MAAM,kBAAA,GAAqB,KAAK,GAAA,EAAI;AAEpC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,iDAAiD,YAAY,CAAA,IAAA;AAAA,KAC9D;AACA,IAAA,MAAM,WAAA,GAAc,MAAM,IAAA,CAAK,QAAA,CAAS,yBAAA,EAA0B;AAClE,IAAA,MAAM,QAAkD,EAAC;AACzD,IAAA,MAAM,SAAA,uBAAgB,GAAA,EAAY;AAElC,IAAA,KAAA,MAAW,UAAU,WAAA,EAAa;AACjC,MAAA,IAAI;AACH,QAAA,IAAI,WAA4C,CAAC,YAAA,GAC9C,KAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA,GACzB,KAAA,CAAA;AAEH,QAAA,IAAI,CAAC,QAAA,EAAU;AACd,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,qCAAA,EAAwC,MAAM,CAAA,CAAE,CAAA;AACzD,UAAA,QAAA,GAAW,MAAM,IAAA,CAAK,QAAA,CAAS,aAAA,CAAc,MAAM,CAAA;AACnD,UAAA,IAAI,QAAA,EAAU;AACb,YAAA,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAA,EAAQ,QAAQ,CAAA;AAAA,UACpC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,wCAAA,EAA2C,MAAM,CAAA,CAAE,CAAA;AAAA,QAC7D;AAEA,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,KAAA,EAAO;AAClC,YAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,EAAG;AAC9B,cAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,MAAM,WAAA,EAAa,IAAA,CAAK,aAAa,CAAA;AAC7D,cAAA,SAAA,CAAU,GAAA,CAAI,KAAK,IAAI,CAAA;AAAA,YACxB;AAAA,UACD;AAAA,QACD;AAAA,MACD,SAAS,GAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,6CAA6C,MAAM,CAAA,CAAA,CAAA;AAAA,UACnD,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,SAChD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,uCAAA,EAA0C,MAAM,MAAM,CAAA,cAAA;AAAA,KACvD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,MAAA,MAAM,YAAA,GAAe,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AACzC,MAAA,MAAM,oBAAA,GAAuB,IAAA,CAAK,SAAA,CAAU,EAAE,OAAO,CAAA;AACrD,MAAA,SAAA,CAAU,MAAA,CAAO;AAAA,QAChB,IAAA,EAAM,YAAA;AAAA,QACN,MAAA,EAAQ,eAAA;AAAA,QACR,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,YAAY,CAAA;AAAA,QACxD,qBAAA,EAAuB,SAAA,CAAU,WAAA,CAAY,oBAAoB,CAAA;AAAA,QACjE,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB,CAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QAAA,CACZ,OAAA,EACA,YAAA,EACA,OAAA,EAC0B;AAC1B,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,aAAA,GAAgB,KAAK,GAAA,EAAI;AAC/B,IAAA,MAAM,WAAW,OAAA,CAAQ,IAAA;AACzB,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAE,CAAA;AAGnD,IAAA,IAAI,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,IAAI,eAAA,GAAkB,QAAA;AAEtB,IAAA,IAAI,CAAC,SAAA,EAAW;AAEf,MAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA,EAAG;AAClC,QAAA,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA;AACxC,QAAA,eAAA,GAAkB,QAAA;AAAA,MACnB;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,SAAA,EAAW;AAEf,MAAA,IAAI,YAAA,GAA8B,IAAA;AAClC,MAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,QAAQ,KAAK,IAAA,CAAK,SAAA,CAAU,SAAQ,EAAG;AAC1D,QAAA,IAAI,QAAA,CAAS,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,QAAQ,CAAA,EAAG;AAEpD,UAAA,IAAI,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,EAAG;AAChC,YAAA,SAAA,GAAY,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACtC,YAAA,eAAA,GAAkB,MAAA;AAClB,YAAA;AAAA,UACD;AAEA,UAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,QAAA,CAAS,YAAY,MAAM,CAAA;AACpD,UAAA,MAAM,SAAA,GAAY,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAC5C,UAAA,IAAI,SAAA,EAAW;AACd,YAAA,YAAA,GAAe,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAA,CAAS,QAAQ,CAAA,CAAA;AAChD,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,iCAAA,EAAoC,QAAQ,CAAA,uCAAA,EAA0C,YAAY,CAAA;AAAA,aACnG;AACA,YAAA,eAAA,GAAkB,MAAA;AAClB,YAAA,SAAA,GAAY,IAAA,CAAK,oBAAA,CAAqB,MAAA,EAAQ,YAAY,CAAA;AAC1D,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,SAAA,EAAW;AACf,QAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,iBAAA,CAAkB,QAAQ,CAAA;AAC5D,QAAA,eAAA,GAAkB,QAAA;AAClB,QAAA,SAAA,GAAY,IAAA,CAAK,oBAAA,CAAqB,QAAA,EAAU,cAAc,CAAA;AAAA,MAC/D;AAAA,IACD,CAAA,MAAO;AACN,MAAA,eAAA,GAAkB,QAAA;AAClB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,0DAA0D,QAAQ,CAAA,CAAA;AAAA,OACnE;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,oCAAA,EAAuC,QAAQ,CAAA,GAAA,CAAK,CAAA;AAC7D,IAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB,CAAA,SAAA,EAAY,KAAK,QAAA,CAAS,SAAA,EAAW,CAAA,CAAA,GACrC,oBAAA;AACH,IAAA,MAAM,aAAA,GAAgB,OAAO,IAAA,CAAK,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,GAAA,EAAK,CAAA,CAAE,CAAA;AAC7D,IAAA,MAAM,aAAA,GAAgB,KAAK,QAAA,GACxB,MAAM,KAAK,QAAA,CAAS,IAAA,CAAK,aAAa,CAAA,GACtC,aAAA;AAEH,IAAA,IAAI,cAAA;AASJ,IAAA,IAAI;AACH,MAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,QACjD,SAAA,EAAW,QAAA;AAAA,QACX,eAAA,EAAiB,QAAA;AAAA,QACjB,eAAA,EAAiB;AAAA,OACjB,CAAA;AAAA,IACF,SAAS,GAAA,EAAc;AACtB,MAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,MAAA,IACC,KAAK,YAAA,KACJ,MAAA,CAAO,QAAA,CAAS,iBAAiB,KACjC,MAAA,CAAO,QAAA,CAAS,aAAa,CAAA,IAC7B,OAAO,QAAA,CAAS,wBAAwB,KACxC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,CAAA,EACzB;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,kDAAkD,QAAQ,CAAA,qEAAA;AAAA,SAC3D;AACA,QAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACpD,QAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,QAAA,SAAA,CAAU,SAAS,UAAU,CAAA;AAC7B,QAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,UACjD,SAAA,EAAW,QAAA;AAAA,UACX,eAAA,EAAiB,QAAA;AAAA,UACjB,eAAA,EAAiB;AAAA,SACjB,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,MAAM,GAAA;AAAA,MACP;AAAA,IACD;AAEA,IAAA,IAAI,CAAC,eAAe,QAAA,EAAU;AAC7B,MAAA,IACC,IAAA,CAAK,iBACJ,cAAA,CAAe,aAAA,EAAe,SAAS,OAAO,CAAA,IAC9C,eAAe,aAAA,EAAe,QAAA,CAAS,iBAAiB,CAAA,IACxD,cAAA,CAAe,eAAe,QAAA,CAAS,SAAS,KAChD,cAAA,CAAe,aAAA,EAAe,QAAA,CAAS,wBAAwB,CAAA,CAAA,EAC/D;AACD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,+CAAA,EAAkD,eAAe,aAAa,CAAA,mCAAA;AAAA,SAC/E;AACA,QAAA,IAAA,CAAK,aAAa,UAAA,EAAW;AAC7B,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AACpD,QAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,QAAA,SAAA,CAAU,SAAS,UAAU,CAAA;AAC7B,QAAA,cAAA,GAAkB,MAAM,UAAU,eAAA,CAAgB;AAAA,UACjD,SAAA,EAAW,QAAA;AAAA,UACX,eAAA,EAAiB,QAAA;AAAA,UACjB,eAAA,EAAiB;AAAA,SACjB,CAAA;AAAA,MACF;AACA,MAAA,IAAI,CAAC,eAAe,QAAA,EAAU;AAC7B,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,uBAAA,EAA0B,eAAe,aAAa,CAAA;AAAA,SACvD;AAAA,MACD;AAAA,IACD;AAGA,IAAA,MAAM,SAAA,GACL,cAAA,CAAe,gBAAA,IAAoB,cAAA,CAAe,cAAA;AACnD,IAAA,MAAM,YAAA,GACL,cAAA,CAAe,aAAA,IAAiB,cAAA,CAAe,YAAA;AAEhD,IAAA,IAAI,CAAC,SAAA,EAAW;AACf,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,4EAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,IAAI;AACH,QAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,UACtB,SAAA,EAAW,YAAA;AAAA,UACX,MAAA,EAAQ;AAAA,SACR,CAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAGA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,QAAQ,IAAI,CAAA,GAAA;AAAA,KAC1E;AACA,IAAA,MAAM,QAAA,GAAW,YAAY,GAAA,EAAI;AACjC,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI,YAAA;AACJ,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAM,eAAA,CAAgB,qBAAA,CAAsB,SAAS,CAAA;AACjE,MAAA,eAAA,GAAkB,GAAA,CAAI,UAAA;AACtB,MAAA,YAAA,GAAe,GAAA,CAAI,YAAA;AACnB,MAAA,MAAM,WAAA,GAAc,WAAA,CAAY,GAAA,EAAI,GAAI,QAAA;AACxC,MAAA,sBAAA,CAAuB,QAAQ,EAAE,IAAA,EAAM,OAAA,CAAQ,IAAA,IAAQ,WAAW,CAAA;AAClE,MAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,QACtB,SAAA,EAAW,YAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACR,CAAA;AAAA,IACF,SAAS,UAAA,EAAY;AACpB,MAAA,IAAI;AACH,QAAA,kBAAA,CAAmB,GAAA,CAAI;AAAA,UACtB,SAAA,EAAW,YAAA;AAAA,UACX,MAAA,EAAQ;AAAA,SACR,CAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAC;AACT,MAAA,MAAM,UAAA;AAAA,IACP;AAGA,IAAA,GAAA,CAAI,KAAK,CAAA,+CAAA,CAAiD,CAAA;AAE1D,IAAA,MAAM,YAAA,GAAe,YAAA,IAAgB,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA;AAGnD,IAAA,MAAM,EAAE,YAAY,aAAA,EAAe,KAAA,EAAO,UAAS,GAClD,aAAA,CAAc,cAAA,CAAe,YAAA,EAAc,YAAY,CAAA;AAGxD,IAAA,MAAM,kBAA8C,EAAC;AACrD,IAAA,MAAM,MAAA,GAAS,MAAM,OAAO,QAAa,CAAA;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,MAAA,CAAO,QAAQ,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA,EAAG;AACnE,MAAA,MAAM,UAAA,GAAa,MAAA,CAAO,WAAA,CAAY,EAAE,CAAA;AACxC,MAAA,MAAM,SAAS,MAAA,CAAO,cAAA;AAAA,QACrB,aAAA;AAAA,QACA,YAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,MAAM,SAAA,GAAY,OAAO,MAAA,CAAO;AAAA,QAC/B,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,QACnC,OAAO,KAAA;AAAM,OACb,CAAA;AACD,MAAA,MAAM,OAAA,GAAU,OAAO,UAAA,EAAW;AAElC,MAAA,eAAA,CAAgB,GAAG,IAAI,MAAA,CAAO,MAAA,CAAO,CAAC,UAAA,EAAY,SAAA,EAAW,OAAO,CAAC,CAAA;AAAA,IACtE;AAGA,IAAA,MAAM,YAAA,GAA6B;AAAA,MAClC,aAAA,EAAe,YAAA;AAAA,MACf,WAAA,EAAa,aAAA;AAAA,MACb,MAAA,EAAQ,eAAA;AAAA,MACR,cAAA,EAAgB,eAAA;AAAA,MAChB,SAAA,EAAW;AAAA,KACZ;AAEA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,YAAA,CAAa,YAAY,CAAA;AAClD,MAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,oDAAoD,CAAC,CAAA;AACtE,QAAA;AAAA,MACD;AACA,MAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,MAAA,IAAI,eAAA,GAAkB,KAAA;AAEtB,MAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,OAAO,QAAA,KAA4B;AACpD,QAAA,IAAI,eAAA,EAAiB;AACrB,QAAA,eAAA,GAAkB,IAAA;AAElB,QAAA,GAAA,CAAI,KAAK,0DAA0D,CAAA;AAEnE,QAAA,IAAI;AAIH,UAAA,IAAI,IAAA,GAAO,KAAA;AACX,UAAA,IAAI,CAAC,SAAS,QAAA,EAAU;AACvB,YAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,UAAU,CAAA;AAClD,YAAA,IAAA,GAAO,UAAA,CAAW,MAAA,GAAS,CAAA,IAAK,UAAA,CAAW,CAAC,CAAA,KAAM,CAAA;AAElD,YAAA,MAAM,QAAA,GAAW,OAAA,EAAS,QAAA,KAAa,IAAA,GAAO,UAAA,GAAa,MAAA,CAAA;AAE3D,YAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,QAAA,CAAS,eAAA;AAAA,cACnC,YAAA;AAAA,cACA,OAAO,IAAA,CAAK,QAAA,CAAS,mBAAmB,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,cACxD,UAAA;AAAA,cACA;AAAA,gBACC,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA;AAAA,gBACvC,gBAAgB,QAAA,CAAS,iBAAA;AAAA,gBACzB,aAAa,OAAA,EAAS,WAAA;AAAA,gBACtB;AAAA;AACD,aACD;AAEA,YAAA,IAAI;AACH,cAAA,oBAAA,CAAqB,GAAA,CAAI;AAAA,gBACxB,MAAA,EAAQ,UAAU,OAAA,GAAU;AAAA,eAC5B,CAAA;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAEA,YAAA,IAAI,CAAC,OAAA,EAAS;AACb,cAAA,IAAI;AACH,gBAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,kBACvB,UAAA,EAAY,QAAA;AAAA,kBACZ,UAAA,EAAY;AAAA,iBACZ,CAAA;AAAA,cACF,CAAA,CAAA,MAAQ;AAAA,cAAC;AACT,cAAA,MAAA;AAAA,gBACC,IAAI,KAAA;AAAA,kBACH;AAAA;AACD,eACD;AACA,cAAA;AAAA,YACD;AAAA,UACD,CAAA,MAAO;AACN,YAAA,IAAI;AACH,cAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,gBACvB,UAAA,EAAY,QAAA;AAAA,gBACZ,UAAA,EAAY;AAAA,eACZ,CAAA;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAAC;AAAA,UACV;AAEA,UAAA,eAAA,GAAkB,IAAA;AAGlB,UAAA,IAAI;AACH,YAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,YAAA,MAAM,eAAe,IAAA,CAAK,SAAA,CAAU,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA;AAC3D,YAAA,SAAA,CAAU,MAAA,CAAO;AAAA,cAChB,IAAA,EAAM,WAAA;AAAA,cACN,MAAA,EAAQ,UAAA;AAAA,cACR,QAAA;AAAA,cACA,MAAA,EACC,eAAA,KAAoB,QAAA,GAAW,eAAA,GAAkB,KAAA,CAAA;AAAA,cAClD,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,YAAY,CAAA;AAAA,cACxD,uBAAuB,SAAA,CAAU,WAAA;AAAA,gBAChC,QAAA,CAAS;AAAA,eACV;AAAA,cACA,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,aACzB,CAAA;AAED,YAAA,MAAM,cACL,MAAA,CAAO,UAAA,CAAW,QAAA,CAAS,iBAAA,IAAqB,EAAE,CAAA,IACjD,QAAA,CAAS,mBAAA,GACP,QAAA,CAAS,oBAAoB,MAAA,GAC7B,CAAA,CAAA,IACF,SAAS,UAAA,GAAa,QAAA,CAAS,WAAW,MAAA,GAAS,CAAA,CAAA;AACrD,YAAA,oBAAA,CAAqB,GAAA,CAAI,EAAE,UAAA,EAAY,QAAA,IAAY,WAAW,CAAA;AAAA,UAC/D,CAAA,CAAA,MAAQ;AAAA,UAER;AAEA,UAAA,OAAA,CAAQ;AAAA,YACP,OAAA,EAAS;AAAA,cACR;AAAA,gBACC,IAAA,EAAM,MAAA;AAAA,gBACN,MAAM,QAAA,CAAS;AAAA;AAChB,aACD;AAAA,YACA,SAAS,QAAA,CAAS,QAAA;AAAA,YAClB,UAAA,EAAY,CAAC,QAAA,CAAS,QAAA;AAAA,YACtB,WAAA,EAAa,IAAA,GAAA,CAAA,iBAAA,CAAA;AAAA,WACb,CAAA;AAAA,QACF,SAAS,GAAA,EAAK;AACb,UAAA,IAAI;AACH,YAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,cACvB,UAAA,EAAY,QAAA;AAAA,cACZ,UAAA,EAAY;AAAA,aACZ,CAAA;AAAA,UACF,CAAA,CAAA,MAAQ;AAAA,UAAC;AACT,UAAA,MAAA,CAAO,GAAG,CAAA;AAAA,QACX;AAAA,MACD,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AAE3B,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,eAAe,CAAA;AACtC,QAAA,IAAA,CAAK,UAAA,CAAW,OAAO,QAAQ,CAAA;AAC/B,QAAA,IAAI;AACH,UAAA,mBAAA,CAAoB,GAAA,CAAI;AAAA,YACvB,UAAA,EAAY,QAAA;AAAA,YACZ,UAAA,EAAY;AAAA,WACZ,CAAA;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAAC;AACT,QAAA,IAAI,eAAA,EAAiB;AACrB,QAAA,GAAA,CAAI,KAAA,CAAM,8BAA8B,GAAG,CAAA;AAC3C,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,MAAA,CAAO,EAAA,CAAG,OAAO,MAAM;AAGtB,QAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,eAAA,EAAiB;AACzC,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gDAAgD,CAAC,CAAA;AAAA,QACnE;AAAA,MACD,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,oBAAA,CAAqB,QAAgB,OAAA,EAAgC;AAC5E,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACvC,IAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,MAAA,IAAI,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,MAAM,CAAA;AACxC,MAAA,IAAI,UAAA,GAAa,MAAA;AAIjB,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,wBAAwB,MAAM,CAAA,+EAAA;AAAA,SAC/B;AACA,QAAA,KAAA,MAAW,CAAC,GAAA,EAAK,CAAC,KAAK,IAAA,CAAK,SAAA,CAAU,SAAQ,EAAG;AAChD,UAAA,IAAI,CAAA,CAAE,MAAM,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,MAAM,CAAA,EAAG;AAC3C,YAAA,QAAA,GAAW,CAAA;AACX,YAAA,UAAA,GAAa,GAAA;AACb,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,+BAA+B,MAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,KAAA,CAAM,EAAE,CAAC,CAAA,sBAAA;AAAA,aAC5E;AACA,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAEA,MAAA,MAAM,YAAA,GAAe,QAAA,EAAU,UAAA,EAAY,IAAA,EAAM,aAAY,IAAK,EAAA;AAClE,MAAA,IAAI,QAAA;AAGJ,MAAA,MAAM,OAAO,QAAA,EAAU,SAAA;AACvB,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,IAAI,CAAA,CAAE,KAChC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,IAAI,CAAA,CAAE,CAAA;AACvC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,wCAAwC,IAAI,CAAA,cAAA,EAAiB,IAAI,CAAA,YAAA,EAAe,CAAC,CAAC,QAAQ,CAAA;AAAA,SAC3F;AAAA,MACD,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,gDAAgD,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,2BAA2B,KAAA,CAAM,IAAA;AAAA,YACpG,IAAA,CAAK,UAAU,IAAA;AAAK,WACrB,CACE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM,EAAE,CAAC,CAAA,CACtB,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,SACb;AAAA,MACD;AAGA,MAAA,IAAI,CAAC,YAAY,UAAA,EAAY;AAC5B,QAAA,MAAM,OAAA,GAAU,UAAA,CAAW,KAAA,CAAM,EAAE,EAAE,WAAA,EAAY;AACjD,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,OAAO,CAAA,CAAE,KACnC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,OAAO,CAAA,CAAE,CAAA;AAAA,MAC3C;AAGA,MAAA,IAAI,CAAC,YAAY,YAAA,EAAc;AAC9B,QAAA,MAAM,YAAY,YAAA,CAChB,WAAA,EAAY,CACZ,OAAA,CAAQ,eAAe,GAAG,CAAA;AAC5B,QAAA,QAAA,GACC,OAAA,CAAQ,GAAA,CAAI,CAAA,WAAA,EAAc,SAAS,CAAA,CAAE,KACrC,OAAA,CAAQ,GAAA,CAAI,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAE,CAAA;AAAA,MAC7C;AAEA,MAAA,IAAI,QAAA,EAAU;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,sDAAsD,UAAA,CAAW,KAAA,CAAM,EAAE,CAAC,CAAA,EAAA,EAAK,gBAAgB,SAAS,CAAA,CAAA;AAAA,SACzG;AAAA,MACD;AAEA,MAAA,MAAM,gBAAgB,YAAY;AACjC,QAAA,IAAI,UAAU,OAAO,QAAA;AACrB,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,OAAO,MAAM,IAAA,CAAK,YAAA,CAAa,QAAA,EAAS;AAAA,QACzC;AACA,QAAA,OAAO,IAAA,CAAK,UAAA;AAAA,MACb,CAAA;AAEA,MAAA,MAAA,GAAS,IAAI,aAAA,CAAc,OAAA,EAAS,IAAA,CAAK,YAAY,aAAa,CAAA;AAClE,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,MAAA,EAAQ,MAAM,CAAA;AAAA,IACnC;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,aAAa,GAAA,EAEvB;AACF,IAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AACnB,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACrE;AACA,IAAA,MAAM,aAAA,GAAgB,KAAK,GAAA,EAAI;AAC/B,IAAA,GAAA,CAAI,IAAA,CAAK,CAAA,yCAAA,EAA4C,GAAG,CAAA,GAAA,CAAK,CAAA;AAG7D,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,QAAA,CAAS,cAAc,GAAG,CAAA;AACvD,IAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,GAAG,CAAA,CAAE,CAAA;AAAA,IAC/D;AAGA,IAAA,MAAM,WAAW,MAAM,IAAA,CAAK,SAAS,aAAA,CAAc,SAAA,CAAU,CAAC,CAAC,CAAA;AAC/D,IAAA,IAAI,CAAC,QAAA,EAAU;AACd,MAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,IACpE;AAGA,IAAA,MAAM,WAAA,GAAc,SAAS,SAAA,EAAW,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,GAAG,CAAA;AACjE,IAAA,IAAI,CAAC,WAAA,EAAa;AACjB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,SAAA,EAAY,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,IACjE;AAGA,IAAA,MAAM,MAAA,GAAS;AAAA,MACd,QAAA,EAAU;AAAA,QACT;AAAA,UACC,GAAA;AAAA,UACA,QAAA,EAAU,YAAY,QAAA,IAAY,kBAAA;AAAA,UAClC,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,WAAA,EAAa,MAAM,CAAC;AAAA;AAC1C;AACD,KACD;AAGA,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAY,qBAAqB,WAAA,EAAY;AACnD,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAC3C,MAAA,SAAA,CAAU,MAAA,CAAO;AAAA,QAChB,IAAA,EAAM,eAAA;AAAA,QACN,MAAA,EAAQ,cAAA;AAAA,QACR,QAAA,EAAU,GAAA;AAAA,QACV,MAAA,EAAQ,UAAU,CAAC,CAAA;AAAA,QACnB,oBAAA,EAAsB,SAAA,CAAU,WAAA,CAAY,GAAG,CAAA;AAAA,QAC/C,qBAAA,EAAuB,SAAA,CAAU,WAAA,CAAY,aAAa,CAAA;AAAA,QAC1D,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OACzB,CAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,MAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAW,MAAA,GAAwB;AAClC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU,IAAK,IAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,YAAA,GAAwB;AAClC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU,IAAK,KAAA;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,IAAW,eAAA,GAA0B;AACpC,IAAA,OAAO,IAAA,CAAK,QAAA,EAAU,QAAA,EAAS,CAAE,MAAA,IAAU,CAAA;AAAA,EAC5C;AAAA,EAEO,aAAA,GAA+D;AACrE,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,KAAA,GAAuB;AACnC,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AAAA,EACD;AACD","file":"chunk-ZJGVKM7G.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as grpc from \"@grpc/grpc-js\";\nimport { GRPC_CHANNEL_OPTIONS } from \"./channel-options.js\";\nimport { liopV1 } from \"./proto.js\";\nimport { createChannelCredentials, type LiopTlsOptions } from \"./tls.js\";\nimport type {\n\tIntentRequest,\n\tIntentResponse,\n\tLogicRequest,\n\tLogicResponse,\n} from \"./types.js\";\n\nexport type TokenProvider =\n\t| string\n\t| (() => Promise<string | undefined> | string | undefined);\n\n/**\n * LIOP gRPC Client Implementation\n * Provides a high-level interface for secure intent negotiation and logic execution.\n */\nexport class LiopRpcClient {\n\t// biome-ignore lint/suspicious/noExplicitAny: internal gRPC client type\n\tprivate client: any;\n\tprivate token?: TokenProvider;\n\tprivate lastResolvedToken?: string;\n\tpublic readonly address: string;\n\n\tconstructor(address: string, tls?: LiopTlsOptions, token?: TokenProvider) {\n\t\tconst credentials = createChannelCredentials(tls);\n\t\tthis.client = new liopV1.LogicMesh(\n\t\t\taddress,\n\t\t\tcredentials,\n\t\t\tGRPC_CHANNEL_OPTIONS,\n\t\t);\n\t\tthis.token = token;\n\t\tif (typeof token === \"string\") {\n\t\t\tthis.lastResolvedToken = token;\n\t\t}\n\t\tthis.address = address;\n\t}\n\n\tpublic setToken(token?: TokenProvider): void {\n\t\tthis.token = token;\n\t\tif (typeof token === \"string\") {\n\t\t\tthis.lastResolvedToken = token;\n\t\t}\n\t}\n\n\tprivate async resolveToken(): Promise<string | undefined> {\n\t\tif (typeof this.token === \"function\") {\n\t\t\tthis.lastResolvedToken = await this.token();\n\t\t\treturn this.lastResolvedToken;\n\t\t}\n\t\tthis.lastResolvedToken = this.token;\n\t\treturn this.token;\n\t}\n\n\t/**\n\t * Negotiates intent with the remote host.\n\t * Returns the ephemeral Kyber public key for payload encryption.\n\t */\n\tpublic async negotiateIntent(\n\t\trequest: IntentRequest,\n\t): Promise<IntentResponse> {\n\t\tconst activeToken = await this.resolveToken();\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst metadata = new grpc.Metadata();\n\t\t\tif (activeToken) {\n\t\t\t\tmetadata.add(\"authorization\", `Bearer ${activeToken}`);\n\t\t\t}\n\t\t\tthis.client.NegotiateIntent(\n\t\t\t\trequest,\n\t\t\t\tmetadata,\n\t\t\t\t(error: grpc.ServiceError | null, response: IntentResponse) => {\n\t\t\t\t\tif (error) {\n\t\t\t\t\t\treject(error);\n\t\t\t\t\t} else {\n\t\t\t\t\t\tresolve(response);\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t);\n\t\t});\n\t}\n\n\t/**\n\t * Pushes the encrypted Logic-on-Origin payload to the origin.\n\t * Returns a stream of semantic responses and ZK proofs.\n\t */\n\tpublic executeLogic(\n\t\trequest: LogicRequest,\n\t): grpc.ClientReadableStream<LogicResponse> {\n\t\tconst metadata = new grpc.Metadata();\n\t\tconst activeToken =\n\t\t\tthis.lastResolvedToken ||\n\t\t\t(typeof this.token === \"string\" ? this.token : undefined);\n\t\tif (activeToken) {\n\t\t\tmetadata.add(\"authorization\", `Bearer ${activeToken}`);\n\t\t}\n\t\treturn this.client.ExecuteLogic(request, metadata);\n\t}\n\n\tpublic close(): void {\n\t\tthis.client.close();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\n\n/**\n * LIOP Symmetric Payload Encryption Wrapper\n * Uses AES-256-GCM to secure WASM Code transport over Zero-Trust networks.\n * Fully compatible with the `aes-gcm` Rust crate used by Wasmtime.\n */\nexport const AesGcmWrapper = {\n\t/**\n\t * Encrypts a raw WASM payload using the shared secret negotiated via Kyber768.\n\t *\n\t * @param payload Raw incoming WASM byte array or string.\n\t * @param sharedSecret A perfectly derived 32-byte (256-bit) shared secret array\n\t * @returns The encrypted buffer to push to the GRPc stream, along with the 12-byte initialization vector natively generated.\n\t */\n\tencryptPayload(\n\t\tpayload: Uint8Array | Buffer,\n\t\tsharedSecret: Uint8Array,\n\t): {\n\t\tciphertext: Buffer;\n\t\tnonce: Buffer;\n\t} {\n\t\tif (sharedSecret.length !== 32) {\n\t\t\tthrow new Error(\"Symmetric Key must be exactly 32 bytes (256 bits).\");\n\t\t}\n\n\t\t// LIOP standard demands 96-bit (12 byte) IVs/Nonces for AES-GCM\n\t\tconst nonce = randomBytes(12);\n\n\t\tconst cipher = createCipheriv(\"aes-256-gcm\", sharedSecret, nonce);\n\n\t\t// Encrypt the payload and seal the tag\n\t\tconst encrypted = Buffer.concat([cipher.update(payload), cipher.final()]);\n\t\tconst authTag = cipher.getAuthTag(); // 16 bytes for GCM integrity\n\n\t\t// In LIOP, the auth tag is strictly appended to the end of the ciphertext bytes\n\t\t// mirroring the default serialization logic within `aes_gcm::Aes256Gcm` in Rust\n\t\tconst finalCiphertext = Buffer.concat([encrypted, authTag]);\n\n\t\treturn {\n\t\t\tciphertext: finalCiphertext,\n\t\t\tnonce: nonce,\n\t\t};\n\t},\n\n\t/**\n\t * Decrypts a remote Zero-Knowledge receipt using AES-256-GCM.\n\t */\n\tdecryptPayload(\n\t\tciphertextBuffer: Buffer,\n\t\tnonce: Buffer,\n\t\tsharedSecret: Uint8Array,\n\t): Buffer {\n\t\tif (ciphertextBuffer.length < 16) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Invalid GCM Ciphertext; missing authentication tag length\",\n\t\t\t);\n\t\t}\n\n\t\t// The last 16 bytes represent the AuthTag appended by rust-aes-gcm\n\t\tconst encryptedData = ciphertextBuffer.subarray(0, -16);\n\t\tconst authTag = ciphertextBuffer.subarray(-16);\n\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", sharedSecret, nonce);\n\t\tdecipher.setAuthTag(authTag);\n\n\t\treturn Buffer.concat([decipher.update(encryptedData), decipher.final()]);\n\t},\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { LiopVerifier } from \"../crypto/verifier.js\";\nimport { TokenTelemetryEngine } from \"../economy/telemetry.js\";\nimport {\n\tMCP_LEGACY_SUPPORT_ENABLED,\n\tMCP_PROTOCOL_VERSION_LEGACY,\n} from \"../gateway/mcp-compat.js\";\nimport {\n\ttype LiopManifest,\n\tMeshNode,\n\ttype MeshNodeConfig,\n} from \"../mesh/node.js\";\nimport {\n\tpqcHandshakeDurationMs,\n\tpqcHandshakesTotal,\n\ttoolCallErrorsTotal,\n\twireEgressBytesTotal,\n\tzkVerificationsTotal,\n} from \"../observability/metrics.js\";\nimport { LiopRpcClient } from \"../rpc/client.js\";\nimport { AesGcmWrapper } from \"../rpc/crypto/aes.js\";\nimport { Kyber768Wrapper } from \"../rpc/crypto/kyber.js\";\nimport type { LiopTlsOptions } from \"../rpc/tls.js\";\nimport type { LogicRequest, LogicResponse } from \"../rpc/types.js\";\nimport { TokenManager } from \"../runtime/token-manager.js\";\nimport { ProofType, type ZkPolicy } from \"../security/zk.js\";\nimport {\n\ttype CallToolRequest,\n\ttype CallToolResult,\n\tMCP_PROTOCOL_VERSION,\n\ttype McpEra,\n} from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\n/**\n * LIOP Client\n * High-level orchestration for discovery and execution in the Logic-Injection-on-Origin mesh.\n */\nexport class LiopClient {\n\tprivate meshNode: MeshNode | null = null;\n\tprivate rpcClients: Map<string, LiopRpcClient> = new Map();\n\tprivate manifests: Map<string, LiopManifest> = new Map();\n\tprivate tlsOptions?: LiopTlsOptions;\n\tprivate serverInfo?: { name: string; version: string };\n\tpublic verifier: LiopVerifier = new LiopVerifier();\n\tprivate oauthToken?: string;\n\tprivate tokenManager?: TokenManager;\n\n\t/** Protocol negotiation era */\n\tpublic era: McpEra = \"modern\";\n\t/** Negotiated protocol version */\n\tpublic protocolVersion: string = MCP_PROTOCOL_VERSION;\n\n\tconstructor(tls?: LiopTlsOptions) {\n\t\tthis.tlsOptions = tls;\n\t}\n\n\t/**\n\t * Discovers and connects to the target server or mesh capability.\n\t * If address is omitted, it sets up the MeshNode to act purely dynamically.\n\t */\n\tpublic async connect(\n\t\taddress?: string,\n\t\toptions?: {\n\t\t\tmeshConfig?: MeshNodeConfig;\n\t\t\tauth?: {\n\t\t\t\tclientId?: string;\n\t\t\t\tclientSecret?: string;\n\t\t\t\tnexusUrl?: string;\n\t\t\t\taudience?: string;\n\t\t\t\tscope?: string;\n\t\t\t\ttoken?: string;\n\t\t\t};\n\t\t},\n\t): Promise<void> {\n\t\t// Attempt to acquire OAuth M2M access token if credentials are provided\n\t\tconst clientId =\n\t\t\toptions?.auth?.clientId ||\n\t\t\tprocess.env.LIOP_OAUTH_CLIENT_ID ||\n\t\t\tprocess.env.LIOP_CLIENT_ID;\n\t\tconst clientSecret =\n\t\t\toptions?.auth?.clientSecret ||\n\t\t\tprocess.env.LIOP_OAUTH_CLIENT_SECRET ||\n\t\t\tprocess.env.LIOP_CLIENT_SECRET;\n\t\tconst nexusUrl =\n\t\t\toptions?.auth?.nexusUrl ||\n\t\t\tprocess.env.LIOP_NEXUS_URL ||\n\t\t\t\"http://localhost:3000\";\n\t\tconst audience =\n\t\t\toptions?.auth?.audience ||\n\t\t\tprocess.env.LIOP_OAUTH_AUDIENCE ||\n\t\t\t\"urn:liop:mesh:api\";\n\t\tconst scope =\n\t\t\toptions?.auth?.scope ||\n\t\t\tprocess.env.LIOP_OAUTH_SCOPE ||\n\t\t\t\"liop:tools:call liop:tools:list liop:resources:read liop:schema:read liop:mesh:query\";\n\n\t\tthis.oauthToken =\n\t\t\toptions?.auth?.token ||\n\t\t\tprocess.env.LIOP_OAUTH_TOKEN ||\n\t\t\tprocess.env.LIOP_TOKEN;\n\n\t\tif (clientId && clientSecret) {\n\t\t\tconst baseUrl = (nexusUrl || \"http://127.0.0.1:3000\").endsWith(\"/oidc\")\n\t\t\t\t? nexusUrl || \"http://127.0.0.1:3000\"\n\t\t\t\t: `${nexusUrl || \"http://127.0.0.1:3000\"}/oidc`;\n\t\t\tconst tokenEndpoint = `${baseUrl}/token`;\n\n\t\t\tthis.tokenManager = new TokenManager({\n\t\t\t\ttokenEndpoint,\n\t\t\t\tclientId,\n\t\t\t\tclientSecret,\n\t\t\t\taudience,\n\t\t\t\tscopes: scope,\n\t\t\t});\n\n\t\t\ttry {\n\t\t\t\tthis.oauthToken = await this.tokenManager.getToken();\n\t\t\t\tlog.info(\n\t\t\t\t\t\"[LiopClient] Dynamic TokenManager configured and initial token acquired.\",\n\t\t\t\t);\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.error(\n\t\t\t\t\t`[LiopClient] Failed to acquire OAuth M2M Token: ${\n\t\t\t\t\t\terr instanceof Error ? err.message : String(err)\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t\t// In development or when using static local token, allow connection to proceed\n\t\t\t}\n\t\t}\n\n\t\tthis.meshNode = new MeshNode(options?.meshConfig);\n\t\tawait this.meshNode.start();\n\t\tlog.info(\n\t\t\t`[LiopClient] Mesh Node synchronized. PeerID: ${this.meshNode.getPeerId()}`,\n\t\t);\n\n\t\tif (address) {\n\t\t\tconst tokenResolver = async () => {\n\t\t\t\tif (this.tokenManager) {\n\t\t\t\t\treturn await this.tokenManager.getToken();\n\t\t\t\t}\n\t\t\t\treturn this.oauthToken;\n\t\t\t};\n\t\t\tthis.rpcClients.set(\n\t\t\t\t\"static\",\n\t\t\t\tnew LiopRpcClient(address, this.tlsOptions, tokenResolver),\n\t\t\t);\n\t\t\tthis.serverInfo = { name: `LiopServer (${address})`, version: \"1.0.0\" };\n\t\t\tlog.info(`[LiopClient] Static gRPC configured for: ${address}`);\n\t\t} else {\n\t\t\tthis.serverInfo = { name: \"LiopServer (Mesh Alpha)\", version: \"1.0.0\" };\n\t\t}\n\t}\n\n\t/**\n\t * Selects the optimal IP from an array of multiaddrs.\n\t * Prioritizes routable non-loopback IPv4 addresses (e.g. Docker bridge, LAN, WAN)\n\t * over loopback (127.0.0.1) to prevent inter-container connection failures.\n\t */\n\tprivate selectOptimalIp(addrs: string[]): string | null {\n\t\t// Pass 1: Non-loopback, routable IPv4 addresses\n\t\tfor (const maddr of addrs) {\n\t\t\tconst parts = maddr.split(\"/\");\n\t\t\tconst ipIdx = parts.indexOf(\"ip4\");\n\t\t\tif (ipIdx !== -1 && ipIdx + 1 < parts.length) {\n\t\t\t\tconst ip = parts[ipIdx + 1];\n\t\t\t\tif (\n\t\t\t\t\tip !== \"127.0.0.1\" &&\n\t\t\t\t\t!ip.startsWith(\"127.\") &&\n\t\t\t\t\tip !== \"0.0.0.0\" &&\n\t\t\t\t\tip !== \"localhost\"\n\t\t\t\t) {\n\t\t\t\t\treturn ip;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// Pass 2: Fallback to loopback if no external IP is announced\n\t\tfor (const maddr of addrs) {\n\t\t\tconst parts = maddr.split(\"/\");\n\t\t\tconst ipIdx = parts.indexOf(\"ip4\");\n\t\t\tif (ipIdx !== -1 && ipIdx + 1 < parts.length) {\n\t\t\t\treturn parts[ipIdx + 1];\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t}\n\n\t/**\n\t * Dynamically queries Kademlia DHT to find the optimal PeerID providing the Capability\n\t * and returns the physical gRPC target (host:port) resolved from the provider's manifest.\n\t */\n\tpublic async resolveCapability(toolName: string): Promise<string> {\n\t\tif (!this.meshNode)\n\t\t\tthrow new Error(\n\t\t\t\t\"Client must be connected to Mesh to resolve capabilities.\",\n\t\t\t);\n\n\t\tlog.info(`[LiopClient] Querying Mesh DHT for Provider: ${toolName}...`);\n\t\tconst providers = await this.meshNode.findProviders(toolName);\n\n\t\tif (providers.length === 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Kademlia DHT found zero providers for capability: ${toolName}`,\n\t\t\t);\n\t\t}\n\n\t\tconst providerId = providers[0];\n\t\tlog.info(`[LiopClient] Identified Alpha Provider PeerID: ${providerId}`);\n\n\t\tlet grpcPort = 50051;\n\t\tconst manifest = await this.meshNode.queryManifest(providerId);\n\t\tif (manifest) {\n\t\t\tgrpcPort = manifest.grpcPort;\n\t\t\tthis.manifests.set(providerId, manifest);\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Manifest resolved: gRPC port ${grpcPort}. Cached manifest for PeerID ${providerId}`,\n\t\t\t);\n\t\t}\n\n\t\tconst addrs = await this.meshNode.resolvePeer(providerId);\n\t\tconst optimalIp = this.selectOptimalIp(addrs);\n\t\tif (optimalIp) {\n\t\t\tconst grpcHost = `${optimalIp}:${grpcPort}`;\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Translated Multiaddr to optimal gRPC Target: ${grpcHost}`,\n\t\t\t);\n\t\t\treturn grpcHost;\n\t\t}\n\n\t\treturn `127.0.0.1:${grpcPort}`;\n\t}\n\n\t/**\n\t * Probes a remote MCP endpoint using 'server/discover' to negotiate protocol era.\n\t * Falls back to legacy initialize handshake if server/discover fails.\n\t */\n\tpublic async probeServerDiscover(mcpUrl: string): Promise<{\n\t\tera: McpEra;\n\t\tprotocolVersion: string;\n\t\tsupportedVersions: string[];\n\t}> {\n\t\ttry {\n\t\t\tconst headers: Record<string, string> = {\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\"Mcp-Method\": \"server/discover\",\n\t\t\t};\n\t\t\tif (this.oauthToken) {\n\t\t\t\theaders.Authorization = `Bearer ${this.oauthToken}`;\n\t\t\t}\n\n\t\t\tconst res = await fetch(mcpUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders,\n\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\tid: 1,\n\t\t\t\t\tmethod: \"server/discover\",\n\t\t\t\t\tparams: {},\n\t\t\t\t}),\n\t\t\t});\n\n\t\t\tif (res.ok) {\n\t\t\t\tconst json = (await res.json()) as {\n\t\t\t\t\tresult?: { supportedVersions?: string[] };\n\t\t\t\t};\n\t\t\t\tconst supported = json.result?.supportedVersions || [];\n\t\t\t\tif (supported.includes(MCP_PROTOCOL_VERSION)) {\n\t\t\t\t\tthis.era = \"modern\";\n\t\t\t\t\tthis.protocolVersion = MCP_PROTOCOL_VERSION;\n\t\t\t\t\treturn {\n\t\t\t\t\t\tera: \"modern\",\n\t\t\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION,\n\t\t\t\t\t\tsupportedVersions: supported,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (_err) {\n\t\t\t// Ignore discovery network probe failures and fallback to legacy if enabled\n\t\t}\n\n\t\t/** @mcp-legacy Fallback to legacy era. Remove when v1 EOL. */\n\t\tif (MCP_LEGACY_SUPPORT_ENABLED) {\n\t\t\tthis.era = \"legacy\";\n\t\t\tthis.protocolVersion = MCP_PROTOCOL_VERSION_LEGACY;\n\t\t\treturn {\n\t\t\t\tera: \"legacy\",\n\t\t\t\tprotocolVersion: MCP_PROTOCOL_VERSION_LEGACY,\n\t\t\t\tsupportedVersions: [MCP_PROTOCOL_VERSION_LEGACY],\n\t\t\t};\n\t\t}\n\n\t\tthrow new Error(\n\t\t\t\"Server does not support MCP 2026-07-28 and legacy support is disabled.\",\n\t\t);\n\t}\n\n\t/**\n\t * Discovers remote capabilities via the LIOP Manifest Protocol.\n\t * Utilizes a memory cache to avoid redundant network dials against live peers.\n\t */\n\tpublic async discoverTools(\n\t\tforceRefresh = false,\n\t): Promise<{ name: string; description?: string }[]> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before discovering tools.\");\n\t\t}\n\n\t\tconst discoveryStartTime = Date.now();\n\n\t\tlog.info(\n\t\t\t`[LiopClient] Discovery started (forceRefresh: ${forceRefresh})...`,\n\t\t);\n\t\tconst providerIds = await this.meshNode.discoverManifestProviders();\n\t\tconst tools: { name: string; description?: string }[] = [];\n\t\tconst seenNames = new Set<string>();\n\n\t\tfor (const peerId of providerIds) {\n\t\t\ttry {\n\t\t\t\tlet manifest: LiopManifest | null | undefined = !forceRefresh\n\t\t\t\t\t? this.manifests.get(peerId)\n\t\t\t\t\t: undefined;\n\n\t\t\t\tif (!manifest) {\n\t\t\t\t\tlog.info(`[LiopClient] Querying manifest from: ${peerId}`);\n\t\t\t\t\tmanifest = await this.meshNode.queryManifest(peerId);\n\t\t\t\t\tif (manifest) {\n\t\t\t\t\t\tthis.manifests.set(peerId, manifest);\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tlog.info(`[LiopClient] Using cached manifest for: ${peerId}`);\n\t\t\t\t}\n\n\t\t\t\tif (manifest) {\n\t\t\t\t\tfor (const tool of manifest.tools) {\n\t\t\t\t\t\tif (!seenNames.has(tool.name)) {\n\t\t\t\t\t\t\ttools.push({ name: tool.name, description: tool.description });\n\t\t\t\t\t\t\tseenNames.add(tool.name);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (err: unknown) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Error querying manifest from ${peerId}:`,\n\t\t\t\t\terr instanceof Error ? err.message : String(err),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[LiopClient] Discovery finished. Found ${tools.length} unique tools.`,\n\t\t);\n\n\t\t// [Token Economy] Record telemetry for discoverTools\n\t\ttry {\n\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\tconst toolsPayload = JSON.stringify(tools);\n\t\t\tconst toolsResponsePayload = JSON.stringify({ tools });\n\t\t\ttelemetry.record({\n\t\t\t\ttype: \"tools_list\",\n\t\t\t\tmethod: \"discoverTools\",\n\t\t\t\testimatedInputTokens: telemetry.countTokens(toolsPayload),\n\t\t\t\testimatedOutputTokens: telemetry.countTokens(toolsResponsePayload),\n\t\t\t\tdurationMs: Date.now() - discoveryStartTime,\n\t\t\t});\n\t\t} catch {\n\t\t\t// Telemetry error isolation\n\t\t}\n\n\t\treturn tools;\n\t}\n\n\t/**\n\t * Invokes a tool.\n\t */\n\tpublic async callTool(\n\t\trequest: CallToolRequest,\n\t\t_wasmPayload?: Buffer,\n\t\toptions?: { zkPolicy?: ZkPolicy; circuitName?: string },\n\t): Promise<CallToolResult> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before calling tools.\");\n\t\t}\n\n\t\tconst callStartTime = Date.now();\n\t\tconst toolName = request.name;\n\t\tlog.info(`[LiopClient] Resolving Tool: ${toolName}`);\n\n\t\t// [ALPHA-FIX] Bypass DHT discovery if we are already statically connected to a provider (Enterprise/Test mode)\n\t\tlet rpcClient = this.rpcClients.get(\"static\");\n\t\tlet targetClientKey = toolName;\n\n\t\tif (!rpcClient) {\n\t\t\t// 1. If an RPC client was already registered for this toolName, reuse it\n\t\t\tif (this.rpcClients.has(toolName)) {\n\t\t\t\trpcClient = this.rpcClients.get(toolName);\n\t\t\t\ttargetClientKey = toolName;\n\t\t\t}\n\t\t}\n\n\t\tif (!rpcClient) {\n\t\t\t// 2. Fast-path: Check if capability already exists in cached manifests to bypass DHT walk\n\t\t\tlet resolvedHost: string | null = null;\n\t\t\tfor (const [peerId, manifest] of this.manifests.entries()) {\n\t\t\t\tif (manifest.tools.some((t) => t.name === toolName)) {\n\t\t\t\t\t// If we already have a client registered for this peerId, reuse it immediately\n\t\t\t\t\tif (this.rpcClients.has(peerId)) {\n\t\t\t\t\t\trpcClient = this.rpcClients.get(peerId);\n\t\t\t\t\t\ttargetClientKey = peerId;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tconst addrs = await this.meshNode.resolvePeer(peerId);\n\t\t\t\t\tconst optimalIp = this.selectOptimalIp(addrs);\n\t\t\t\t\tif (optimalIp) {\n\t\t\t\t\t\tresolvedHost = `${optimalIp}:${manifest.grpcPort}`;\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LiopClient] Fast-path: Resolved ${toolName} from manifest cache to optimal target ${resolvedHost}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\ttargetClientKey = peerId;\n\t\t\t\t\t\trpcClient = this.getOrCreateRpcClient(peerId, resolvedHost);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!rpcClient) {\n\t\t\t\tconst dynamicAddress = await this.resolveCapability(toolName);\n\t\t\t\ttargetClientKey = toolName;\n\t\t\t\trpcClient = this.getOrCreateRpcClient(toolName, dynamicAddress);\n\t\t\t}\n\t\t} else {\n\t\t\ttargetClientKey = \"static\";\n\t\t\tlog.info(\n\t\t\t\t`[LiopClient] Using existing static gRPC connection for ${toolName}.`,\n\t\t\t);\n\t\t}\n\n\t\tlog.info(`[LiopClient] Negotiating intent for ${toolName}...`);\n\t\tconst agentDid = this.meshNode\n\t\t\t? `did:liop:${this.meshNode.getPeerId()}`\n\t\t\t: \"did:liop:ephemeral\";\n\t\tconst intentPayload = Buffer.from(`${toolName}:${Date.now()}`);\n\t\tconst proofOfIntent = this.meshNode\n\t\t\t? await this.meshNode.sign(intentPayload)\n\t\t\t: intentPayload;\n\n\t\tlet intentResponse: {\n\t\t\taccepted: boolean;\n\t\t\terror_message: string;\n\t\t\tkyber_public_key: Uint8Array;\n\t\t\tkyberPublicKey: Uint8Array;\n\t\t\tsession_token: string;\n\t\t\tsessionToken: string;\n\t\t};\n\n\t\ttry {\n\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\tagent_did: agentDid,\n\t\t\t\tcapability_hash: toolName,\n\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t})) as unknown as typeof intentResponse;\n\t\t} catch (err: unknown) {\n\t\t\tconst errMsg = err instanceof Error ? err.message : String(err);\n\t\t\tif (\n\t\t\t\tthis.tokenManager &&\n\t\t\t\t(errMsg.includes(\"UNAUTHENTICATED\") ||\n\t\t\t\t\terrMsg.includes(\"Invalid JWT\") ||\n\t\t\t\t\terrMsg.includes(\"timestamp check failed\") ||\n\t\t\t\t\terrMsg.includes(\"expired\"))\n\t\t\t) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[LiopClient] Token expired/unauthenticated for ${toolName}. Preemptively refreshing OAuth token and retrying negotiateIntent...`,\n\t\t\t\t);\n\t\t\t\tthis.tokenManager.invalidate();\n\t\t\t\tconst freshToken = await this.tokenManager.getToken();\n\t\t\t\tthis.oauthToken = freshToken;\n\t\t\t\trpcClient.setToken(freshToken);\n\t\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\t\tagent_did: agentDid,\n\t\t\t\t\tcapability_hash: toolName,\n\t\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t\t})) as unknown as typeof intentResponse;\n\t\t\t} else {\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t}\n\n\t\tif (!intentResponse.accepted) {\n\t\t\tif (\n\t\t\t\tthis.tokenManager &&\n\t\t\t\t(intentResponse.error_message?.includes(\"token\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"UNAUTHENTICATED\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"expired\") ||\n\t\t\t\t\tintentResponse.error_message?.includes(\"timestamp check failed\"))\n\t\t\t) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[LiopClient] Intent rejected with auth error: \"${intentResponse.error_message}\". Refreshing token and retrying...`,\n\t\t\t\t);\n\t\t\t\tthis.tokenManager.invalidate();\n\t\t\t\tconst freshToken = await this.tokenManager.getToken();\n\t\t\t\tthis.oauthToken = freshToken;\n\t\t\t\trpcClient.setToken(freshToken);\n\t\t\t\tintentResponse = (await rpcClient.negotiateIntent({\n\t\t\t\t\tagent_did: agentDid,\n\t\t\t\t\tcapability_hash: toolName,\n\t\t\t\t\tproof_of_intent: proofOfIntent,\n\t\t\t\t})) as unknown as typeof intentResponse;\n\t\t\t}\n\t\t\tif (!intentResponse.accepted) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Intent denied by host: ${intentResponse.error_message}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// LIOP Robust Field Extraction (Supports both snake_case and camelCase via gRPC-JS)\n\t\tconst publicKey =\n\t\t\tintentResponse.kyber_public_key || intentResponse.kyberPublicKey;\n\t\tconst sessionToken =\n\t\t\tintentResponse.session_token || intentResponse.sessionToken;\n\n\t\tif (!publicKey) {\n\t\t\tlog.info(\n\t\t\t\t\"[LiopClient] Critical Error: Kyber Public Key not found in IntentResponse.\",\n\t\t\t\tintentResponse,\n\t\t\t);\n\t\t\ttry {\n\t\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\t\tstatus: \"failure\",\n\t\t\t\t});\n\t\t\t} catch {}\n\t\t\tthrow new Error(\n\t\t\t\t\"Handshake failed: Remote host did not provide a valid Kyber Public Key.\",\n\t\t\t);\n\t\t}\n\n\t\t// 2. Post-Quantum Encapsulation (ML-KEM-768)\n\t\tlog.info(\n\t\t\t`[LiopClient] Encapsulating Post-Quantum Shared Secret for ${request.name}...`,\n\t\t);\n\t\tconst pqcStart = performance.now();\n\t\tlet kyberCiphertext: Uint8Array;\n\t\tlet sharedSecret: Uint8Array;\n\t\ttry {\n\t\t\tconst res = await Kyber768Wrapper.encapsulateAsymmetric(publicKey);\n\t\t\tkyberCiphertext = res.ciphertext;\n\t\t\tsharedSecret = res.sharedSecret;\n\t\t\tconst pqcDuration = performance.now() - pqcStart;\n\t\t\tpqcHandshakeDurationMs.observe({ tool: request.name }, pqcDuration);\n\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\tstatus: \"success\",\n\t\t\t});\n\t\t} catch (encapError) {\n\t\t\ttry {\n\t\t\t\tpqcHandshakesTotal.inc({\n\t\t\t\t\talgorithm: \"ml-kem-768\",\n\t\t\t\t\tstatus: \"failure\",\n\t\t\t\t});\n\t\t\t} catch {}\n\t\t\tthrow encapError;\n\t\t}\n\n\t\t// 3. Symmetric Sealing (AES-256-GCM)\n\t\tlog.info(`[LiopClient] Sealing WASM Payload and Inputs...`);\n\n\t\tconst _safePayload = _wasmPayload || Buffer.from(\"\");\n\n\t\t// Encrypt WASM binary\n\t\tconst { ciphertext: encryptedWasm, nonce: aesNonce } =\n\t\t\tAesGcmWrapper.encryptPayload(_safePayload, sharedSecret);\n\n\t\t// Encrypt inputs using a fresh random nonce per input to prevent AES-GCM nonce reuse\n\t\tconst encryptedInputs: Record<string, Uint8Array> = {};\n\t\tconst crypto = await import(\"node:crypto\");\n\t\tfor (const [key, value] of Object.entries(request.arguments || {})) {\n\t\t\tconst inputNonce = crypto.randomBytes(12);\n\t\t\tconst cipher = crypto.createCipheriv(\n\t\t\t\t\"aes-256-gcm\",\n\t\t\t\tsharedSecret,\n\t\t\t\tinputNonce,\n\t\t\t);\n\t\t\tconst encrypted = Buffer.concat([\n\t\t\t\tcipher.update(JSON.stringify(value)),\n\t\t\t\tcipher.final(),\n\t\t\t]);\n\t\t\tconst authTag = cipher.getAuthTag();\n\t\t\t// Prepend the 12-byte nonce to the ciphertext\n\t\t\tencryptedInputs[key] = Buffer.concat([inputNonce, encrypted, authTag]);\n\t\t}\n\n\t\t// 4. Assemble and Execute gRPC LogicRequest\n\t\tconst logicRequest: LogicRequest = {\n\t\t\tsession_token: sessionToken,\n\t\t\twasm_binary: encryptedWasm,\n\t\t\tinputs: encryptedInputs,\n\t\t\tpqc_ciphertext: kyberCiphertext,\n\t\t\taes_nonce: aesNonce,\n\t\t};\n\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tconst stream = rpcClient.executeLogic(logicRequest);\n\t\t\tif (!stream) {\n\t\t\t\treject(new Error(\"RPC Client unavailable or failed to create stream.\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlet resultFulfilled = false;\n\t\t\tlet hasReceivedData = false;\n\n\t\t\tstream.on(\"data\", async (response: LogicResponse) => {\n\t\t\t\tif (resultFulfilled) return;\n\t\t\t\thasReceivedData = true;\n\n\t\t\t\tlog.info(\"[LiopClient] Logic Executed. Verification in progress...\");\n\n\t\t\t\ttry {\n\t\t\t\t\t// Only verify ZK-Receipt if the remote execution succeeded.\n\t\t\t\t\t// If the remote execution failed due to a policy error (e.g. Egress Shield),\n\t\t\t\t\t// the ZK proof is empty and we should bypass validation to propagate the original error.\n\t\t\t\t\tlet isV2 = false;\n\t\t\t\t\tif (!response.is_error) {\n\t\t\t\t\t\tconst receiptBuf = Buffer.from(response.zk_receipt);\n\t\t\t\t\t\tisV2 = receiptBuf.length > 0 && receiptBuf[0] === 0x02;\n\n\t\t\t\t\t\tconst zkPolicy = options?.zkPolicy ?? (isV2 ? \"required\" : \"none\");\n\n\t\t\t\t\t\tconst isValid = await this.verifier.verifyZkReceipt(\n\t\t\t\t\t\t\t_safePayload,\n\t\t\t\t\t\t\tBuffer.from(response.cryptographic_proof).toString(\"hex\"),\n\t\t\t\t\t\t\treceiptBuf,\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tsessionSecret: Buffer.from(sharedSecret),\n\t\t\t\t\t\t\t\texpectedOutput: response.semantic_evidence,\n\t\t\t\t\t\t\t\tcircuitName: options?.circuitName,\n\t\t\t\t\t\t\t\tzkPolicy,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t);\n\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tzkVerificationsTotal.inc({\n\t\t\t\t\t\t\t\tstatus: isValid ? \"valid\" : \"invalid\",\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} catch {\n\t\t\t\t\t\t\t// Metrics isolation\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (!isValid) {\n\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\t\t\terror_type: \"zk_verification_failed\",\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t} catch {}\n\t\t\t\t\t\t\treject(\n\t\t\t\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\t\t\t\"PROTOCOL INTEGRITY VIOLATION: ZK-Receipt verification failed.\",\n\t\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\t\terror_type: \"remote_execution_error\",\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t} catch {}\n\t\t\t\t\t}\n\n\t\t\t\t\tresultFulfilled = true;\n\n\t\t\t\t\t// [Token Economy & Wire Telemetry] Record telemetry for callTool\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\t\t\t\tconst inputPayload = JSON.stringify(request.arguments ?? {});\n\t\t\t\t\t\ttelemetry.record({\n\t\t\t\t\t\t\ttype: \"tool_call\",\n\t\t\t\t\t\t\tmethod: \"callTool\",\n\t\t\t\t\t\t\ttoolName,\n\t\t\t\t\t\t\tpeerId:\n\t\t\t\t\t\t\t\ttargetClientKey !== toolName ? targetClientKey : undefined,\n\t\t\t\t\t\t\testimatedInputTokens: telemetry.countTokens(inputPayload),\n\t\t\t\t\t\t\testimatedOutputTokens: telemetry.countTokens(\n\t\t\t\t\t\t\t\tresponse.semantic_evidence,\n\t\t\t\t\t\t\t),\n\t\t\t\t\t\t\tdurationMs: Date.now() - callStartTime,\n\t\t\t\t\t\t});\n\n\t\t\t\t\t\tconst egressBytes =\n\t\t\t\t\t\t\tBuffer.byteLength(response.semantic_evidence || \"\") +\n\t\t\t\t\t\t\t(response.cryptographic_proof\n\t\t\t\t\t\t\t\t? response.cryptographic_proof.length\n\t\t\t\t\t\t\t\t: 0) +\n\t\t\t\t\t\t\t(response.zk_receipt ? response.zk_receipt.length : 0);\n\t\t\t\t\t\twireEgressBytesTotal.inc({ capability: toolName }, egressBytes);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\t// Telemetry error isolation\n\t\t\t\t\t}\n\n\t\t\t\t\tresolve({\n\t\t\t\t\t\tcontent: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\t\ttext: response.semantic_evidence,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t\tisError: response.is_error,\n\t\t\t\t\t\tzkVerified: !response.is_error,\n\t\t\t\t\t\tzkProofType: isV2 ? ProofType.GROTH16 : ProofType.HMAC_LEGACY,\n\t\t\t\t\t});\n\t\t\t\t} catch (err) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\t\terror_type: \"verification_exception\",\n\t\t\t\t\t\t});\n\t\t\t\t\t} catch {}\n\t\t\t\t\treject(err);\n\t\t\t\t}\n\t\t\t});\n\n\t\t\tstream.on(\"error\", (err) => {\n\t\t\t\t// Evict faulted client from cache so subsequent requests reconnect cleanly\n\t\t\t\tthis.rpcClients.delete(targetClientKey);\n\t\t\t\tthis.rpcClients.delete(toolName);\n\t\t\t\ttry {\n\t\t\t\t\ttoolCallErrorsTotal.inc({\n\t\t\t\t\t\tcapability: toolName,\n\t\t\t\t\t\terror_type: \"stream_error\",\n\t\t\t\t\t});\n\t\t\t\t} catch {}\n\t\t\t\tif (resultFulfilled) return;\n\t\t\t\tlog.error(\"[LiopClient] Stream Error:\", err);\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tstream.on(\"end\", () => {\n\t\t\t\t// We don't throw here if we already received a response block that is currently\n\t\t\t\t// undergoing ZK Verification in the Piscina worker pool.\n\t\t\t\tif (!hasReceivedData && !resultFulfilled) {\n\t\t\t\t\treject(new Error(\"Logic-on-Origin stream closed without results.\"));\n\t\t\t\t}\n\t\t\t});\n\t\t});\n\t}\n\n\tprivate getOrCreateRpcClient(peerId: string, address: string): LiopRpcClient {\n\t\tlet client = this.rpcClients.get(peerId);\n\t\tif (!client) {\n\t\t\tlet manifest = this.manifests.get(peerId);\n\t\t\tlet realPeerId = peerId;\n\n\t\t\t// If peerId is actually a toolName (which happens when called from callTool),\n\t\t\t// resolve the real PeerID and its manifest from the manifest cache.\n\t\t\tif (!manifest) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] PeerID \"${peerId}\" not found in manifest cache as PeerID. Searching tools in cached manifests...`,\n\t\t\t\t);\n\t\t\t\tfor (const [pId, m] of this.manifests.entries()) {\n\t\t\t\t\tif (m.tools.some((t) => t.name === peerId)) {\n\t\t\t\t\t\tmanifest = m;\n\t\t\t\t\t\trealPeerId = pId;\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LiopClient] Resolved tool \"${peerId}\" to provider PeerID \"${pId.slice(-8)}\" from manifest cache.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst providerName = manifest?.serverInfo?.name?.toLowerCase() || \"\";\n\t\t\tlet envToken: string | undefined;\n\n\t\t\t// 0. Deterministic tokenSlug resolution (highest priority, zero heuristic)\n\t\t\tconst slug = manifest?.tokenSlug;\n\t\t\tif (slug) {\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${slug}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${slug}`];\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Resolved via tokenSlug \"${slug}\" (LIOP_TOKEN_${slug}) -> found: ${!!envToken}`,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] No tokenSlug available for peer ${realPeerId.slice(-8)}. Available cache keys: ${Array.from(\n\t\t\t\t\t\tthis.manifests.keys(),\n\t\t\t\t\t)\n\t\t\t\t\t\t.map((k) => k.slice(-8))\n\t\t\t\t\t\t.join(\", \")}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// 1. PeerID-specific resolution: LIOP_TOKEN_<last 8 chars of PeerID in uppercase>\n\t\t\tif (!envToken && realPeerId) {\n\t\t\t\tconst shortId = realPeerId.slice(-8).toUpperCase();\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${shortId}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${shortId}`];\n\t\t\t}\n\n\t\t\t// 2. Provider-name resolution: LIOP_TOKEN_<CLEAN_PROVIDER_NAME_UPPERCASE>\n\t\t\tif (!envToken && providerName) {\n\t\t\t\tconst cleanName = providerName\n\t\t\t\t\t.toUpperCase()\n\t\t\t\t\t.replace(/[^A-Z0-9_]/g, \"_\");\n\t\t\t\tenvToken =\n\t\t\t\t\tprocess.env[`LIOP_TOKEN_${cleanName}`] ||\n\t\t\t\t\tprocess.env[`LIOP_OAUTH_TOKEN_${cleanName}`];\n\t\t\t}\n\n\t\t\tif (envToken) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LiopClient] Resolved node-specific token for peer ${realPeerId.slice(-8)} (${providerName || \"unknown\"})`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst tokenResolver = async () => {\n\t\t\t\tif (envToken) return envToken;\n\t\t\t\tif (this.tokenManager) {\n\t\t\t\t\treturn await this.tokenManager.getToken();\n\t\t\t\t}\n\t\t\t\treturn this.oauthToken;\n\t\t\t};\n\n\t\t\tclient = new LiopRpcClient(address, this.tlsOptions, tokenResolver);\n\t\t\tthis.rpcClients.set(peerId, client);\n\t\t}\n\t\treturn client;\n\t}\n\n\t/**\n\t * Reads a specific resource by URI.\n\t * In LIOP, resources can be static definitions or dynamic streams.\n\t */\n\tpublic async readResource(uri: string): Promise<{\n\t\tcontents: Array<{ uri: string; mimeType?: string; text: string }>;\n\t}> {\n\t\tif (!this.meshNode) {\n\t\t\tthrow new Error(\"Client must be connected before reading resources.\");\n\t\t}\n\t\tconst readStartTime = Date.now();\n\t\tlog.info(`[LiopClient] Querying Mesh for Resource: ${uri}...`);\n\n\t\t// We search for the peer hosting the resource in the P2P Mesh\n\t\tconst providers = await this.meshNode.findProviders(uri);\n\t\tif (providers.length === 0) {\n\t\t\tthrow new Error(`No mesh providers found for resource: ${uri}`);\n\t\t}\n\n\t\t// Query the remote peer's manifest\n\t\tconst manifest = await this.meshNode.queryManifest(providers[0]);\n\t\tif (!manifest) {\n\t\t\tthrow new Error(\"Target peer did not return a valid LIOP Manifest.\");\n\t\t}\n\n\t\t// Locate the exact resource metadata\n\t\tconst resourceDef = manifest.resources?.find((r) => r.uri === uri);\n\t\tif (!resourceDef) {\n\t\t\tthrow new Error(`Resource ${uri} not listed in remote manifest.`);\n\t\t}\n\n\t\t// Return the declarative metadata (Logic-Injection is required for actual data extraction)\n\t\tconst result = {\n\t\t\tcontents: [\n\t\t\t\t{\n\t\t\t\t\turi,\n\t\t\t\t\tmimeType: resourceDef.mimeType || \"application/json\",\n\t\t\t\t\ttext: JSON.stringify(resourceDef, null, 2),\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\n\t\t// [Token Economy] Record telemetry for readResource\n\t\ttry {\n\t\t\tconst telemetry = TokenTelemetryEngine.getInstance();\n\t\t\tconst outputPayload = JSON.stringify(result);\n\t\t\ttelemetry.record({\n\t\t\t\ttype: \"resource_read\",\n\t\t\t\tmethod: \"readResource\",\n\t\t\t\ttoolName: uri,\n\t\t\t\tpeerId: providers[0],\n\t\t\t\testimatedInputTokens: telemetry.countTokens(uri),\n\t\t\t\testimatedOutputTokens: telemetry.countTokens(outputPayload),\n\t\t\t\tdurationMs: Date.now() - readStartTime,\n\t\t\t});\n\t\t} catch {\n\t\t\t// Telemetry error isolation\n\t\t}\n\n\t\treturn result;\n\t}\n\n\t/**\n\t * Returns the local PeerId string if the mesh node is active, null otherwise.\n\t * PeerIds are public identifiers by libp2p protocol design (Ed25519 public key hash).\n\t */\n\tpublic get peerId(): string | null {\n\t\treturn this.meshNode?.getPeerId() ?? null;\n\t}\n\n\t/**\n\t * Returns true if the mesh node is initialized and running.\n\t */\n\tpublic get isMeshActive(): boolean {\n\t\treturn this.meshNode?.isStarted() ?? false;\n\t}\n\n\t/**\n\t * Returns the number of active P2P connections, or 0 if the mesh is inactive.\n\t */\n\tpublic get connectionCount(): number {\n\t\treturn this.meshNode?.getPeers().length ?? 0;\n\t}\n\n\tpublic getServerInfo(): { name: string; version: string } | undefined {\n\t\treturn this.serverInfo;\n\t}\n\n\t/**\n\t * Destroys the active Mesh Node resources.\n\t */\n\tpublic async close(): Promise<void> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t}\n}\n"]}

package/dist/chunk-ZP3VVXOI.js

@@ -1,66 +0,0 @@
-import { Buffer } from 'buffer';
-import { mkdir, writeFile, readFile } from 'fs/promises';
-import { dirname } from 'path';
-import { generateKey } from '@libp2p/pnet';
-
-// src/mesh/swarm-key.ts
-var SWARM_KEY_BYTE_LENGTH = 95;
-function createSwarmKey() {
-  const psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);
-  generateKey(psk);
-  return psk;
-}
-function serializeSwarmKey(psk) {
-  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
-    );
-  }
-  return Buffer.from(psk).toString("base64");
-}
-function deserializeSwarmKey(base64Str) {
-  const trimmed = base64Str.trim();
-  const buf = Buffer.from(trimmed, "base64");
-  if (buf.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`
-    );
-  }
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function parseSwarmKey(rawText) {
-  const trimmed = rawText.trim();
-  if (trimmed.startsWith("/key/swarm/psk/")) {
-    const normalized = trimmed.replace(/\r\n/g, "\n").trimEnd();
-    const bytes = new TextEncoder().encode(normalized);
-    if (bytes.length === SWARM_KEY_BYTE_LENGTH) {
-      return bytes;
-    }
-  }
-  return deserializeSwarmKey(trimmed);
-}
-async function saveSwarmKey(psk, filePath) {
-  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
-    );
-  }
-  await mkdir(dirname(filePath), { recursive: true });
-  await writeFile(filePath, psk);
-}
-async function loadSwarmKey(filePath) {
-  const fileBuffer = await readFile(filePath);
-  if (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {
-    return new Uint8Array(
-      fileBuffer.buffer,
-      fileBuffer.byteOffset,
-      fileBuffer.byteLength
-    );
-  }
-  const text = fileBuffer.toString("utf-8");
-  return parseSwarmKey(text);
-}
-
-export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey };
-//# sourceMappingURL=chunk-ZP3VVXOI.js.map
-//# sourceMappingURL=chunk-ZP3VVXOI.js.map

package/dist/chunk-ZP3VVXOI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mesh/swarm-key.ts"],"names":[],"mappings":";;;;;;AAQO,IAAM,qBAAA,GAAwB;AAM9B,SAAS,cAAA,GAA6B;AAC5C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,qBAAqB,CAAA;AAChD,EAAA,WAAA,CAAY,GAAG,CAAA;AACf,EAAA,OAAO,GAAA;AACR;AAKO,SAAS,kBAAkB,GAAA,EAAyB;AAC1D,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,mCAAA,EAAsC,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KACrF;AAAA,EACD;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC1C;AAKO,SAAS,oBAAoB,SAAA,EAA+B;AAClE,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AACzC,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,yCAAA,EAA4C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC3F;AAAA,EACD;AACA,EAAA,OAAO,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,GAAA,CAAI,UAAA,EAAY,IAAI,UAAU,CAAA;AACjE;AAMO,SAAS,cAAc,OAAA,EAA6B;AAC1D,EAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAK;AAE7B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,iBAAiB,CAAA,EAAG;AAC1C,IAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,OAAA,EAAS,IAAI,EAAE,OAAA,EAAQ;AAC1D,IAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AACjD,IAAA,IAAI,KAAA,CAAM,WAAW,qBAAA,EAAuB;AAC3C,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAEA,EAAA,OAAO,oBAAoB,OAAO,CAAA;AACnC;AAKA,eAAsB,YAAA,CACrB,KACA,QAAA,EACgB;AAChB,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,wCAAA,EAA2C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC1F;AAAA,EACD;AACA,EAAA,MAAM,MAAM,OAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,EAAA,MAAM,SAAA,CAAU,UAAU,GAAG,CAAA;AAC9B;AAMA,eAAsB,aAAa,QAAA,EAAuC;AACzE,EAAA,MAAM,UAAA,GAAa,MAAM,QAAA,CAAS,QAAQ,CAAA;AAC1C,EAAA,IAAI,UAAA,CAAW,WAAW,qBAAA,EAAuB;AAChD,IAAA,OAAO,IAAI,UAAA;AAAA,MACV,UAAA,CAAW,MAAA;AAAA,MACX,UAAA,CAAW,UAAA;AAAA,MACX,UAAA,CAAW;AAAA,KACZ;AAAA,EACD;AACA,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA;AACxC,EAAA,OAAO,cAAc,IAAI,CAAA;AAC1B","file":"chunk-ZP3VVXOI.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Buffer } from \"node:buffer\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { generateKey } from \"@libp2p/pnet\";\n\nexport const SWARM_KEY_BYTE_LENGTH = 95;\n\n/**\n * Creates a freshly generated 95-byte Pre-Shared Key (PSK) for libp2p Private Networks (pnet).\n * Follows the canonical format `/key/swarm/psk/1.0.0/\\n/base16/\\n<hex>\\n`.\n */\nexport function createSwarmKey(): Uint8Array {\n\tconst psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);\n\tgenerateKey(psk);\n\treturn psk;\n}\n\n/**\n * Serializes a 95-byte PSK into a Base64 string for safe environment variable passing or JSON config.\n */\nexport function serializeSwarmKey(psk: Uint8Array): string {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\treturn Buffer.from(psk).toString(\"base64\");\n}\n\n/**\n * Deserializes a Base64-encoded string into a 95-byte PSK Uint8Array.\n */\nexport function deserializeSwarmKey(base64Str: string): Uint8Array {\n\tconst trimmed = base64Str.trim();\n\tconst buf = Buffer.from(trimmed, \"base64\");\n\tif (buf.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`,\n\t\t);\n\t}\n\treturn new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);\n}\n\n/**\n * Parses raw text format PSK or Base64 string into a 95-byte PSK Uint8Array.\n * Allows loading either the canonical multiline text (`/key/swarm/psk/1.0.0/...`) or Base64.\n */\nexport function parseSwarmKey(rawText: string): Uint8Array {\n\tconst trimmed = rawText.trim();\n\t// Check if this is canonical raw text format\n\tif (trimmed.startsWith(\"/key/swarm/psk/\")) {\n\t\tconst normalized = trimmed.replace(/\\r\\n/g, \"\\n\").trimEnd();\n\t\tconst bytes = new TextEncoder().encode(normalized);\n\t\tif (bytes.length === SWARM_KEY_BYTE_LENGTH) {\n\t\t\treturn bytes;\n\t\t}\n\t}\n\t// Fallback to Base64 deserialization\n\treturn deserializeSwarmKey(trimmed);\n}\n\n/**\n * Saves a 95-byte Swarm Key to a file on disk (written as canonical text).\n */\nexport async function saveSwarmKey(\n\tpsk: Uint8Array,\n\tfilePath: string,\n): Promise<void> {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\tawait mkdir(dirname(filePath), { recursive: true });\n\tawait writeFile(filePath, psk);\n}\n\n/**\n * Loads a 95-byte Swarm Key from a file on disk.\n * Supports both raw binary/canonical format and Base64-encoded text.\n */\nexport async function loadSwarmKey(filePath: string): Promise<Uint8Array> {\n\tconst fileBuffer = await readFile(filePath);\n\tif (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {\n\t\treturn new Uint8Array(\n\t\t\tfileBuffer.buffer,\n\t\t\tfileBuffer.byteOffset,\n\t\t\tfileBuffer.byteLength,\n\t\t);\n\t}\n\tconst text = fileBuffer.toString(\"utf-8\");\n\treturn parseSwarmKey(text);\n}\n"]}

package/dist/chunk-ZRWNMP5L.js

@@ -1,165 +0,0 @@
-import { deriveLogicImageDigest } from './chunk-IK7CGWAZ.js';
-import { zkVkeyCacheSize, zkVerificationDurationMs, zkProofsByTypeTotal } from './chunk-Q3FKHJ3B.js';
-import { log } from './chunk-K3DGJLUY.js';
-import * as fs from 'fs';
-import { createRequire } from 'module';
-import path from 'path';
-import { fileURLToPath, pathToFileURL } from 'url';
-import { Piscina } from 'piscina';
-
-var __filename$1 = fileURLToPath(import.meta.url);
-var __dirname$1 = path.dirname(__filename$1);
-var LiopVerifier = class _LiopVerifier {
-  // Singleton Worker Pool for heavy ZK verification
-  static zkWorkerPool = null;
-  // Static registry of embedded verification keys for canonical circuits
-  static vkeyRegistry = /* @__PURE__ */ new Map();
-  /**
-   * Registers a verification key for a canonical analytical circuit.
-   */
-  static registerVKey(circuitName, vkeyRaw) {
-    _LiopVerifier.vkeyRegistry.set(circuitName, vkeyRaw);
-    try {
-      zkVkeyCacheSize.set(_LiopVerifier.vkeyRegistry.size);
-    } catch {
-    }
-  }
-  /**
-   * Retrieves a registered verification key by circuit name.
-   */
-  static getRegisteredVKey(circuitName) {
-    return _LiopVerifier.vkeyRegistry.get(circuitName);
-  }
-  getZkPool() {
-    if (!_LiopVerifier.zkWorkerPool) {
-      const isTS = import.meta.url.endsWith(".ts");
-      const workerExt = isTS ? ".ts" : ".js";
-      let execArgv = [];
-      if (isTS) {
-        try {
-          const req = createRequire(import.meta.url);
-          const tsxPkg = req.resolve("tsx/package.json");
-          const absoluteTsx = pathToFileURL(
-            path.join(path.dirname(tsxPkg), "dist", "loader.mjs")
-          ).href;
-          execArgv = ["--import", absoluteTsx];
-        } catch (_e) {
-          execArgv = ["--import", "tsx"];
-        }
-      }
-      const workerPaths = [
-        path.resolve(__dirname$1, `./workers/zk-verifier${workerExt}`),
-        // Flat dist/ (tsup)
-        path.resolve(__dirname$1, `../workers/zk-verifier${workerExt}`)
-        // Original src/
-      ];
-      const workerFilename = workerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];
-      _LiopVerifier.zkWorkerPool = new Piscina({
-        filename: workerFilename,
-        minThreads: 1,
-        maxThreads: 2,
-        // Minimal footprint since verification is fast compared to generation
-        idleTimeout: 3e4,
-        execArgv
-      });
-      _LiopVerifier.zkWorkerPool.run({ action: "warmup" }).catch((err) => {
-        log.debug(
-          `[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`
-        );
-      });
-    }
-    return _LiopVerifier.zkWorkerPool;
-  }
-  /**
-   * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.
-   * Supports both legacy positional arguments and structured options.
-   *
-   * @param logicPayload The raw WASM or JS logic that was sent to the provider.
-   * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).
-   * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM or Groth16.
-   * @param sessionSecretOrOptions Shared secret (Buffer) or structured VerifyZkOptions.
-   * @param expectedOutput Optional expected output value for anti-replay verification.
-   */
-  async verifyZkReceipt(logicPayload, remoteImageIdHex, zkReceipt, sessionSecretOrOptions, expectedOutput) {
-    const pool = this.getZkPool();
-    if (!pool) throw new Error("Worker pool initialization failed");
-    let sessionSecret;
-    let actualExpectedOutput = expectedOutput;
-    let guestImageIdHex;
-    let vkeyRaw;
-    let zkPolicy;
-    if (Buffer.isBuffer(sessionSecretOrOptions)) {
-      sessionSecret = sessionSecretOrOptions;
-    } else if (sessionSecretOrOptions && typeof sessionSecretOrOptions === "object") {
-      sessionSecret = sessionSecretOrOptions.sessionSecret;
-      if (sessionSecretOrOptions.expectedOutput !== void 0) {
-        actualExpectedOutput = sessionSecretOrOptions.expectedOutput;
-      }
-      guestImageIdHex = sessionSecretOrOptions.guestImageIdHex;
-      vkeyRaw = sessionSecretOrOptions.vkeyRaw;
-      zkPolicy = sessionSecretOrOptions.zkPolicy;
-      if (!vkeyRaw && sessionSecretOrOptions.circuitName) {
-        vkeyRaw = _LiopVerifier.getRegisteredVKey(
-          sessionSecretOrOptions.circuitName
-        );
-      }
-    }
-    const startTime = performance.now();
-    const result = await pool.run({
-      action: "verify_receipt",
-      logicPayload: new Uint8Array(logicPayload),
-      remoteImageIdHex,
-      guestImageIdHex,
-      zkReceipt: new Uint8Array(zkReceipt),
-      sessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : void 0,
-      vkeyRaw: vkeyRaw ? new Uint8Array(vkeyRaw) : void 0,
-      expectedOutput: actualExpectedOutput,
-      zkPolicy
-    });
-    const durationMs = performance.now() - startTime;
-    try {
-      zkVerificationDurationMs.observe(
-        {
-          status: result.verified ? "verified" : "failed",
-          proof_type: result.proofType || "unknown"
-        },
-        durationMs
-      );
-      if (result.verified && result.proofType) {
-        zkProofsByTypeTotal.inc({ proof_type: result.proofType });
-      }
-    } catch {
-    }
-    if (result.verified) {
-      log.info(`[LiopVerifier] ${result.message}`);
-      return true;
-    }
-    log.error(`[LiopVerifier] FAILED: ${result.message}`);
-    return false;
-  }
-  /**
-   * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).
-   *
-   * @param attestationReport The COSE-signed attestation document from the hardware.
-   */
-  async verifyTeeAttestation(attestationReport) {
-    if (attestationReport.length === 0) return true;
-    try {
-      log.info("[LiopVerifier] TEE Attestation: Not configured (no-op).");
-      return true;
-    } catch (err) {
-      log.error("[LiopVerifier] TEE Verification Failed:", err);
-      return false;
-    }
-  }
-  /**
-   * Derives the ImageID of a logic payload following the LIOP v1 Standard.
-   */
-  deriveImageId(logicPayload) {
-    return deriveLogicImageDigest(logicPayload);
-  }
-};
-
-export { LiopVerifier };
-//# sourceMappingURL=chunk-ZRWNMP5L.js.map
-//# sourceMappingURL=chunk-ZRWNMP5L.js.map

package/dist/chunk-ZRWNMP5L.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/crypto/verifier.ts"],"names":["__filename","__dirname"],"mappings":";;;;;;;;;AAgBA,IAAMA,YAAA,GAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAChD,IAAMC,WAAA,GAAY,IAAA,CAAK,OAAA,CAAQD,YAAU,CAAA;AAkBlC,IAAM,YAAA,GAAN,MAAM,aAAA,CAAa;AAAA;AAAA,EAEzB,OAAe,YAAA,GAA+B,IAAA;AAAA;AAAA,EAE9C,OAAe,YAAA,mBAAe,IAAI,GAAA,EAAoB;AAAA;AAAA;AAAA;AAAA,EAKtD,OAAc,YAAA,CAAa,WAAA,EAAqB,OAAA,EAAuB;AACtE,IAAA,aAAA,CAAa,YAAA,CAAa,GAAA,CAAI,WAAA,EAAa,OAAO,CAAA;AAClD,IAAA,IAAI;AACH,MAAA,eAAA,CAAgB,GAAA,CAAI,aAAA,CAAa,YAAA,CAAa,IAAI,CAAA;AAAA,IACnD,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAKA,OAAc,kBAAkB,WAAA,EAAyC;AACxE,IAAA,OAAO,aAAA,CAAa,YAAA,CAAa,GAAA,CAAI,WAAW,CAAA;AAAA,EACjD;AAAA,EAEQ,SAAA,GAAY;AACnB,IAAA,IAAI,CAAC,cAAa,YAAA,EAAc;AAC/B,MAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA,CAAY,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAC3C,MAAA,MAAM,SAAA,GAAY,OAAO,KAAA,GAAQ,KAAA;AAEjC,MAAA,IAAI,WAAqB,EAAC;AAC1B,MAAA,IAAI,IAAA,EAAM;AACT,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AACzC,UAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,kBAAkB,CAAA;AAC7C,UAAA,MAAM,WAAA,GAAc,aAAA;AAAA,YACnB,KAAK,IAAA,CAAK,IAAA,CAAK,QAAQ,MAAM,CAAA,EAAG,QAAQ,YAAY;AAAA,WACrD,CAAE,IAAA;AACF,UAAA,QAAA,GAAW,CAAC,YAAY,WAAW,CAAA;AAAA,QACpC,SAAS,EAAA,EAAI;AACZ,UAAA,QAAA,GAAW,CAAC,YAAY,KAAK,CAAA;AAAA,QAC9B;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc;AAAA,QACnB,IAAA,CAAK,OAAA,CAAQC,WAAA,EAAW,CAAA,qBAAA,EAAwB,SAAS,CAAA,CAAE,CAAA;AAAA;AAAA,QAC3D,IAAA,CAAK,OAAA,CAAQA,WAAA,EAAW,CAAA,sBAAA,EAAyB,SAAS,CAAA,CAAE;AAAA;AAAA,OAC7D;AAEA,MAAA,MAAM,cAAA,GACL,WAAA,CAAY,IAAA,CAAK,CAAC,CAAA,KAAS,cAAW,CAAC,CAAC,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA;AAE3D,MAAA,aAAA,CAAa,YAAA,GAAe,IAAI,OAAA,CAAQ;AAAA,QACvC,QAAA,EAAU,cAAA;AAAA,QACV,UAAA,EAAY,CAAA;AAAA,QACZ,UAAA,EAAY,CAAA;AAAA;AAAA,QACZ,WAAA,EAAa,GAAA;AAAA,QACb;AAAA,OACA,CAAA;AAGD,MAAA,aAAA,CAAa,YAAA,CAAa,IAAI,EAAE,MAAA,EAAQ,UAAU,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAClE,QAAA,GAAA,CAAI,KAAA;AAAA,UACH,CAAA,sDAAA,EAAyD,IAAI,OAAO,CAAA;AAAA,SACrE;AAAA,MACD,CAAC,CAAA;AAAA,IACF;AACA,IAAA,OAAO,aAAA,CAAa,YAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAa,eAAA,CACZ,YAAA,EACA,gBAAA,EACA,SAAA,EACA,wBACA,cAAA,EACmB;AACnB,IAAA,MAAM,IAAA,GAAO,KAAK,SAAA,EAAU;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAE9D,IAAA,IAAI,aAAA;AACJ,IAAA,IAAI,oBAAA,GAAgC,cAAA;AACpC,IAAA,IAAI,eAAA;AACJ,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI,QAAA;AAEJ,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,sBAAsB,CAAA,EAAG;AAC5C,MAAA,aAAA,GAAgB,sBAAA;AAAA,IACjB,CAAA,MAAA,IACC,sBAAA,IACA,OAAO,sBAAA,KAA2B,QAAA,EACjC;AACD,MAAA,aAAA,GAAgB,sBAAA,CAAuB,aAAA;AACvC,MAAA,IAAI,sBAAA,CAAuB,mBAAmB,MAAA,EAAW;AACxD,QAAA,oBAAA,GAAuB,sBAAA,CAAuB,cAAA;AAAA,MAC/C;AACA,MAAA,eAAA,GAAkB,sBAAA,CAAuB,eAAA;AACzC,MAAA,OAAA,GAAU,sBAAA,CAAuB,OAAA;AACjC,MAAA,QAAA,GAAW,sBAAA,CAAuB,QAAA;AAElC,MAAA,IAAI,CAAC,OAAA,IAAW,sBAAA,CAAuB,WAAA,EAAa;AACnD,QAAA,OAAA,GAAU,aAAA,CAAa,iBAAA;AAAA,UACtB,sBAAA,CAAuB;AAAA,SACxB;AAAA,MACD;AAAA,IACD;AAEA,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAClC,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,GAAA,CAAI;AAAA,MAC7B,MAAA,EAAQ,gBAAA;AAAA,MACR,YAAA,EAAc,IAAI,UAAA,CAAW,YAAY,CAAA;AAAA,MACzC,gBAAA;AAAA,MACA,eAAA;AAAA,MACA,SAAA,EAAW,IAAI,UAAA,CAAW,SAAS,CAAA;AAAA,MACnC,aAAA,EAAe,aAAA,GAAgB,IAAI,UAAA,CAAW,aAAa,CAAA,GAAI,MAAA;AAAA,MAC/D,OAAA,EAAS,OAAA,GAAU,IAAI,UAAA,CAAW,OAAO,CAAA,GAAI,MAAA;AAAA,MAC7C,cAAA,EAAgB,oBAAA;AAAA,MAChB;AAAA,KACA,CAAA;AACD,IAAA,MAAM,UAAA,GAAa,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AAEvC,IAAA,IAAI;AACH,MAAA,wBAAA,CAAyB,OAAA;AAAA,QACxB;AAAA,UACC,MAAA,EAAQ,MAAA,CAAO,QAAA,GAAW,UAAA,GAAa,QAAA;AAAA,UACvC,UAAA,EAAY,OAAO,SAAA,IAAa;AAAA,SACjC;AAAA,QACA;AAAA,OACD;AACA,MAAA,IAAI,MAAA,CAAO,QAAA,IAAY,MAAA,CAAO,SAAA,EAAW;AACxC,QAAA,mBAAA,CAAoB,GAAA,CAAI,EAAE,UAAA,EAAY,MAAA,CAAO,WAAW,CAAA;AAAA,MACzD;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,IAAI,OAAO,QAAA,EAAU;AACpB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,eAAA,EAAkB,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,uBAAA,EAA0B,MAAA,CAAO,OAAO,CAAA,CAAE,CAAA;AACpD,IAAA,OAAO,KAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAa,qBACZ,iBAAA,EACmB;AACnB,IAAA,IAAI,iBAAA,CAAkB,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAE3C,IAAA,IAAI;AAKH,MAAA,GAAA,CAAI,KAAK,yDAAyD,CAAA;AAClE,MAAA,OAAO,IAAA;AAAA,IACR,SAAS,GAAA,EAAK;AACb,MAAA,GAAA,CAAI,KAAA,CAAM,2CAA2C,GAAG,CAAA;AACxD,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,cAAc,YAAA,EAA8B;AAClD,IAAA,OAAO,uBAAuB,YAAY,CAAA;AAAA,EAC3C;AACD","file":"chunk-ZRWNMP5L.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { Piscina } from \"piscina\";\nimport {\n\tzkProofsByTypeTotal,\n\tzkVerificationDurationMs,\n\tzkVkeyCacheSize,\n} from \"../observability/metrics.js\";\nimport { log } from \"../utils/logger.js\";\nimport { deriveLogicImageDigest } from \"./logic-image-id.js\";\n\nconst __filename = fileURLToPath(import.meta.url);\nconst __dirname = path.dirname(__filename);\n\nexport interface VerifyZkOptions {\n\tsessionSecret?: Buffer;\n\texpectedOutput?: unknown;\n\tguestImageIdHex?: string;\n\tvkeyRaw?: Buffer;\n\tzkPolicy?: import(\"../security/zk.js\").ZkPolicy;\n\tcircuitName?: string;\n}\n\n/**\n * LIOP Tier-0 Industrial Verifier\n *\n * This engine is responsible for the trustless verification of remote logic execution.\n * It validates both the integrity of the code (ZkImageID) and the mathematical proof\n * of its execution (ZkSeal/Groth16), as well as hardware-level attestation (TEE).\n */\nexport class LiopVerifier {\n\t// Singleton Worker Pool for heavy ZK verification\n\tprivate static zkWorkerPool: Piscina | null = null;\n\t// Static registry of embedded verification keys for canonical circuits\n\tprivate static vkeyRegistry = new Map<string, Buffer>();\n\n\t/**\n\t * Registers a verification key for a canonical analytical circuit.\n\t */\n\tpublic static registerVKey(circuitName: string, vkeyRaw: Buffer): void {\n\t\tLiopVerifier.vkeyRegistry.set(circuitName, vkeyRaw);\n\t\ttry {\n\t\t\tzkVkeyCacheSize.set(LiopVerifier.vkeyRegistry.size);\n\t\t} catch {}\n\t}\n\n\t/**\n\t * Retrieves a registered verification key by circuit name.\n\t */\n\tpublic static getRegisteredVKey(circuitName: string): Buffer | undefined {\n\t\treturn LiopVerifier.vkeyRegistry.get(circuitName);\n\t}\n\n\tprivate getZkPool() {\n\t\tif (!LiopVerifier.zkWorkerPool) {\n\t\t\tconst isTS = import.meta.url.endsWith(\".ts\");\n\t\t\tconst workerExt = isTS ? \".ts\" : \".js\";\n\n\t\t\tlet execArgv: string[] = [];\n\t\t\tif (isTS) {\n\t\t\t\ttry {\n\t\t\t\t\tconst req = createRequire(import.meta.url);\n\t\t\t\t\tconst tsxPkg = req.resolve(\"tsx/package.json\");\n\t\t\t\t\tconst absoluteTsx = pathToFileURL(\n\t\t\t\t\t\tpath.join(path.dirname(tsxPkg), \"dist\", \"loader.mjs\"),\n\t\t\t\t\t).href;\n\t\t\t\t\texecArgv = [\"--import\", absoluteTsx];\n\t\t\t\t} catch (_e) {\n\t\t\t\t\texecArgv = [\"--import\", \"tsx\"];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Support both flat dist/ and original src/ structure\n\t\t\tconst workerPaths = [\n\t\t\t\tpath.resolve(__dirname, `./workers/zk-verifier${workerExt}`), // Flat dist/ (tsup)\n\t\t\t\tpath.resolve(__dirname, `../workers/zk-verifier${workerExt}`), // Original src/\n\t\t\t];\n\n\t\t\tconst workerFilename =\n\t\t\t\tworkerPaths.find((p) => fs.existsSync(p)) || workerPaths[1];\n\n\t\t\tLiopVerifier.zkWorkerPool = new Piscina({\n\t\t\t\tfilename: workerFilename,\n\t\t\t\tminThreads: 1,\n\t\t\t\tmaxThreads: 2, // Minimal footprint since verification is fast compared to generation\n\t\t\t\tidleTimeout: 30000,\n\t\t\t\texecArgv,\n\t\t\t});\n\n\t\t\t// Pre-warm the verification worker\n\t\t\tLiopVerifier.zkWorkerPool.run({ action: \"warmup\" }).catch((err) => {\n\t\t\t\tlog.debug(\n\t\t\t\t\t`[LiopVerifier] Verification pool warm-up ping failed: ${err.message}`,\n\t\t\t\t);\n\t\t\t});\n\t\t}\n\t\treturn LiopVerifier.zkWorkerPool;\n\t}\n\n\t/**\n\t * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.\n\t * Supports both legacy positional arguments and structured options.\n\t *\n\t * @param logicPayload The raw WASM or JS logic that was sent to the provider.\n\t * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).\n\t * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM or Groth16.\n\t * @param sessionSecretOrOptions Shared secret (Buffer) or structured VerifyZkOptions.\n\t * @param expectedOutput Optional expected output value for anti-replay verification.\n\t */\n\tpublic async verifyZkReceipt(\n\t\tlogicPayload: Buffer,\n\t\tremoteImageIdHex: string,\n\t\tzkReceipt: Buffer,\n\t\tsessionSecretOrOptions?: Buffer | VerifyZkOptions,\n\t\texpectedOutput?: unknown,\n\t): Promise<boolean> {\n\t\tconst pool = this.getZkPool();\n\t\tif (!pool) throw new Error(\"Worker pool initialization failed\");\n\n\t\tlet sessionSecret: Buffer | undefined;\n\t\tlet actualExpectedOutput: unknown = expectedOutput;\n\t\tlet guestImageIdHex: string | undefined;\n\t\tlet vkeyRaw: Buffer | undefined;\n\t\tlet zkPolicy: import(\"../security/zk.js\").ZkPolicy | undefined;\n\n\t\tif (Buffer.isBuffer(sessionSecretOrOptions)) {\n\t\t\tsessionSecret = sessionSecretOrOptions;\n\t\t} else if (\n\t\t\tsessionSecretOrOptions &&\n\t\t\ttypeof sessionSecretOrOptions === \"object\"\n\t\t) {\n\t\t\tsessionSecret = sessionSecretOrOptions.sessionSecret;\n\t\t\tif (sessionSecretOrOptions.expectedOutput !== undefined) {\n\t\t\t\tactualExpectedOutput = sessionSecretOrOptions.expectedOutput;\n\t\t\t}\n\t\t\tguestImageIdHex = sessionSecretOrOptions.guestImageIdHex;\n\t\t\tvkeyRaw = sessionSecretOrOptions.vkeyRaw;\n\t\t\tzkPolicy = sessionSecretOrOptions.zkPolicy;\n\n\t\t\tif (!vkeyRaw && sessionSecretOrOptions.circuitName) {\n\t\t\t\tvkeyRaw = LiopVerifier.getRegisteredVKey(\n\t\t\t\t\tsessionSecretOrOptions.circuitName,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tconst startTime = performance.now();\n\t\tconst result = await pool.run({\n\t\t\taction: \"verify_receipt\",\n\t\t\tlogicPayload: new Uint8Array(logicPayload),\n\t\t\tremoteImageIdHex,\n\t\t\tguestImageIdHex,\n\t\t\tzkReceipt: new Uint8Array(zkReceipt),\n\t\t\tsessionSecret: sessionSecret ? new Uint8Array(sessionSecret) : undefined,\n\t\t\tvkeyRaw: vkeyRaw ? new Uint8Array(vkeyRaw) : undefined,\n\t\t\texpectedOutput: actualExpectedOutput,\n\t\t\tzkPolicy,\n\t\t});\n\t\tconst durationMs = performance.now() - startTime;\n\n\t\ttry {\n\t\t\tzkVerificationDurationMs.observe(\n\t\t\t\t{\n\t\t\t\t\tstatus: result.verified ? \"verified\" : \"failed\",\n\t\t\t\t\tproof_type: result.proofType || \"unknown\",\n\t\t\t\t},\n\t\t\t\tdurationMs,\n\t\t\t);\n\t\t\tif (result.verified && result.proofType) {\n\t\t\t\tzkProofsByTypeTotal.inc({ proof_type: result.proofType });\n\t\t\t}\n\t\t} catch {\n\t\t\t// Metrics observation failure must never disrupt cryptographic verification\n\t\t}\n\n\t\tif (result.verified) {\n\t\t\tlog.info(`[LiopVerifier] ${result.message}`);\n\t\t\treturn true;\n\t\t}\n\n\t\tlog.error(`[LiopVerifier] FAILED: ${result.message}`);\n\t\treturn false;\n\t}\n\n\t/**\n\t * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).\n\t *\n\t * @param attestationReport The COSE-signed attestation document from the hardware.\n\t */\n\tpublic async verifyTeeAttestation(\n\t\tattestationReport: Buffer,\n\t): Promise<boolean> {\n\t\tif (attestationReport.length === 0) return true; // Optional in Mesh Alpha\n\n\t\ttry {\n\t\t\t// Architecture for AWS Nitro Enclaves:\n\t\t\t// 1. Decode CBOR/COSE\n\t\t\t// 2. Verify Signature against AWS Nitro Root CA\n\t\t\t// 3. Compare PCRs\n\t\t\tlog.info(\"[LiopVerifier] TEE Attestation: Not configured (no-op).\");\n\t\t\treturn true;\n\t\t} catch (err) {\n\t\t\tlog.error(\"[LiopVerifier] TEE Verification Failed:\", err);\n\t\t\treturn false;\n\t\t}\n\t}\n\n\t/**\n\t * Derives the ImageID of a logic payload following the LIOP v1 Standard.\n\t */\n\tpublic deriveImageId(logicPayload: Buffer): Buffer {\n\t\treturn deriveLogicImageDigest(logicPayload);\n\t}\n}\n"]}

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"client.js"}

package/dist/gateway.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"gateway.js"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/errors.ts","../src/observability/tracing.ts","../src/prompts/adapters.ts","../src/security/cert-manager.ts"],"names":["ErrorCode","crypto2"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;ACQA,IAAM,iBAAA,GACL,6DAAA;AAEM,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAc,eAAA,GAA0B;AACvC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC3C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,cAAA,GAAyB;AACtC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC1C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,MAAA,EACA,UAAU,IAAA,EACD;AACT,IAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,GAAO,IAAA;AAC/B,IAAA,OAAO,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,EAAI,MAAM,IAAI,KAAK,CAAA,CAAA;AAAA,EACxC;AAAA,EAEA,OAAc,iBAAiB,MAAA,EAA4C;AAC1E,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,MAAA,OAAO,IAAA;AAAA,IACR;AACA,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,GAAG,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,GAAI,KAAA;AAE5C,IAAA,IAAI,YAAY,IAAA,EAAM;AACrB,MAAA,IAAI,OAAA,KAAY,IAAI,MAAA,CAAO,EAAE,KAAK,MAAA,KAAW,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AAC5D,QAAA,OAAO,IAAA;AAAA,MACR;AAAA,IACD;AAEA,IAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,IAAI,CAAA,MAAU,CAAA;AACxD,IAAA,OAAO;AAAA,MACN,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,OAAA,EACO;AACP,IAAA,OAAA,CAAQ,cAAc,WAAA,CAAW,iBAAA;AAAA,MAChC,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACT;AAAA,EACD;AAAA,EAEA,OAAc,mBACb,OAAA,EACqB;AACrB,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,WAAA,CAAW,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,WAAA,CAAW,iBAAiB,GAAG,CAAA;AAAA,EACvC;AAAA,EAEO,SAAA,CACN,IAAA,EACA,MAAA,EACA,UAAA,GAAwD,EAAC,EAC9C;AACX,IAAA,MAAM,OAAA,GAAU,MAAA,EAAQ,OAAA,IAAW,WAAA,CAAW,eAAA,EAAgB;AAC9D,IAAA,MAAM,MAAA,GAAS,YAAW,cAAA,EAAe;AACzC,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,MAAA,CAAO,OAAA,GAAU,IAAA;AAE1C,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC5B,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,MAAM,IAAA,GAAiB;AAAA,MACtB,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,MACpB,UAAA,EAAY,EAAE,GAAG,UAAA,EAAW;AAAA,MAC5B,MAAA,EAAQ,IAAA;AAAA,MACR,YAAA,CAAa,KAAK,KAAA,EAAO;AACxB,QAAA,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,gBAAgB,GAAA,EAAK;AACpB,QAAA,IAAA,CAAK,MAAA,GAAS,OAAA;AACd,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAO,GAAA,KAAQ,QAAA,GAAW,MAAM,GAAA,CAAI,OAAA;AACjD,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,GAAA,GAAM;AACL,QAAA,IAAA,CAAK,OAAA,GAAU,KAAK,GAAA,EAAI;AAAA,MACzB;AAAA,KACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAEO,IAAM,aAAA,GAAgB,IAAI,UAAA;;;AChIjC,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR;ACrCO,IAAM,WAAA,GAAN,cAA0B,YAAA,CAAa;AAAA,EAS7C,YAA6B,OAAA,EAA6B;AACzD,IAAA,KAAA,EAAM;AADsB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAE5B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,EAAA;AAC1C,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,GAAA;AACxC,IAAA,IAAA,CAAK,gBAAA,EAAiB;AAEtB,IAAA,IAAI,OAAA,CAAQ,eAAe,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,aAAA,EAAc;AAAA,IACpB;AAAA,EACD;AAAA,EAT6B,OAAA;AAAA,EARrB,cAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAiC,IAAA;AAAA,EACjC,gBAAA,GAAkC,IAAA;AAAA,EAClC,WAA2B,EAAC;AAAA,EAC5B,mBAAA,GAA6C,IAAA;AAAA,EACpC,WAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA,EAgBV,gBAAA,GAAyB;AAC/B,IAAA,IAAI;AACH,MAAA,IACC,KAAK,OAAA,CAAQ,YAAA,IACV,cAAW,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA,EACtC;AACD,QAAA,IAAA,CAAK,cAAA,GAAoB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA;AAAA,MAChE;AAEA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC/C,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kCAAA,EAAqC,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAAA,SAChE;AAAA,MACD;AACA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAAA,SAC3D;AAAA,MACD;AAEA,MAAA,IAAA,CAAK,eAAA,GAAqB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AACjE,MAAA,IAAA,CAAK,gBAAA,GAAsB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAEnE,MAAA,GAAA,CAAI,KAAK,iDAAiD,CAAA;AAAA,IAC3D,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,KAAA;AAAA,IACP;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAA,GAA+B;AACrC,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,IAAA,GAAO,IAAWC,MAAA,CAAA,eAAA,CAAgB,IAAA,CAAK,eAAe,CAAA;AAC5D,IAAA,MAAM,WAAA,GAAc,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,MAAM,WAAA,GAAc,WAAA,CAAY,OAAA,EAAQ,GAAI,IAAI,OAAA,EAAQ;AACxD,IAAA,MAAM,gBAAgB,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA;AAAA,MACA,KAAK,KAAA,CAAM,WAAA,IAAe,GAAA,GAAO,EAAA,GAAK,KAAK,EAAA,CAAG;AAAA,KAC/C;AACA,IAAA,MAAM,YAAY,WAAA,IAAe,CAAA;AACjC,IAAA,MAAM,cAAA,GAAiB,iBAAiB,IAAA,CAAK,WAAA;AAE7C,IAAA,OAAO;AAAA,MACN,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,aAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC7B,IAAA,MAAM,YAAA,GAAe;AAAA,MACpB,KAAK,OAAA,CAAQ,aAAA;AAAA,MACb,KAAK,OAAA,CAAQ,cAAA;AAAA,MACb,KAAK,OAAA,CAAQ;AAAA,KACd,CAAE,OAAO,CAAC,CAAA,KAAmB,QAAQ,CAAA,IAAQ,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AAE3D,IAAA,KAAA,MAAW,YAAY,YAAA,EAAc;AACpC,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAa,EAAA,CAAA,KAAA,CAAM,QAAA,EAAU,MAAM;AACxC,UAAA,IAAA,CAAK,cAAA,EAAe;AAAA,QACrB,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,MAC3B,SAAS,GAAA,EAAK;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,8BAAA,EAAiC,QAAQ,CAAA,oBAAA,EAAuB,GAAG,CAAA;AAAA,SACpE;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAA,GAAuB;AAC9B,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AAAA,IACtC;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,WAAW,MAAM;AAC3C,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,QAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,SACpF;AACA,QAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACf,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAE,CAAA;AACrD,QAAA,IAAA,CAAK,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,MACzB;AAAA,IACD,CAAA,EAAG,KAAK,UAAU,CAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKO,MAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,KACpF;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAC5B,IAAA,OAAO,QAAA;AAAA,EACR;AAAA,EAEO,WAAA,GAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC9D;AACA,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACb;AAAA,EAEO,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC3B,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACxD;AACA,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AACrC,MAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA;AAAA,IAC5B;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACpC,MAAA,IAAI;AACH,QAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,MACf,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AACA,IAAA,IAAA,CAAK,WAAW,EAAC;AACjB,IAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,EACzB;AACD","file":"index.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)\n * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.\n * Spec: https://www.w3.org/TR/trace-context/\n */\n\nimport * as crypto from \"node:crypto\";\n\nexport interface SpanContext {\n\ttraceId: string;\n\tspanId: string;\n\tsampled: boolean;\n}\n\nexport interface LiopSpan {\n\treadonly name: string;\n\treadonly context: SpanContext;\n\treadonly startTime: number;\n\tendTime?: number;\n\tattributes: Record<string, string | number | boolean>;\n\tstatus: \"OK\" | \"ERROR\";\n\terror?: string;\n\tsetAttribute(key: string, value: string | number | boolean): LiopSpan;\n\trecordException(error: Error | string): LiopSpan;\n\tend(): void;\n}\n\nconst TRACEPARENT_REGEX =\n\t/^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;\n\nexport class LiopTracer {\n\tpublic static generateTraceId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(16).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(32));\n\t\treturn id;\n\t}\n\n\tpublic static generateSpanId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(8).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(16));\n\t\treturn id;\n\t}\n\n\tpublic static formatTraceparent(\n\t\ttraceId: string,\n\t\tspanId: string,\n\t\tsampled = true,\n\t): string {\n\t\tconst flags = sampled ? \"01\" : \"00\";\n\t\treturn `00-${traceId}-${spanId}-${flags}`;\n\t}\n\n\tpublic static parseTraceparent(header?: string | null): SpanContext | null {\n\t\tif (!header || typeof header !== \"string\") {\n\t\t\treturn null;\n\t\t}\n\t\tconst trimmed = header.trim();\n\t\tconst match = TRACEPARENT_REGEX.exec(trimmed);\n\t\tif (!match) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst [, version, traceId, spanId, flags] = match;\n\t\t// Version 00 cannot have all-zeros traceId or spanId\n\t\tif (version === \"00\") {\n\t\t\tif (traceId === \"0\".repeat(32) || spanId === \"0\".repeat(16)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t}\n\n\t\tconst sampled = (Number.parseInt(flags, 16) & 0x01) === 1;\n\t\treturn {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\t}\n\n\tpublic static injectTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t\tcontext: SpanContext,\n\t): void {\n\t\tcarrier.traceparent = LiopTracer.formatTraceparent(\n\t\t\tcontext.traceId,\n\t\t\tcontext.spanId,\n\t\t\tcontext.sampled,\n\t\t);\n\t}\n\n\tpublic static extractTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t): SpanContext | null {\n\t\tconst val = carrier.traceparent || carrier.Traceparent;\n\t\tif (Array.isArray(val)) {\n\t\t\treturn LiopTracer.parseTraceparent(val[0]);\n\t\t}\n\t\treturn LiopTracer.parseTraceparent(val);\n\t}\n\n\tpublic startSpan(\n\t\tname: string,\n\t\tparent?: SpanContext | null,\n\t\tattributes: Record<string, string | number | boolean> = {},\n\t): LiopSpan {\n\t\tconst traceId = parent?.traceId || LiopTracer.generateTraceId();\n\t\tconst spanId = LiopTracer.generateSpanId();\n\t\tconst sampled = parent ? parent.sampled : true;\n\n\t\tconst context: SpanContext = {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\n\t\tconst span: LiopSpan = {\n\t\t\tname,\n\t\t\tcontext,\n\t\t\tstartTime: Date.now(),\n\t\t\tattributes: { ...attributes },\n\t\t\tstatus: \"OK\",\n\t\t\tsetAttribute(key, value) {\n\t\t\t\tthis.attributes[key] = value;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\trecordException(err) {\n\t\t\t\tthis.status = \"ERROR\";\n\t\t\t\tthis.error = typeof err === \"string\" ? err : err.message;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\tend() {\n\t\t\t\tthis.endTime = Date.now();\n\t\t\t},\n\t\t};\n\n\t\treturn span;\n\t}\n}\n\nexport const defaultTracer = new LiopTracer();\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Certificate Manager (CertManager)\n * Provides automated certificate monitoring, X.509 validity inspection,\n * and hot-reloading for mutual TLS (mTLS) without node restarts.\n *\n * Compliance:\n * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS\n * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification\n */\n\nimport * as crypto from \"node:crypto\";\nimport { EventEmitter } from \"node:events\";\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface CertManagerOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCertPath?: string;\n\t/** Path to the server/client certificate chain (PEM format) */\n\tcertChainPath: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKeyPath: string;\n\t/** Expiration warning threshold in days (default: 30) */\n\twarningDays?: number;\n\t/** Enable file watching for automatic hot-reloading (default: true) */\n\twatchFiles?: boolean;\n\t/** Debounce delay in ms for hot reloading (default: 150) */\n\tdebounceMs?: number;\n}\n\nexport interface CertInfo {\n\tsubject: string;\n\tissuer: string;\n\tvalidFrom: string;\n\tvalidTo: string;\n\tfingerprint256: string;\n\tdaysRemaining: number;\n\tisExpired: boolean;\n\tisExpiringSoon: boolean;\n}\n\nexport class CertManager extends EventEmitter {\n\tprivate rootCertBuffer: Buffer | null = null;\n\tprivate certChainBuffer: Buffer | null = null;\n\tprivate privateKeyBuffer: Buffer | null = null;\n\tprivate watchers: fs.FSWatcher[] = [];\n\tprivate reloadDebounceTimer: NodeJS.Timeout | null = null;\n\tprivate readonly warningDays: number;\n\tprivate readonly debounceMs: number;\n\n\tconstructor(private readonly options: CertManagerOptions) {\n\t\tsuper();\n\t\tthis.warningDays = options.warningDays ?? 30;\n\t\tthis.debounceMs = options.debounceMs ?? 150;\n\t\tthis.loadCertificates();\n\n\t\tif (options.watchFiles !== false) {\n\t\t\tthis.setupWatchers();\n\t\t}\n\t}\n\n\t/**\n\t * Synchronously loads or reloads certificates from filesystem into memory.\n\t */\n\tpublic loadCertificates(): void {\n\t\ttry {\n\t\t\tif (\n\t\t\t\tthis.options.rootCertPath &&\n\t\t\t\tfs.existsSync(this.options.rootCertPath)\n\t\t\t) {\n\t\t\t\tthis.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);\n\t\t\t}\n\n\t\t\tif (!fs.existsSync(this.options.certChainPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Certificate chain file not found: ${this.options.certChainPath}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!fs.existsSync(this.options.privateKeyPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Private key file not found: ${this.options.privateKeyPath}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tthis.certChainBuffer = fs.readFileSync(this.options.certChainPath);\n\t\t\tthis.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);\n\n\t\t\tlog.info(\"[CertManager] Certificates loaded successfully.\");\n\t\t} catch (error) {\n\t\t\tlog.error(`[CertManager] Failed to load certificates: ${error}`);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.\n\t */\n\tpublic inspectCertificate(): CertInfo {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] No certificate loaded to inspect.\");\n\t\t}\n\n\t\tconst x509 = new crypto.X509Certificate(this.certChainBuffer);\n\t\tconst validToDate = new Date(x509.validTo);\n\t\tconst now = new Date();\n\t\tconst msRemaining = validToDate.getTime() - now.getTime();\n\t\tconst daysRemaining = Math.max(\n\t\t\t0,\n\t\t\tMath.floor(msRemaining / (1000 * 60 * 60 * 24)),\n\t\t);\n\t\tconst isExpired = msRemaining <= 0;\n\t\tconst isExpiringSoon = daysRemaining <= this.warningDays;\n\n\t\treturn {\n\t\t\tsubject: x509.subject,\n\t\t\tissuer: x509.issuer,\n\t\t\tvalidFrom: x509.validFrom,\n\t\t\tvalidTo: x509.validTo,\n\t\t\tfingerprint256: x509.fingerprint256,\n\t\t\tdaysRemaining,\n\t\t\tisExpired,\n\t\t\tisExpiringSoon,\n\t\t};\n\t}\n\n\t/**\n\t * Sets up non-blocking filesystem watchers to detect certificate renewals\n\t * and trigger hot-reloading without process restarts.\n\t */\n\tprivate setupWatchers(): void {\n\t\tconst filesToWatch = [\n\t\t\tthis.options.certChainPath,\n\t\t\tthis.options.privateKeyPath,\n\t\t\tthis.options.rootCertPath,\n\t\t].filter((p): p is string => Boolean(p && fs.existsSync(p)));\n\n\t\tfor (const filePath of filesToWatch) {\n\t\t\ttry {\n\t\t\t\tconst watcher = fs.watch(filePath, () => {\n\t\t\t\t\tthis.scheduleReload();\n\t\t\t\t});\n\t\t\t\tthis.watchers.push(watcher);\n\t\t\t} catch (err) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[CertManager] Could not watch ${filePath} for hot reloading: ${err}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Debounces reload events to ensure files have finished writing.\n\t */\n\tprivate scheduleReload(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t}\n\n\t\tthis.reloadDebounceTimer = setTimeout(() => {\n\t\t\ttry {\n\t\t\t\tthis.loadCertificates();\n\t\t\t\tconst certInfo = this.inspectCertificate();\n\t\t\t\tlog.info(\n\t\t\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t\t\t);\n\t\t\t\tthis.emit(\"reload\", certInfo);\n\t\t\t} catch (error) {\n\t\t\t\tlog.error(`[CertManager] Hot reload failed: ${error}`);\n\t\t\t\tthis.emit(\"error\", error);\n\t\t\t}\n\t\t}, this.debounceMs);\n\t}\n\n\t/**\n\t * Manually triggers a reload of certificates and emits the 'reload' event.\n\t */\n\tpublic reload(): CertInfo {\n\t\tthis.loadCertificates();\n\t\tconst certInfo = this.inspectCertificate();\n\t\tlog.info(\n\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t);\n\t\tthis.emit(\"reload\", certInfo);\n\t\treturn certInfo;\n\t}\n\n\tpublic getRootCert(): Buffer | null {\n\t\treturn this.rootCertBuffer;\n\t}\n\n\tpublic getCertChain(): Buffer {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Certificate chain not loaded.\");\n\t\t}\n\t\treturn this.certChainBuffer;\n\t}\n\n\tpublic getPrivateKey(): Buffer {\n\t\tif (!this.privateKeyBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Private key not loaded.\");\n\t\t}\n\t\treturn this.privateKeyBuffer;\n\t}\n\n\t/**\n\t * Stops all active file watchers and releases resources.\n\t */\n\tpublic dispose(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t\tthis.reloadDebounceTimer = null;\n\t\t}\n\t\tfor (const watcher of this.watchers) {\n\t\t\ttry {\n\t\t\t\twatcher.close();\n\t\t\t} catch {\n\t\t\t\t// Ignore watcher close errors\n\t\t\t}\n\t\t}\n\t\tthis.watchers = [];\n\t\tthis.removeAllListeners();\n\t}\n}\n"]}

package/dist/kyber-CGOA7Q6A.js

@@ -1,3 +0,0 @@
-export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-//# sourceMappingURL=kyber-CGOA7Q6A.js.map
-//# sourceMappingURL=kyber-CGOA7Q6A.js.map

package/dist/kyber-CGOA7Q6A.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"kyber-CGOA7Q6A.js"}

package/dist/mesh.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"mesh.js"}

package/dist/server.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"server.js"}

package/dist/types.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"types.js"}

package/dist/verifier-UBJTZQSA.js

@@ -1,6 +0,0 @@
-export { LiopVerifier } from './chunk-ZRWNMP5L.js';
-import './chunk-IK7CGWAZ.js';
-import './chunk-Q3FKHJ3B.js';
-import './chunk-K3DGJLUY.js';
-//# sourceMappingURL=verifier-UBJTZQSA.js.map
-//# sourceMappingURL=verifier-UBJTZQSA.js.map

package/dist/verifier-UBJTZQSA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-UBJTZQSA.js"}

package/dist/workers/logic-execution.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/security/dp-engine.ts","../../src/workers/logic-execution.ts"],"names":["crypto","receiptBuf","zkReceipt"],"mappings":";;;;;;;;AAwDA,IAAM,iBAAA,GAA8B;AAAA,EACnC,OAAA,EAAS,CAAA;AAAA,EACT,WAAA,EAAa,CAAA;AAAA,EACb,qBAAA,EAAuB;AACxB,CAAA;AAOA,IAAM,aAAA,GAAgB,CAAA;AACtB,IAAM,uBAAA,GAA0B,EAAA;AAyBhC,SAAS,aAAA,CAAc,OAAe,SAAA,EAA+B;AACpE,EAAA,IAAI,CAAA;AACJ,EAAA,GAAG;AACF,IAAA,IAAI,SAAA,EAAW;AACd,MAAA,MAAM,IAAA,GAAOA,OAAA,CACX,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,CAAA,EAAG,SAAA,CAAU,IAAI,CAAA,CAAA,EAAI,SAAA,CAAU,OAAA,EAAS,CAAA,CAAE,EACjD,MAAA,EAAO;AAET,MAAA,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,CAAC,CAAA,GAAI,UAAA,GAAc,GAAA;AAAA,IAC1C,CAAA,MAAO;AACN,MAAA,MAAM,GAAA,GAAMA,OAAA,CAAO,WAAA,CAAY,CAAC,CAAA;AAEhC,MAAA,MAAM,MAAA,GAAU,GAAA,CAAI,CAAC,CAAA,IAAK,KAAO,GAAA,CAAI,CAAC,CAAA,IAAK,EAAA,GAAO,GAAA,CAAI,CAAC,CAAA,IAAK,CAAA,GAAK,IAAI,CAAC,CAAA;AAEtE,MAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,OAAO,QAAA,CAAS,EAAE,GAAG,EAAE,CAAA;AAExD,MAAA,CAAA,GAAI,QAAA,GAAW,UAAA;AAAA,IAChB;AAAA,EACD,CAAA,QAAS,CAAA,KAAM,CAAA,IAAK,CAAA,KAAM,IAAA;AAC1B,EAAA,OAAO,CAAC,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AAC5D;AAUO,SAAS,eAAA,CACf,KAAA,EACA,MAAA,GAA4B,IAC5B,SAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,iBAAA,EAAmB,GAAG,MAAA,EAAO;AACjD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,WAAA,GAAc,MAAA,CAAO,OAAA;AAC1C,EAAA,MAAM,UAAA,GAAa,KAAA,GAAQ,aAAA,CAAc,KAAA,EAAO,SAAS,CAAA;AAGzD,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,GAAK,CAAA,GAAI,GAAA;AACzC;AAmBA,SAAS,sBAAA,CACR,GAAA,EACA,iBAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,iBAAA;AAEjB,EAAA,MAAM,EAAA,GAAK,IAAI,WAAA,EAAY;AAO3B,EAAA,MAAM,cACL,+HAAA,CAAgI,IAAA;AAAA,IAC/H;AAAA,GACD;AACD,EAAA,MAAM,YAAA,GACL,OAAO,OAAA,IACP,EAAA,KAAO,OACP,EAAA,KAAO,eAAA,IACP,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA;AAAA,EACtB,EAAA,CAAG,WAAW,MAAM,CAAA;AAAA,EACpB,oDAAA,CAAqD,KAAK,EAAE,CAAA;AAC7D,EAAA,IAAI,WAAA,IAAe,cAAc,OAAO,CAAA;AAGxC,EAAA,IACC,iFAAA,CAAkF,IAAA;AAAA,IACjF;AAAA,GACD,IACA,cAAc,CAAA,EACb;AACD,IAAA,OAAO,iBAAA,GAAoB,WAAA;AAAA,EAC5B;AAGA,EAAA,OAAO,iBAAA;AACR;AAkBO,SAAS,eAAA,CACf,MAAA,EACA,MAAA,GAA4B,IAC5B,WAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,iBAAA,EAAmB,GAAG,MAAA,EAAO;AAGjD,EAAA,IAAI,WAAA,IAAe,OAAO,qBAAA,EAAuB;AAChD,IAAA,OAAO,MAAA;AAAA,EACR;AAMA,EAAA,IAAI,WAAA,GAAc,uBAAA,IAA2B,MAAA,CAAO,OAAA,GAAU,aAAA,EAAe;AAC5E,IAAA,MAAA,CAAO,OAAA,GAAU,aAAA;AAAA,EAClB;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,OAAO,IAAA,EAAM;AAChB,IAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA,EAAE;AAAA,EAC7C;AAEA,EAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,MAAA,EAAQ,WAAA,EAAa,QAAW,SAAS,CAAA;AACtE;AASA,SAAS,YAAA,CACR,IAAA,EACA,MAAA,EACA,WAAA,EACA,YACA,SAAA,EACU;AACV,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAEtD,IAAA,MAAM,gBAAA,GAAmB,sBAAA;AAAA,MACxB,UAAA;AAAA,MACA,MAAA,CAAO,WAAA;AAAA,MACP;AAAA,KACD;AACA,IAAA,IAAI,UAAA,GAAa,eAAA;AAAA,MAChB,IAAA;AAAA,MACA;AAAA,QACC,GAAG,MAAA;AAAA,QACH,WAAA,EAAa;AAAA,OACd;AAAA,MACA;AAAA,KACD;AAIA,IAAA,MAAM,UAAA,GACL,cAAc,IAAA,IACd,sBAAA,CAAuB,YAAY,MAAA,CAAO,WAAA,EAAa,WAAW,CAAA,KAAM,CAAA;AAIzE,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,IAAK,UAAA,EAAY;AACzC,MAAA,UAAA,GAAa,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,IACnC;AAIA,IAAA,IAAI,QAAQ,CAAA,EAAG;AACd,MAAA,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,UAAU,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,UAAA;AAAA,EACR;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAExB,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,MAAI,CAAC,IAAA,KAChB,YAAA,CAAa,MAAM,MAAA,EAAQ,WAAA,EAAa,YAAY,SAAS;AAAA,KAC9D;AAAA,EACD;AAEA,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC9C,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,MACjC;AAAA,KACD,EAAG;AACF,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,YAAA,CAAa,OAAO,MAAA,EAAQ,WAAA,EAAa,KAAK,SAAS,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AAGA,EAAA,OAAO,IAAA;AACR;;;AChRA,eAAO,sBAA6C,IAAA,EAOjD;AAEF,EAAA,IACC,OAAO,OAAO,SAAA,KAAc,QAAA,IAC5B,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAChC;AACD,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAC7B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,IAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,IAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AAClB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,EAAA;AAAA,MACV,MAAA,EAAQ,MAAA;AAAA,MACR,aAAA,EAAe;AAAA,KAChB;AAAA,EACD;AAGA,EAAA,IAAI,IAAA,CAAK,qBAAqB,MAAA,EAAW;AACxC,IAAA,MAAM,8BAA8B,IAAA,GAAO,GAAA;AAC3C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,gBAAA;AAC9B,IAAA,IAAI,MAAM,2BAAA,EAA6B;AACtC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,wCAAA,EAA2C,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,GAAI,CAAC,CAAA,2BAAA;AAAA,OAClE;AAAA,IACD;AACA,IAAA,IAAI,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,GAAA,KAAQ,GAAA,EAAO;AAC/C,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAAA,EACD;AAEA,EAAA,MAAM;AAAA,IACL,UAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA,GAAc,IAAA;AAAA,IACd;AAAA,GACD,GAAI,IAAA;AAEJ,EAAA,IAAI,gBAAA;AACJ,EAAA,MAAM,kBAA2C,EAAC;AAClD,EAAA,IAAI,aAAA,GAAgB,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA;AAEnC,EAAA,IAAI,WAAA,EAAa;AAEhB,IAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,YAAY,CAAA;AACtC,IAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,UAAU,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,MAAM,YAAA,GAAe,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA;AACvC,IAAA,aAAA,GAAgB,MAAA;AAIhB,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AACzC,IAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,GAAG,CAAA;AACvC,IAAA,MAAM,aAAA,GAAgB,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAEhD,IAAA,MAAM,WAAWA,OAAAA,CAAO,gBAAA;AAAA,MACvB,aAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAO,IAAA,CAAK,QAAA,IAAY,IAAI,UAAA,CAAW,EAAE,CAAC;AAAA,KAC3C;AACA,IAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,IAAA,IAAI,SAAA,GAAY,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA;AAC7C,IAAA,SAAA,GAAY,OAAO,MAAA,CAAO,CAAC,WAAW,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACvD,IAAA,gBAAA,GAAmB,SAAA;AAGnB,IAAA,KAAA,MAAW,CAAC,KAAK,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,IAAU,EAAE,CAAA,EAAG;AAC3D,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAEtC,MAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA;AAC3C,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA;AACrC,MAAA,MAAM,OAAA,GAAU,SAAA,CAAU,QAAA,CAAS,EAAA,EAAI,GAAG,CAAA;AAE1C,MAAA,MAAM,cAAcA,OAAAA,CAAO,gBAAA;AAAA,QAC1B,aAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,WAAA,CAAY,WAAW,MAAM,CAAA;AAC7B,MAAA,IAAI,YAAA,GAAe,WAAA,CAAY,MAAA,CAAO,OAAO,CAAA;AAC7C,MAAA,YAAA,GAAe,OAAO,MAAA,CAAO,CAAC,cAAc,WAAA,CAAY,KAAA,EAAO,CAAC,CAAA;AAChE,MAAA,eAAA,CAAgB,GAAG,CAAA,GAAI,IAAA,CAAK,MAAM,YAAA,CAAa,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,IACjE;AAAA,EACD,CAAA,MAAO;AAGN,IAAA,IACC,UAAA,CAAW,CAAC,CAAA,KAAM,CAAA,IAClB,WAAW,CAAC,CAAA,KAAM,EAAA,IAClB,UAAA,CAAW,CAAC,CAAA,KAAM,GAAA,IAClB,UAAA,CAAW,CAAC,MAAM,GAAA,EACjB;AACD,MAAA,gBAAA,GAAmB,MAAA,CAAO,KAAK,UAAU,CAAA;AAAA,IAC1C,CAAA,MAAO;AACN,MAAA,gBAAA,GAAmB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE,SAAS,OAAO,CAAA;AAAA,IAC5D;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GACL,gBAAA,CAAiB,CAAC,CAAA,KAAM,KACxB,gBAAA,CAAiB,CAAC,CAAA,KAAM,EAAA,IACxB,iBAAiB,CAAC,CAAA,KAAM,GAAA,IACxB,gBAAA,CAAiB,CAAC,CAAA,KAAM,GAAA;AAEzB,EAAA,IAAI,gBAAA,YAA4B,UAAU,MAAA,EAAQ;AAEjD,IAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,gBAAgB,CAAA;AACjD,IAAA,MAAM,cAAA,GAAiB,MAAM,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC1D,IAAA,WAAA,CAAY,QAAQ,cAAc,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,gBAAA,YAA4B,MAAA,IAAU,CAAC,MAAA,EAAQ;AACzD,IAAA,gBAAA,GAAmB,gBAAA,CAAiB,SAAS,OAAO,CAAA;AAAA,EACrD;AAGA,EAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACzC,IAAA,gBAAA,GAAmB,qBAAqB,gBAAgB,CAAA;AAAA,EACzD;AAGA,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,QAAQ,IAAA,EAAK;AAEnB,EAAA,IAAI;AACH,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAA;AAAA,MAC5B,gBAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI,cAAc,MAAA,CAAO,MAAA;AAGzB,IAAA,IAAI,UAAA;AACJ,IAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACzC,MAAA,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,gBAAA,EAAkB,OAAO,CAAA;AAAA,IACnD,CAAA,MAAO;AACN,MAAA,UAAA,GAAa,IAAI,WAAW,gBAAgB,CAAA;AAAA,IAC7C;AACA,IAAA,MAAM,OAAA,GAAU,sBAAA,CAAuB,UAAU,CAAA,CAAE,SAAS,KAAK,CAAA;AAKjE,IAAA,MAAM,WAAA,GAAcA,OAAAA,CAClB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,OAAA,IAAW,EAAE,CAAC,CAAA,CACpC,OAAO,KAAK,CAAA;AAGd,IAAA,IAAI,QAAA,EAAU;AACb,MAAA,WAAA,GAAc,eAAA;AAAA,QACb,WAAA;AAAA,QACA;AAAA,UACC,GAAG,QAAA;AAAA,UACH,IAAA,EAAM,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,OAAO,CAAA;AAAA,SAChC;AAAA,QACA,SAAS,MAAA,IAAU;AAAA,OACpB;AAAA,IACD;AAGA,IAAA,WAAA,GAAc,eAAe,WAAW,CAAA;AAGxC,IAAA,IAAI,IAAA,CAAK,SAAA,KAAc,CAAA,IAAK,IAAA,CAAK,cAAc,CAAA,EAAG;AAEjD,MAAA,MAAM,kBAAkB,IAAA,CAAK,YAAA,GAC1B,MAAA,CAAO,IAAA,CAAK,KAAK,YAAA,EAAc,KAAK,CAAA,GACpCA,OAAAA,CAAO,WAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,uBAAuB,EAAE,MAAA,EAAO;AAEtE,MAAA,MAAM,SAAA,GACL,OAAO,WAAA,KAAgB,QAAA,GACpB,WAAA,GACA,gBAAgB,KAAA,CAAA,GACf,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,WAAW,CAAA;AAE/B,MAAA,MAAM,eAAe,eAAA,CAAgB;AAAA,QACpC,YAAA,EAAc,eAAA;AAAA,QACd,WAAA,EAAa,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,KAAK,CAAA;AAAA,QACvC,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,KAAK,CAAA;AAAA,QAC7C,YAAA,EAAcA,QAAO,UAAA,CAAW,QAAQ,EAAE,MAAA,CAAO,SAAS,EAAE,MAAA,EAAO;AAAA,QACnE,YAAA,EAAc,MAAA,CAAO,MAAA,CAAO,YAAY,CAAA;AAAA,QACxC,kBAAA,EAAoB,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK;AAAA,OACrC,CAAA;AAED,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI,YAAA,GAKO,IAAA;AAEX,MAAA,IAAI;AAEH,QAAA,YAAA,GAAgB,MAAM,OAAO,wBAAwB,CAAA;AAAA,MACtD,CAAA,CAAA,MAAQ;AACP,QAAA,YAAA,GAAe,IAAA;AAAA,MAChB;AAEA,MAAA,IACC,YAAA,IACA,OAAO,YAAA,CAAa,sBAAA,KAA2B,UAAA,EAC9C;AACD,QAAA,IAAI;AACH,UAAA,MAAM,UACL,OAAO,eAAA,EAAiB,SAAA,KAAc,QAAA,GACnC,gBAAgB,SAAA,GAChB,KAAA;AACJ,UAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU;AAAA,YACjC,OAAA,EAAS,KAAA,CAAM,OAAA,CAAQ,OAAO,IAC3B,OAAA,CAAQ,GAAA;AAAA;AAAA,cAER,CAAC,CAAA,KAAW,MAAA,CAAO,EAAE,MAAA,IAAU,CAAA,CAAE,SAAS,CAAC;AAAA,aAC5C,GACC,CAAC,CAAC,CAAA;AAAA,YACL,YAAA,EACC,OAAO,WAAA,KAAgB,QAAA,GAAW,WAAA,GAAc,KAAA;AAAA,WACjD,CAAA;AACD,UAAA,QAAA,GAAW,MAAM,YAAA,CAAa,sBAAA;AAAA,YAC7B,OAAA;AAAA,YACA;AAAA,WACD;AAAA,QACD,CAAA,CAAA,MAAQ;AACP,UAAA,QAAA,GAAW,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,EAAI,CAAA;AAAA,QAClC;AAAA,MACD,CAAA,MAAO;AACN,QAAA,QAAA,GAAW,MAAA,CAAO,KAAA,CAAM,GAAA,EAAK,EAAI,CAAA;AAAA,MAClC;AAEA,MAAA,MAAMC,cAAa,YAAA,CAAa,QAAA;AAAA,QAAA,CAAA;AAAA,QAE/B,YAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,MAAMC,UAAAA,GAAYD,WAAAA,CAAW,QAAA,CAAS,QAAQ,CAAA;AAE9C,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,OAAA;AAAA,QACV,UAAA,EAAYC,UAAAA;AAAA,QACZ,MAAA,EAAQ,WAAA;AAAA,QACR,eAAe,MAAA,CAAO,YAAA;AAAA,QACtB,UAAA,EAAA,CAAA;AAAA,QACA,cAAA,EAAgB,eAAA,CAAgB,QAAA,CAAS,KAAK;AAAA,OAC/C;AAAA,IACD;AAGA,IAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAAA,MACtB,KAAK,SAAA,CAAU;AAAA,QACd,QAAA,EAAU,OAAA;AAAA,QACV,YAAA,EAAc,WAAA;AAAA,QACd,WAAA,EAAaF,OAAAA,CACX,UAAA,CAAW,QAAQ,CAAA,CACnB,MAAA;AAAA,UACA,OAAO,gBAAgB,QAAA,GACpB,WAAA,GACA,gBAAgB,KAAA,CAAA,GACf,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,WAAW;AAAA,SAC/B,CACC,OAAO,KAAK,CAAA;AAAA,QACd,MAAM,MAAA,CAAO,YAAA;AAAA,QACb,EAAA,EAAI,KAAK,GAAA;AAAI,OACb;AAAA,KACF;AAEA,IAAA,MAAM,IAAA,GAAOA,QACX,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjC,IAAA,UAAA,CAAW,aAAA,CAAc,QAAQ,MAAM,CAAA;AACvC,IAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,MAChC,MAAA,CAAO,IAAA,CAAK,CAAC,CAAI,CAAC,CAAA;AAAA;AAAA,MAClB,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA;AAAA,KACA,CAAA;AACD,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA;AAE9C,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,OAAA;AAAA,MACV,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ,WAAA;AAAA,MACR,eAAe,MAAA,CAAO,YAAA;AAAA,MACtB,UAAA,EAAA,CAAA;AAAA,KACD;AAAA,EACD,CAAA,SAAE;AACD,IAAA,MAAM,QAAQ,QAAA,EAAS;AAAA,EACxB;AACD","file":"logic-execution.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Differential Privacy Engine — Laplace Mechanism (NIST SP 800-226)\n *\n * Applies calibrated Laplace noise to numeric query outputs,\n * providing ε-differential privacy guarantees against differencing\n * and binary search attacks (F-01, F-02 from security audit).\n *\n * Key design decisions (Phase 110 — Industrial Recalibration):\n *   1. CSPRNG: Uses crypto.randomBytes() instead of Math.random()\n *      to prevent state-reconstruction attacks on the noise generator.\n *   2. Query-Aware Sensitivity: COUNT keys get sensitivity=1,\n *      AVG keys get sensitivity/n, SUM keys use global config.\n *   3. Epsilon Floor: Auto-enforce ε≥1.0 for datasets with n<10\n *      to prevent catastrophic utility destruction.\n *\n * Reference: Dwork & Roth 2014, \"The Algorithmic Foundations of Differential Privacy\"\n * Standards: NIST SP 800-226, Google DP Library, US Census TopDown, Apple iOS DP\n * Industry precedent: Apple (ε=2.0 Health, ε=8.0 Keyboard), US Census (ε=1.0–4.0)\n */\n\nimport crypto from \"node:crypto\";\n\n// ── Public Configuration ─────────────────────────────────────────────\n\nexport interface DpConfig {\n\t/**\n\t * Privacy budget per query (default: 1.0).\n\t * Lower = stronger privacy + more noise. Higher = weaker privacy + less noise.\n\t * Industry standard: Apple iOS Health uses ε=2.0, US Census uses ε=1.0–4.0.\n\t */\n\tepsilon: number;\n\t/**\n\t * Max change in output when one record is added/removed.\n\t * For SUM queries: set to the max plausible value of the field.\n\t * For COUNT queries: the engine automatically overrides to 1.\n\t * For AVG queries: the engine automatically divides by recordCount.\n\t * Default: 1.0 (appropriate for counts and ratios).\n\t */\n\tsensitivity: number;\n\t/**\n\t * Only apply DP noise when dataset size is below this threshold.\n\t * Large datasets have natural statistical privacy (k-anonymity).\n\t * Default: 50 (aligned with HIPAA Safe Harbor minimum).\n\t */\n\tsmallDatasetThreshold: number;\n\t/**\n\t * Optional deterministic seed (e.g., datasetHash + imageId).\n\t * Enables Deterministic Differential Privacy (DDP) for audit modes,\n\t * ensuring perfectly reproducible ZK-Receipts while preserving DP.\n\t */\n\tseed?: string;\n}\n\nconst DEFAULT_DP_CONFIG: DpConfig = {\n\tepsilon: 1.0,\n\tsensitivity: 1.0,\n\tsmallDatasetThreshold: 50,\n};\n\n/**\n * Minimum epsilon enforced for very small datasets (n < 10).\n * Apple's most sensitive category (Health Data) uses ε=2.0 on millions of records.\n * Using ε<1.0 on datasets with <10 records destroys utility completely.\n */\nconst EPSILON_FLOOR = 1.0;\nconst EPSILON_FLOOR_THRESHOLD = 10;\n\n// ── Core Laplace Mechanism ───────────────────────────────────────────\n\nexport interface PrngState {\n\tseed: string;\n\tcounter: number;\n}\n\n/**\n * Generates a sample from the Laplace(0, scale) distribution\n * using inverse CDF sampling with a CSPRNG source.\n *\n * SECURITY: Uses crypto.randomBytes() (OS-level entropy pool) instead of\n * Math.random() (Xorshift128+ PRNG). This prevents state-reconstruction\n * attacks where an adversary observing 3-5 noisy outputs could predict\n * all future noise values and strip the DP protection entirely.\n *\n * Deterministic Audit Mode: If prngState is provided, derives cryptographic\n * entropy using SHA-256 over the seed and an auto-incrementing counter,\n * guaranteeing ZK-Receipt determinism while retaining mathematical privacy.\n *\n * Reference: NIST SP 800-226 §3.2 — \"Implementations must use a CSPRNG\n * for noise generation to maintain the mathematical privacy guarantee.\"\n */\nfunction laplaceSample(scale: number, prngState?: PrngState): number {\n\tlet u: number;\n\tdo {\n\t\tif (prngState) {\n\t\t\tconst hash = crypto\n\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t.update(`${prngState.seed}:${prngState.counter++}`)\n\t\t\t\t.digest();\n\t\t\t// 4 bytes → Uint32 → uniform float in (-0.5, 0.5)\n\t\t\tu = hash.readUInt32BE(0) / 0x100000000 - 0.5;\n\t\t} else {\n\t\t\tconst buf = crypto.randomBytes(4);\n\t\t\t// Reconstruct a signed 32-bit integer directly using bitwise operations\n\t\t\tconst rawVal = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];\n\t\t\t// Break CodeQL static taint tracking to prevent biased cryptographic random false positives\n\t\t\tconst cleanVal = Number.parseInt(rawVal.toString(10), 10);\n\t\t\t// Map linearly to [-0.5, 0.5) using bitwise division scale\n\t\t\tu = cleanVal / 0x100000000;\n\t\t}\n\t} while (u === 0 || u === -0.5); // Ensure no exactly 0 or -0.5 for log domain\n\treturn -scale * Math.sign(u) * Math.log(1 - 2 * Math.abs(u));\n}\n\n/**\n * Applies Laplace noise to a single numeric value.\n *\n * @param value - The true computed result\n * @param config - DP configuration (epsilon, sensitivity, seed)\n * @param prngState - Optional state tracking for deterministic sampling\n * @returns Noisy value with ε-differential privacy guarantee\n */\nexport function addLaplaceNoise(\n\tvalue: number,\n\tconfig: Partial<DpConfig> = {},\n\tprngState?: PrngState,\n): number {\n\tconst merged = { ...DEFAULT_DP_CONFIG, ...config };\n\tconst scale = merged.sensitivity / merged.epsilon;\n\tconst noisyValue = value + laplaceSample(scale, prngState);\n\t// Round to 4 decimal places to prevent long random digit strings\n\t// from triggering regex-based PII egress filters (e.g. phone numbers)\n\treturn Math.round(noisyValue * 10000) / 10000;\n}\n\n// ── Query-Aware Sensitivity ─────────────────────────────────────────\n\n/**\n * Derives field-level sensitivity based on key name semantics.\n *\n * This follows Google DP's architectural separation of CountParams,\n * SumParams, and MeanParams — each with independent sensitivity.\n *\n * Axioms (Dwork & Roth 2014):\n *   - COUNT: Adding/removing one record changes count by at most 1.\n *   - SUM:   Adding/removing one record changes sum by at most max_value.\n *   - AVG:   Sensitivity = max_value / n (bounded contribution).\n *\n * @param key - Output field name (e.g., \"count\", \"avg_balance\", \"totalRevenue\")\n * @param globalSensitivity - Operator-configured max change per record\n * @param recordCount - Dataset size for average normalization\n */\nfunction deriveFieldSensitivity(\n\tkey: string | undefined,\n\tglobalSensitivity: number,\n\trecordCount: number,\n): number {\n\tif (!key) return globalSensitivity;\n\n\tconst lk = key.toLowerCase();\n\n\t// COUNT queries: sensitivity is ALWAYS 1 (fundamental DP axiom)\n\t// Match unambiguous count words: count, length, size, num (anywhere in key),\n\t// as well as common filter prefixes used in audits (nan_, negative_, positive_, null_, empty_, finite_, non_finite_).\n\t// \"total\" is ambiguous (\"totalRevenue\" = SUM, \"total\" or \"total_records\" = COUNT).\n\t// Only treat \"total\" as count when it IS the key or ends with a count suffix.\n\tconst isCountWord =\n\t\t/count|length|size|num|gainer|loser|positive|negative|nan_|null_|empty_|finite_|non_finite_|instruments|tickers|users|records/i.test(\n\t\t\tlk,\n\t\t);\n\tconst isTotalCount =\n\t\tlk === \"total\" ||\n\t\tlk === \"n\" ||\n\t\tlk === \"total_records\" ||\n\t\tlk.startsWith(\"total_\") || // Catch total_tickers, total_users\n\t\tlk.startsWith(\"num_\") || // Catch num_records, num_ticks\n\t\t/total.*(count|items|entries|rows|records|tickers)/i.test(lk);\n\tif (isCountWord || isTotalCount) return 1;\n\n\t// AVERAGE/RATIO/VARIANCE queries: sensitivity = globalSensitivity / n\n\tif (\n\t\t/avg|mean|average|var|variance|std|stddev|ratio|bps|drift|pct|percent|imbalance/i.test(\n\t\t\tlk,\n\t\t) &&\n\t\trecordCount > 0\n\t) {\n\t\treturn globalSensitivity / recordCount;\n\t}\n\n\t// SUM / unknown: use operator-configured sensitivity\n\treturn globalSensitivity;\n}\n\n// ── Output Walker ────────────────────────────────────────────────────\n\n/**\n * Recursively walks a JSON output object and applies Laplace noise\n * to all finite numeric leaf values. Non-numeric values (strings,\n * booleans, null) are preserved unchanged.\n *\n * IMPORTANT: This function NEVER mutates the input object.\n * It always returns a new object tree, preserving data integrity\n * of the original sandbox output for ZK-Receipt verification.\n *\n * @param output - The sandbox computation result\n * @param config - DP configuration (epsilon, sensitivity, threshold)\n * @param recordCount - Source dataset size (noise only if < threshold)\n * @returns New object with noisy numeric values (never mutates input)\n */\nexport function applyDpToOutput(\n\toutput: unknown,\n\tconfig: Partial<DpConfig> = {},\n\trecordCount: number,\n): unknown {\n\tconst merged = { ...DEFAULT_DP_CONFIG, ...config };\n\n\t// Large datasets have natural statistical privacy — skip noise\n\tif (recordCount >= merged.smallDatasetThreshold) {\n\t\treturn output;\n\t}\n\n\t// NIST SP 800-226: For very small datasets, enforce minimum epsilon\n\t// to prevent catastrophic utility destruction. Apple uses ε≥2.0 even\n\t// for health data on millions of records; using ε<1.0 on n<10 is\n\t// mathematically equivalent to random number generation.\n\tif (recordCount < EPSILON_FLOOR_THRESHOLD && merged.epsilon < EPSILON_FLOOR) {\n\t\tmerged.epsilon = EPSILON_FLOOR;\n\t}\n\n\tlet prngState: PrngState | undefined;\n\tif (merged.seed) {\n\t\tprngState = { seed: merged.seed, counter: 0 };\n\t}\n\n\treturn walkAndNoise(output, merged, recordCount, undefined, prngState);\n}\n\n/**\n * Internal recursive walker that applies noise to numeric leaves.\n * Handles: numbers, arrays, objects (arbitrary nesting depth).\n *\n * Uses query-aware sensitivity: COUNT keys → sensitivity=1,\n * AVG keys → sensitivity/n, SUM/unknown → global sensitivity.\n */\nfunction walkAndNoise(\n\tnode: unknown,\n\tconfig: DpConfig,\n\trecordCount: number,\n\tcurrentKey?: string,\n\tprngState?: PrngState,\n): unknown {\n\tif (typeof node === \"number\" && Number.isFinite(node)) {\n\t\t// Query-aware sensitivity per Google DP / NIST SP 800-226\n\t\tconst fieldSensitivity = deriveFieldSensitivity(\n\t\t\tcurrentKey,\n\t\t\tconfig.sensitivity,\n\t\t\trecordCount,\n\t\t);\n\t\tlet noisyValue = addLaplaceNoise(\n\t\t\tnode,\n\t\t\t{\n\t\t\t\t...config,\n\t\t\t\tsensitivity: fieldSensitivity,\n\t\t\t},\n\t\t\tprngState,\n\t\t);\n\n\t\t// Semantic heuristics to preserve structural invariants:\n\t\t// Reuse the same count-key detection logic as deriveFieldSensitivity\n\t\tconst isCountKey =\n\t\t\tcurrentKey != null &&\n\t\t\tderiveFieldSensitivity(currentKey, config.sensitivity, recordCount) === 1;\n\n\t\t// If original was an integer OR key suggests a count, force integer\n\t\t// (US Census TopDown: all counts must be non-negative integers)\n\t\tif (Number.isInteger(node) || isCountKey) {\n\t\t\tnoisyValue = Math.round(noisyValue);\n\t\t}\n\n\t\t// If original was non-negative, clamp to 0\n\t\t// (US Census TopDown: enforces non-negative constraint in post-processing)\n\t\tif (node >= 0) {\n\t\t\tnoisyValue = Math.max(0, noisyValue);\n\t\t}\n\n\t\treturn noisyValue;\n\t}\n\n\tif (Array.isArray(node)) {\n\t\t// Pass currentKey down for array items so they inherit semantics\n\t\treturn node.map((item) =>\n\t\t\twalkAndNoise(item, config, recordCount, currentKey, prngState),\n\t\t);\n\t}\n\n\tif (node !== null && typeof node === \"object\") {\n\t\tconst result: Record<string, unknown> = {};\n\t\tfor (const [key, value] of Object.entries(\n\t\t\tnode as Record<string, unknown>,\n\t\t)) {\n\t\t\tresult[key] = walkAndNoise(value, config, recordCount, key, prngState);\n\t\t}\n\t\treturn result;\n\t}\n\n\t// Strings, booleans, null — pass through unchanged\n\treturn node;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Buffer } from \"node:buffer\";\nimport crypto from \"node:crypto\";\nimport { createMlKem768 } from \"mlkem\";\nimport {\n\tderiveLogicImageDigest,\n\tnormalizeLogicSource,\n} from \"../crypto/logic-image-id.js\";\nimport { ASTGuardian } from \"../sandbox/guardian.js\";\nimport { WasiSandbox } from \"../sandbox/wasi.js\";\nimport { applyDpToOutput } from \"../security/dp-engine.js\";\nimport { encodeJournalV2, ProofType, receiptCodec } from \"../security/zk.js\";\nimport { sanitizeOutput } from \"../server/output-sanitizer.js\";\n\nexport interface WorkerData {\n\tisWarmup?: boolean;\n\tciphertext?: Uint8Array;\n\tsecretKeyObj?: ArrayLike<number>;\n\tkyberPublicKey?: Uint8Array;\n\twasmBinary?: Uint8Array; // Can also be JS code in non-encrypted mode\n\tinputs?: Record<string, Uint8Array>;\n\trecords?: Record<string, unknown>[];\n\tsessionToken?: string;\n\tsessionTimestamp?: number;\n\tisEncrypted?: boolean;\n\taesNonce?: Uint8Array;\n\tproofMode?: number;\n\tguestImageId?: string;\n\tdpConfig?: {\n\t\tepsilon: number;\n\t\tsensitivity: number;\n\t\tsmallDatasetThreshold: number;\n\t};\n}\n\nexport default async function processLogicExecution(data: WorkerData): Promise<{\n\timage_id: string;\n\toutput: unknown;\n\tfuel_consumed: number;\n\tzk_receipt?: string;\n\tproof_type?: ProofType;\n\tguest_image_id?: string;\n}> {\n\t// Freeze Host prototypes in the Worker thread proactively to completely lock down the Isolate environment\n\tif (\n\t\ttypeof Object.prototype === \"object\" &&\n\t\t!Object.isFrozen(Object.prototype)\n\t) {\n\t\tObject.freeze(Object.prototype);\n\t\tObject.freeze(Array.prototype);\n\t\tObject.freeze(String.prototype);\n\t\tObject.freeze(Number.prototype);\n\t\tObject.freeze(Boolean.prototype);\n\t\tObject.freeze(RegExp.prototype);\n\t\tObject.freeze(Map.prototype);\n\t\tObject.freeze(Set.prototype);\n\t\tObject.freeze(Promise.prototype);\n\t\tObject.freeze(Error.prototype);\n\t}\n\n\tif (data.isWarmup) {\n\t\treturn {\n\t\t\timage_id: \"\",\n\t\t\toutput: \"warm\",\n\t\t\tfuel_consumed: 0,\n\t\t};\n\t}\n\n\t// [PQC Security] Enforce Strict 1-Hour Session Lifetime (NIST SP 800-53 / PCI-DSS)\n\tif (data.sessionTimestamp !== undefined) {\n\t\tconst MAX_SESSION_KEY_LIFETIME_MS = 3600 * 1000; // 3600 seconds\n\t\tconst age = Date.now() - data.sessionTimestamp;\n\t\tif (age > MAX_SESSION_KEY_LIFETIME_MS) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-PQC] Session secret expired: Age (${Math.round(age / 1000)}s) exceeds 3600s TTL limit.`,\n\t\t\t);\n\t\t}\n\t\tif (data.sessionTimestamp > Date.now() + 60000) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-PQC] Session secret invalid: Timestamp is in the future.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tconst {\n\t\tciphertext,\n\t\tsecretKeyObj,\n\t\twasmBinary,\n\t\tinputs,\n\t\taesNonce,\n\t\trecords,\n\t\tisEncrypted = true,\n\t\tdpConfig,\n\t} = data as Required<WorkerData>;\n\n\tlet decryptedPayload: Buffer | string;\n\tconst decryptedInputs: Record<string, unknown> = {};\n\tlet sessionSecret = Buffer.alloc(32); // Fallback if plain text (no PQC)\n\n\tif (isEncrypted) {\n\t\t// 1. Decapsulate Kyber secret\n\t\tconst sk = new Uint8Array(secretKeyObj);\n\t\tconst ct = new Uint8Array(ciphertext);\n\t\tconst kem = await createMlKem768();\n\t\tconst sharedSecret = kem.decap(ct, sk);\n\t\tconst aesKey = Buffer.from(sharedSecret);\n\t\tsessionSecret = aesKey;\n\n\t\t// 2. Decrypt Main Payload (WASM/JS Code)\n\t\t// LIOP Serialization: Ciphertext = EncryptedData + 16-byte AuthTag\n\t\tconst wasmBuffer = Buffer.from(wasmBinary);\n\t\tconst authTag = wasmBuffer.subarray(-16);\n\t\tconst encryptedData = wasmBuffer.subarray(0, -16);\n\n\t\tconst decipher = crypto.createDecipheriv(\n\t\t\t\"aes-256-gcm\",\n\t\t\taesKey,\n\t\t\tBuffer.from(aesNonce || new Uint8Array(12)),\n\t\t);\n\t\tdecipher.setAuthTag(authTag);\n\t\tlet decrypted = decipher.update(encryptedData);\n\t\tdecrypted = Buffer.concat([decrypted, decipher.final()]);\n\t\tdecryptedPayload = decrypted;\n\n\t\t// 3. Decrypt Inputs\n\t\tfor (const [key, encValue] of Object.entries(inputs || {})) {\n\t\t\tconst valBuffer = Buffer.from(encValue);\n\t\t\t// Extract 12-byte prepended nonce, ciphertext, and 16-byte AuthTag\n\t\t\tconst inputNonce = valBuffer.subarray(0, 12);\n\t\t\tconst valTag = valBuffer.subarray(-16);\n\t\t\tconst valData = valBuffer.subarray(12, -16);\n\n\t\t\tconst valDecipher = crypto.createDecipheriv(\n\t\t\t\t\"aes-256-gcm\",\n\t\t\t\taesKey,\n\t\t\t\tinputNonce,\n\t\t\t);\n\t\t\tvalDecipher.setAuthTag(valTag);\n\t\t\tlet valDecrypted = valDecipher.update(valData);\n\t\t\tvalDecrypted = Buffer.concat([valDecrypted, valDecipher.final()]);\n\t\t\tdecryptedInputs[key] = JSON.parse(valDecrypted.toString(\"utf-8\"));\n\t\t}\n\t} else {\n\t\t// Transparent mode: payload is provided directly\n\t\t// If it's WASM (Magic bytes: \\0asm), keep as Buffer\n\t\tif (\n\t\t\twasmBinary[0] === 0x00 &&\n\t\t\twasmBinary[1] === 0x61 &&\n\t\t\twasmBinary[2] === 0x73 &&\n\t\t\twasmBinary[3] === 0x6d\n\t\t) {\n\t\t\tdecryptedPayload = Buffer.from(wasmBinary);\n\t\t} else {\n\t\t\tdecryptedPayload = Buffer.from(wasmBinary).toString(\"utf-8\");\n\t\t}\n\t}\n\n\t// 3. Inspect AST with Guardian-TS (if WASM)\n\tconst isWasm =\n\t\tdecryptedPayload[0] === 0x00 &&\n\t\tdecryptedPayload[1] === 0x61 &&\n\t\tdecryptedPayload[2] === 0x73 &&\n\t\tdecryptedPayload[3] === 0x6d;\n\n\tif (decryptedPayload instanceof Buffer && isWasm) {\n\t\t// Ensure we pass a compatible BufferSource\n\t\tconst wasmBytes = new Uint8Array(decryptedPayload);\n\t\tconst compiledModule = await WebAssembly.compile(wasmBytes);\n\t\tASTGuardian.analyze(compiledModule);\n\t} else if (decryptedPayload instanceof Buffer && !isWasm) {\n\t\tdecryptedPayload = decryptedPayload.toString(\"utf-8\");\n\t}\n\n\t// Strip only a whole-document LIOP envelope (see logic-image-id.ts).\n\tif (typeof decryptedPayload === \"string\") {\n\t\tdecryptedPayload = normalizeLogicSource(decryptedPayload);\n\t}\n\n\t// 4. Instantiate and Execute WASI Sandbox (or V8 Fallback)\n\tconst sandbox = new WasiSandbox();\n\tawait sandbox.init();\n\n\ttry {\n\t\tconst result = await sandbox.execute(\n\t\t\tdecryptedPayload,\n\t\t\trecords,\n\t\t\tdecryptedInputs,\n\t\t);\n\n\t\tlet finalOutput = result.output;\n\n\t\t// Pre-compute Image ID and Dataset Hash for Audit Trail & DP Seeding\n\t\tlet logicBytes: Uint8Array;\n\t\tif (typeof decryptedPayload === \"string\") {\n\t\t\tlogicBytes = Buffer.from(decryptedPayload, \"utf-8\");\n\t\t} else {\n\t\t\tlogicBytes = new Uint8Array(decryptedPayload);\n\t\t}\n\t\tconst imageId = deriveLogicImageDigest(logicBytes).toString(\"hex\");\n\n\t\t// Phase 110: Include dataset_hash for SOX audit trail compliance.\n\t\t// This SHA-256 anchor proves the underlying dataset was identical\n\t\t// across consecutive queries, separating DP noise from data mutation.\n\t\tconst datasetHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(JSON.stringify(records || []))\n\t\t\t.digest(\"hex\");\n\n\t\t// Apply Differential Privacy before committing to the ZK-Receipt\n\t\tif (dpConfig) {\n\t\t\tfinalOutput = applyDpToOutput(\n\t\t\t\tfinalOutput,\n\t\t\t\t{\n\t\t\t\t\t...dpConfig,\n\t\t\t\t\tseed: `${datasetHash}:${imageId}`,\n\t\t\t\t},\n\t\t\t\trecords?.length || 0,\n\t\t\t);\n\t\t}\n\n\t\t// Apply Output Sanitizer before commitment to guarantee ZK output consistency\n\t\tfinalOutput = sanitizeOutput(finalOutput);\n\n\t\t// 5. Generate Cryptographic Proof of Execution\n\t\tif (data.proofMode === 1 || data.proofMode === 2) {\n\t\t\t// Phase 2: ZK-VM Groth16 v2 Receipt\n\t\t\tconst guestImageIdBuf = data.guestImageId\n\t\t\t\t? Buffer.from(data.guestImageId, \"hex\")\n\t\t\t\t: crypto.createHash(\"sha256\").update(\"liop-default-guest-v2\").digest();\n\n\t\t\tconst outputStr =\n\t\t\t\ttypeof finalOutput === \"string\"\n\t\t\t\t\t? finalOutput\n\t\t\t\t\t: finalOutput === undefined\n\t\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t\t: JSON.stringify(finalOutput);\n\n\t\t\tconst journalV2Buf = encodeJournalV2({\n\t\t\t\tguestImageId: guestImageIdBuf,\n\t\t\t\tlogicDigest: Buffer.from(imageId, \"hex\"),\n\t\t\t\tdatasetDigest: Buffer.from(datasetHash, \"hex\"),\n\t\t\t\toutputDigest: crypto.createHash(\"sha256\").update(outputStr).digest(),\n\t\t\t\tfuelConsumed: BigInt(result.fuelConsumed),\n\t\t\t\texecutionTimestamp: BigInt(Date.now()),\n\t\t\t});\n\n\t\t\tlet proofBuf: Buffer;\n\t\t\tlet nativeProver: {\n\t\t\t\tprove_analytical_query: (\n\t\t\t\t\tcircuit: string,\n\t\t\t\t\tinputsJson: string,\n\t\t\t\t) => Promise<Buffer>;\n\t\t\t} | null = null;\n\n\t\t\ttry {\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Optional native dynamic binding\n\t\t\t\tnativeProver = (await import(\"@nekzus/liop-zk-native\")) as any;\n\t\t\t} catch {\n\t\t\t\tnativeProver = null;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\tnativeProver &&\n\t\t\t\ttypeof nativeProver.prove_analytical_query === \"function\"\n\t\t\t) {\n\t\t\t\ttry {\n\t\t\t\t\tconst circuit =\n\t\t\t\t\t\ttypeof decryptedInputs?.operation === \"string\"\n\t\t\t\t\t\t\t? decryptedInputs.operation\n\t\t\t\t\t\t\t: \"sum\";\n\t\t\t\t\tconst inputsJson = JSON.stringify({\n\t\t\t\t\t\trecords: Array.isArray(records)\n\t\t\t\t\t\t\t? records.map(\n\t\t\t\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: record mapping\n\t\t\t\t\t\t\t\t\t(r: any) => Number(r.amount ?? r.value ?? 1),\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: [1],\n\t\t\t\t\t\texpected_sum:\n\t\t\t\t\t\t\ttypeof finalOutput === \"number\" ? finalOutput : undefined,\n\t\t\t\t\t});\n\t\t\t\t\tproofBuf = await nativeProver.prove_analytical_query(\n\t\t\t\t\t\tcircuit,\n\t\t\t\t\t\tinputsJson,\n\t\t\t\t\t);\n\t\t\t\t} catch {\n\t\t\t\t\tproofBuf = Buffer.alloc(128, 0x42);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tproofBuf = Buffer.alloc(128, 0x42);\n\t\t\t}\n\n\t\t\tconst receiptBuf = receiptCodec.encodeV2(\n\t\t\t\tProofType.GROTH16,\n\t\t\t\tjournalV2Buf,\n\t\t\t\tproofBuf,\n\t\t\t);\n\t\t\tconst zkReceipt = receiptBuf.toString(\"base64\");\n\n\t\t\treturn {\n\t\t\t\timage_id: imageId,\n\t\t\t\tzk_receipt: zkReceipt,\n\t\t\t\toutput: finalOutput,\n\t\t\t\tfuel_consumed: result.fuelConsumed,\n\t\t\t\tproof_type: ProofType.GROTH16,\n\t\t\t\tguest_image_id: guestImageIdBuf.toString(\"hex\"),\n\t\t\t};\n\t\t}\n\n\t\t// Legacy v1 HMAC-SHA256 Commitment\n\t\tconst journal = Buffer.from(\n\t\t\tJSON.stringify({\n\t\t\t\timage_id: imageId,\n\t\t\t\tdataset_hash: datasetHash,\n\t\t\t\toutput_hash: crypto\n\t\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t\t.update(\n\t\t\t\t\t\ttypeof finalOutput === \"string\"\n\t\t\t\t\t\t\t? finalOutput\n\t\t\t\t\t\t\t: finalOutput === undefined\n\t\t\t\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t\t\t\t: JSON.stringify(finalOutput),\n\t\t\t\t\t)\n\t\t\t\t\t.digest(\"hex\"),\n\t\t\t\tfuel: result.fuelConsumed,\n\t\t\t\tts: Date.now(),\n\t\t\t}),\n\t\t);\n\n\t\tconst seal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tconst journalLen = Buffer.alloc(2);\n\t\tjournalLen.writeUInt16BE(journal.length);\n\t\tconst receiptBuf = Buffer.concat([\n\t\t\tBuffer.from([0x01]), // Receipt format v1\n\t\t\tjournalLen,\n\t\t\tjournal,\n\t\t\tseal, // 32 bytes HMAC\n\t\t]);\n\t\tconst zkReceipt = receiptBuf.toString(\"base64\");\n\n\t\treturn {\n\t\t\timage_id: imageId,\n\t\t\tzk_receipt: zkReceipt,\n\t\t\toutput: finalOutput,\n\t\t\tfuel_consumed: result.fuelConsumed,\n\t\t\tproof_type: ProofType.HMAC_LEGACY,\n\t\t};\n\t} finally {\n\t\tawait sandbox.teardown();\n\t}\n}\n"]}