@nekzus/liop 2.4.6 → 2.5.0-beta.2

package/dist/{chunk-SONUORBT.js → chunk-7BSCUYUE.js}

@@ -417,5 +417,5 @@ ${processedLogic}
 };
 
 export { ASTGuardian, WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment };
-//# sourceMappingURL=chunk-SONUORBT.js.map
-//# sourceMappingURL=chunk-SONUORBT.js.map
+//# sourceMappingURL=chunk-7BSCUYUE.js.map
+//# sourceMappingURL=chunk-7BSCUYUE.js.map

package/dist/chunk-7BSCUYUE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sandbox/guardian.ts","../src/sandbox/wasi.ts"],"names":[],"mappings":";;;;;;;;;;AAGO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACxC,YAAY,OAAA,EAAiB;AAC5B,IAAA,KAAA,CAAM,CAAA,0BAAA,EAA6B,OAAO,CAAA,CAAE,CAAA;AAC5C,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACb;AACD,CAAA;AAQO,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1B,QAAQ,MAAA,EAAkC;AACzC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA;AACjD,IAAA,IAAI,YAAA,GAAe,CAAA;AAEnB,IAAA,MAAM,sBAAA,uBAA6B,GAAA,CAAI;AAAA,MACtC,UAAA;AAAA,MACA,SAAA;AAAA,MACA,UAAA;AAAA,MACA,SAAA;AAAA,MACA,aAAA;AAAA,MACA,mBAAA;AAAA,MACA,UAAA;AAAA,MACA,gBAAA;AAAA,MACA,gBAAA;AAAA,MACA,YAAA;AAAA,MACA,WAAA;AAAA,MACA,gBAAA;AAAA,MACA,qBAAA;AAAA,MACA;AAAA,KACA,CAAA;AAED,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AAE1B,MAAA,IAAI,GAAA,CAAI,WAAW,wBAAA,EAA0B;AAC5C,QAAA,IAAI,CAAC,sBAAA,CAAuB,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,EAAG;AAC1C,UAAA,MAAM,IAAI,aAAA;AAAA,YACT,CAAA,6BAAA,EAAgC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,IAAI,CAAA;AAAA,WACvD;AAAA,QACD;AAAA,MACD,CAAA,MAAO;AACN,QAAA,MAAM,IAAI,aAAA;AAAA,UACT,CAAA,oCAAA,EAAuC,IAAI,MAAM,CAAA;AAAA,SAClD;AAAA,MACD;AACA,MAAA,YAAA,EAAA;AAEA,MAAA,IAAI,eAAe,GAAA,EAAK;AACvB,QAAA,MAAM,IAAI,aAAA;AAAA,UACT;AAAA,SACD;AAAA,MACD;AAAA,IACD;AAAA,EAKD;AACD;ACxDA,IAAM,eAAe,OAAA,CAAQ,IAAA;AAE7B,OAAA,CAAQ,IAAA,GAAO,CAAC,IAAA,EAAM,IAAA,EAAA,GAAS,IAAA,KAAS;AACvC,EAAA,IACE,IAAA,KAAS,aACT,OAAO,IAAA,KAAS,YACf,IAAA,CAAiC,IAAA,KAAS,yBAC3C,MAAA,CAAQ,IAAA,CAAiC,OAAO,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,IAClE,MAAA,CAAQ,KAAiC,OAAO,CAAA,CAAE,QAAA,CAAS,gBAAgB,CAAA,EAC1E;AACD,IAAA,OAAO,KAAA;AAAA,EACR;AACA,EAAA,OAAO,aAAa,IAAA,CAAK,OAAA,EAAS,IAAA,EAAM,IAAA,EAAM,GAAG,IAAI,CAAA;AACtD,CAAA;AAMO,SAAS,qBAAA,GAAgD;AAC/D,EAAA,MAAM,SAAA,GAAY,QAAQ,QAAA,KAAa,OAAA;AACvC,EAAA,MAAM,WAAW,SAAA,GACd;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,UAAA;AAAA,IACA,cAAA;AAAA,IACA,MAAA;AAAA,IACA,wBAAA;AAAA,IACA,aAAA;AAAA,IACA,YAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,MAEA,CAAC,MAAA,EAAQ,WAAW,MAAA,EAAQ,OAAA,EAAS,QAAQ,MAAM,CAAA;AAEtD,EAAA,MAAM,GAAA,GAA8B;AAAA,IACnC,QAAA,EAAU,YAAA;AAAA,IACV,SAAA,EAAW;AAAA,GACZ;AAEA,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC3B,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC3B,IAAA,IAAI,QAAQ,MAAA,IAAa,CAAC,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AAC/C,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AAAA,IACZ;AAAA,EACD;AAEA,EAAA,OAAO,GAAA;AACR;AAMO,SAAS,4BAA4B,IAAA,EAAsB;AACjE,EAAA,IAAI;AACH,IAAA,MAAM,GAAA,GAAY,YAAM,IAAA,EAAM;AAAA,MAC7B,WAAA,EAAa,IAAA;AAAA,MACb,UAAA,EAAY,QAAA;AAAA,MACZ,0BAAA,EAA4B;AAAA,KAC5B,CAAA;AAED,IAAA,IAAI,KAAA,GAAQ,GAAA;AAEZ,IAAA,MAAA,CAAO,GAAA,EAAK;AAAA,MACX,UAAA,GAAa;AACZ,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,OAAA,GAAU;AACT,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,iBAAA,GAAoB;AACnB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA;AAAA,MAEA,oBAAoB,IAAA,EAAW;AAC9B,QAAA,KAAA,IAAS,CAAA,IAAK,IAAA,CAAK,YAAA,EAAc,MAAA,IAAU,CAAA,CAAA;AAAA,MAC5C,CAAA;AAAA,MACA,oBAAA,GAAuB;AACtB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA;AAAA,MAEA,iBAAiB,IAAA,EAAW;AAC3B,QAAA,KAAA,IAAS,CAAA,GAAA,CAAK,IAAA,CAAK,UAAA,EAAY,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC/C,CAAA;AAAA;AAAA,MAEA,gBAAgB,IAAA,EAAW;AAC1B,QAAA,KAAA,IAAS,CAAA,GAAA,CAAK,IAAA,CAAK,QAAA,EAAU,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC7C,CAAA;AAAA;AAAA,MAEA,eAAe,IAAA,EAAW;AACzB,QAAA,KAAA,IAAS,EAAA,GAAA,CAAM,IAAA,CAAK,SAAA,EAAW,MAAA,IAAU,CAAA,IAAK,CAAA;AAAA,MAC/C,CAAA;AAAA,MACA,mBAAA,GAAsB;AACrB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,kBAAA,GAAqB;AACpB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,uBAAA,GAA0B;AACzB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,WAAA,GAAc;AACb,QAAA,KAAA,IAAS,CAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,YAAA,GAAe;AACd,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,cAAA,GAAiB;AAChB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,gBAAA,GAAmB;AAClB,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,YAAA,GAAe;AACd,QAAA,KAAA,IAAS,EAAA;AAAA,MACV,CAAA;AAAA,MACA,eAAA,GAAkB;AACjB,QAAA,KAAA,IAAS,CAAA;AAAA,MACV;AAAA,KACA,CAAA;AAGD,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,KAAA,GAAQ,GAAG,CAAA,GAAI,GAAA;AAAA,EACjC,SAAS,EAAA,EAAI;AAEZ,IAAA,OAAO,GAAA;AAAA,EACR;AACD;AAeO,IAAM,cAAN,MAAkB;AAAA,EAChB,IAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA,GAAqC,IAAA;AAAA,EACrC,YAAA,GAAqC,IAAA;AAAA,EAE7C,WAAA,CAAY,MAAA,GAAwB,EAAC,EAAG;AACvC,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,UAAA,EAAW;AAEnC,IAAA,IAAA,CAAK,UAAA,GAAkB,IAAA,CAAA,IAAA;AAAA,MACnB,EAAA,CAAA,MAAA,EAAO;AAAA,MACV,WAAA;AAAA,MACA,WAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACN;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,IAAA,GAAsB;AAClC,IAAA,IAAI;AACH,MAAA,MAAS,SAAM,IAAA,CAAK,UAAA,EAAY,EAAE,SAAA,EAAW,MAAM,CAAA;AAGnD,MAAA,IAAA,CAAK,eAAe,MAAS,EAAA,CAAA,IAAA;AAAA,QACvB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAAA,QACvC;AAAA,OACD;AACA,MAAA,IAAA,CAAK,eAAe,MAAS,EAAA,CAAA,IAAA;AAAA,QACvB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAAA,QACvC;AAAA,OACD;AAEA,MAAA,IAAA,CAAK,IAAA,GAAO,IAAI,IAAA,CAAK;AAAA,QACpB,OAAA,EAAS,UAAA;AAAA,QACT,IAAA,EAAM,CAAC,cAAc,CAAA;AAAA,QACrB,GAAA,EAAK,IAAA,CAAK,MAAA,CAAO,QAAA,GACd,EAAE,GAAG,qBAAA,EAAsB,EAAG,UAAA,EAAY,IAAA,CAAK,SAAA,EAAU,GACzD;AAAA,UACA,QAAA,EAAU,YAAA;AAAA,UACV,SAAA,EAAW,MAAA;AAAA,UACX,YAAY,IAAA,CAAK;AAAA,SAClB;AAAA,QACF,QAAA,EAAU;AAAA,UACT,YAAY,IAAA,CAAK,UAAA;AAAA,UACjB,GAAG,KAAK,MAAA,CAAO;AAAA,SAChB;AAAA,QACA,MAAA,EAAQ,KAAK,YAAA,CAAa,EAAA;AAAA,QAC1B,MAAA,EAAQ,KAAK,YAAA,CAAa;AAAA,OAC1B,CAAA;AAAA,IACF,SAAS,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,+BAAA,EAAkC,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,UAAU,CAAA;AAAA,OACtF;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QACZ,aAAA,EACA,OAAA,GAAqC,EAAC,EACtC,MAAA,GAAkC,EAAC,EACkB;AACrD,IAAA,MAAM,SAAA,GAAY,YAAY,GAAA,EAAI;AAElC,IAAA,IAAI,yBAAyB,MAAA,EAAQ;AAEpC,MAAA,IAAI;AACH,QAAA,MAAM,SAAS,MAAM,WAAA,CAAY,QAAQ,IAAI,UAAA,CAAW,aAAa,CAAC,CAAA;AAGtE,QAAA,WAAA,CAAY,QAAQ,MAAM,CAAA;AAE1B,QAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,WAAA;AAAA,UAClC,MAAA;AAAA,UACA,IAAA,CAAK,KAAK,eAAA;AAAgB,SAC3B;AAGA,QAAA,IAAA,CAAK,IAAA,CAAK,MAAM,QAAQ,CAAA;AAGxB,QAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAC1D,QAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AAC1D,QAAA,MAAM,MAAA,GAAS,MAAS,EAAA,CAAA,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AACpD,QAAA,MAAM,MAAA,GAAS,MAAS,EAAA,CAAA,QAAA,CAAS,UAAA,EAAY,OAAO,CAAA;AAEpD,QAAA,MAAM,QAAA,GAAW,WAAA,CAAY,GAAA,EAAI,GAAI,SAAA;AACrC,QAAA,OAAO;AAAA,UACN,MAAA,EACC,MAAA,KAAW,MAAA,GAAS,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,GAAK,wBAAA,CAAA;AAAA,UAC1C,YAAA,EAAc,IAAA,CAAK,KAAA,CAAM,QAAA,GAAW,GAAI;AAAA,SACzC;AAAA,MACD,SAAS,KAAA,EAAgB;AACxB,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,uBAAuB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC9E;AAAA,MACD;AAAA,IACD,CAAA,MAAO;AAKN,MAAA,MAAM,UAAA,mBAAkB,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAC1C,MAAA,MAAM,GAAA,GAAM,EAAE,OAAA,EAAS,GAAG,MAAA,EAAO;AAGjC,MAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,MAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,MAAA,UAAA,CAAW,MAAA,GAAS,MAAA;AACpB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,MAAA,GAAS,MAAA;AACpB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,cAAA,GAAiB,MAAA;AAC5B,MAAA,UAAA,CAAW,IAAA,GAAO,MAAA;AAClB,MAAA,UAAA,CAAW,QAAA,GAAW,MAAA;AACtB,MAAA,UAAA,CAAW,iBAAA,GAAoB,MAAA;AAC/B,MAAA,UAAA,CAAW,IAAA,GAAO,MAAA;AAMlB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,SAAA,GAAY,MAAA;AACvB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,WAAA,GAAc,MAAA;AACzB,MAAA,UAAA,CAAW,UAAA,GAAa,MAAA;AACxB,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,YAAA,GAAe,MAAA;AAC1B,MAAA,UAAA,CAAW,aAAA,GAAgB,MAAA;AAC3B,MAAA,UAAA,CAAW,cAAA,GAAiB,MAAA;AAC5B,MAAA,UAAA,CAAW,QAAA,GAAW,MAAA;AAItB,MAAA,MAAM,eAAA,GAAkB,CAAC,GAAA,KAAkB;AAC1C,QAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AACpC,UAAA,OAAO,GAAA;AAAA,QACR;AACA,QAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,UAAA,OAAO,GAAA,CAAI,IAAI,eAAe,CAAA;AAAA,QAC/B;AACA,QAAA,MAAM,KAAA,mBAAQ,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAChC,QAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC7C,UAAA,KAAA,CAAM,GAAG,CAAA,GAAI,eAAA,CAAgB,GAAG,CAAA;AAAA,QACjC;AACA,QAAA,OAAO,KAAA;AAAA,MACR,CAAA;AAGA,MAAA,UAAA,CAAW,OAAA,GAAU,gBAAgB,IAAA,CAAK,KAAA,CAAM,KAAK,SAAA,CAAU,OAAO,CAAC,CAAC,CAAA;AACxE,MAAA,UAAA,CAAW,GAAA,GAAM,gBAAgB,IAAA,CAAK,KAAA,CAAM,KAAK,SAAA,CAAU,GAAG,CAAC,CAAC,CAAA;AAEhE,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClD,QAAA,UAAA,CAAW,GAAG,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AAAA,MACpE;AAIA,MAAA,MAAM,UAAA,GAAa,CAAC,GAAA,KAAa;AAChC,QAAA,IAAI,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,GAAG,CAAA,EAAG;AAC5D,UAAA,MAAA,CAAO,OAAO,GAAG,CAAA;AACjB,UAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AACnC,YAAA,UAAA,CAAW,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,UACpB;AAAA,QACD;AACA,QAAA,OAAO,GAAA;AAAA,MACR,CAAA;AAEA,MAAA,UAAA,CAAW,WAAW,OAAO,CAAA;AAC7B,MAAA,UAAA,CAAW,WAAW,GAAG,CAAA;AAGzB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,EAAG;AAC1C,QAAA,MAAA,CAAO,cAAA,CAAe,YAAY,GAAA,EAAK;AAAA,UACtC,QAAA,EAAU,KAAA;AAAA,UACV,YAAA,EAAc;AAAA,SACd,CAAA;AAAA,MACF;AAIA,MAAA,IAAI,cAAA,GAAiB,OAAO,aAAa,CAAA;AACzC,MAAA,IACC,eAAA,CAAgB,KAAK,cAAc,CAAA,IACnC,CAAC,cAAA,CAAe,QAAA,CAAS,oBAAoB,CAAA,EAC5C;AACD,QAAA,IAAI,CAAC,cAAA,CAAe,QAAA,CAAS,oBAAoB,CAAA,EAAG;AACnD,UAAA,cAAA,GAAiB,CAAA;AAAA,EAA8B,cAAc;AAAA,CAAA,CAAA;AAAA,QAC9D;AAAA,MACD;AAEA,MAAA,MAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA,MAAA,EAiBd,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAAA,CAAA;AAWnB,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,IAAI,EAAA,CAAG,MAAA,CAAO,UAAA,EAAY;AAAA,UACxC,UAAU,CAAA,aAAA,EAAgB,IAAA,CAAK,UAAU,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA;AAAA,SACpD,CAAA;AAGD,QAAA,IACC,CAAC,OAAA,CAAQ,GAAA,CAAI,MAAA,IACb,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,IAC5B,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAChC;AACD,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAC7B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,UAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,UAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,UAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,UAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,UAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,QAC9B;AAKA,QAAA,MAAM,OAAA,GAAU,EAAA,CAAG,aAAA,CAAc,UAAA,EAAY;AAAA,UAC5C,IAAA,EAAM,cAAA;AAAA,UACN,MAAA,EAAQ,gBAAA;AAAA,UACR,aAAA,EAAe;AAAA,SACf,CAAA;AAGD,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,CAAa,OAAA,EAAS;AAAA,UAC3C,OAAA,EAAS,GAAA;AAAA,UACT,aAAA,EAAe,IAAA;AAAA,UACf,aAAA,EAAe;AAAA,SACf,CAAA;AAGD,QAAA,MAAM,WACL,OAAO,aAAA,KAAkB,WACtB,aAAA,GACA,aAAA,CAAc,SAAS,OAAO,CAAA;AAClC,QAAA,MAAM,QAAA,GAAW,4BAA4B,QAAQ,CAAA;AAErD,QAAA,IAAI,WAAW,GAAA,EAAS;AACvB,UAAA,MAAM,IAAI,KAAA;AAAA,YACT;AAAA,WACD;AAAA,QACD;AAEA,QAAA,OAAO,EAAE,MAAA,EAAQ,YAAA,EAAc,QAAA,EAAS;AAAA,MACzC,SAAS,KAAA,EAAO;AACf,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kBAAA,EAAqB,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,mBAAmB,CAAA;AAAA,SAClF;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAa,QAAA,GAA0B;AACtC,IAAA,IAAI;AACH,MAAA,IAAI,IAAA,CAAK,YAAA,EAAc,MAAM,IAAA,CAAK,aAAa,KAAA,EAAM;AACrD,MAAA,IAAI,IAAA,CAAK,YAAA,EAAc,MAAM,IAAA,CAAK,aAAa,KAAA,EAAM;AACrD,MAAA,MAAS,EAAA,CAAA,EAAA,CAAG,KAAK,UAAA,EAAY,EAAE,WAAW,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,IAC9D,SAAS,EAAA,EAAI;AAAA,IAEb;AAAA,EACD;AACD","file":"chunk-7BSCUYUE.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport class GuardianError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(`AST Sec-Policy Violation: ${message}`);\n\t\tthis.name = \"GuardianError\";\n\t}\n}\n\n/**\n * The Guardian-TS Module\n * Scans the Abstract Syntax Tree (AST) imports of incoming WASM\n * before it reaches the V8 Wasmtime engine to prevent sandbox-escape\n * zero-days, resource exhaustion bombs, and evasive execution.\n */\nexport const ASTGuardian = {\n\t/**\n\t * Analyzes the WebAssembly Module interface proactively.\n\t *\n\t * @param module - The compiled WebAssembly.Module to inspect\n\t * @throws {GuardianError} If illegal imports or capabilities are detected\n\t */\n\tanalyze(module: WebAssembly.Module): void {\n\t\tconst imports = WebAssembly.Module.imports(module);\n\t\tlet _importCount = 0;\n\n\t\tconst ALLOWED_WASI_FUNCTIONS = new Set([\n\t\t\t\"fd_write\",\n\t\t\t\"fd_read\",\n\t\t\t\"fd_close\",\n\t\t\t\"fd_seek\",\n\t\t\t\"environ_get\",\n\t\t\t\"environ_sizes_get\",\n\t\t\t\"args_get\",\n\t\t\t\"args_sizes_get\",\n\t\t\t\"clock_time_get\",\n\t\t\t\"random_get\",\n\t\t\t\"proc_exit\",\n\t\t\t\"fd_prestat_get\",\n\t\t\t\"fd_prestat_dir_name\",\n\t\t\t\"fd_fdstat_get\",\n\t\t]);\n\n\t\tfor (const imp of imports) {\n\t\t\t// Strict Sandbox Validation: Only allow WASI preview 1 specific whitelisted functions.\n\t\t\tif (imp.module === \"wasi_snapshot_preview1\") {\n\t\t\t\tif (!ALLOWED_WASI_FUNCTIONS.has(imp.name)) {\n\t\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t\t`Banned WASI Import Detected: ${imp.module}/${imp.name}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t`Banned Host Import Module Detected: ${imp.module}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\t_importCount++;\n\n\t\t\tif (_importCount > 128) {\n\t\t\t\tthrow new GuardianError(\n\t\t\t\t\t\"Import limit exceeded. Possible resource exhaustion attack.\",\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// In Node.js / V8, the maximum module size and function limits\n\t\t// are natively enforced by the engine during compilation.\n\t\t// A successfully compiled WebAssembly.Module already passed structural checks.\n\t},\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport crypto from \"node:crypto\";\nimport * as fs from \"node:fs/promises\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\nimport vm from \"node:vm\";\nimport { WASI } from \"node:wasi\";\nimport * as acorn from \"acorn\";\nimport { simple } from \"acorn-walk\";\nimport { ASTGuardian } from \"./guardian.js\";\n\n// Silence Node.js ExperimentalWarning for WASI (Industrial console parity)\nconst originalEmit = process.emit;\n// @ts-expect-error\nprocess.emit = (name, data, ...args) => {\n\tif (\n\t\t(name === \"warning\" &&\n\t\t\ttypeof data === \"object\" &&\n\t\t\t(data as Record<string, unknown>).name === \"ExperimentalWarning\" &&\n\t\t\tString((data as Record<string, unknown>).message).includes(\"WASI\")) ||\n\t\tString((data as Record<string, unknown>).message).includes(\"importing WASI\")\n\t) {\n\t\treturn false;\n\t}\n\treturn originalEmit.call(process, name, data, ...args);\n};\n\n/**\n * Returns a filtered environment object containing only safe system variables,\n * preventing exposure of sensitive credentials and shell function injection.\n */\nexport function getDefaultEnvironment(): Record<string, string> {\n\tconst isWindows = process.platform === \"win32\";\n\tconst safeKeys = isWindows\n\t\t? [\n\t\t\t\t\"APPDATA\",\n\t\t\t\t\"HOMEDRIVE\",\n\t\t\t\t\"HOMEPATH\",\n\t\t\t\t\"LOCALAPPDATA\",\n\t\t\t\t\"PATH\",\n\t\t\t\t\"PROCESSOR_ARCHITECTURE\",\n\t\t\t\t\"SYSTEMDRIVE\",\n\t\t\t\t\"SYSTEMROOT\",\n\t\t\t\t\"TEMP\",\n\t\t\t\t\"USERNAME\",\n\t\t\t\t\"USERPROFILE\",\n\t\t\t\t\"PROGRAMFILES\",\n\t\t\t]\n\t\t: [\"HOME\", \"LOGNAME\", \"PATH\", \"SHELL\", \"TERM\", \"USER\"];\n\n\tconst env: Record<string, string> = {\n\t\tNODE_ENV: \"production\",\n\t\tLIOP_NODE: \"true\",\n\t};\n\n\tfor (const key of safeKeys) {\n\t\tconst val = process.env[key];\n\t\tif (val !== undefined && !val.startsWith(\"()\")) {\n\t\t\tenv[key] = val;\n\t\t}\n\t}\n\n\treturn env;\n}\n\n/**\n * Calculates deterministic execution fuel units based on AST instruction complexity.\n * Guarantees identical fuel consumption for the same logic across different hardware.\n */\nexport function calculateAstInstructionFuel(code: string): number {\n\ttry {\n\t\tconst ast = acorn.parse(code, {\n\t\t\tecmaVersion: 2022,\n\t\t\tsourceType: \"script\",\n\t\t\tallowReturnOutsideFunction: true,\n\t\t});\n\n\t\tlet score = 100; // Base fuel for VM initialization & envelope parsing\n\n\t\tsimple(ast, {\n\t\t\tIdentifier() {\n\t\t\t\tscore += 1;\n\t\t\t},\n\t\t\tLiteral() {\n\t\t\t\tscore += 1;\n\t\t\t},\n\t\t\tBinaryExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\tUnaryExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\tLogicalExpression() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tVariableDeclaration(node: any) {\n\t\t\t\tscore += 5 * (node.declarations?.length || 1);\n\t\t\t},\n\t\t\tAssignmentExpression() {\n\t\t\t\tscore += 3;\n\t\t\t},\n\t\t\tMemberExpression() {\n\t\t\t\tscore += 3;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tObjectExpression(node: any) {\n\t\t\t\tscore += 5 + (node.properties?.length || 0) * 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tArrayExpression(node: any) {\n\t\t\t\tscore += 5 + (node.elements?.length || 0) * 2;\n\t\t\t},\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: ESTree node\n\t\t\tCallExpression(node: any) {\n\t\t\t\tscore += 10 + (node.arguments?.length || 0) * 2;\n\t\t\t},\n\t\t\tFunctionDeclaration() {\n\t\t\t\tscore += 20;\n\t\t\t},\n\t\t\tFunctionExpression() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tArrowFunctionExpression() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tIfStatement() {\n\t\t\t\tscore += 5;\n\t\t\t},\n\t\t\tSwitchStatement() {\n\t\t\t\tscore += 10;\n\t\t\t},\n\t\t\tForStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tForInStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tForOfStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tWhileStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tDoWhileStatement() {\n\t\t\t\tscore += 50;\n\t\t\t},\n\t\t\tTryStatement() {\n\t\t\t\tscore += 15;\n\t\t\t},\n\t\t\tReturnStatement() {\n\t\t\t\tscore += 2;\n\t\t\t},\n\t\t});\n\n\t\t// Normalize to buckets of 100 to prevent timing side-channel inference\n\t\treturn Math.ceil(score / 100) * 100;\n\t} catch (_e) {\n\t\t// Fallback for non-JS or unparseable code\n\t\treturn 500;\n\t}\n}\n\nexport interface SandboxConfig {\n\tallowEnv?: boolean;\n\tallowedDirectories?: Record<string, string>; // guestPath -> hostPath\n\tmemoryLimitMb?: number;\n}\n\n/**\n * LIOP WasiSandbox (Industrial Grade)\n *\n * Provides a production-grade isolated environment for executing untrusted logic.\n * Primarily uses WebAssembly (WASI) for byte-code isolation, with a hardened\n * V8 Isolate fallback for dynamic JS-to-WASM logic injection.\n */\nexport class WasiSandbox {\n\tprivate wasi!: WASI;\n\tprivate sandboxId: string;\n\tprivate workingDir: string;\n\tprivate config: SandboxConfig;\n\tprivate stdoutHandle: fs.FileHandle | null = null;\n\tprivate stderrHandle: fs.FileHandle | null = null;\n\n\tconstructor(config: SandboxConfig = {}) {\n\t\tthis.sandboxId = crypto.randomUUID();\n\t\t// Use a dedicated LIOP directory in the OS temp folder\n\t\tthis.workingDir = path.join(\n\t\t\tos.tmpdir(),\n\t\t\t\"liop-mesh\",\n\t\t\t\"sandboxes\",\n\t\t\tthis.sandboxId,\n\t\t);\n\t\tthis.config = config;\n\t}\n\n\t/**\n\t * Initializes the physical sandbox environment with strict directory lockdown.\n\t */\n\tpublic async init(): Promise<void> {\n\t\ttry {\n\t\t\tawait fs.mkdir(this.workingDir, { recursive: true });\n\n\t\t\t// Initialize WASI with explicit limits\n\t\t\tthis.stdoutHandle = await fs.open(\n\t\t\t\tpath.join(this.workingDir, \"stdout.log\"),\n\t\t\t\t\"w+\",\n\t\t\t);\n\t\t\tthis.stderrHandle = await fs.open(\n\t\t\t\tpath.join(this.workingDir, \"stderr.log\"),\n\t\t\t\t\"w+\",\n\t\t\t);\n\n\t\t\tthis.wasi = new WASI({\n\t\t\t\tversion: \"preview1\",\n\t\t\t\targs: [\"liop_runtime\"],\n\t\t\t\tenv: this.config.allowEnv\n\t\t\t\t\t? { ...getDefaultEnvironment(), RUNTIME_ID: this.sandboxId }\n\t\t\t\t\t: {\n\t\t\t\t\t\t\tNODE_ENV: \"production\",\n\t\t\t\t\t\t\tLIOP_NODE: \"true\",\n\t\t\t\t\t\t\tRUNTIME_ID: this.sandboxId,\n\t\t\t\t\t\t},\n\t\t\t\tpreopens: {\n\t\t\t\t\t\"/sandbox\": this.workingDir,\n\t\t\t\t\t...this.config.allowedDirectories,\n\t\t\t\t},\n\t\t\t\tstdout: this.stdoutHandle.fd,\n\t\t\t\tstderr: this.stderrHandle.fd,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Sandbox Initialization Failed: ${error instanceof Error ? error.message : \"FS Error\"}`,\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Executes logic (WASM or JS-Wrapped) with hard resource limits.\n\t */\n\tpublic async execute(\n\t\tcompiledLogic: Buffer | string,\n\t\trecords: Record<string, unknown>[] = [],\n\t\tinputs: Record<string, unknown> = {},\n\t): Promise<{ output: unknown; fuelConsumed: number }> {\n\t\tconst startTime = performance.now();\n\n\t\tif (compiledLogic instanceof Buffer) {\n\t\t\t// Path A: Native WebAssembly Isolation\n\t\t\ttry {\n\t\t\t\tconst module = await WebAssembly.compile(new Uint8Array(compiledLogic));\n\n\t\t\t\t// Tier-0 Guardian: Static analysis to prevent sandbox escapes\n\t\t\t\tASTGuardian.analyze(module);\n\n\t\t\t\tconst instance = await WebAssembly.instantiate(\n\t\t\t\t\tmodule,\n\t\t\t\t\tthis.wasi.getImportObject() as WebAssembly.Imports,\n\t\t\t\t);\n\n\t\t\t\t// Standard entry point\n\t\t\t\tthis.wasi.start(instance);\n\n\t\t\t\t// Capture output from the sandbox\n\t\t\t\tconst stdoutPath = path.join(this.workingDir, \"stdout.log\");\n\t\t\t\tconst stderrPath = path.join(this.workingDir, \"stderr.log\");\n\t\t\t\tconst stdout = await fs.readFile(stdoutPath, \"utf-8\");\n\t\t\t\tconst stderr = await fs.readFile(stderrPath, \"utf-8\");\n\n\t\t\t\tconst duration = performance.now() - startTime;\n\t\t\t\treturn {\n\t\t\t\t\toutput:\n\t\t\t\t\t\tstdout || (stderr ? `Error: ${stderr}` : \"WASM_EXECUTION_SUCCESS\"),\n\t\t\t\t\tfuelConsumed: Math.floor(duration * 1000),\n\t\t\t\t};\n\t\t\t} catch (error: unknown) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`WASM Runtime Error: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t\t);\n\t\t\t}\n\t\t} else {\n\t\t\t// Path B: Hardened V8 Isolate Fallback\n\t\t\t// Uses node:vm with zero-prototype objects to prevent prototype pollution escapes.\n\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for Sandbox global poisoning\n\t\t\tconst sandboxEnv: any = Object.create(null); // Isolated global object\n\t\t\tconst env = { records, ...inputs };\n\n\t\t\t// Explicitly poison Node.js escape vectors in the context\n\t\t\tsandboxEnv.require = undefined;\n\t\t\tsandboxEnv.process = undefined;\n\t\t\tsandboxEnv.global = undefined;\n\t\t\tsandboxEnv.globalThis = undefined;\n\t\t\tsandboxEnv.Buffer = undefined;\n\t\t\tsandboxEnv.setTimeout = undefined;\n\t\t\tsandboxEnv.setInterval = undefined;\n\t\t\tsandboxEnv.setImmediate = undefined;\n\t\t\tsandboxEnv.queueMicrotask = undefined;\n\t\t\tsandboxEnv.eval = undefined;\n\t\t\tsandboxEnv.Function = undefined;\n\t\t\tsandboxEnv.SharedArrayBuffer = undefined;\n\t\t\tsandboxEnv.Date = undefined;\n\n\t\t\t// [DoS Defense] Block off-heap memory allocation vectors.\n\t\t\t// Logic-on-Origin operates on JSON data (env.records) — binary buffers\n\t\t\t// serve no legitimate purpose and enable memory exhaustion DoS.\n\t\t\t// (Uint8Array(2GB) bypassed Piscina's maxOldGenerationSizeMb limit)\n\t\t\tsandboxEnv.ArrayBuffer = undefined;\n\t\t\tsandboxEnv.Uint8Array = undefined;\n\t\t\tsandboxEnv.Int8Array = undefined;\n\t\t\tsandboxEnv.Uint16Array = undefined;\n\t\t\tsandboxEnv.Int16Array = undefined;\n\t\t\tsandboxEnv.Uint32Array = undefined;\n\t\t\tsandboxEnv.Int32Array = undefined;\n\t\t\tsandboxEnv.Float32Array = undefined;\n\t\t\tsandboxEnv.Float64Array = undefined;\n\t\t\tsandboxEnv.BigInt64Array = undefined;\n\t\t\tsandboxEnv.BigUint64Array = undefined;\n\t\t\tsandboxEnv.DataView = undefined;\n\n\t\t\t// Recurse and strip prototype chain from host-passed objects to prevent escaping via constructor\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for recursive null prototype mapping\n\t\t\tconst toNullPrototype = (obj: any): any => {\n\t\t\t\tif (!obj || typeof obj !== \"object\") {\n\t\t\t\t\treturn obj;\n\t\t\t\t}\n\t\t\t\tif (Array.isArray(obj)) {\n\t\t\t\t\treturn obj.map(toNullPrototype);\n\t\t\t\t}\n\t\t\t\tconst clone = Object.create(null);\n\t\t\t\tfor (const [key, val] of Object.entries(obj)) {\n\t\t\t\t\tclone[key] = toNullPrototype(val);\n\t\t\t\t}\n\t\t\t\treturn clone;\n\t\t\t};\n\n\t\t\t// Inject strictly monitored globals\n\t\t\tsandboxEnv.records = toNullPrototype(JSON.parse(JSON.stringify(records))); // Deep copy safety + null prototype\n\t\t\tsandboxEnv.env = toNullPrototype(JSON.parse(JSON.stringify(env)));\n\n\t\t\tfor (const [key, value] of Object.entries(inputs)) {\n\t\t\t\tsandboxEnv[key] = toNullPrototype(JSON.parse(JSON.stringify(value)));\n\t\t\t}\n\n\t\t\t// Freeze the sandbox context to prevent mutation (SEC-GAP-1)\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Required for recursive deep freeze of unknown data\n\t\t\tconst deepFreeze = (obj: any) => {\n\t\t\t\tif (obj && typeof obj === \"object\" && !Object.isFrozen(obj)) {\n\t\t\t\t\tObject.freeze(obj);\n\t\t\t\t\tfor (const key of Object.keys(obj)) {\n\t\t\t\t\t\tdeepFreeze(obj[key]);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn obj;\n\t\t\t};\n\n\t\t\tdeepFreeze(sandboxEnv.records);\n\t\t\tdeepFreeze(sandboxEnv.env);\n\n\t\t\t// Prevent property addition/modification on global scope\n\t\t\tfor (const key of Object.keys(sandboxEnv)) {\n\t\t\t\tObject.defineProperty(sandboxEnv, key, {\n\t\t\t\t\twritable: false,\n\t\t\t\t\tconfigurable: false,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// LIOP Execution Wrapper\n\t\t\t// Host-side logic transformation to avoid 'new Function' in sandbox\n\t\t\tlet processedLogic = String(compiledLogic);\n\t\t\tif (\n\t\t\t\t/^\\s*return\\s/m.test(processedLogic) ||\n\t\t\t\t!processedLogic.includes(\"function liop_main\")\n\t\t\t) {\n\t\t\t\tif (!processedLogic.includes(\"function liop_main\")) {\n\t\t\t\t\tprocessedLogic = `function liop_main(env) {\\n${processedLogic}\\n}`;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst scriptCode = `\n\t\t\t\t(function() {\n\t\t\t\t\t\"use strict\";\n\t\t\t\t\ttry {\n\t\t\t\t\t\t// Pre-execution prototype freezing (PCI-DSS Compliance)\n\t\t\t\t\t\tObject.freeze(Object.prototype);\n\t\t\t\t\t\tObject.freeze(Array.prototype);\n\t\t\t\t\t\tObject.freeze(String.prototype);\n\t\t\t\t\t\tObject.freeze(Number.prototype);\n\t\t\t\t\t\tObject.freeze(Boolean.prototype);\n\t\t\t\t\t\tObject.freeze(RegExp.prototype);\n\t\t\t\t\t\tObject.freeze(Map.prototype);\n\t\t\t\t\t\tObject.freeze(Set.prototype);\n\t\t\t\t\t\tObject.freeze(Promise.prototype);\n\t\t\t\t\t\tObject.freeze(Error.prototype);\n\t\t\t\t\t\tObject.freeze(Object.getPrototypeOf(function(){}));\n\n\t\t\t\t\t\t${processedLogic}\n\t\t\t\t\t\tif (typeof liop_main === 'function') {\n\t\t\t\t\t\t\treturn liop_main(env);\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn \"ERR_NO_ENTRY_POINT\";\n\t\t\t\t\t} catch(e) {\n\t\t\t\t\t\treturn \"LogicError: \" + e.message;\n\t\t\t\t\t}\n\t\t\t\t})();\n\t\t\t`;\n\n\t\t\ttry {\n\t\t\t\tconst script = new vm.Script(scriptCode, {\n\t\t\t\t\tfilename: `liop-sandbox-${this.sandboxId.slice(0, 8)}.js`,\n\t\t\t\t});\n\n\t\t\t\t// Freeze Host prototypes in production (non-test environments) to completely block Prototype Pollution\n\t\t\t\tif (\n\t\t\t\t\t!process.env.VITEST &&\n\t\t\t\t\ttypeof Object.prototype === \"object\" &&\n\t\t\t\t\t!Object.isFrozen(Object.prototype)\n\t\t\t\t) {\n\t\t\t\t\tObject.freeze(Object.prototype);\n\t\t\t\t\tObject.freeze(Array.prototype);\n\t\t\t\t\tObject.freeze(String.prototype);\n\t\t\t\t\tObject.freeze(Number.prototype);\n\t\t\t\t\tObject.freeze(Boolean.prototype);\n\t\t\t\t\tObject.freeze(RegExp.prototype);\n\t\t\t\t\tObject.freeze(Map.prototype);\n\t\t\t\t\tObject.freeze(Set.prototype);\n\t\t\t\t\tObject.freeze(Promise.prototype);\n\t\t\t\t\tObject.freeze(Error.prototype);\n\t\t\t\t}\n\n\t\t\t\t// microtaskMode: Ensures Promises created inside the sandbox are\n\t\t\t\t// resolved within the timeout/breakOnSigint scope (Node.js ≥14.6).\n\t\t\t\t// Without this, async microtasks could escape the 5s CPU limit.\n\t\t\t\tconst context = vm.createContext(sandboxEnv, {\n\t\t\t\t\tname: \"LIOP Isolate\",\n\t\t\t\t\torigin: \"liop://sandbox\",\n\t\t\t\t\tmicrotaskMode: \"afterEvaluate\",\n\t\t\t\t});\n\n\t\t\t\t// Execution with hard CPU and Memory limits (Fuel)\n\t\t\t\tconst output = script.runInContext(context, {\n\t\t\t\t\ttimeout: 5000,\n\t\t\t\t\tbreakOnSigint: true,\n\t\t\t\t\tdisplayErrors: true,\n\t\t\t\t});\n\n\t\t\t\t// [Phase Beta-3] Deterministic AST Instruction Fuel Metering (SOC 2 / Zero Hardware Drift)\n\t\t\t\tconst logicStr =\n\t\t\t\t\ttypeof compiledLogic === \"string\"\n\t\t\t\t\t\t? compiledLogic\n\t\t\t\t\t\t: compiledLogic.toString(\"utf-8\");\n\t\t\t\tconst fuelUsed = calculateAstInstructionFuel(logicStr);\n\n\t\t\t\tif (fuelUsed > 1000000) {\n\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\"LIOP_RESOURCE_EXHAUSTED: Execution fuel limit exceeded.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\treturn { output, fuelConsumed: fuelUsed };\n\t\t\t} catch (error) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`V8 Isolate Fault: ${error instanceof Error ? error.message : \"Execution Timeout\"}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Physically cleans up the sandbox and releases resources.\n\t */\n\tpublic async teardown(): Promise<void> {\n\t\ttry {\n\t\t\tif (this.stdoutHandle) await this.stdoutHandle.close();\n\t\t\tif (this.stderrHandle) await this.stderrHandle.close();\n\t\t\tawait fs.rm(this.workingDir, { recursive: true, force: true });\n\t\t} catch (_e) {\n\t\t\t// Silent fail on teardown to prevent process crashes\n\t\t}\n\t}\n}\n"]}

package/dist/{chunk-QLCOEP5J.js → chunk-7PITYWOV.js}

@@ -64,5 +64,5 @@ var Kyber768Wrapper = {
 };
 
 export { Kyber768Wrapper };
-//# sourceMappingURL=chunk-QLCOEP5J.js.map
-//# sourceMappingURL=chunk-QLCOEP5J.js.map
+//# sourceMappingURL=chunk-7PITYWOV.js.map
+//# sourceMappingURL=chunk-7PITYWOV.js.map

package/dist/chunk-7PITYWOV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/crypto/kyber.ts"],"names":[],"mappings":";;;AAiBA,IAAI,WAAA,GAAiE,IAAA;AAErE,eAAe,cAAA,GAAiB;AAC/B,EAAA,IAAI,CAAC,WAAA,EAAa;AACjB,IAAA,WAAA,GAAc,MAAM,cAAA,EAAe;AAAA,EACpC;AACA,EAAA,OAAO,WAAA;AACR;AAEO,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,WAAW,IAAA,EAAM;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,0DAAA,EAA6D,OAAO,MAAM,CAAA,CAAA;AAAA,OAC3E;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,sBAAsB,SAAA,EAGzB;AACF,IAAA,IAAI;AACH,MAAA,IAAI,SAAA,CAAU,WAAW,IAAA,EAAM;AAC9B,QAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,MAClE;AAEA,MAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,MAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,GAAA,CAAI,MAAM,SAAS,CAAA;AAEpC,MAAA,OAAO;AAAA,QACN,UAAA,EAAY,EAAA;AAAA,QACZ,YAAA,EAAc;AAAA,OACf;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAyC,MAAgB,OAAO,CAAA;AAAA,OACjE;AAAA,IACD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,eAAA,GAGH;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,MAAM,CAAC,EAAA,EAAI,EAAE,CAAA,GAAI,IAAI,eAAA,EAAgB;AACrC,IAAA,OAAO;AAAA,MACN,SAAA,EAAW,EAAA;AAAA,MACX,SAAA,EAAW;AAAA,KACZ;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAA,CACL,UAAA,EACA,SAAA,EACsB;AACtB,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,OAAO,GAAA,CAAI,KAAA,CAAM,UAAA,EAAY,SAAS,CAAA;AAAA,EACvC;AACD","file":"chunk-7PITYWOV.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { createMlKem768 } from \"mlkem\";\n\n/**\n * LIOP Post-Quantum Cryptography Wrapper\n * Implements ML-KEM-768 (NIST FIPS 203) for Zero-Trust secure key encapsulation\n * directly compatible with `pqcrypto-kyber` on the Mesh-Node Backend.\n *\n * Uses the `mlkem` package which provides:\n * - FIPS 203 compliance (ML-KEM standard)\n * - Constant-time validation (KyberSlash patched)\n * - ~3.5x performance improvement over legacy crystals-kyber\n */\n\n/** Lazy-initialized singleton for the ML-KEM-768 engine */\nlet kemInstance: Awaited<ReturnType<typeof createMlKem768>> | null = null;\n\nasync function getKemInstance() {\n\tif (!kemInstance) {\n\t\tkemInstance = await createMlKem768();\n\t}\n\treturn kemInstance;\n}\n\nexport const Kyber768Wrapper = {\n\t/**\n\t * Extracts and validates the 1184-byte Public Key from the Rust LIOP Data Node\n\t * @param buffer Raw buffer sent via gRPC IntentResponse\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== 1184) {\n\t\t\tthrow new Error(\n\t\t\t\t`Kyber768 Public Key must be exactly 1184 bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Encapsulates a shared secret using the server's public key.\n\t * Returns the 1088-byte ciphertext to be sent back, and the 32-byte shared AES secret.\n\t */\n\tasync encapsulateAsymmetric(publicKey: Uint8Array): Promise<{\n\t\tciphertext: Uint8Array;\n\t\tsharedSecret: Uint8Array;\n\t}> {\n\t\ttry {\n\t\t\tif (publicKey.length !== 1184) {\n\t\t\t\tthrow new Error(\"Kyber768 Public Key must be exactly 1184 bytes.\");\n\t\t\t}\n\n\t\t\tconst kem = await getKemInstance();\n\t\t\tconst [ct, ss] = kem.encap(publicKey);\n\n\t\t\treturn {\n\t\t\t\tciphertext: ct,\n\t\t\t\tsharedSecret: ss,\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`Failed to perform PQC encapsulation: ${(error as Error).message}`,\n\t\t\t);\n\t\t}\n\t},\n\n\t/**\n\t * Generates a Kyber768 KeyPair for the server to accept intents.\n\t */\n\tasync generateKeyPair(): Promise<{\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t}> {\n\t\tconst kem = await getKemInstance();\n\t\tconst [pk, sk] = kem.generateKeyPair();\n\t\treturn {\n\t\t\tpublicKey: pk,\n\t\t\tsecretKey: sk,\n\t\t};\n\t},\n\n\t/**\n\t * Decapsulates the shared secret using the server's secret key.\n\t * Zero-fills the shared secret buffer after extraction for side-channel protection.\n\t */\n\tasync decapsulateSymmetric(\n\t\tciphertext: Uint8Array,\n\t\tsecretKey: Uint8Array,\n\t): Promise<Uint8Array> {\n\t\tconst kem = await getKemInstance();\n\t\treturn kem.decap(ciphertext, secretKey);\n\t},\n};\n"]}

package/dist/{chunk-T5IUZF47.js → chunk-EJ426URA.js}

@@ -1,6 +1,7 @@
-import { LiopMcpRouter } from './chunk-547TYL27.js';
-import { LIOP_SCOPES, meshPeersConnected, manifestCacheSize, protocolMetrics } from './chunk-U5BZ66VX.js';
-import { log } from './chunk-72MNYFR6.js';
+import { LiopMcpRouter } from './chunk-VRB5HUYU.js';
+import { LIOP_SCOPES } from './chunk-WPTOJYN5.js';
+import { meshPeersConnected, manifestCacheSize, protocolMetrics } from './chunk-PAICJCKJ.js';
+import { log } from './chunk-K3DGJLUY.js';
 import * as http from 'http';
 import * as http2 from 'http2';
 import * as net from 'net';
@@ -122,6 +123,53 @@ async function dispatchGrpcWebRequest(req, res, handler) {
   });
 }
 
+// src/gateway/interceptor.ts
+var DEFAULT_TIMEOUT_MS = 2500;
+async function executeGatewayInterceptor(request, context, options) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const failMode = options.failMode ?? "closed";
+  const signal = AbortSignal.timeout(timeoutMs);
+  const frozenRequest = Object.freeze(structuredClone(request));
+  let onAbortListener;
+  const abortPromise = new Promise((_, reject) => {
+    onAbortListener = () => reject(signal.reason);
+    signal.addEventListener("abort", onAbortListener, { once: true });
+  });
+  try {
+    const result = await Promise.race([
+      Promise.resolve(
+        options.interceptor(frozenRequest, { ...context, signal })
+      ),
+      abortPromise
+    ]);
+    return result;
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    if (failMode === "open") {
+      log.warn(
+        `[LIOP-Gateway] Interceptor error (fail-open, allowing request): ${errorMessage}`
+      );
+      return {
+        allowed: true,
+        metadata: { interceptorError: errorMessage, failMode: "open" }
+      };
+    }
+    log.error(
+      `[LIOP-Gateway] Interceptor error (fail-closed, rejecting request): ${errorMessage}`
+    );
+    return {
+      allowed: false,
+      reason: `Interceptor unavailable: ${errorMessage}`,
+      errorCode: -32098,
+      metadata: { interceptorError: errorMessage, failMode: "closed" }
+    };
+  } finally {
+    if (onAbortListener) {
+      signal.removeEventListener("abort", onAbortListener);
+    }
+  }
+}
+
 // src/gateway/rate-limiter.ts
 var InMemoryRateLimiter = class {
   windowMs;
@@ -205,12 +253,13 @@ var InMemoryRateLimiter = class {
 
 // src/gateway/hybrid.ts
 var LiopHybridGateway = class {
-  constructor(liopServer, meshNode = null, rpcPort = 50051, rateLimiterOptions) {
+  constructor(liopServer, meshNode = null, rpcPort = 50051, rateLimiterOptions, interceptorOptions) {
     this.liopServer = liopServer;
     this.meshNode = meshNode;
     this.jwtValidator = this.liopServer.jwtValidator;
     this.oauthProvider = this.liopServer.oauthProvider;
     this.rateLimiter = new InMemoryRateLimiter(rateLimiterOptions);
+    this.interceptorOptions = interceptorOptions;
     this.router = new LiopMcpRouter(this.liopServer, this.meshNode, rpcPort);
     this.h2Server = http2.createServer();
     this.setupH2Routes();
@@ -254,6 +303,7 @@ var LiopHybridGateway = class {
   // biome-ignore lint/suspicious/noExplicitAny: oidc-provider is loaded in Phase C
   oauthProvider;
   rateLimiter;
+  interceptorOptions;
   isDraining = false;
   activeRequests = 0;
   setupH2Routes() {
@@ -413,6 +463,11 @@ var LiopHybridGateway = class {
               token_endpoint: `${baseUrl}/token`
             } : {}
           } : void 0;
+          const topologyInfo = {
+            tier: this.meshNode?.isPrivateNetwork?.() ? 1 : 2,
+            prmEndpoint: this.jwtValidator ? "/.well-known/oauth-protected-resource" : void 0,
+            transportCapabilities: ["http-mcp", "grpc-lio", "p2p-dht"]
+          };
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(
             JSON.stringify({
@@ -421,6 +476,7 @@ var LiopHybridGateway = class {
               mesh: meshInfo,
               tools: this.liopServer.listTools().map((t) => t.name),
               auth: authInfoResponse,
+              topology: topologyInfo,
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             })
           );
@@ -489,6 +545,27 @@ var LiopHybridGateway = class {
           }
           try {
             const jsonRequest = JSON.parse(body);
+            if (this.interceptorOptions?.interceptor) {
+              const verdict = await executeGatewayInterceptor(
+                jsonRequest,
+                { clientIp, authInfo, protocol: "http1" },
+                this.interceptorOptions
+              );
+              if (!verdict.allowed) {
+                res.writeHead(403, { "Content-Type": "application/json" });
+                res.end(
+                  JSON.stringify({
+                    jsonrpc: "2.0",
+                    id: jsonRequest.id ?? null,
+                    error: {
+                      code: verdict.errorCode ?? -32099,
+                      message: verdict.reason || "Forbidden: Rejected by Gateway Interceptor"
+                    }
+                  })
+                );
+                return;
+              }
+            }
             const mcpMethod = req.headers["mcp-method"];
             const mcpName = req.headers["mcp-name"];
             const mcpVersion = req.headers["mcp-protocol-version"];
@@ -591,6 +668,31 @@ var LiopHybridGateway = class {
           }
         }
         const jsonRequest = JSON.parse(body);
+        if (this.interceptorOptions?.interceptor) {
+          const h2ClientIp = stream.session?.socket?.remoteAddress || "127.0.0.1";
+          const verdict = await executeGatewayInterceptor(
+            jsonRequest,
+            { clientIp: h2ClientIp, authInfo, protocol: "http2" },
+            this.interceptorOptions
+          );
+          if (!verdict.allowed) {
+            stream.respond({
+              ":status": 403,
+              "content-type": "application/json"
+            });
+            stream.end(
+              JSON.stringify({
+                jsonrpc: "2.0",
+                id: jsonRequest.id ?? null,
+                error: {
+                  code: verdict.errorCode ?? -32099,
+                  message: verdict.reason || "Forbidden: Rejected by Gateway Interceptor"
+                }
+              })
+            );
+            return;
+          }
+        }
         const mcpMethod = headers["mcp-method"];
         const mcpName = headers["mcp-name"];
         const mcpVersion = headers["mcp-protocol-version"];
@@ -711,6 +813,6 @@ var LiopHybridGateway = class {
   }
 };
 
-export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, isGrpcWebRequest };
-//# sourceMappingURL=chunk-T5IUZF47.js.map
-//# sourceMappingURL=chunk-T5IUZF47.js.map
+export { GRPC_WEB_CONSTANTS, InMemoryRateLimiter, LiopHybridGateway, buildProtectedResourceMetadata, decodeFrames, dispatchGrpcWebRequest, encodeDataFrame, encodeTrailerFrame, executeGatewayInterceptor, isGrpcWebRequest };
+//# sourceMappingURL=chunk-EJ426URA.js.map
+//# sourceMappingURL=chunk-EJ426URA.js.map

package/dist/chunk-EJ426URA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/prm.ts","../src/gateway/grpc-web.ts","../src/gateway/interceptor.ts","../src/gateway/rate-limiter.ts","../src/gateway/hybrid.ts"],"names":[],"mappings":";;;;;;;;;AAuCO,SAAS,8BAAA,CACf,QACA,QAAA,EAC4B;AAC5B,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,QAAA;AAAA,IACV,qBAAA,EAAuB,CAAC,MAAM,CAAA;AAAA,IAC9B,gBAAA,EAAkB,WAAA;AAAA,IAClB,wBAAA,EAA0B,CAAC,QAAQ,CAAA;AAAA,IACnC,sBAAA,EAAwB;AAAA,GACzB;AACD;;;AC7BO,IAAM,kBAAA,GAAqB;AAAA,EACjC,SAAA,EAAW,CAAA;AAAA,EACX,aAAA,EAAe,GAAA;AAAA,EACf,aAAA,EAAe,CAAA;AAAA,EACf,mBAAA,EAAqB,sBAAA;AAAA,EACrB,SAAA,EAAW,CAAA;AAAA,EACX,gBAAA,EAAkB,CAAA;AAAA,EAClB,cAAA,EAAgB,CAAA;AAAA,EAChB,uBAAA,EAAyB,CAAA;AAAA,EACzB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,gBAAA,EAAkB,CAAA;AAAA,EAClB,wBAAA,EAA0B,CAAA;AAAA,EAC1B,sBAAA,EAAwB,EAAA;AAAA,EACxB,eAAA,EAAiB;AAClB;AAUO,SAAS,iBAAiB,WAAA,EAA+B;AAC/D,EAAA,IAAI,CAAC,aAAa,OAAO,KAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,YAAY,WAAA,EAAY;AACtC,EAAA,OACC,KAAA,CAAM,UAAA,CAAW,sBAAsB,CAAA,IACvC,KAAA,CAAM,WAAW,4BAA4B,CAAA,IAC7C,KAAA,CAAM,UAAA,CAAW,2BAA2B,CAAA;AAE9C;AAKO,SAAS,gBAAgB,OAAA,EAAsC;AACrE,EAAA,MAAM,GAAA,GAAM,OAAO,QAAA,CAAS,OAAO,IAAI,OAAA,GAAU,MAAA,CAAO,KAAK,OAAO,CAAA;AACpE,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,SAAA,EAAW,CAAC,CAAA;AACjD,EAAA,MAAA,CAAO,aAAA,CAAc,GAAA,CAAI,MAAA,EAAQ,CAAC,CAAA;AAClC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,GAAG,CAAC,CAAA;AACnC;AAKO,SAAS,kBAAA,CACf,SAAiB,kBAAA,CAAmB,SAAA,EACpC,UAAkB,EAAA,EAClB,cAAA,GAAyC,EAAC,EACjC;AACT,EAAA,MAAM,KAAA,GAAQ;AAAA,IACb,eAAe,MAAM,CAAA,CAAA;AAAA,IACrB,CAAA,aAAA,EAAgB,kBAAA,CAAmB,OAAO,CAAC,CAAA;AAAA,GAC5C;AAEA,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,cAAc,CAAA,EAAG;AAC1D,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,KAAK,CAAA,CAAE,CAAA;AAAA,EAC7B;AAEA,EAAA,MAAM,WAAA,GAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA;AAAA,CAAA;AACzC,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,OAAO,CAAA;AAEnD,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,kBAAA,CAAmB,aAAa,CAAA;AAC5D,EAAA,MAAA,CAAO,UAAA,CAAW,kBAAA,CAAmB,aAAA,EAAe,CAAC,CAAA;AACrD,EAAA,MAAA,CAAO,aAAA,CAAc,UAAA,CAAW,MAAA,EAAQ,CAAC,CAAA;AAEzC,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,MAAA,EAAQ,UAAU,CAAC,CAAA;AAC1C;AAKO,SAAS,aAAa,MAAA,EAAgC;AAC5D,EAAA,MAAM,SAAyB,EAAC;AAChC,EAAA,IAAI,MAAA,GAAS,CAAA;AAEb,EAAA,OAAO,MAAA,GAAS,kBAAA,CAAmB,aAAA,IAAiB,MAAA,CAAO,MAAA,EAAQ;AAClE,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,YAAA,CAAa,MAAA,GAAS,CAAC,CAAA;AAC7C,IAAA,MAAM,YAAA,GAAe,SAAS,kBAAA,CAAmB,aAAA;AACjD,IAAA,MAAM,aAAa,YAAA,GAAe,MAAA;AAElC,IAAA,IAAI,UAAA,GAAa,OAAO,MAAA,EAAQ;AAC/B,MAAA;AAAA,IACD;AAEA,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,CAAS,YAAA,EAAc,UAAU,CAAA;AACxD,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACX,SAAA,EAAA,CACE,IAAA,GAAO,kBAAA,CAAmB,aAAA,MAC3B,kBAAA,CAAmB,aAAA;AAAA,MACpB,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,OAAO;AAAA,KAC5B,CAAA;AAED,IAAA,MAAA,GAAS,UAAA;AAAA,EACV;AAEA,EAAA,OAAO,MAAA;AACR;AAMA,eAAsB,sBAAA,CACrB,GAAA,EACA,GAAA,EACA,OAAA,EAIgB;AAChB,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,GAAA,CAAI,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACjC,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EAClB,CAAC,CAAA;AAED,EAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AACzB,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AACrC,MAAA,MAAM,MAAA,GAAS,aAAa,QAAQ,CAAA;AACpC,MAAA,MAAM,WAAA,GACL,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,SAAS,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC5D,MAAA,MAAM,WAAA,GAAc,IAAI,GAAA,IAAO,GAAA;AAE/B,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,gCAAA,EAAmC,WAAW,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,CAAA,OAAA;AAAA,OACtE;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,WAAA,EAAa,WAAW,CAAA;AAErD,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,SAAA,CAAU,+BAA+B,GAAG,CAAA;AAChD,MAAA,GAAA,CAAI,SAAA;AAAA,QACH,+BAAA;AAAA,QACA;AAAA,OACD;AAGA,MAAA,IAAI,MAAA,CAAO,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,EAAG;AAC1C,QAAA,GAAA,CAAI,KAAA,CAAM,eAAA,CAAgB,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,MACvC;AAGA,MAAA,GAAA,CAAI,MAAM,kBAAA,CAAmB,MAAA,CAAO,QAAQ,MAAA,CAAO,OAAA,IAAW,EAAE,CAAC,CAAA;AACjE,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,CAAE,CAAA;AAC/C,MAAA,GAAA,CAAI,UAAA,GAAa,GAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,4BAA4B,CAAA;AAC1D,MAAA,GAAA,CAAI,KAAA;AAAA,QACH,kBAAA;AAAA,UACC,kBAAA,CAAmB,eAAA;AAAA,UAClB,MAAgB,OAAA,IAAW;AAAA;AAC7B,OACD;AACA,MAAA,GAAA,CAAI,GAAA,EAAI;AAAA,IACT;AAAA,EACD,CAAC,CAAA;AACF;;;AC3HA,IAAM,kBAAA,GAAqB,IAAA;AAW3B,eAAsB,yBAAA,CACrB,OAAA,EACA,OAAA,EACA,OAAA,EAEkC;AAClC,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACvC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,QAAA;AACrC,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAM5C,EAAA,MAAM,aAAA,GAAgB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,OAAO,CAAC,CAAA;AAE5D,EAAA,IAAI,eAAA;AACJ,EAAA,MAAM,YAAA,GAAe,IAAI,OAAA,CAAe,CAAC,GAAG,MAAA,KAAW;AACtD,IAAA,eAAA,GAAkB,MAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAC5C,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,eAAA,EAAiB,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EACjE,CAAC,CAAA;AAED,EAAA,IAAI;AACH,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,IAAA,CAAK;AAAA,MACjC,OAAA,CAAQ,OAAA;AAAA,QACP,QAAQ,WAAA,CAAY,aAAA,EAAe,EAAE,GAAG,OAAA,EAAS,QAAQ;AAAA,OAC1D;AAAA,MACA;AAAA,KACA,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACR,SAAS,KAAA,EAAgB;AACxB,IAAA,MAAM,eAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAE1E,IAAA,IAAI,aAAa,MAAA,EAAQ;AACxB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,mEAAmE,YAAY,CAAA;AAAA,OAChF;AACA,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,QAAA,EAAU,EAAE,gBAAA,EAAkB,YAAA,EAAc,UAAU,MAAA;AAAO,OAC9D;AAAA,IACD;AAGA,IAAA,GAAA,CAAI,KAAA;AAAA,MACH,sEAAsE,YAAY,CAAA;AAAA,KACnF;AACA,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,4BAA4B,YAAY,CAAA,CAAA;AAAA,MAChD,SAAA,EAAW,MAAA;AAAA,MACX,QAAA,EAAU,EAAE,gBAAA,EAAkB,YAAA,EAAc,UAAU,QAAA;AAAS,KAChE;AAAA,EACD,CAAA,SAAE;AACD,IAAA,IAAI,eAAA,EAAiB;AACpB,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,eAAe,CAAA;AAAA,IACpD;AAAA,EACD;AACD;;;ACnGO,IAAM,sBAAN,MAA0B;AAAA,EACf,QAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA,uBAAyC,GAAA,EAAI;AAAA,EACtD,YAAA;AAAA,EAER,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAG;AAC7C,IAAA,IAAA,CAAK,QAAA,GAAW,QAAQ,QAAA,IAAY,GAAA;AACpC,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,GAAA;AAG1C,IAAA,IAAA,CAAK,eAAe,WAAA,CAAY,MAAM,IAAA,CAAK,OAAA,IAAW,GAAM,CAAA;AAC5D,IAAA,IAAI,OAAO,IAAA,CAAK,YAAA,CAAa,KAAA,KAAU,UAAA,EAAY;AAClD,MAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,IACzB;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,MAAM,GAAA,EAA8B;AAC1C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAEjC,IAAA,IAAI,CAAC,MAAA,IAAU,GAAA,IAAO,MAAA,CAAO,SAAA,EAAW;AACvC,MAAA,MAAA,GAAS;AAAA,QACR,KAAA,EAAO,CAAA;AAAA,QACP,SAAA,EAAW,MAAM,IAAA,CAAK;AAAA,OACvB;AACA,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,MAAM,CAAA;AAC5B,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,IAAA;AAAA,QACT,SAAA,EAAW,KAAK,WAAA,GAAc,CAAA;AAAA,QAC9B,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK;AAAA,OACf;AAAA,IACD;AAEA,IAAA,IAAI,MAAA,CAAO,KAAA,IAAS,IAAA,CAAK,WAAA,EAAa;AACrC,MAAA,OAAO;AAAA,QACN,OAAA,EAAS,KAAA;AAAA,QACT,SAAA,EAAW,CAAA;AAAA,QACX,OAAO,IAAA,CAAK,WAAA;AAAA,QACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,OAC5C;AAAA,IACD;AAEA,IAAA,MAAA,CAAO,KAAA,EAAA;AACP,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,IAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,WAAA,GAAc,MAAA,CAAO,KAAA;AAAA,MACrC,OAAO,IAAA,CAAK,WAAA;AAAA,MACZ,SAAS,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,YAAY,GAAG;AAAA,KAC5C;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,MAAM,GAAA,EAAmB;AAC/B,IAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,MAAM,KAAK,IAAA,CAAK,OAAA,CAAQ,SAAQ,EAAG;AACnD,MAAA,IAAI,GAAA,IAAO,OAAO,SAAA,EAAW;AAC5B,QAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,MACxB;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,KAAA,GAAc;AACpB,IAAA,IAAI,KAAK,YAAA,EAAc;AACtB,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,MAAA;AAAA,IACrB;AACA,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACpB;AACD;;;ACrFO,IAAM,oBAAN,MAAwB;AAAA,EAa9B,YACS,UAAA,EACA,QAAA,GAA4B,MACpC,OAAA,GAAkB,KAAA,EAClB,oBACA,kBAAA,EACC;AALO,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAKR,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,UAAA,CAAW,YAAA;AACpC,IAAA,IAAA,CAAK,aAAA,GAAgB,KAAK,UAAA,CAAW,aAAA;AACrC,IAAA,IAAA,CAAK,WAAA,GAAc,IAAI,mBAAA,CAAoB,kBAAkB,CAAA;AAC7D,IAAA,IAAA,CAAK,kBAAA,GAAqB,kBAAA;AAG1B,IAAA,IAAA,CAAK,SAAS,IAAI,aAAA,CAAc,KAAK,UAAA,EAAY,IAAA,CAAK,UAAU,OAAO,CAAA;AAGvE,IAAA,IAAA,CAAK,WAAiB,KAAA,CAAA,YAAA,EAAa;AACnC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,WAAgB,IAAA,CAAA,YAAA,EAAa;AAClC,IAAA,IAAA,CAAK,aAAA,EAAc;AAGnB,IAAA,IAAA,CAAK,SAAA,GAAgB,GAAA,CAAA,YAAA,CAAa,CAAC,MAAA,KAAW;AAC7C,MAAA,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,CAAC,MAAA,KAAW;AAC/B,QAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,EAAS,CAAE,WAAW,gBAAgB,CAAA;AAC7D,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,iDAAA,EAAoD,OAAA,GAAU,eAAA,GAAkB,gBAAgB,CAAA;AAAA,SACjG;AACA,QAAA,IAAI,OAAA,EAAS;AACZ,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC,CAAA,MAAO;AACN,UAAA,IAAA,CAAK,QAAA,CAAS,IAAA,CAAK,YAAA,EAAc,MAAM,CAAA;AAAA,QACxC;AACA,QAAA,MAAA,CAAO,QAAQ,MAAM,CAAA;AAAA,MACtB,CAAC,CAAA;AACD,MAAA,MAAA,CAAO,EAAA;AAAA,QAAG,OAAA;AAAA,QAAS,CAAC,GAAA,KACnB,GAAA,CAAI,MAAM,CAAA,uCAAA,EAA0C,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,OAClE;AAAA,IACD,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AACA,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA;AAAA,MAAG,OAAA;AAAA,MAAS,CAAC,GAAA,KAC1B,GAAA,CAAI,MAAM,CAAA,gCAAA,EAAmC,GAAA,CAAI,OAAO,CAAA,CAAE;AAAA,KAC3D;AAEA,IAAA,GAAA,CAAI,KAAK,4CAA4C,CAAA;AAAA,EACtD;AAAA,EAlDS,UAAA;AAAA,EACA,QAAA;AAAA,EAdD,SAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA;AAAA;AAAA,EAEA,aAAA;AAAA,EACA,WAAA;AAAA,EACS,kBAAA;AAAA,EACT,UAAA,GAAa,KAAA;AAAA,EACb,cAAA,GAAiB,CAAA;AAAA,EAuDjB,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,QAAA,EAAU,CAAC,QAAQ,OAAA,KAAY;AAC/C,MAAA,MAAM,WAAA,GAAc,QAAQ,cAAc,CAAA;AAC1C,MAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,CAAA;AAE5B,MAAA,IAAI,gBAAgB,kBAAA,EAAoB;AACvC,QAAA,IAAA,CAAK,iBAAiB,MAAiC,CAAA;AAAA,MACxD,CAAA,MAAA,IAAW,SAAS,MAAA,EAAQ;AAC3B,QAAA,IAAA,CAAK,iBAAA,CAAkB,QAAmC,OAAO,CAAA;AAAA,MAClE;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,aAAA,GAAgB;AACvB,IAAA,IAAA,CAAK,QAAA,CAAS,EAAA,CAAG,SAAA,EAAW,OAAO,KAAK,GAAA,KAAQ;AAC/C,MAAA,IAAA,CAAK,cAAA,IAAkB,CAAA;AACvB,MAAA,MAAM,SAAS,MAAM;AACpB,QAAA,GAAA,CAAI,cAAA,CAAe,UAAU,MAAM,CAAA;AACnC,QAAA,GAAA,CAAI,cAAA,CAAe,SAAS,MAAM,CAAA;AAClC,QAAA,IAAA,CAAK,iBAAiB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAC,CAAA;AAAA,MAC1D,CAAA;AACA,MAAA,GAAA,CAAI,EAAA,CAAG,UAAU,MAAM,CAAA;AACvB,MAAA,GAAA,CAAI,EAAA,CAAG,SAAS,MAAM,CAAA;AAEtB,MAAA,MAAM,GAAA,GAAM,IAAI,GAAA,IAAO,EAAA;AACvB,MAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AAGnB,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,QAAA,EAAU;AAClB,UAAA,kBAAA,CAAmB,IAAI,EAAC,EAAG,KAAK,QAAA,CAAS,QAAA,GAAW,MAAM,CAAA;AAAA,QAC3D;AACA,QAAA,IAAI,KAAK,MAAA,EAAQ;AAChB,UAAA,iBAAA,CAAkB,IAAI,EAAC,EAAG,IAAA,CAAK,MAAA,CAAO,sBAAsB,CAAA;AAAA,QAC7D;AACA,QAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,UAClB,cAAA,EAAgB;AAAA,SAChB,CAAA;AACD,QAAA,GAAA,CAAI,GAAA,CAAI,eAAA,CAAgB,oBAAA,EAAsB,CAAA;AAC9C,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,UAAA,EAAY;AAC3C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,IAAA;AAAA,YACR,MAAA,EAAQ,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA;AAAA,YACnC,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,SAAA,EAAW;AAC1C,QAAA,IAAI,KAAK,UAAA,EAAY;AACpB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,UAAA;AAAA,cACR,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,MAAM,cAAc,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,WAAU,GAAI,IAAA;AAChE,QAAA,IAAI,CAAC,WAAA,EAAa;AACjB,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,WAAA,EAAa,KAAA;AAAA,cACb,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,MAAA,EAAQ,OAAA;AAAA,YACR,WAAA,EAAa,IAAA;AAAA,YACb,OAAO,IAAA,CAAK,QAAA,GAAW,KAAK,QAAA,CAAS,QAAA,GAAW,MAAA,GAAS,CAAA;AAAA,YACzD,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,WAClC;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,IAAA,CAAK,UAAA,IAAc,GAAA,KAAQ,MAAA,EAAQ;AACtC,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,QAAA,GAAA,CAAI,GAAA;AAAA,UACH,KAAK,SAAA,CAAU;AAAA,YACd,OAAA,EAAS,KAAA;AAAA,YACT,KAAA,EAAO;AAAA,cACN,IAAA,EAAM,KAAA;AAAA,cACN,OAAA,EAAS;AAAA;AACV,WACA;AAAA,SACF;AACA,QAAA;AAAA,MACD;AAGA,MAAA,MAAM,WAAA,GAAc,GAAA,CAAI,OAAA,CAAQ,cAAc,CAAA;AAC9C,MAAA,IAAI,gBAAA,CAAiB,WAAW,CAAA,EAAG;AAClC,QAAA,MAAM,sBAAA,CAAuB,GAAA,EAAK,GAAA,EAAK,OAAO,SAAS,OAAA,KAAY;AAClE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,uCAAA,EAA0C,OAAO,CAAA,EAAA,EAAK,OAAA,CAAQ,MAAM,CAAA,OAAA;AAAA,WACrE;AACA,UAAA,OAAO;AAAA,YACN,QAAQ,kBAAA,CAAmB,SAAA;AAAA,YAC3B,OAAA,EAAS,IAAA;AAAA,YACT,IAAA,EAAM,MAAA,CAAO,IAAA,CAAK,EAAE;AAAA,WACrB;AAAA,QACD,CAAC,CAAA;AACD,QAAA;AAAA,MACD;AAGA,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,IAAK,KAAK,aAAA,EAAe;AAClD,QAAA,MAAM,QAAA,GACL,OAAO,IAAA,CAAK,aAAA,CAAc,QAAA,KAAa,aACpC,IAAA,CAAK,aAAA,CAAc,QAAA,EAAS,GAC5B,IAAA,CAAK,aAAA;AAET,QAAA,MAAM,cAAc,GAAA,CAAI,GAAA;AACxB,QAAA,GAAA,CAAI,GAAA,GAAA,CAAO,WAAA,IAAe,EAAA,EAAI,KAAA,CAAM,CAAC,CAAA,IAAK,GAAA;AAC1C,QAAA,IAAI;AACH,UAAA,OAAO,QAAA,CAAS,KAAK,GAAG,CAAA;AAAA,QACzB,CAAA,SAAE;AACD,UAAA,GAAA,CAAI,GAAA,GAAM,WAAA;AAAA,QACX;AAAA,MACD;AAGA,MAAA,IAAI,MAAA,KAAW,KAAA,IAAS,GAAA,KAAQ,uCAAA,EAAyC;AACxE,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,GAAA,GAAM,8BAAA;AAAA,YACX,IAAA,CAAK,aAAa,SAAA,EAAU;AAAA,YAC5B,IAAA,CAAK,aAAa,WAAA;AAAY,WAC/B;AACA,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA;AAC3B,UAAA;AAAA,QACD;AACA,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AACnB,QAAA;AAAA,MACD;AAEA,MAAA,IACC,WAAW,KAAA,KACV,GAAA,KAAQ,OAAO,GAAA,KAAQ,MAAA,IAAU,QAAQ,SAAA,CAAA,EACzC;AACD,QAAA,IACC,QAAQ,SAAA,IACR,GAAA,CAAI,QAAQ,MAAA,EAAQ,QAAA,CAAS,kBAAkB,CAAA,EAC9C;AACD,UAAA,MAAM,QAAA,GAAW,KAAK,QAAA,GACnB;AAAA,YACA,QAAQ,IAAA,CAAK,QAAA,CAAS,SAAA,EAAU,EAAG,UAAS,IAAK,EAAA;AAAA,YACjD,UAAA,EAAY,IAAA,CAAK,QAAA,CACf,aAAA,EAAc,CACd,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,EAAU;AAAA,WAC1B,GACC,IAAA;AACH,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,YAAA,EAAc,SAAA,EAAU;AAC5C,UAAA,MAAM,OAAA,GAAU,SACb,MAAA,CAAO,QAAA,CAAS,OAAO,CAAA,GACtB,MAAA,GACA,CAAA,EAAG,MAAM,CAAA,KAAA,CAAA,GACV,EAAA;AACH,UAAA,MAAM,gBAAA,GACL,IAAA,CAAK,YAAA,IAAgB,MAAA,GAClB;AAAA,YACA,MAAA;AAAA,YACA,QAAA,EAAU,GAAG,OAAO,CAAA,KAAA,CAAA;AAAA,YACpB,GAAI,KAAK,aAAA,GACN;AAAA,cACA,cAAA,EAAgB,GAAG,OAAO,CAAA,MAAA;AAAA,gBAE1B;AAAC,WACL,GACC,MAAA;AAEJ,UAAA,MAAM,YAAA,GAAe;AAAA,YACpB,IAAA,EAAM,IAAA,CAAK,QAAA,EAAU,gBAAA,OAAuB,CAAA,GAAI,CAAA;AAAA,YAChD,WAAA,EAAa,IAAA,CAAK,YAAA,GACf,uCAAA,GACA,MAAA;AAAA,YACH,qBAAA,EAAuB,CAAC,UAAA,EAAY,UAAA,EAAY,SAAS;AAAA,WAC1D;AAEA,UAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,UAAA,GAAA,CAAI,GAAA;AAAA,YACH,KAAK,SAAA,CAAU;AAAA,cACd,MAAA,EAAQ,SAAA;AAAA,cACR,IAAA,EAAM,IAAA,CAAK,UAAA,CAAW,aAAA,EAAc;AAAA,cACpC,IAAA,EAAM,QAAA;AAAA,cACN,KAAA,EAAO,KAAK,UAAA,CAAW,SAAA,GAAY,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA;AAAA,cACpD,IAAA,EAAM,gBAAA;AAAA,cACN,QAAA,EAAU,YAAA;AAAA,cACV,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,aAClC;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,4BAA4B,CAAA;AACjE,QAAA,GAAA,CAAI,GAAA,CAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAA,CAWK,CAAA;AACb,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,GAAA,KAAQ,MAAA,IAAU,MAAA,KAAW,MAAA,EAAQ;AACxC,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,aAAA;AAC/B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACjD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,GAAA,CAAI,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AAClD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,IAAI,IAAA,GAAO,EAAA;AACX,QAAA,GAAA,CAAI,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACpD,QAAA,GAAA,CAAI,EAAA,CAAG,OAAO,YAAY;AAEzB,UAAA,MAAM,QAAA,GAAW,GAAA,CAAI,MAAA,CAAO,aAAA,IAAiB,WAAA;AAC7C,UAAA,MAAM,YAAA,GAAe,UAAU,QAAA,GAC5B,CAAA,OAAA,EAAU,SAAS,QAAQ,CAAA,CAAA,GAC3B,MAAM,QAAQ,CAAA,CAAA;AACjB,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,WAAA,CAAY,KAAA,CAAM,YAAY,CAAA;AACtD,UAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACxB,YAAA,GAAA,CAAI,UAAU,GAAA,EAAK;AAAA,cAClB,cAAA,EAAgB,kBAAA;AAAA,cAChB,eAAe,IAAA,CAAK,IAAA,CAAK,WAAW,OAAA,GAAU,GAAI,EAAE,QAAA;AAAS,aAC7D,CAAA;AACD,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,EAAA,EAAI,IAAA;AAAA,gBACJ,KAAA,EAAO;AAAA,kBACN,IAAA,EAAM,MAAA;AAAA,kBACN,OAAA,EAAS;AAAA;AACV,eACA;AAAA,aACF;AACA,YAAA;AAAA,UACD;AAEA,UAAA,IAAI;AACH,YAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAMnC,YAAA,IAAI,IAAA,CAAK,oBAAoB,WAAA,EAAa;AACzC,cAAA,MAAM,UAAU,MAAM,yBAAA;AAAA,gBACrB,WAAA;AAAA,gBACA,EAAE,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,OAAA,EAAQ;AAAA,gBACxC,IAAA,CAAK;AAAA,eAIN;AACA,cAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACrB,gBAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,gBAAA,GAAA,CAAI,GAAA;AAAA,kBACH,KAAK,SAAA,CAAU;AAAA,oBACd,OAAA,EAAS,KAAA;AAAA,oBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,oBACtB,KAAA,EAAO;AAAA,sBACN,IAAA,EAAM,QAAQ,SAAA,IAAa,CAAA,KAAA;AAAA,sBAC3B,OAAA,EACC,QAAQ,MAAA,IACR;AAAA;AACF,mBACA;AAAA,iBACF;AACA,gBAAA;AAAA,cACD;AAAA,YACD;AAGA,YAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA;AAC1C,YAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA;AACtC,YAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAIrD,YAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,cAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,cAAA,GAAA,CAAI,GAAA;AAAA,gBACH,KAAK,SAAA,CAAU;AAAA,kBACd,OAAA,EAAS,KAAA;AAAA,kBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,kBACtB,KAAA,EAAO;AAAA,oBACN,IAAA,EAAM,CAAA,KAAA;AAAA,oBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,iBACA;AAAA,eACF;AACA,cAAA;AAAA,YACD;AAEA,YAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,cAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,gBAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,cAC7B;AACA,cAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CACnB,yCACD,CAAA,EACC;AACD,gBAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,cACL;AAAA,YACD;AAEA,YAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,YAAA,GAAA,CAAI,SAAA,CAAU,GAAA,EAAK,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACzD,YAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,UACjC,SAAS,CAAA,EAAY;AACpB,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,kDAAA,EAAsD,EAAY,OAAO,CAAA;AAAA,aAC1E;AACA,YAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,YAAA,GAAA,CAAI,GAAA;AAAA,cACH,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,KAAA,EAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAS,aAAA;AAAc,eAC9C;AAAA,aACF;AAAA,UACD;AAAA,QACD,CAAC,CAAA;AAAA,MACF,CAAA,MAAO;AACN,QAAA,GAAA,CAAI,UAAU,GAAG,CAAA;AACjB,QAAA,GAAA,CAAI,IAAI,WAAW,CAAA;AAAA,MACpB;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEQ,iBAAiB,MAAA,EAAiC;AACzD,IAAA,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAmB;AAErC,MAAA,MAAM,IAAA,GAAO,KAAA;AACb,MAAA,IAAI,IAAA;AACH,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,yCAAA,EAA4C,KAAK,MAAM,CAAA,MAAA;AAAA,SACxD;AAAA,IACF,CAAC,CAAA;AACD,IAAA,MAAA,CAAO,QAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,cAAA,EAAgB,oBAAoB,CAAA;AACrE,IAAA,MAAA,CAAO,GAAA,EAAI;AAAA,EACZ;AAAA,EAEQ,iBAAA,CACP,QACA,OAAA,EACC;AACD,IAAA,IAAI,IAAA,GAAO,EAAA;AACX,IAAA,MAAA,CAAO,GAAG,MAAA,EAAQ,CAAC,UAAW,IAAA,IAAQ,KAAA,CAAM,UAAW,CAAA;AACvD,IAAA,MAAA,CAAO,EAAA,CAAG,OAAO,YAAY;AAC5B,MAAA,IAAI;AACH,QAAA,IAAI,QAAA,GAA4B,IAAA;AAGhC,QAAA,IAAI,KAAK,YAAA,EAAc;AACtB,UAAA,MAAM,aAAa,OAAA,CAAQ,aAAA;AAC3B,UAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EACC,6FAAA;AAAA,cACD,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,cAAA,EAAgB,CAAC,CAAA;AACpD,YAAA;AAAA,UACD;AACA,UAAA,IAAI;AACH,YAAA,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,CAAa,SAAS,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,UAChE,SAAS,CAAA,EAAY;AACpB,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,kBAAA,EAAoB,CAAA,iDAAA,EAAqD,CAAA,CAAY,OAAO,CAAA,CAAA,CAAA;AAAA,cAC5F,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,IAAI,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,eAAA,EAAiB,CAAC,CAAA;AACrD,YAAA;AAAA,UACD;AAAA,QACD;AAEA,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAGnC,QAAA,IAAI,IAAA,CAAK,oBAAoB,WAAA,EAAa;AACzC,UAAA,MAAM,UAAA,GACL,MAAA,CAAO,OAAA,EAAS,MAAA,EAAQ,aAAA,IAAiB,WAAA;AAC1C,UAAA,MAAM,UAAU,MAAM,yBAAA;AAAA,YACrB,WAAA;AAAA,YACA,EAAE,QAAA,EAAU,UAAA,EAAY,QAAA,EAAU,UAAU,OAAA,EAAQ;AAAA,YACpD,IAAA,CAAK;AAAA,WAIN;AACA,UAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACrB,YAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,cACd,SAAA,EAAW,GAAA;AAAA,cACX,cAAA,EAAgB;AAAA,aAChB,CAAA;AACD,YAAA,MAAA,CAAO,GAAA;AAAA,cACN,KAAK,SAAA,CAAU;AAAA,gBACd,OAAA,EAAS,KAAA;AAAA,gBACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,gBACtB,KAAA,EAAO;AAAA,kBACN,IAAA,EAAM,QAAQ,SAAA,IAAa,CAAA,KAAA;AAAA,kBAC3B,OAAA,EACC,QAAQ,MAAA,IACR;AAAA;AACF,eACA;AAAA,aACF;AACA,YAAA;AAAA,UACD;AAAA,QACD;AAGA,QAAA,MAAM,SAAA,GAAY,QAAQ,YAAY,CAAA;AACtC,QAAA,MAAM,OAAA,GAAU,QAAQ,UAAU,CAAA;AAClC,QAAA,MAAM,UAAA,GAAa,QAAQ,sBAAsB,CAAA;AAIjD,QAAA,IAAI,SAAA,IAAa,SAAA,KAAc,WAAA,CAAY,MAAA,EAAQ;AAClD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,OAAA,EAAS,CAAA,qCAAA,EAAwC,SAAS,CAAA,kCAAA,EAAqC,YAAY,MAAM,CAAA,CAAA;AAAA;AAClH,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IACC,WACA,WAAA,CAAY,MAAA,EAAQ,QACpB,OAAA,KAAY,WAAA,CAAY,OAAO,IAAA,EAC9B;AACD,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA;AAAA,YACN,KAAK,SAAA,CAAU;AAAA,cACd,OAAA,EAAS,KAAA;AAAA,cACT,EAAA,EAAI,YAAY,EAAA,IAAM,IAAA;AAAA,cACtB,KAAA,EAAO;AAAA,gBACN,IAAA,EAAM,CAAA,KAAA;AAAA,gBACN,SAAS,CAAA,mCAAA,EAAsC,OAAO,CAAA,8BAAA,EAAiC,WAAA,CAAY,OAAO,IAAI,CAAA,CAAA;AAAA;AAC/G,aACA;AAAA,WACF;AACA,UAAA;AAAA,QACD;AAEA,QAAA,IAAI,UAAA,IAAc,YAAY,MAAA,EAAQ;AACrC,UAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO;AAC9B,YAAA,WAAA,CAAY,MAAA,CAAO,QAAQ,EAAC;AAAA,UAC7B;AACA,UAAA,IACC,CAAC,WAAA,CAAY,MAAA,CAAO,KAAA,CAAM,yCAAyC,CAAA,EAClE;AACD,YAAA,WAAA,CAAY,MAAA,CAAO,KAAA,CAClB,yCACD,CAAA,GAAI,UAAA;AAAA,UACL;AAAA,QACD;AAEA,QAAA,MAAM,WAAW,MAAM,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,aAAa,QAAQ,CAAA;AACjE,QAAA,IAAI,QAAA,EAAU;AACb,UAAA,MAAA,CAAO,OAAA,CAAQ;AAAA,YACd,SAAA,EAAW,GAAA;AAAA,YACX,cAAA,EAAgB;AAAA,WAChB,CAAA;AACD,UAAA,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,QACpC,CAAA,aAAc,KAAA,EAAM;AAAA,MACrB,SAAS,EAAA,EAAI;AACZ,QAAA,MAAA,CAAO,OAAA,CAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,CAAA;AACjC,QAAA,MAAA,CAAO,GAAA,EAAI;AAAA,MACZ;AAAA,IACD,CAAC,CAAA;AAAA,EACF;AAAA,EAEA,MAAa,MAAA,CAAO,IAAA,EAAc,IAAA,GAAe,SAAA,EAA4B;AAC5E,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,KAAA,EAAM;AAG1B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,UAAA,CAAW,SAAA,EAAU;AACxC,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,QAAA,MAAM,IAAA,CAAK,QAAA,CAAS,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAA;AAChD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,uDAAA,EAAmD,KAAK,IAAI,CAAA;AAAA,SAC7D;AAAA,MACD;AAAA,IACD;AACA,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACvC,MAAA,IAAA,CAAK,SAAA,CAAU,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAmC;AAC9D,QAAA,IAAI,GAAA,CAAI,SAAS,YAAA,EAAc;AAC9B,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,8BAA8B,IAAI,CAAA,sCAAA;AAAA,WACnC;AAAA,QACD,CAAA,MAAO;AACN,UAAA,GAAA,CAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAAA,QACzD;AACA,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACX,CAAC,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,MAAM;AACvC,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,OAAA,EAAQ;AACpC,QAAA,MAAM,aACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,OAAA,IAAW,IAAA;AACpD,QAAA,MAAM,eACL,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,MAAM,IAAA,IAAQ,IAAA;AAEjD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,sEAAA,EAAoE,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SAC/F;AACA,QAAA,OAAA,CAAQ,YAAY,CAAA;AAAA,MACrB,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEO,SAAA,GAAqB;AAC3B,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACb;AAAA,EAEA,MAAa,KAAA,CAAM,SAAA,GAAY,GAAA,EAAqB;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,qDAAA,EAAwD,IAAA,CAAK,cAAc,CAAA,WAAA,EAAc,SAAS,CAAA,MAAA;AAAA,KACnG;AACA,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,EAAI;AACvB,IAAA,OAAO,KAAK,cAAA,GAAiB,CAAA,IAAK,KAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,EAAW;AACjE,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AAAA,IACvD;AACA,IAAA,MAAM,KAAK,IAAA,EAAK;AAAA,EACjB;AAAA,EAEA,MAAa,IAAA,GAAO;AACnB,IAAA,IAAI,KAAK,QAAA,EAAU;AAClB,MAAA,MAAM,IAAA,CAAK,SAAS,IAAA,EAAK;AAAA,IAC1B;AACA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AACvB,IAAA,IAAA,CAAK,UAAU,KAAA,EAAM;AACrB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AAAA,EACrB;AAAA,EAEO,SAAA,GAA2B;AACjC,IAAA,OAAO,IAAA,CAAK,MAAA;AAAA,EACb;AACD","file":"chunk-EJ426URA.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Protected Resource Metadata — RFC 9728\n *\n * Builds the JSON document served at /.well-known/oauth-protected-resource.\n * This enables MCP clients to discover the authorization server and\n * required scopes for accessing LIOP tools and resources.\n *\n * Standards: RFC 9728, MCP Spec 2025-11-25\n */\n\nimport { LIOP_SCOPES } from \"./rbac.js\";\n\n/**\n * RFC 9728 Protected Resource Metadata response.\n *\n * @see https://datatracker.ietf.org/doc/rfc9728\n */\nexport interface ProtectedResourceMetadata {\n\t/** Identifier for the protected resource. */\n\tresource: string;\n\t/** Array of authorization server issuer URLs that can issue tokens for this resource. */\n\tauthorization_servers: string[];\n\t/** OAuth scopes accepted by this resource. */\n\tscopes_supported: readonly string[];\n\t/** Methods of presenting the bearer token (always \"header\" for LIOP). */\n\tbearer_methods_supported: string[];\n\t/** URL to the resource documentation. */\n\tresource_documentation: string;\n}\n\n/**\n * Builds the Protected Resource Metadata document (RFC 9728).\n *\n * @param issuer - OIDC issuer URL of the Nexus authorization server\n * @param audience - JWT audience claim (resource identifier)\n */\nexport function buildProtectedResourceMetadata(\n\tissuer: string,\n\taudience: string,\n): ProtectedResourceMetadata {\n\treturn {\n\t\tresource: audience,\n\t\tauthorization_servers: [issuer],\n\t\tscopes_supported: LIOP_SCOPES,\n\t\tbearer_methods_supported: [\"header\"],\n\t\tresource_documentation: \"https://github.com/nekzus/liop\",\n\t};\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP gRPC-Web Protocol Adapter (HTTP/1.1 Fallback)\n *\n * Implements standard gRPC-Web framing per the official gRPC-Web specification:\n * https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-WEB.md\n *\n * Allows web browsers, corporate Layer 7 HTTP/1.1 proxies, and enterprise WAFs\n * to invoke LIOP nodes over HTTP/1.1 without requiring HTTP/2 streaming or h2c.\n *\n * Frame Format:\n * - 1 byte: Frame Flag (0x00 = Data Frame, 0x80 = Trailers Frame)\n * - 4 bytes: 32-bit Big-Endian Unsigned Integer (payload length in bytes)\n * - N bytes: Message or Trailer payload\n */\n\nimport type * as http from \"node:http\";\nimport { log } from \"../utils/logger.js\";\n\nexport const GRPC_WEB_CONSTANTS = {\n\tFLAG_DATA: 0x00,\n\tFLAG_TRAILERS: 0x80,\n\tHEADER_LENGTH: 5,\n\tCONTENT_TYPE_PREFIX: \"application/grpc-web\",\n\tSTATUS_OK: 0,\n\tSTATUS_CANCELLED: 1,\n\tSTATUS_UNKNOWN: 2,\n\tSTATUS_INVALID_ARGUMENT: 3,\n\tSTATUS_DEADLINE_EXCEEDED: 4,\n\tSTATUS_NOT_FOUND: 5,\n\tSTATUS_PERMISSION_DENIED: 7,\n\tSTATUS_UNAUTHENTICATED: 16,\n\tSTATUS_INTERNAL: 13,\n} as const;\n\nexport interface GrpcWebFrame {\n\tisTrailer: boolean;\n\tpayload: Buffer;\n}\n\n/**\n * Checks if an incoming HTTP request is a gRPC-Web request.\n */\nexport function isGrpcWebRequest(contentType?: string): boolean {\n\tif (!contentType) return false;\n\tconst lower = contentType.toLowerCase();\n\treturn (\n\t\tlower.startsWith(\"application/grpc-web\") ||\n\t\tlower.startsWith(\"application/grpc-web+proto\") ||\n\t\tlower.startsWith(\"application/grpc-web+json\")\n\t);\n}\n\n/**\n * Encodes a binary payload into a standard 5-byte framed gRPC-Web Data Frame.\n */\nexport function encodeDataFrame(payload: Buffer | Uint8Array): Buffer {\n\tconst buf = Buffer.isBuffer(payload) ? payload : Buffer.from(payload);\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_DATA, 0);\n\theader.writeUInt32BE(buf.length, 1);\n\treturn Buffer.concat([header, buf]);\n}\n\n/**\n * Encodes gRPC status and optional message into a 5-byte framed gRPC-Web Trailer Frame.\n */\nexport function encodeTrailerFrame(\n\tstatus: number = GRPC_WEB_CONSTANTS.STATUS_OK,\n\tmessage: string = \"\",\n\tcustomTrailers: Record<string, string> = {},\n): Buffer {\n\tconst lines = [\n\t\t`grpc-status:${status}`,\n\t\t`grpc-message:${encodeURIComponent(message)}`,\n\t];\n\n\tfor (const [key, value] of Object.entries(customTrailers)) {\n\t\tlines.push(`${key}:${value}`);\n\t}\n\n\tconst trailerText = `${lines.join(\"\\r\\n\")}\\r\\n`;\n\tconst trailerBuf = Buffer.from(trailerText, \"utf-8\");\n\n\tconst header = Buffer.alloc(GRPC_WEB_CONSTANTS.HEADER_LENGTH);\n\theader.writeUInt8(GRPC_WEB_CONSTANTS.FLAG_TRAILERS, 0);\n\theader.writeUInt32BE(trailerBuf.length, 1);\n\n\treturn Buffer.concat([header, trailerBuf]);\n}\n\n/**\n * Parses raw gRPC-Web byte streams into an array of frames.\n */\nexport function decodeFrames(buffer: Buffer): GrpcWebFrame[] {\n\tconst frames: GrpcWebFrame[] = [];\n\tlet offset = 0;\n\n\twhile (offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH <= buffer.length) {\n\t\tconst flag = buffer.readUInt8(offset);\n\t\tconst length = buffer.readUInt32BE(offset + 1);\n\t\tconst payloadStart = offset + GRPC_WEB_CONSTANTS.HEADER_LENGTH;\n\t\tconst payloadEnd = payloadStart + length;\n\n\t\tif (payloadEnd > buffer.length) {\n\t\t\tbreak; // Incomplete frame\n\t\t}\n\n\t\tconst payload = buffer.subarray(payloadStart, payloadEnd);\n\t\tframes.push({\n\t\t\tisTrailer:\n\t\t\t\t(flag & GRPC_WEB_CONSTANTS.FLAG_TRAILERS) ===\n\t\t\t\tGRPC_WEB_CONSTANTS.FLAG_TRAILERS,\n\t\t\tpayload: Buffer.from(payload),\n\t\t});\n\n\t\toffset = payloadEnd;\n\t}\n\n\treturn frames;\n}\n\n/**\n * Dispatches an HTTP/1.1 gRPC-Web request to an underlying protocol handler\n * and serializes data and trailer frames back to the client.\n */\nexport async function dispatchGrpcWebRequest(\n\treq: http.IncomingMessage,\n\tres: http.ServerResponse,\n\thandler: (\n\t\tpath: string,\n\t\tpayload: Buffer,\n\t) => Promise<{ status: number; message?: string; data?: Buffer }>,\n): Promise<void> {\n\tconst chunks: Buffer[] = [];\n\n\treq.on(\"data\", (chunk: Buffer) => {\n\t\tchunks.push(chunk);\n\t});\n\n\treq.on(\"end\", async () => {\n\t\ttry {\n\t\t\tconst fullBody = Buffer.concat(chunks);\n\t\t\tconst frames = decodeFrames(fullBody);\n\t\t\tconst dataPayload =\n\t\t\t\tframes.find((f) => !f.isTrailer)?.payload ?? Buffer.alloc(0);\n\t\t\tconst requestPath = req.url || \"/\";\n\n\t\t\tlog.info(\n\t\t\t\t`[gRPC-Web] Handling request for ${requestPath} (${dataPayload.length} bytes)`,\n\t\t\t);\n\n\t\t\tconst result = await handler(requestPath, dataPayload);\n\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.setHeader(\"access-control-allow-origin\", \"*\");\n\t\t\tres.setHeader(\n\t\t\t\t\"access-control-expose-headers\",\n\t\t\t\t\"grpc-status, grpc-message, content-type\",\n\t\t\t);\n\n\t\t\t// Write Data Frame (if response payload exists)\n\t\t\tif (result.data && result.data.length > 0) {\n\t\t\t\tres.write(encodeDataFrame(result.data));\n\t\t\t}\n\n\t\t\t// Write Trailer Frame (status and message)\n\t\t\tres.write(encodeTrailerFrame(result.status, result.message || \"\"));\n\t\t\tres.end();\n\t\t} catch (error) {\n\t\t\tlog.error(`[gRPC-Web] Dispatch error: ${error}`);\n\t\t\tres.statusCode = 200;\n\t\t\tres.setHeader(\"content-type\", \"application/grpc-web+proto\");\n\t\t\tres.write(\n\t\t\t\tencodeTrailerFrame(\n\t\t\t\t\tGRPC_WEB_CONSTANTS.STATUS_INTERNAL,\n\t\t\t\t\t(error as Error).message || \"Internal server error\",\n\t\t\t\t),\n\t\t\t);\n\t\t\tres.end();\n\t\t}\n\t});\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { AuthInfo } from \"../security/jwt-validator.js\";\nimport type { McpRequest } from \"../types.js\";\nimport { log } from \"../utils/logger.js\";\n\n/**\n * Verdict returned by a GatewayInterceptor function.\n * Determines whether the request is admitted into the routing pipeline.\n */\nexport interface GatewayAdmissionResult {\n\t/** true = request passes to router.dispatch(). false = rejected at perimeter. */\n\tallowed: boolean;\n\t/** Human-readable denial reason (included in JSON-RPC error response). */\n\treason?: string;\n\t/** Custom JSON-RPC error code. Defaults to -32099 when omitted. */\n\terrorCode?: number;\n\t/** Opaque metadata bag for telemetry or audit logging downstream. */\n\tmetadata?: Record<string, unknown>;\n}\n\n/**\n * Contextual information passed to the interceptor alongside the request.\n * Contains only non-sensitive, non-cryptographic perimeter metadata.\n */\nexport interface GatewayInterceptorContext {\n\t/** Originating client IP address (post-JWT, post-rate-limit). */\n\tclientIp: string;\n\t/** Authenticated identity from JWT validation, or null for unauthenticated gateways. */\n\tauthInfo: AuthInfo | null;\n\t/** Transport protocol that received this request. */\n\tprotocol: \"http1\" | \"http2\";\n\t/** Abort signal that fires when the interceptor timeout expires. */\n\tsignal: AbortSignal;\n}\n\n/**\n * Technology-agnostic admission function.\n * The developer implements this in their application code, connecting\n * any decision engine (TypeSafe Jev, ONNX, regex rules, custom logic).\n *\n * Receives a frozen deep-clone of the request to prevent prototype pollution.\n * May return synchronously or asynchronously.\n */\nexport type GatewayInterceptor = (\n\trequest: Readonly<McpRequest>,\n\tcontext: GatewayInterceptorContext,\n) => Promise<GatewayAdmissionResult> | GatewayAdmissionResult;\n\n/**\n * Configuration for the perimeter admission hook.\n */\nexport interface GatewayInterceptorOptions {\n\t/** The interceptor function. When undefined, the gateway skips interception entirely. */\n\tinterceptor?: GatewayInterceptor;\n\t/** Maximum milliseconds to wait for the interceptor. Default: 2500. */\n\ttimeoutMs?: number;\n\t/** Behavior when the interceptor throws or times out. Default: \"closed\". */\n\tfailMode?: \"closed\" | \"open\";\n}\n\nconst DEFAULT_TIMEOUT_MS = 2500;\n\n/**\n * Executes the interceptor with timeout enforcement via AbortSignal.timeout(),\n * prototype pollution isolation via structuredClone + Object.freeze,\n * and fail-mode policy enforcement.\n *\n * AbortSignal.timeout() is stable since Node.js 17.3 (available in Node.js 20+ LTS).\n * Promise.race guarantees the gateway never blocks beyond timeoutMs even if the\n * interceptor ignores the signal.\n */\nexport async function executeGatewayInterceptor(\n\trequest: McpRequest,\n\tcontext: Omit<GatewayInterceptorContext, \"signal\">,\n\toptions: Required<Pick<GatewayInterceptorOptions, \"interceptor\">> &\n\t\tGatewayInterceptorOptions,\n): Promise<GatewayAdmissionResult> {\n\tconst timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\tconst failMode = options.failMode ?? \"closed\";\n\tconst signal = AbortSignal.timeout(timeoutMs);\n\n\t// structuredClone severs all prototype chain references (deep copy).\n\t// Object.freeze blocks top-level mutation on the clone.\n\t// Even if the interceptor mutates nested properties, the original\n\t// jsonRequest in the gateway scope remains untouched.\n\tconst frozenRequest = Object.freeze(structuredClone(request));\n\n\tlet onAbortListener: (() => void) | undefined;\n\tconst abortPromise = new Promise<never>((_, reject) => {\n\t\tonAbortListener = () => reject(signal.reason);\n\t\tsignal.addEventListener(\"abort\", onAbortListener, { once: true });\n\t});\n\n\ttry {\n\t\tconst result = await Promise.race([\n\t\t\tPromise.resolve(\n\t\t\t\toptions.interceptor(frozenRequest, { ...context, signal }),\n\t\t\t),\n\t\t\tabortPromise,\n\t\t]);\n\t\treturn result;\n\t} catch (error: unknown) {\n\t\tconst errorMessage = error instanceof Error ? error.message : String(error);\n\n\t\tif (failMode === \"open\") {\n\t\t\tlog.warn(\n\t\t\t\t`[LIOP-Gateway] Interceptor error (fail-open, allowing request): ${errorMessage}`,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tallowed: true,\n\t\t\t\tmetadata: { interceptorError: errorMessage, failMode: \"open\" },\n\t\t\t};\n\t\t}\n\n\t\t// fail-closed: reject with error response\n\t\tlog.error(\n\t\t\t`[LIOP-Gateway] Interceptor error (fail-closed, rejecting request): ${errorMessage}`,\n\t\t);\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Interceptor unavailable: ${errorMessage}`,\n\t\t\terrorCode: -32098,\n\t\t\tmetadata: { interceptorError: errorMessage, failMode: \"closed\" },\n\t\t};\n\t} finally {\n\t\tif (onAbortListener) {\n\t\t\tsignal.removeEventListener(\"abort\", onAbortListener);\n\t\t}\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Sliding-Window Rate Limiter\n *\n * High-performance, zero-dependency in-memory rate limiter designed\n * to protect the LIOP Hybrid Gateway and Mesh Nodes against Denial of Service (DoS),\n * worker pool exhaustion, and brute-force attacks.\n *\n * Conforms to OWASP API Security Top 10 (API4:2023 - Unrestricted Resource Consumption).\n */\n\nexport interface RateLimiterOptions {\n\t/** Window duration in milliseconds (default: 60,000ms = 1 minute) */\n\twindowMs?: number;\n\t/** Maximum number of allowed requests per window (default: 120) */\n\tmaxRequests?: number;\n}\n\nexport interface RateLimitStatus {\n\tallowed: boolean;\n\tremaining: number;\n\tlimit: number;\n\tresetMs: number;\n}\n\ninterface WindowRecord {\n\tcount: number;\n\tresetTime: number;\n}\n\nexport class InMemoryRateLimiter {\n\tprivate readonly windowMs: number;\n\tprivate readonly maxRequests: number;\n\tprivate readonly records: Map<string, WindowRecord> = new Map();\n\tprivate cleanupTimer?: NodeJS.Timeout;\n\n\tconstructor(options: RateLimiterOptions = {}) {\n\t\tthis.windowMs = options.windowMs ?? 60_000;\n\t\tthis.maxRequests = options.maxRequests ?? 120;\n\n\t\t// Clean up expired buckets periodically (every 30s)\n\t\tthis.cleanupTimer = setInterval(() => this.cleanup(), 30_000);\n\t\tif (typeof this.cleanupTimer.unref === \"function\") {\n\t\t\tthis.cleanupTimer.unref();\n\t\t}\n\t}\n\n\t/**\n\t * Evaluates whether a request from the given key (IP, token, or clientId) is permitted.\n\t *\n\t * @param key Identifier for the client (e.g., remote IP or OAuth client ID)\n\t * @returns Status containing allowed boolean, remaining quota, and time until reset\n\t */\n\tpublic check(key: string): RateLimitStatus {\n\t\tconst now = Date.now();\n\t\tlet record = this.records.get(key);\n\n\t\tif (!record || now >= record.resetTime) {\n\t\t\trecord = {\n\t\t\t\tcount: 1,\n\t\t\t\tresetTime: now + this.windowMs,\n\t\t\t};\n\t\t\tthis.records.set(key, record);\n\t\t\treturn {\n\t\t\t\tallowed: true,\n\t\t\t\tremaining: this.maxRequests - 1,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: this.windowMs,\n\t\t\t};\n\t\t}\n\n\t\tif (record.count >= this.maxRequests) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\tremaining: 0,\n\t\t\t\tlimit: this.maxRequests,\n\t\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t\t};\n\t\t}\n\n\t\trecord.count++;\n\t\treturn {\n\t\t\tallowed: true,\n\t\t\tremaining: this.maxRequests - record.count,\n\t\t\tlimit: this.maxRequests,\n\t\t\tresetMs: Math.max(0, record.resetTime - now),\n\t\t};\n\t}\n\n\t/**\n\t * Explicitly resets the rate limit bucket for a given key.\n\t */\n\tpublic reset(key: string): void {\n\t\tthis.records.delete(key);\n\t}\n\n\t/**\n\t * Cleans up expired rate-limiting buckets to prevent memory leaks.\n\t */\n\tpublic cleanup(): void {\n\t\tconst now = Date.now();\n\t\tfor (const [key, record] of this.records.entries()) {\n\t\t\tif (now >= record.resetTime) {\n\t\t\t\tthis.records.delete(key);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Destroys internal timers and clears records.\n\t */\n\tpublic close(): void {\n\t\tif (this.cleanupTimer) {\n\t\t\tclearInterval(this.cleanupTimer);\n\t\t\tthis.cleanupTimer = undefined;\n\t\t}\n\t\tthis.records.clear();\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as http from \"node:http\";\nimport * as http2 from \"node:http2\";\nimport * as net from \"node:net\";\nimport type { MeshNode } from \"../mesh/index.js\";\nimport {\n\tmanifestCacheSize,\n\tmeshPeersConnected,\n\tprotocolMetrics,\n} from \"../observability/metrics.js\";\nimport type { AuthInfo, JwtValidator } from \"../security/jwt-validator.js\";\nimport { buildProtectedResourceMetadata } from \"../security/prm.js\";\nimport type { LiopServer } from \"../server/index.js\";\nimport { log } from \"../utils/logger.js\";\nimport {\n\tdispatchGrpcWebRequest,\n\tGRPC_WEB_CONSTANTS,\n\tisGrpcWebRequest,\n} from \"./grpc-web.js\";\nimport {\n\texecuteGatewayInterceptor,\n\ttype GatewayInterceptorOptions,\n} from \"./interceptor.js\";\nimport {\n\tInMemoryRateLimiter,\n\ttype RateLimiterOptions,\n} from \"./rate-limiter.js\";\nimport { LiopMcpRouter } from \"./router.js\";\n\n/**\n * LIOP Hybrid Gateway\n * High-level orchestration for connecting MCP (JSON-RPC) clients to the LIOP Mesh.\n */\nexport class LiopHybridGateway {\n\tprivate netServer: net.Server;\n\tprivate h2Server: http2.Http2Server;\n\tprivate h1Server: http.Server;\n\tprivate router: LiopMcpRouter;\n\tprivate jwtValidator?: JwtValidator;\n\t// biome-ignore lint/suspicious/noExplicitAny: oidc-provider is loaded in Phase C\n\tprivate oauthProvider?: any;\n\tprivate rateLimiter: InMemoryRateLimiter;\n\tprivate readonly interceptorOptions?: GatewayInterceptorOptions;\n\tprivate isDraining = false;\n\tprivate activeRequests = 0;\n\n\tconstructor(\n\t\tprivate liopServer: LiopServer,\n\t\tprivate meshNode: MeshNode | null = null,\n\t\trpcPort: number = 50051,\n\t\trateLimiterOptions?: RateLimiterOptions,\n\t\tinterceptorOptions?: GatewayInterceptorOptions,\n\t) {\n\t\tthis.jwtValidator = this.liopServer.jwtValidator;\n\t\tthis.oauthProvider = this.liopServer.oauthProvider;\n\t\tthis.rateLimiter = new InMemoryRateLimiter(rateLimiterOptions);\n\t\tthis.interceptorOptions = interceptorOptions;\n\n\t\t// Initialize the Universal Router\n\t\tthis.router = new LiopMcpRouter(this.liopServer, this.meshNode, rpcPort);\n\n\t\t// Internal HTTP/2 Server (for Native gRPC Proxying)\n\t\tthis.h2Server = http2.createServer();\n\t\tthis.setupH2Routes();\n\n\t\t// Internal HTTP/1 Server (for Browser/MCP)\n\t\tthis.h1Server = http.createServer();\n\t\tthis.setupH1Routes();\n\n\t\t// Primary Multiplexer (L4)\n\t\tthis.netServer = net.createServer((socket) => {\n\t\t\tsocket.once(\"data\", (buffer) => {\n\t\t\t\tconst isHttp2 = buffer.toString().startsWith(\"PRI * HTTP/2.0\");\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Incoming L4 Connection. Protocol: ${isHttp2 ? \"HTTP/2 (gRPC)\" : \"HTTP/1.1 (MCP)\"}`,\n\t\t\t\t);\n\t\t\t\tif (isHttp2) {\n\t\t\t\t\tthis.h2Server.emit(\"connection\", socket);\n\t\t\t\t} else {\n\t\t\t\t\tthis.h1Server.emit(\"connection\", socket);\n\t\t\t\t}\n\t\t\t\tsocket.unshift(buffer);\n\t\t\t});\n\t\t\tsocket.on(\"error\", (err) =>\n\t\t\t\tlog.error(`[LIOP-Gateway] NetServer Socket Error: ${err.message}`),\n\t\t\t);\n\t\t});\n\n\t\t// Attach error listeners to sub-servers to catch silent failures\n\t\tthis.h1Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H1 Server Error: ${err.message}`),\n\t\t);\n\t\tthis.h2Server.on(\"error\", (err) =>\n\t\t\tlog.error(`[LIOP-Gateway] H2 Server Error: ${err.message}`),\n\t\t);\n\n\t\tlog.info(\"[LIOP-Gateway] Hybrid adapter initialized.\");\n\t}\n\n\tprivate setupH2Routes() {\n\t\tthis.h2Server.on(\"stream\", (stream, headers) => {\n\t\t\tconst contentType = headers[\"content-type\"] as string;\n\t\t\tconst path = headers[\":path\"] as string;\n\n\t\t\tif (contentType === \"application/grpc\") {\n\t\t\t\tthis.handleGrpcStream(stream as http2.ServerHttp2Stream);\n\t\t\t} else if (path === \"/mcp\") {\n\t\t\t\tthis.handleMcpH2Stream(stream as http2.ServerHttp2Stream, headers);\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate setupH1Routes() {\n\t\tthis.h1Server.on(\"request\", async (req, res) => {\n\t\t\tthis.activeRequests += 1;\n\t\t\tconst onDone = () => {\n\t\t\t\tres.removeListener(\"finish\", onDone);\n\t\t\t\tres.removeListener(\"close\", onDone);\n\t\t\t\tthis.activeRequests = Math.max(0, this.activeRequests - 1);\n\t\t\t};\n\t\t\tres.on(\"finish\", onDone);\n\t\t\tres.on(\"close\", onDone);\n\n\t\t\tconst url = req.url || \"\";\n\t\t\tconst method = req.method;\n\n\t\t\t// [Phase Beta-3] Prometheus Metrics Endpoint\n\t\t\tif (method === \"GET\" && url === \"/metrics\") {\n\t\t\t\tif (this.meshNode) {\n\t\t\t\t\tmeshPeersConnected.set({}, this.meshNode.getPeers().length);\n\t\t\t\t}\n\t\t\t\tif (this.router) {\n\t\t\t\t\tmanifestCacheSize.set({}, this.router.getManifestCacheSize());\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, {\n\t\t\t\t\t\"Content-Type\": \"text/plain; version=0.0.4; charset=utf-8\",\n\t\t\t\t});\n\t\t\t\tres.end(protocolMetrics.exportPrometheusText());\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Liveness Probe\n\t\t\tif (method === \"GET\" && url === \"/healthz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ok\",\n\t\t\t\t\t\tuptime: Math.floor(process.uptime()),\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-3] K8s Readiness Probe\n\t\t\tif (method === \"GET\" && url === \"/readyz\") {\n\t\t\t\tif (this.isDraining) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"draining\",\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tconst meshStarted = this.meshNode ? this.meshNode.isStarted() : true;\n\t\t\t\tif (!meshStarted) {\n\t\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"unready\",\n\t\t\t\t\t\t\tmeshStarted: false,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tstatus: \"ready\",\n\t\t\t\t\t\tmeshStarted: true,\n\t\t\t\t\t\tpeers: this.meshNode ? this.meshNode.getPeers().length : 0,\n\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// Reject new MCP requests if draining\n\t\t\tif (this.isDraining && url === \"/mcp\") {\n\t\t\t\tres.writeHead(503, { \"Content-Type\": \"application/json\" });\n\t\t\t\tres.end(\n\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\tcode: -32000,\n\t\t\t\t\t\t\tmessage: \"Gateway is draining connections for shutdown\",\n\t\t\t\t\t\t},\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [Phase Beta-2] gRPC-Web HTTP/1.1 Framing Fallback\n\t\t\tconst contentType = req.headers[\"content-type\"];\n\t\t\tif (isGrpcWebRequest(contentType)) {\n\t\t\t\tawait dispatchGrpcWebRequest(req, res, async (reqPath, payload) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] gRPC-Web fallback call: ${reqPath} (${payload.length} bytes)`,\n\t\t\t\t\t);\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: GRPC_WEB_CONSTANTS.STATUS_OK,\n\t\t\t\t\t\tmessage: \"OK\",\n\t\t\t\t\t\tdata: Buffer.from(\"\"),\n\t\t\t\t\t};\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\t// [SEC] M2M OAuth 2.1 OIDC Authorization Server Router (Phase C proxy)\n\t\t\tif (url.startsWith(\"/oidc\") && this.oauthProvider) {\n\t\t\t\tconst callback =\n\t\t\t\t\ttypeof this.oauthProvider.callback === \"function\"\n\t\t\t\t\t\t? this.oauthProvider.callback()\n\t\t\t\t\t\t: this.oauthProvider;\n\t\t\t\t// Rewrite req.url to strip the '/oidc' prefix before delegating to oidc-provider\n\t\t\t\tconst originalUrl = req.url;\n\t\t\t\treq.url = (originalUrl || \"\").slice(5) || \"/\";\n\t\t\t\ttry {\n\t\t\t\t\treturn callback(req, res);\n\t\t\t\t} finally {\n\t\t\t\t\treq.url = originalUrl;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// [SEC] RFC 9728 Protected Resource Metadata (PRM) Endpoint\n\t\t\tif (method === \"GET\" && url === \"/.well-known/oauth-protected-resource\") {\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst prm = buildProtectedResourceMetadata(\n\t\t\t\t\t\tthis.jwtValidator.getIssuer(),\n\t\t\t\t\t\tthis.jwtValidator.getAudience(),\n\t\t\t\t\t);\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(JSON.stringify(prm));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\tmethod === \"GET\" &&\n\t\t\t\t(url === \"/\" || url === \"/mcp\" || url === \"/health\")\n\t\t\t) {\n\t\t\t\tif (\n\t\t\t\t\turl === \"/health\" &&\n\t\t\t\t\treq.headers.accept?.includes(\"application/json\")\n\t\t\t\t) {\n\t\t\t\t\tconst meshInfo = this.meshNode\n\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\tpeerId: this.meshNode.getPeerId()?.toString() || \"\",\n\t\t\t\t\t\t\t\tmultiaddrs: this.meshNode\n\t\t\t\t\t\t\t\t\t.getMultiaddrs()\n\t\t\t\t\t\t\t\t\t.map((m) => m.toString()),\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t: null;\n\t\t\t\t\tconst issuer = this.jwtValidator?.getIssuer();\n\t\t\t\t\tconst baseUrl = issuer\n\t\t\t\t\t\t? issuer.endsWith(\"/oidc\")\n\t\t\t\t\t\t\t? issuer\n\t\t\t\t\t\t\t: `${issuer}/oidc`\n\t\t\t\t\t\t: \"\";\n\t\t\t\t\tconst authInfoResponse =\n\t\t\t\t\t\tthis.jwtValidator && issuer\n\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\tissuer,\n\t\t\t\t\t\t\t\t\tjwks_uri: `${baseUrl}/jwks`,\n\t\t\t\t\t\t\t\t\t...(this.oauthProvider\n\t\t\t\t\t\t\t\t\t\t? {\n\t\t\t\t\t\t\t\t\t\t\t\ttoken_endpoint: `${baseUrl}/token`,\n\t\t\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\t\t: {}),\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t: undefined;\n\n\t\t\t\t\tconst topologyInfo = {\n\t\t\t\t\t\ttier: this.meshNode?.isPrivateNetwork?.() ? 1 : 2,\n\t\t\t\t\t\tprmEndpoint: this.jwtValidator\n\t\t\t\t\t\t\t? \"/.well-known/oauth-protected-resource\"\n\t\t\t\t\t\t\t: undefined,\n\t\t\t\t\t\ttransportCapabilities: [\"http-mcp\", \"grpc-lio\", \"p2p-dht\"],\n\t\t\t\t\t};\n\n\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\tres.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tstatus: \"healthy\",\n\t\t\t\t\t\t\tnode: this.liopServer.getServerInfo(),\n\t\t\t\t\t\t\tmesh: meshInfo,\n\t\t\t\t\t\t\ttools: this.liopServer.listTools().map((t) => t.name),\n\t\t\t\t\t\t\tauth: authInfoResponse,\n\t\t\t\t\t\t\ttopology: topologyInfo,\n\t\t\t\t\t\t\ttimestamp: new Date().toISOString(),\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n\t\t\t\tres.end(`\n                    <body style=\"background:#0f172a;color:#f8fafc;font-family:sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;margin:0\">\n                        <div style=\"background:#1e293b;padding:40px;border-radius:16px;border:1px solid #38bdf8;text-align:center;box-shadow:0 20px 25px -5px rgba(0,0,0,0.1)\">\n                            <h1 style=\"color:#38bdf8;margin-top:0\">LIOP Protocol Transformer</h1>\n                            <p style=\"opacity:0.8;font-weight:600\">L4/L7 Transcoding: JSON-RPC &harr; gRPC</p>\n                            <p style=\"opacity:0.6;font-size:14px\">Active Protections: Kyber768 + AES-256-GCM + ZK-Proof Ready</p>\n                            <div style=\"background:#0f172a;padding:15px;border-radius:8px;margin-top:20px;border:1px dashed #334155\">\n                                <code style=\"color:#10b981\">Endpoint: http://localhost:3000/mcp</code>\n                            </div>\n                        </div>\n                    </body>\n                `);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (url === \"/mcp\" && method === \"POST\") {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = req.headers.authorization;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tres.writeHead(401, {\n\t\t\t\t\t\t\t\"WWW-Authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tlet body = \"\";\n\t\t\t\treq.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\t\t\treq.on(\"end\", async () => {\n\t\t\t\t\t// [SEC] Rate limiting per IP or authenticated client (OWASP API4:2023)\n\t\t\t\t\tconst clientIp = req.socket.remoteAddress || \"127.0.0.1\";\n\t\t\t\t\tconst rateLimitKey = authInfo?.clientId\n\t\t\t\t\t\t? `client:${authInfo.clientId}`\n\t\t\t\t\t\t: `ip:${clientIp}`;\n\t\t\t\t\tconst rateStatus = this.rateLimiter.check(rateLimitKey);\n\t\t\t\t\tif (!rateStatus.allowed) {\n\t\t\t\t\t\tres.writeHead(429, {\n\t\t\t\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\t\t\t\t\"Retry-After\": Math.ceil(rateStatus.resetMs / 1000).toString(),\n\t\t\t\t\t\t});\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\tid: null,\n\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\tcode: -32029,\n\t\t\t\t\t\t\t\t\tmessage: \"Rate limit exceeded. Too many requests.\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t\t\t// [SEC] Perimeter Admission Hook (technology-agnostic)\n\t\t\t\t\t\t// Executes AFTER JWT + RateLimiter to prevent attackers from\n\t\t\t\t\t\t// exhausting external API quotas (e.g., TYPESAFE_API_KEY) with\n\t\t\t\t\t\t// unauthenticated or rate-limited traffic.\n\t\t\t\t\t\tif (this.interceptorOptions?.interceptor) {\n\t\t\t\t\t\t\tconst verdict = await executeGatewayInterceptor(\n\t\t\t\t\t\t\t\tjsonRequest,\n\t\t\t\t\t\t\t\t{ clientIp, authInfo, protocol: \"http1\" },\n\t\t\t\t\t\t\t\tthis.interceptorOptions as Required<\n\t\t\t\t\t\t\t\t\tPick<GatewayInterceptorOptions, \"interceptor\">\n\t\t\t\t\t\t\t\t> &\n\t\t\t\t\t\t\t\t\tGatewayInterceptorOptions,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\tif (!verdict.allowed) {\n\t\t\t\t\t\t\t\tres.writeHead(403, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\t\tcode: verdict.errorCode ?? -32099,\n\t\t\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\t\t\tverdict.reason ||\n\t\t\t\t\t\t\t\t\t\t\t\t\"Forbidden: Rejected by Gateway Interceptor\",\n\t\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// [SEP-2243] Header-based routing validation\n\t\t\t\t\t\tconst mcpMethod = req.headers[\"mcp-method\"] as string | undefined;\n\t\t\t\t\t\tconst mcpName = req.headers[\"mcp-name\"] as string | undefined;\n\t\t\t\t\t\tconst mcpVersion = req.headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t\t\t| string\n\t\t\t\t\t\t\t| undefined;\n\n\t\t\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\tmcpName &&\n\t\t\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\tres.writeHead(400, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\t!jsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t]\n\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\t\t\tres.writeHead(200, { \"Content-Type\": \"application/json\" });\n\t\t\t\t\t\tres.end(JSON.stringify(response));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Gateway] Error processing JSON-RPC payload: ${(e as Error).message}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tres.writeHead(400);\n\t\t\t\t\t\tres.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\terror: { code: -32700, message: \"Parse error\" },\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t});\n\t\t\t} else {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not Found\");\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate handleGrpcStream(stream: http2.ServerHttp2Stream) {\n\t\tstream.on(\"data\", (chunk: unknown) => {\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Standard gRPC stream data is Buffer\n\t\t\tconst data = chunk as any;\n\t\t\tif (data)\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] Native gRPC Proxy passing ${data.length} bytes`,\n\t\t\t\t);\n\t\t});\n\t\tstream.respond({ \":status\": 200, \"content-type\": \"application/grpc\" });\n\t\tstream.end();\n\t}\n\n\tprivate handleMcpH2Stream(\n\t\tstream: http2.ServerHttp2Stream,\n\t\theaders: http2.IncomingHttpHeaders,\n\t) {\n\t\tlet body = \"\";\n\t\tstream.on(\"data\", (chunk) => (body += chunk.toString()));\n\t\tstream.on(\"end\", async () => {\n\t\t\ttry {\n\t\t\t\tlet authInfo: AuthInfo | null = null;\n\n\t\t\t\t// [SEC] Continuous verification of Bearer token over HTTP/2 (NIST SP 800-207)\n\t\t\t\tif (this.jwtValidator) {\n\t\t\t\t\tconst authHeader = headers.authorization as string;\n\t\t\t\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\":\n\t\t\t\t\t\t\t\t'Bearer error=\"invalid_token\", error_description=\"Missing or malformed Authorization header\"',\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Unauthorized\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\ttry {\n\t\t\t\t\t\tauthInfo = await this.jwtValidator.validate(authHeader.slice(7));\n\t\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 401,\n\t\t\t\t\t\t\t\"www-authenticate\": `Bearer error=\"invalid_token\", error_description=\"${(e as Error).message}\"`,\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(JSON.stringify({ error: \"Invalid token\" }));\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst jsonRequest = JSON.parse(body);\n\n\t\t\t\t// [SEC] Perimeter Admission Hook (HTTP/2 symmetry)\n\t\t\t\tif (this.interceptorOptions?.interceptor) {\n\t\t\t\t\tconst h2ClientIp =\n\t\t\t\t\t\tstream.session?.socket?.remoteAddress || \"127.0.0.1\";\n\t\t\t\t\tconst verdict = await executeGatewayInterceptor(\n\t\t\t\t\t\tjsonRequest,\n\t\t\t\t\t\t{ clientIp: h2ClientIp, authInfo, protocol: \"http2\" },\n\t\t\t\t\t\tthis.interceptorOptions as Required<\n\t\t\t\t\t\t\tPick<GatewayInterceptorOptions, \"interceptor\">\n\t\t\t\t\t\t> &\n\t\t\t\t\t\t\tGatewayInterceptorOptions,\n\t\t\t\t\t);\n\t\t\t\t\tif (!verdict.allowed) {\n\t\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\t\":status\": 403,\n\t\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t\t});\n\t\t\t\t\t\tstream.end(\n\t\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\t\tcode: verdict.errorCode ?? -32099,\n\t\t\t\t\t\t\t\t\tmessage:\n\t\t\t\t\t\t\t\t\t\tverdict.reason ||\n\t\t\t\t\t\t\t\t\t\t\"Forbidden: Rejected by Gateway Interceptor\",\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// [SEP-2243] Header-based routing validation in HTTP/2\n\t\t\t\tconst mcpMethod = headers[\"mcp-method\"] as string | undefined;\n\t\t\t\tconst mcpName = headers[\"mcp-name\"] as string | undefined;\n\t\t\t\tconst mcpVersion = headers[\"mcp-protocol-version\"] as\n\t\t\t\t\t| string\n\t\t\t\t\t| undefined;\n\n\t\t\t\tif (mcpMethod && mcpMethod !== jsonRequest.method) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Method' header (${mcpMethod}) does not match JSON-RPC method (${jsonRequest.method})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (\n\t\t\t\t\tmcpName &&\n\t\t\t\t\tjsonRequest.params?.name &&\n\t\t\t\t\tmcpName !== jsonRequest.params.name\n\t\t\t\t) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 400,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(\n\t\t\t\t\t\tJSON.stringify({\n\t\t\t\t\t\t\tjsonrpc: \"2.0\",\n\t\t\t\t\t\t\tid: jsonRequest.id ?? null,\n\t\t\t\t\t\t\terror: {\n\t\t\t\t\t\t\t\tcode: -32020,\n\t\t\t\t\t\t\t\tmessage: `HeaderMismatch: 'Mcp-Name' header (${mcpName}) does not match target name (${jsonRequest.params.name})`,\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t}),\n\t\t\t\t\t);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\n\t\t\t\tif (mcpVersion && jsonRequest.params) {\n\t\t\t\t\tif (!jsonRequest.params._meta) {\n\t\t\t\t\t\tjsonRequest.params._meta = {};\n\t\t\t\t\t}\n\t\t\t\t\tif (\n\t\t\t\t\t\t!jsonRequest.params._meta[\"io.modelcontextprotocol/protocolVersion\"]\n\t\t\t\t\t) {\n\t\t\t\t\t\tjsonRequest.params._meta[\n\t\t\t\t\t\t\t\"io.modelcontextprotocol/protocolVersion\"\n\t\t\t\t\t\t] = mcpVersion;\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst response = await this.router.dispatch(jsonRequest, authInfo);\n\t\t\t\tif (response) {\n\t\t\t\t\tstream.respond({\n\t\t\t\t\t\t\":status\": 200,\n\t\t\t\t\t\t\"content-type\": \"application/json\",\n\t\t\t\t\t});\n\t\t\t\t\tstream.end(JSON.stringify(response));\n\t\t\t\t} else stream.close();\n\t\t\t} catch (_e) {\n\t\t\t\tstream.respond({ \":status\": 400 });\n\t\t\t\tstream.end();\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic async listen(port: number, host: string = \"0.0.0.0\"): Promise<number> {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.start();\n\n\t\t\t// Announce all local tools to the DHT\n\t\t\tconst tools = this.liopServer.listTools();\n\t\t\tfor (const tool of tools) {\n\t\t\t\tawait this.meshNode.announceCapability(tool.name);\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] 📡 Announced local tool to Mesh: ${tool.name}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn new Promise((resolve, reject) => {\n\t\t\tthis.netServer.on(\"error\", (err: Error & { code?: string }) => {\n\t\t\t\tif (err.code === \"EADDRINUSE\") {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Gateway] FATAL: Port ${port} is already in use by another process.`,\n\t\t\t\t\t);\n\t\t\t\t} else {\n\t\t\t\t\tlog.error(`[LIOP-Gateway] Binding Error: ${err.message}`);\n\t\t\t\t}\n\t\t\t\treject(err);\n\t\t\t});\n\n\t\t\tthis.netServer.listen(port, host, () => {\n\t\t\t\tconst addr = this.netServer.address();\n\t\t\t\tconst actualHost =\n\t\t\t\t\ttypeof addr === \"string\" ? addr : addr?.address || host;\n\t\t\t\tconst assignedPort =\n\t\t\t\t\ttypeof addr === \"string\" ? port : addr?.port || port;\n\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Gateway] ✅ Transformer Mesh Gateway READY and listening on ${actualHost}:${assignedPort}`,\n\t\t\t\t);\n\t\t\t\tresolve(assignedPort);\n\t\t\t});\n\t\t});\n\t}\n\n\tpublic isDrained(): boolean {\n\t\treturn this.isDraining;\n\t}\n\n\tpublic async drain(timeoutMs = 5000): Promise<void> {\n\t\tthis.isDraining = true;\n\t\tlog.info(\n\t\t\t`[LIOP-Gateway] Draining gateway connections (active: ${this.activeRequests}, timeout: ${timeoutMs}ms)...`,\n\t\t);\n\t\tconst start = Date.now();\n\t\twhile (this.activeRequests > 0 && Date.now() - start < timeoutMs) {\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, 50));\n\t\t}\n\t\tawait this.stop();\n\t}\n\n\tpublic async stop() {\n\t\tif (this.meshNode) {\n\t\t\tawait this.meshNode.stop();\n\t\t}\n\t\tthis.rateLimiter.close();\n\t\tthis.netServer.close();\n\t\tthis.h2Server.close();\n\t\tthis.h1Server.close();\n\t}\n\n\tpublic getRouter(): LiopMcpRouter {\n\t\treturn this.router;\n\t}\n}\n"]}