@nekzus/liop 2.5.0 → 2.6.1

package/dist/chunk-WPTOJYN5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rpc/crypto/dilithium.ts","../src/security/rbac.ts"],"names":[],"mappings":";;;AAkBO,IAAM,qBAAA,GAAwB;AAAA,EACpC,gBAAA,EAAkB,IAAA;AAAA,EAClB,gBAAA,EAAkB,IAAA;AAAA,EAClB,eAAA,EAAiB,IAAA;AAAA,EACjB,eAAA,EAAiB,IAAI,WAAA,EAAY,CAAE,OAAO,wBAAwB;AACnE;AAKA,SAAS,iBAAiB,OAAA,EAA0C;AACnE,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAChC,IAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,OAAO,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,OAAA;AACR;AAOA,SAAS,iBAAiB,GAAA,EAAsB;AAC/C,EAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,OAAO,GAAA,KAAQ,QAAA,EAAU;AAC5C,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC1B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,IAAI,GAAA,CAAI,GAAA,CAAI,gBAAgB,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,MAAA,GAAS,GAAA;AACf,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CACnC,MAAA,CAAO,CAAC,GAAA,KAAQ,MAAA,CAAO,GAAG,CAAA,KAAM,MAAS,EACzC,IAAA,EAAK;AACP,EAAA,MAAM,UAAU,UAAA,CAAW,GAAA;AAAA,IAC1B,CAAC,GAAA,KAAQ,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,GAAG,CAAC,CAAA,CAAA,EAAI,gBAAA,CAAiB,MAAA,CAAO,GAAG,CAAC,CAAC,CAAA;AAAA,GACjE;AACA,EAAA,OAAO,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAC7B;AAEO,IAAM,kBAAA,GAAqB;AAAA;AAAA,EAEjC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,kBAAkB,qBAAA,CAAsB,gBAAA;AAAA,EACxC,iBAAiB,qBAAA,CAAsB,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvC,gBAAgB,IAAA,EAGd;AACD,IAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,MAAA,KAAW,EAAA,EAAI;AAC/B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,mDAAA,EAAsD,KAAK,MAAM,CAAA,CAAA;AAAA,OAClE;AAAA,IACD;AACA,IAAA,MAAM,IAAA,GAAO,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA;AACjC,IAAA,OAAO;AAAA,MACN,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK;AAAA,KACjB;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,MAAA,EAAgC;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAC7D,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,OAAO,MAAM,CAAA,CAAA;AAAA,OACjH;AAAA,IACD;AACA,IAAA,OAAO,MAAA;AAAA,EACR,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CACC,OAAA,EACA,SAAA,EACA,OAAA,EACa;AACb,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,qCAAA,EAAwC,qBAAA,CAAsB,gBAAgB,CAAA,kBAAA,EAAqB,UAAU,MAAM,CAAA,CAAA;AAAA,OACpH;AAAA,IACD;AACA,IAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,IAAA,OAAO,SAAS,IAAA,CAAK,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,EAC3D,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,CACC,SAAA,EACA,OAAA,EACA,SAAA,EACA,OAAA,EACU;AACV,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,eAAA,EAAiB;AAC/D,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,qBAAA,CAAsB,gBAAA,EAAkB;AAChE,MAAA,OAAO,KAAA;AAAA,IACR;AACA,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,iBAAiB,OAAO,CAAA;AACzC,MAAA,MAAM,GAAA,GAAM,WAAW,qBAAA,CAAsB,eAAA;AAC7C,MAAA,OAAO,QAAA,CAAS,OAAO,SAAA,EAAW,QAAA,EAAU,WAAW,EAAE,OAAA,EAAS,KAAK,CAAA;AAAA,IACxE,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAA,CACC,QAAA,EACA,SAAA,EACA,SAAA,EAC2C;AAC3C,IAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,IAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,SAAS,CAAA;AAC7C,IAAA,OAAO;AAAA,MACN,WAAW,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,MAC7C,WAAW,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,QAAQ;AAAA,KACpD;AAAA,EACD,CAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA,CACC,QAAA,EACA,eAAA,EACA,eAAA,EACU;AACV,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,eAAA,EAAiB,QAAQ,CAAA;AACjD,MAAA,MAAM,EAAE,YAAA,EAAc,IAAA,EAAM,cAAc,IAAA,EAAM,GAAG,UAAS,GAAI,QAAA;AAChE,MAAA,MAAM,YAAA,GAAe,iBAAiB,QAAQ,CAAA;AAC9C,MAAA,OAAO,IAAA,CAAK,MAAA,CAAO,GAAA,EAAK,YAAA,EAAc,GAAG,CAAA;AAAA,IAC1C,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AACD;;;AC1JA,IAAM,SAAA,GAAyD;AAAA;AAAA,EAE9D,YAAY,EAAC;AAAA,EACb,6BAA6B,EAAC;AAAA,EAC9B,2BAA2B,EAAC;AAAA,EAC5B,MAAM,EAAC;AAAA,EACP,mBAAmB,EAAC;AAAA,EACpB,wBAAwB,EAAC;AAAA;AAAA,EAGzB,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA,EAChC,YAAA,EAAc,CAAC,iBAAiB,CAAA;AAAA;AAAA,EAGhC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,gBAAA,EAAkB,CAAC,qBAAqB,CAAA;AAAA,EACxC,0BAAA,EAA4B,CAAC,qBAAqB,CAAA;AAAA;AAAA,EAGlD,cAAA,EAAgB,CAAC,kBAAkB,CAAA;AAAA,EACnC,aAAA,EAAe,CAAC,kBAAkB;AACnC,CAAA;AAuBO,SAAS,gBAAA,CACf,MAAA,EACA,IAAA,EACA,gBAAA,EACsB;AACtB,EAAA,MAAM,YAAA,GAAe,UAAU,MAAM,CAAA;AAGrC,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AAC5D,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACxB;AAGA,EAAA,IAAI,CAAC,IAAA,EAAM;AACV,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,uCAAuC,MAAM,CAAA;AAAA,KACtD;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GAAS,CAAC,GAAI,YAAA,IAAgB,EAAC,EAAI,GAAI,gBAAA,IAAoB,EAAG,CAAA;AAGpE,EAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACxB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,mBAAmB,MAAM,CAAA,8BAAA;AAAA,KAClC;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,IAAI,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AACxC,EAAA,MAAM,OAAA,GAAU,OAAO,MAAA,CAAO,CAAC,MAAM,CAAC,YAAA,CAAa,GAAA,CAAI,CAAC,CAAC,CAAA;AAEzD,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACvB,IAAA,OAAO;AAAA,MACN,OAAA,EAAS,KAAA;AAAA,MACT,QAAQ,CAAA,wBAAA,EAA2B,MAAM,cAAc,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC1E;AAAA,EACD;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACxB;AAMO,IAAM,WAAA,GAAc;AAAA,EAC1B,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA,qBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACD","file":"chunk-WPTOJYN5.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Post-Quantum Digital Signature Wrapper\n * Implements ML-DSA-65 (CRYSTALS-Dilithium, NIST FIPS 204) for quantum-resistant\n * manifest attestation, node revocation receipts, and cryptographic integrity.\n *\n * Characteristics:\n * - Security Category: NIST Level 3 (~AES-192 equivalent quantum resistance)\n * - Public Key Length: 1952 bytes\n * - Secret Key Length: 4032 bytes\n * - Signature Length: 3309 bytes\n * - Implementation: Pure TypeScript/JS via @noble/post-quantum\n */\n\nimport { ml_dsa65 } from \"@noble/post-quantum/ml-dsa.js\";\n\nexport const DILITHIUM65_CONSTANTS = {\n\tPUBLIC_KEY_BYTES: 1952,\n\tSECRET_KEY_BYTES: 4032,\n\tSIGNATURE_BYTES: 3309,\n\tDEFAULT_CONTEXT: new TextEncoder().encode(\"LIOP-FIPS204-ML-DSA-65\"),\n} as const;\n\n/**\n * Deterministically normalizes a message into a Uint8Array.\n */\nfunction normalizeMessage(message: Uint8Array | string): Uint8Array {\n\tif (typeof message === \"string\") {\n\t\treturn new TextEncoder().encode(message);\n\t}\n\treturn message;\n}\n\n/**\n * Deterministic canonical JSON serializer to ensure stable cryptographic hashing\n * regardless of key ordering in JavaScript objects (per RFC 8785 JCS).\n * Keys with undefined values are strictly excluded per RFC 8785 section 3.2.2.\n */\nfunction canonicalizeJson(obj: unknown): string {\n\tif (obj === null || typeof obj !== \"object\") {\n\t\treturn JSON.stringify(obj);\n\t}\n\tif (Array.isArray(obj)) {\n\t\treturn `[${obj.map(canonicalizeJson).join(\",\")}]`;\n\t}\n\tconst record = obj as Record<string, unknown>;\n\tconst sortedKeys = Object.keys(record)\n\t\t.filter((key) => record[key] !== undefined)\n\t\t.sort();\n\tconst entries = sortedKeys.map(\n\t\t(key) => `${JSON.stringify(key)}:${canonicalizeJson(record[key])}`,\n\t);\n\treturn `{${entries.join(\",\")}}`;\n}\n\nexport const Dilithium65Wrapper = {\n\t/** Constants */\n\tPUBLIC_KEY_BYTES: DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES,\n\tSECRET_KEY_BYTES: DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES,\n\tSIGNATURE_BYTES: DILITHIUM65_CONSTANTS.SIGNATURE_BYTES,\n\n\t/**\n\t * Generates a new ML-DSA-65 (FIPS 204) key pair.\n\t * Optionally accepts a 32-byte seed for deterministic key generation.\n\t */\n\tgenerateKeyPair(seed?: Uint8Array): {\n\t\tpublicKey: Uint8Array;\n\t\tsecretKey: Uint8Array;\n\t} {\n\t\tif (seed && seed.length !== 32) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 seed must be exactly 32 bytes (Received: ${seed.length})`,\n\t\t\t);\n\t\t}\n\t\tconst keys = ml_dsa65.keygen(seed);\n\t\treturn {\n\t\t\tpublicKey: keys.publicKey,\n\t\t\tsecretKey: keys.secretKey,\n\t\t};\n\t},\n\n\t/**\n\t * Validates and imports a raw ML-DSA-65 public key.\n\t */\n\timportPublicKey(buffer: Uint8Array): Uint8Array {\n\t\tif (buffer.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Public Key must be exactly ${DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES} bytes (Received: ${buffer.length})`,\n\t\t\t);\n\t\t}\n\t\treturn buffer;\n\t},\n\n\t/**\n\t * Signs a message using the post-quantum secret key.\n\t * Supports optional domain separation context (up to 255 bytes).\n\t */\n\tsign(\n\t\tmessage: Uint8Array | string,\n\t\tsecretKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): Uint8Array {\n\t\tif (secretKey.length !== DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES) {\n\t\t\tthrow new Error(\n\t\t\t\t`ML-DSA-65 Secret Key must be exactly ${DILITHIUM65_CONSTANTS.SECRET_KEY_BYTES} bytes (Received: ${secretKey.length})`,\n\t\t\t);\n\t\t}\n\t\tconst msgBytes = normalizeMessage(message);\n\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\treturn ml_dsa65.sign(msgBytes, secretKey, { context: ctx });\n\t},\n\n\t/**\n\t * Verifies an ML-DSA-65 post-quantum digital signature.\n\t */\n\tverify(\n\t\tsignature: Uint8Array,\n\t\tmessage: Uint8Array | string,\n\t\tpublicKey: Uint8Array,\n\t\tcontext?: Uint8Array,\n\t): boolean {\n\t\tif (signature.length !== DILITHIUM65_CONSTANTS.SIGNATURE_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\tif (publicKey.length !== DILITHIUM65_CONSTANTS.PUBLIC_KEY_BYTES) {\n\t\t\treturn false;\n\t\t}\n\t\ttry {\n\t\t\tconst msgBytes = normalizeMessage(message);\n\t\t\tconst ctx = context ?? DILITHIUM65_CONSTANTS.DEFAULT_CONTEXT;\n\t\t\treturn ml_dsa65.verify(signature, msgBytes, publicKey, { context: ctx });\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n\n\t/**\n\t * Signs a structured manifest (LiopManifest) using canonical JSON serialization.\n\t * Returns base64-encoded signature and public key for transport over gRPC/MCP.\n\t */\n\tsignManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsecretKey: Uint8Array,\n\t\tpublicKey: Uint8Array,\n\t): { signature: string; publicKey: string } {\n\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\tconst sig = this.sign(canonicalStr, secretKey);\n\t\treturn {\n\t\t\tsignature: Buffer.from(sig).toString(\"base64\"),\n\t\t\tpublicKey: Buffer.from(publicKey).toString(\"base64\"),\n\t\t};\n\t},\n\n\t/**\n\t * Verifies the post-quantum signature of a structured manifest.\n\t */\n\tverifyManifest(\n\t\tmanifest: Record<string, unknown>,\n\t\tsignatureBase64: string,\n\t\tpublicKeyBase64: string,\n\t): boolean {\n\t\ttry {\n\t\t\tconst sig = Buffer.from(signatureBase64, \"base64\");\n\t\t\tconst pub = Buffer.from(publicKeyBase64, \"base64\");\n\t\t\tconst { pqcSignature: _sig, pqcPublicKey: _pub, ...unsigned } = manifest;\n\t\t\tconst canonicalStr = canonicalizeJson(unsigned);\n\t\t\treturn this.verify(sig, canonicalStr, pub);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t},\n};\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP RBAC Engine — Scope-Based Authorization\n *\n * Maps MCP JSON-RPC methods to required LIOP OAuth scopes.\n * Enforces least-privilege access at the router level before\n * any tool execution or resource read occurs.\n *\n * Standards: NIST SP 800-207 §4.3 (least privilege), OWASP LLM06 (Excessive Agency),\n *            OWASP API-A01 (Broken Access Control)\n */\n\nimport type { AuthInfo } from \"./jwt-validator.js\";\n\n/**\n * Maps MCP JSON-RPC methods to the LIOP scopes required to invoke them.\n * Empty array = no authentication required (public endpoints).\n */\nconst SCOPE_MAP: Readonly<Record<string, readonly string[]>> = {\n\t// Protocol lifecycle — unauthenticated (MCP spec compliance)\n\tinitialize: [],\n\t\"notifications/initialized\": [],\n\t\"notifications/cancelled\": [],\n\tping: [],\n\t\"server/discover\": [],\n\t\"subscriptions/listen\": [],\n\n\t// Tool operations — require explicit authorization\n\t\"tools/list\": [\"liop:tools:list\"],\n\t\"tools/call\": [\"liop:tools:call\"],\n\n\t// Resource operations — read-level access\n\t\"resources/list\": [\"liop:resources:read\"],\n\t\"resources/read\": [\"liop:resources:read\"],\n\t\"resources/templates/list\": [\"liop:resources:read\"],\n\n\t// Prompt/schema operations — schema-level access\n\t\"prompts/list\": [\"liop:schema:read\"],\n\t\"prompts/get\": [\"liop:schema:read\"],\n};\n\n/**\n * Authorization result with optional denial reason for audit logging.\n */\nexport interface AuthorizationResult {\n\tallowed: boolean;\n\treason?: string;\n}\n\n/**\n * Evaluates whether a request is authorized based on JWT scopes.\n *\n * Decision logic:\n * 1. Methods with no required scopes (initialize, ping) → always allowed.\n * 2. Methods with required scopes but no auth → denied.\n * 3. Methods with required scopes → all scopes must be present in the JWT.\n * 4. Unknown methods with no auth → denied (fail-closed per NIST SP 800-207).\n *\n * @param method - MCP JSON-RPC method name (e.g., \"tools/call\")\n * @param auth - Validated JWT context, or null if unauthenticated\n * @param additionalScopes - Extra scopes required by specific node configuration\n */\nexport function authorizeRequest(\n\tmethod: string,\n\tauth: AuthInfo | null,\n\tadditionalScopes?: readonly string[],\n): AuthorizationResult {\n\tconst methodScopes = SCOPE_MAP[method];\n\n\t// Methods explicitly marked as public (empty scope array) pass freely\n\tif (methodScopes !== undefined && methodScopes.length === 0) {\n\t\treturn { allowed: true };\n\t}\n\n\t// If no auth context and method requires scopes → deny\n\tif (!auth) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Authentication required for method: ${method}`,\n\t\t};\n\t}\n\n\t// Merge method-level scopes with node-level additional scopes\n\tconst needed = [...(methodScopes ?? []), ...(additionalScopes ?? [])];\n\n\t// If no scopes needed (unknown method, no additional) → fail-closed\n\tif (needed.length === 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Unknown method: ${method}. Access denied (fail-closed).`,\n\t\t};\n\t}\n\n\t// Verify all required scopes are present in the JWT\n\tconst clientScopes = new Set(auth.scopes);\n\tconst missing = needed.filter((s) => !clientScopes.has(s));\n\n\tif (missing.length > 0) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\treason: `Insufficient scopes for ${method}. Missing: ${missing.join(\", \")}`,\n\t\t};\n\t}\n\n\treturn { allowed: true };\n}\n\n/**\n * All LIOP OAuth scopes supported by the protocol.\n * Used for PRM metadata and client registration.\n */\nexport const LIOP_SCOPES = [\n\t\"liop:tools:list\",\n\t\"liop:tools:call\",\n\t\"liop:resources:read\",\n\t\"liop:schema:read\",\n\t\"liop:mesh:query\",\n] as const;\n\nexport type LiopScope = (typeof LIOP_SCOPES)[number];\n"]}

package/dist/{chunk-74CISO2I.js → chunk-XRDN232O.js}

@@ -1,4 +1,4 @@
-import { log } from './chunk-72MNYFR6.js';
+import { log } from './chunk-K3DGJLUY.js';
 import * as fs from 'fs/promises';
 import * as path from 'path';
 import { noise } from '@chainsafe/libp2p-noise';
@@ -60,7 +60,8 @@ var MeshNode = class _MeshNode {
       identityPath: config.identityPath,
       enableWAN: config.enableWAN ?? false,
       dhtStoragePath: config.dhtStoragePath,
-      addressMapper: config.addressMapper
+      addressMapper: config.addressMapper,
+      swarmKey: config.swarmKey
     };
   }
   shouldSkipManifestDial(peerIdStr) {
@@ -258,6 +259,16 @@ var MeshNode = class _MeshNode {
     if (enableDcutr) {
       services.dcutr = dcutr();
     }
+    let connectionProtector;
+    if (this.config.swarmKey) {
+      const { preSharedKey } = await import('@libp2p/pnet');
+      connectionProtector = preSharedKey({
+        psk: this.config.swarmKey
+      });
+      log.info(
+        "[LIOP-Mesh] \u{1F512} Private Network (pnet) enabled \u2014 transport-layer PSK isolation active"
+      );
+    }
     this.node = await createLibp2p({
       privateKey,
       addresses: {
@@ -266,6 +277,7 @@ var MeshNode = class _MeshNode {
       transports,
       connectionEncrypters: [noise()],
       streamMuxers: [yamux()],
+      ...connectionProtector ? { connectionProtector } : {},
       // biome-ignore lint/suspicious/noExplicitAny: services polymorphic definition
       services,
       peerDiscovery: (
@@ -846,8 +858,20 @@ var MeshNode = class _MeshNode {
     if (!this.node) return [];
     return this.node.getConnections().map((c) => c.remotePeer.toString());
   }
+  /**
+   * Returns true if this MeshNode was booted inside an isolated libp2p private network (pnet PSK).
+   */
+  isPrivateNetwork() {
+    return Boolean(this.config.swarmKey);
+  }
+  /**
+   * Returns the configured 95-byte Swarm Key, or undefined if running in a public/consortium mesh.
+   */
+  getSwarmKey() {
+    return this.config.swarmKey;
+  }
 };
 
 export { MeshNode };
-//# sourceMappingURL=chunk-74CISO2I.js.map
-//# sourceMappingURL=chunk-74CISO2I.js.map
+//# sourceMappingURL=chunk-XRDN232O.js.map
+//# sourceMappingURL=chunk-XRDN232O.js.map

package/dist/chunk-XRDN232O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mesh/node.ts"],"names":["privateKey","resolve","raw"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAyFA,IAAM,uBAAA,GAA0B;AAAA,EAC/B,iFAAA;AAAA,EACA,iFAAA;AAAA,EACA,iFAAA;AAAA,EACA;AACD,CAAA;AAEA,IAAM,sBAAA,GAAyB,sBAAA;AAC/B,IAAM,wBAAA,GAA2B,eAAA;AAQ1B,IAAM,QAAA,GAAN,MAAM,SAAA,CAAS;AAAA,EACb,IAAA,GAAsB,IAAA;AAAA,EACtB,MAAA;AAAA,EACA,wBAAA,uBAGA,GAAA,EAAI;AAAA,EACZ,OAAwB,8BAAA,GAAiC,GAAA;AAAA,EACzD,OAAwB,gCAAgC,CAAA,GAAI,GAAA;AAAA,EAC5D,OAAwB,kCAAA,GAAqC,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrD,qBAAA,uBAAyC,GAAA,EAAI;AAAA;AAAA,EAG7C,YAAA,GAAe,KAAA;AAAA;AAAA,EAGf,gBAAA,GAAgD,IAAA;AAAA;AAAA,EAGhD,0BAAA,GAA6B,KAAA;AAAA;AAAA;AAAA,EAI7B,eAAA,GAA8B,IAAA;AAAA,EAEtC,WAAA,CAAY,MAAA,GAAyB,EAAC,EAAG;AACxC,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACb,eAAA,EAAiB,OAAO,eAAA,IAAmB;AAAA,QAC1C,uBAAA;AAAA,QACA;AAAA,OACD;AAAA,MACA,cAAA,EAAgB,MAAA,CAAO,cAAA,IAAkB,EAAC;AAAA,MAC1C,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,SAAA,EAAW,OAAO,SAAA,IAAa,KAAA;AAAA,MAC/B,gBAAgB,MAAA,CAAO,cAAA;AAAA,MACvB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,UAAU,MAAA,CAAO;AAAA,KAClB;AAAA,EACD;AAAA,EAEQ,uBAAuB,SAAA,EAA4B;AAC1D,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,SAAS,CAAA;AACzD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,GAAA,IAAO,KAAA,CAAM,aAAA,EAAe,OAAO,KAAA;AACvC,IAAA,IACC,GAAA,GAAM,KAAA,CAAM,aAAA,GACZ,SAAA,CAAS,kCAAA,EACR;AACD,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,uCAAA,EAA0C,SAAS,CAAA,kBAAA,EAAqB,IAAA,CAAK,MAAM,KAAA,CAAM,aAAA,GAAgB,GAAA,IAAO,GAAI,CAAC,CAAA,YAAA;AAAA,OACtH;AACA,MAAA,KAAA,CAAM,aAAA,GAAgB,GAAA;AAAA,IACvB;AACA,IAAA,OAAO,IAAA;AAAA,EACR;AAAA,EAEQ,0BAA0B,SAAA,EAAyB;AAC1D,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,SAAS,CAAA;AACxD,IAAA,MAAM,QAAA,GAAA,CAAY,IAAA,EAAM,QAAA,IAAY,CAAA,IAAK,CAAA;AACzC,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA;AAAA,MACpB,UAAS,8BAAA,GAAiC,CAAA,IAAK,KAAK,GAAA,CAAI,CAAA,EAAG,WAAW,CAAC,CAAA;AAAA,MACvE,SAAA,CAAS;AAAA,KACV;AACA,IAAA,IAAA,CAAK,wBAAA,CAAyB,IAAI,SAAA,EAAW;AAAA,MAC5C,QAAA;AAAA,MACA,eAAe,GAAA,GAAM,OAAA;AAAA,MACrB,aAAA,EAAe;AAAA,KACf,CAAA;AAAA,EACF;AAAA,EAEQ,yBAAyB,SAAA,EAAyB;AACzD,IAAA,IAAA,CAAK,wBAAA,CAAyB,OAAO,SAAS,CAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBAAA,GAAuB;AACpC,IAAA,IAAI;AACH,MAAA,MAAM,EAAE,eAAA,EAAiB,sBAAA,EAAuB,GAAK,MAAM;AAAA,QAC1D;AAAA;AAAA,OAED;AACA,MAAA,MAAM,EAAE,UAAA,EAAY,YAAA,EAAa,GAAI,MAAM,OAC1C,yBACD,CAAA;AAEA,MAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC7B,QAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAC1D,QAAA,IAAI;AACH,UAAA,MAAM,IAAA,GAAO,MAAS,EAAA,CAAA,QAAA,CAAS,YAAA,EAAc,OAAO,CAAA;AACpD,UAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC5B,UAAA,MAAM,aAAA,GAAgB,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AACzD,UAAA,IAAI;AACH,YAAA,MAAMA,WAAAA,GAAa,uBAAuB,aAAa,CAAA;AACvD,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,+CAA+C,YAAY,CAAA;AAAA,aAC5D;AACA,YAAA,OAAO,EAAE,UAAA,EAAAA,WAAAA,EAAY,KAAA,EAAO,KAAA,EAAM;AAAA,UACnC,SAAS,UAAA,EAAqB;AAC7B,YAAA,GAAA,CAAI,KAAA;AAAA,cACH,CAAA,mCAAA,EAAsC,YAAY,CAAA,mDAAA,EACjD,UAAA,YAAsB,QACnB,UAAA,CAAW,OAAA,GACX,MAAA,CAAO,UAAU,CACrB,CAAA;AAAA,aACD;AAAA,UAED;AAAA,QACD,SAAS,KAAA,EAAgB;AACxB,UAAA,MAAM,CAAA,GAAI,KAAA;AACV,UAAA,IAAI,CAAA,CAAE,SAAS,QAAA,EAAU;AACxB,YAAA,GAAA,CAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAAA,UAC7D;AAAA,QACD;AAAA,MACD;AAEA,MAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,SAAS,CAAA;AAClD,MAAA,OAAO,EAAE,UAAA,EAAY,KAAA,EAAO,IAAA,EAAK;AAAA,IAClC,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA;AAAA,QACH,sDAAsD,KAAK,CAAA,qCAAA;AAAA,OAC5D;AAIA,MAAA,IAAI;AACH,QAAA,MAAM,EAAE,eAAA,EAAgB,GAAK,MAAM;AAAA,UAClC;AAAA;AAAA,SAED;AACA,QAAA,MAAM,YAAA,GAAe,MAAM,eAAA,CAAgB,SAAS,CAAA;AACpD,QAAA,OAAO,EAAE,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,IAAA,EAAK;AAAA,MAChD,SAAS,aAAA,EAAe;AACvB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,aAAa,CAAA,CAAE,CAAA;AAAA,MAC5D;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,aAAa,UAAA,EAAiB;AAC3C,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,CAAC,KAAK,IAAA,EAAM;AAE7C,IAAA,IAAI;AACH,MAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAC1D,MAAA,MAAM,EAAE,oBAAA,EAAqB,GAAK,MAAM;AAAA,QACvC;AAAA;AAAA,OAED;AACA,MAAA,MAAM,EAAE,QAAA,EAAU,UAAA,EAAW,GAAI,MAAM,OAAO,uBAAuB,CAAA;AAErE,MAAA,MAAM,aAAA,GAAgB,qBAAqB,UAAU,CAAA;AACrD,MAAA,MAAM,cAAA,GAAiB,UAAA,CAAW,aAAA,EAAe,QAAQ,CAAA;AAEzD,MAAA,MAAM,IAAA,GAAO;AAAA,QACZ,EAAA,EAAI,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAA,EAAS;AAAA,QAC9B,OAAA,EAAS;AAAA,OACV;AAEA,MAAA,MAAS,SAAW,IAAA,CAAA,OAAA,CAAQ,YAAY,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9D,MAAA,MAAS,aAAU,YAAA,EAAc,IAAA,CAAK,UAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAC,CAAA;AAC9D,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,kCAAA,EAAqC,YAAY,CAAA,CAAE,CAAA;AAAA,IAC7D,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,wCAAA,EAA2C,KAAK,CAAA,CAAE,CAAA;AAAA,IAC7D;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,gBAAgB,UAAA,EAAkC;AAC/D,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,MAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAU,CAAC,CAAA;AACrE,IAAA,OAAO,GAAA,CAAI,MAAA,CAAO,CAAA,EAAG,EAAA,EAAM,IAAI,CAAA;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,aAAA,GAA+B;AAC5C,IAAA,IACC,KAAK,YAAA,IACL,CAAC,KAAK,IAAA,IACN,IAAA,CAAK,sBAAsB,IAAA,KAAS,CAAA;AAEpC,MAAA;AAED,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAI;AAEH,MAAA,MAAM,IAAI,OAAA,CAAQ,CAACC,aAAY,UAAA,CAAWA,QAAAA,EAAS,GAAG,CAAC,CAAA;AAEvD,MAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AAEhB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0BAAA,EAA6B,IAAA,CAAK,qBAAA,CAAsB,IAAI,CAAA,yCAAA;AAAA,OAC7D;AAEA,MAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,qBAAA,EAAuB;AAC9C,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,eAAA,CAAgB,IAAI,CAAA;AAC3C,UAAA,MAAM,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA;AAC1C,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAE,CAAA;AAAA,QAC7C,SAAS,EAAA,EAAI;AACZ,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,mCAAA,EAAsC,IAAI,CAAA,EAAA,EAAK,EAAE,CAAA,CAAE,CAAA;AAAA,QAC7D;AAAA,MACD;AAAA,IACD,CAAA,SAAE;AACD,MAAA,IAAA,CAAK,YAAA,GAAe,KAAA;AAAA,IACrB;AAAA,EACD;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC5B,IAAA,IAAI,KAAK,IAAA,EAAM;AACf,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,oBAAA,EAAqB;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAEhE,IAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAM,GAAI,MAAA;AAC9B,IAAA,IAAA,CAAK,eAAA,GAAkB,UAAA;AAEvB,IAAA,IAAI,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,EAAC;AAC/C,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,IAAK,IAAA,CAAK,OAAO,SAAA,EAAW;AACpD,MAAA,SAAA,GAAY,uBAAA;AAAA,IACb;AAEA,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,MAAA,CAAO,aAAA,IAAiB,IAAA;AACnD,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,MAAA,CAAO,WAAA,IAAe,IAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,MAAA,CAAO,WAAA,IAAe,IAAA;AAC/C,IAAA,MAAM,aAAa,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,CAAC,KAAK,MAAA,CAAO,SAAA;AAG1D,IAAA,MAAM,gBAAuB,EAAC;AAC9B,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACzB,MAAA,aAAA,CAAc,IAAA;AAAA,QACb,SAAA,CAAU;AAAA,UACT,IAAA,EAAM;AAAA,SACN;AAAA,OACF;AAAA,IACD;AACA,IAAA,IAAI,UAAA,EAAY;AACf,MAAA,aAAA,CAAc,IAAA,CAAK,MAAM,CAAA;AAAA,IAC1B;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,MAAA,CAAO,SAAA,GAC7B,iBAAA,GACA,qBAAA;AAGH,IAAA,MAAM,UAAA,GAAoB,CAAC,GAAA,EAAI,EAAG,YAAY,CAAA;AAC9C,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,UAAA,CAAW,IAAA,CAAK,uBAAuB,CAAA;AAAA,IACxC;AAGA,IAAA,MAAM,QAAA,GAAgC;AAAA,MACrC,UAAU,QAAA,EAAS;AAAA,MACnB,MAAM,IAAA,EAAK;AAAA,MACX,KAAK,MAAA,CAAO;AAAA,QACX,QAAA,EAAU,WAAA;AAAA,QACV,UAAA,EAAY,KAAA;AAAA;AAAA,QAEZ,uBAAA,EAAyB,IAAA;AAAA;AAAA,QAEzB,cAAA,EAAgB,CAAC,IAAA,KAAS;AAAA,OAC1B;AAAA,KACF;AAEA,IAAA,IAAI,aAAA,EAAe;AAClB,MAAA,QAAA,CAAS,UAAU,OAAA,EAAQ;AAAA,IAC5B;AACA,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,QAAA,CAAS,QAAQ,kBAAA,EAAmB;AAAA,IACrC;AACA,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,QAAA,CAAS,QAAQ,KAAA,EAAM;AAAA,IACxB;AAIA,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI,IAAA,CAAK,OAAO,QAAA,EAAU;AACzB,MAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,cAAc,CAAA;AACpD,MAAA,mBAAA,GAAsB,YAAA,CAAa;AAAA,QAClC,GAAA,EAAK,KAAK,MAAA,CAAO;AAAA,OACjB,CAAA;AACD,MAAA,GAAA,CAAI,IAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AAEA,IAAA,IAAA,CAAK,IAAA,GAAO,MAAM,YAAA,CAAa;AAAA,MAC9B,UAAA;AAAA,MACA,SAAA,EAAW;AAAA,QACV,MAAA,EAAQ,KAAK,MAAA,CAAO;AAAA,OACrB;AAAA,MACA,UAAA;AAAA,MACA,oBAAA,EAAsB,CAAC,KAAA,EAAO,CAAA;AAAA,MAC9B,YAAA,EAAc,CAAC,KAAA,EAAO,CAAA;AAAA,MACtB,GAAI,mBAAA,GAAsB,EAAE,mBAAA,KAAwB,EAAC;AAAA;AAAA,MAErD,QAAA;AAAA,MACA,aAAA;AAAA;AAAA,QAEC,aAAA,CAAc,MAAA,GAAS,CAAA,GAAK,aAAA,GAAwB;AAAA;AAAA,KACrD,CAAA;AAGD,IAAA,IAAA,CAAK,IAAA,CAAK,gBAAA,CAAiB,gBAAA,EAAkB,CAAC,GAAA,KAAQ;AACrD,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,EAAA;AAC1B,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6BAAA,EAAgC,MAAA,CAAO,QAAA,EAAU,CAAA,CAAE,CAAA;AAE5D,MAAA,IAAI,KAAK,IAAA,EAAM;AAEd,QAAA,IAAI,UAAA,GAAkB,MAAA;AAGtB,QAAA,IAAI,KAAK,MAAA,CAAO,aAAA,IAAiB,IAAI,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA,EAAG;AAClE,UAAA,MAAM,aAAa,GAAA,CAAI,MAAA,CAAO,UAAA,CAC5B,GAAA,CAAI,CAAC,EAAA,KAAO;AAEZ,YAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,aAAA,CAAe,EAAA,CAAG,UAAU,CAAA;AACvD,YAAA,OAAO,MAAA,GAAS,SAAA,CAAU,MAAM,CAAA,GAAI,IAAA;AAAA,UACrC,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,CAAA,KAAkC,MAAM,IAAI,CAAA;AAEtD,UAAA,MAAM,YAAY,UAAA,CAAW,IAAA;AAAA,YAC5B,CAAC,EAAA,KACA,EAAA,CAAG,QAAA,EAAS,CAAE,QAAA,CAAS,OAAO,CAAA,IAAK,CAAC,EAAA,CAAG,QAAA,EAAS,CAAE,SAAS,KAAK;AAAA,WAClE;AACA,UAAA,IAAI,WAAW,UAAA,GAAa,SAAA;AAAA,QAC7B;AAEA,QAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MAC1C;AAAA,IACD,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,IAAA,CAAK,gBAAA,CAAiB,cAAA,EAAgB,CAAC,GAAA,KAAQ;AACnD,MAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AACnB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,+BAAA,EAAkC,MAAA,CAAO,QAAA,EAAU,CAAA,CAAE,CAAA;AAE9D,MAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AAEhB,MAAA,MAAM,GAAA,GAAO,IAAA,CAAK,IAAA,CAAK,QAAA,CAAiB,GAAA;AACxC,MAAA,IAAI,KAAK,YAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,mBAAA,EAAsB,MAAA,CAAO,QAAA,EAAU,CAAA,qBAAA;AAAA,SACxC;AACA,QAAA,GAAA,CAAI,aAAa,GAAA,CAAI,MAAM,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AACpD,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,oDAAoD,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,WACrG;AAAA,QACD,CAAC,CAAA;AAAA,MACF;AAIA,MAAA,IAAA,CAAK,aAAA,EAAc,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAC5C,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,kCAAkC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SACnF;AAAA,MACD,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAM,IAAA,CAAK,KAAK,KAAA,EAAM;AAGtB,IAAA,MAAM,KAAK,gBAAA,EAAiB;AAG5B,IAAA,IAAA,CAAK,aAAA,EAAc;AAEnB,IAAA,IAAI,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AACtC,MAAA,MAAM,IAAA,CAAK,aAAa,UAAU,CAAA;AAAA,IACnC;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,kCAAA,EAAqC,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA;AAAA,KACjE;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAc,CAAE,OAAA,CAAQ,CAAC,IAAA,KAAS;AAC3C,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,0BAAA,EAA6B,IAAA,CAAK,QAAA,EAAU,CAAA,CAAE,CAAA;AAAA,IACxD,CAAC,CAAA;AAGD,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACzB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,uCAAA,EAA0C,UAAU,MAAM,CAAA,mBAAA;AAAA,OAC3D;AAEA,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC7B,QAAA,IAAI,OAAA,GAAU,KAAA;AACd,QAAA,IAAI,OAAA,GAAU,CAAA;AAEd,QAAA,OAAO,OAAA,IAAW,UAAA,IAAc,CAAC,OAAA,EAAS;AACzC,UAAA,IAAI;AACH,YAAA,MAAM,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACpC,YAAA,GAAA,CAAI,IAAA,CAAK,CAAA,uCAAA,EAAqC,IAAI,CAAA,CAAE,CAAA;AACpD,YAAA,OAAA,GAAU,IAAA;AAAA,UACX,SAAS,EAAA,EAAI;AACZ,YAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,MAAO,CAAA,KAAM,OAAA,GAAU,IAAI,GAAI,CAAA;AACtD,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,sCAAA,EAA+B,OAAO,CAAA,CAAA,EAAI,UAAU,OAAO,IAAI,CAAA,qBAAA,EAAwB,QAAQ,GAAI,CAAA,IAAA;AAAA,aACpG;AACA,YAAA,IAAI,UAAU,UAAA,EAAY;AACzB,cAAA,MAAM,IAAI,OAAA,CAAQ,CAACA,aAAY,UAAA,CAAWA,QAAAA,EAAS,KAAK,CAAC,CAAA;AAAA,YAC1D,CAAA,MAAO;AACN,cAAA,GAAA,CAAI,KAAA;AAAA,gBACH,CAAA,kDAAA,EAAgD,IAAI,CAAA,OAAA,EAAU,UAAU,CAAA,wBAAA;AAAA,eACzE;AAAA,YACD;AACA,YAAA,OAAA,EAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA,EAEA,MAAM,IAAA,GAAsB;AAC3B,IAAA,IAAI,KAAK,IAAA,EAAM;AACd,MAAA,MAAM,KAAK,gBAAA,EAAiB;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAK,IAAA,EAAK;AACrB,MAAA,GAAA,CAAI,KAAK,0BAA0B,CAAA;AAAA,IACpC;AAAA,EACD;AAAA,EAEA,MAAc,gBAAA,GAAmB;AAChC,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,CAAC,KAAK,IAAA,EAAM;AAC/C,IAAA,IAAI;AACH,MAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,cAAc,CAAA;AAC5D,MAAA,MAAM,IAAA,GAAO,MAAS,EAAA,CAAA,QAAA,CAAS,YAAA,EAAc,OAAO,CAAA;AACpD,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,MAAA,MAAM,EAAE,gBAAA,EAAiB,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAE3D,MAAA,IAAI,WAAA,GAAc,CAAA;AAClB,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,QAAA,IAAI,CAAC,IAAA,CAAK,EAAA,IAAM,CAAC,KAAK,SAAA,EAAW;AACjC,QAAA,IAAI;AACH,UAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,IAAA,CAAK,EAAE,CAAA;AACvC,UAAA,MAAM,KAAA,GAAQ,KAAK,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAc,SAAA,CAAU,CAAC,CAAC,CAAA;AAE5D,UAAA,MAAM,IAAA,CAAK,KAAK,SAAA,CAAU,IAAA,CAAK,QAAe,EAAE,UAAA,EAAY,OAAO,CAAA;AAInE,UAAA,MAAM,GAAA,GAAO,IAAA,CAAK,IAAA,CAAK,QAAA,CAAiB,GAAA;AACxC,UAAA,IAAI,KAAK,YAAA,EAAc;AACtB,YAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA,CAAE,MAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAAA,UAC5C;AACA,UAAA,WAAA,EAAA;AAAA,QACD,SAAS,EAAA,EAAI;AAAA,QAAC;AAAA,MACf;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,mBAAA,EAAsB,WAAW,CAAA,uBAAA,CAAyB,CAAA;AAAA,IACpE,SAAS,KAAA,EAAgB;AACxB,MAAA,MAAM,CAAA,GAAI,KAAA;AACV,MAAA,IAAI,CAAA,CAAE,SAAS,QAAA,EAAU;AACxB,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAAA,MAC/D;AAAA,IACD;AAAA,EACD;AAAA,EAEA,MAAc,gBAAA,GAAmB;AAChC,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,CAAC,KAAK,IAAA,EAAM;AAC/C,IAAA,IAAI;AACH,MAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,cAAc,CAAA;AAC5D,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,GAAA,EAAI;AAC/C,MAAA,MAAM,cAAc,EAAC;AACrB,MAAA,KAAA,MAAW,QAAQ,QAAA,EAAU;AAC5B,QAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG;AAC9B,UAAA,WAAA,CAAY,IAAA,CAAK;AAAA,YAChB,EAAA,EAAI,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS;AAAA;AAAA,YAErB,SAAA,EAAW,KAAK,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAW,CAAA,CAAE,SAAA,CAAU,QAAA,EAAU;AAAA,WAChE,CAAA;AAAA,QACF;AAAA,MACD;AACA,MAAA,MAAS,SAAW,IAAA,CAAA,OAAA,CAAQ,YAAY,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9D,MAAA,MAAS,aAAU,YAAA,EAAc,IAAA,CAAK,UAAU,WAAA,EAAa,IAAA,EAAM,CAAC,CAAC,CAAA;AACrE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,kBAAA,EAAqB,WAAA,CAAY,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IACxE,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,8CAAA,EAAiD,KAAK,CAAA,CAAE,CAAA;AAAA,IACnE;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC7B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,0BAAA,EAA4B;AACnD,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAE5B,IAAA,IAAA,CAAK,0BAAA,GAA6B,IAAA;AAGlC,IAAA,IAAA,CAAK,kBAAA,CAAmB,wBAAwB,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAChE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,kDAAA,EAAqD,GAAG,CAAA,CAAE,CAAA;AAAA,IACpE,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,IAAA,CAAK,MAAA;AAAA,MACT,sBAAA;AAAA;AAAA,MAEA,OAAO,WAAgB,aAAA,KAAwB;AAE9C,QAAA,MAAM,MAAA,GAAS,WAAW,MAAA,IAAU,SAAA;AACpC,QAAA,MAAM,IAAA,GAAO,WAAW,UAAA,IAAc,aAAA;AACtC,QAAA,MAAM,UAAA,GAAa,IAAA,EAAM,UAAA,EAAY,QAAA,EAAS,IAAK,SAAA;AAEnD,QAAA,GAAA,CAAI,IAAA,CAAK,CAAA,2CAAA,EAA8C,UAAU,CAAA,CAAA,CAAG,CAAA;AAEpE,QAAA,IAAI;AACH,UAAA,MAAM,QAAA,GAAW,KAAK,gBAAA,IAAmB;AACzC,UAAA,IAAI,CAAC,QAAA,IAAY,CAAC,MAAA,EAAQ;AACzB,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,6DAAA;AAAA,aACD;AACA,YAAA,IAAI;AACH,cAAA,IAAI,OAAO,MAAA,EAAQ,KAAA,KAAU,UAAA,EAAY,MAAM,OAAO,KAAA,EAAM;AAAA,YAC7D,SAAS,EAAA,EAAI;AAAA,YAAC;AACd,YAAA;AAAA,UACD;AAEA,UAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA;AAC3C,UAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,WAAW,CAAA;AAGpD,UAAA,MAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAChC,UAAA,SAAA,CAAU,aAAA,CAAc,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACzC,UAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO,CAAC,WAAW,MAAA,CAAO,IAAA,CAAK,OAAO,CAAC,CAAC,CAAA;AAElE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,iCAAiC,UAAA,CAAW,MAAM,CAAA,WAAA,EAAc,UAAU,YAAY,QAAA,CAAS,KAAA,CAAM,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAI,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,WACnI;AAEA,UAAA,IAAI;AAEH,YAAA,IAAI,OAAO,MAAA,CAAO,IAAA,KAAS,UAAA,EAAY;AACtC,cAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AACvC,cAAA,IAAI,CAAC,QAAA,IAAY,OAAO,MAAA,CAAO,YAAY,UAAA,EAAY;AACtD,gBAAA,IAAI;AACH,kBAAA,MAAM,MAAA,CAAO,QAAQ,EAAE,MAAA,EAAQ,YAAY,OAAA,CAAQ,GAAI,GAAG,CAAA;AAAA,gBAC3D,SAAS,QAAA,EAAU;AAClB,kBAAA,GAAA,CAAI,IAAA;AAAA,oBACH,CAAA,oCAAA,EAAuC,UAAU,CAAA,EAAA,EAAK,QAAA,YAAoB,QAAQ,QAAA,CAAS,OAAA,GAAU,MAAA,CAAO,QAAQ,CAAC,CAAA;AAAA,mBACtH;AAAA,gBACD;AAAA,cACD;AAAA,YACD,CAAA,MAAO;AAEN,cAAA,MAAM,IAAA,CAAK,CAAC,UAAU,CAAA,EAAG,MAAM,CAAA;AAAA,YAChC;AACA,YAAA,GAAA,CAAI,IAAA,CAAK,CAAA,0CAAA,EAA6C,UAAU,CAAA,CAAE,CAAA;AAAA,UACnE,SAAS,QAAA,EAAmB;AAC3B,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,4CAAA,EAA+C,UAAU,CAAA,EAAA,EAAK,QAAA,YAAoB,QAAQ,QAAA,CAAS,OAAA,GAAU,MAAA,CAAO,QAAQ,CAAC,CAAA;AAAA,aAC9H;AAAA,UACD,CAAA,SAAE;AACD,YAAA,IAAI;AACH,cAAA,IAAI,OAAO,MAAA,CAAO,KAAA,KAAU,UAAA,EAAY,MAAM,OAAO,KAAA,EAAM;AAAA,YAC5D,SAAS,EAAA,EAAI;AAAA,YAEb;AAAA,UACD;AACA,UAAA;AAAA,QACD,SAAS,GAAA,EAAc;AACtB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,sCAAA,EAAyC,UAAU,CAAA,EAAA,EAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,WACzG;AAAA,QACD;AAAA,MACD;AAAA,KACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,6CAA6C,sBAAsB,CAAA;AAAA,KACpE;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,wBAAwB,QAAA,EAAoC;AAC3D,IAAA,IAAA,CAAK,gBAAA,GAAmB,QAAA;AACxB,IAAA,IAAI,KAAK,IAAA,EAAM;AACd,MAAA,IAAA,CAAK,aAAA,EAAc;AAAA,IACpB;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,SAAA,EAAiD;AACpE,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAI1D,IAAA,IAAI,SAAA,KAAc,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,UAAS,EAAG;AAC9C,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,+DAA+D,SAAS,CAAA;AAAA,OACzE;AACA,MAAA,OAAO,IAAA,CAAK,oBAAmB,IAAK,IAAA;AAAA,IACrC;AACA,IAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,SAAS,CAAA,EAAG;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,YAAA,GAAe,CAAA;AACrB,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,YAAA,EAAc,OAAA,EAAA,EAAW;AACzD,MAAA,IAAI;AAIH,QAAA,IAAI,UAAA,GAAkB,IAAA;AACtB,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,cAAA,EAAe;AAC7C,QAAA,MAAM,aAAa,WAAA,CAAY,IAAA;AAAA,UAC9B,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAS,KAAM;AAAA,SACpC;AAEA,QAAA,IAAI,UAAA,EAAY;AACf,UAAA,UAAA,GAAa,UAAA,CAAW,UAAA;AAAA,QACzB,CAAA,MAAO;AAEN,UAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,GAAA,EAAI;AAC/C,UAAA,MAAM,MAAA,GAAS,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,EAAA,CAAG,QAAA,EAAS,KAAM,SAAS,CAAA;AACjE,UAAA,IAAI,MAAA,EAAQ;AACX,YAAA,UAAA,GAAa,MAAA,CAAO,EAAA;AAAA,UACrB,CAAA,MAAO;AAGN,YAAA,MAAM,EAAE,gBAAA,EAAiB,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAC3D,YAAA,UAAA,GAAa,iBAAiB,SAAS,CAAA;AAAA,UACxC;AAAA,QACD;AAIA,QAAA,MAAM,kBAAA,GAAqB,UAAA;AAC3B,QAAA,IAAI,UAAA,GAAyB,kBAAA;AAC7B,QAAA,IAAI,IAAA,CAAK,MAAA,CAAO,aAAA,IAAiB,IAAA,CAAK,IAAA,EAAM;AAC3C,UAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,aAAA;AAC3B,UAAA,MAAM,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,UAAU,CAAA;AACrD,UAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG;AACtC,YAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,CACtB,GAAA,CAAI,CAAC,EAAA,KAAO;AACZ,cAAA,MAAM,QAAA,GAAW,EAAA,CAAG,SAAA,CAAU,QAAA,EAAS;AACvC,cAAA,MAAM,MAAA,GAAS,OAAO,QAAQ,CAAA;AAC9B,cAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,cAAA,OAAO;AAAA,gBACN,aAAa,EAAA,CAAG,WAAA;AAAA,gBAChB,SAAA,EAAW,UAAU,MAAM;AAAA,eAC5B;AAAA,YACD,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,CAAA,KAAkC,MAAM,IAAI,CAAA;AAGtD,YAAA,MAAM,YAAY,UAAA,CAAW,IAAA;AAAA,cAC5B,CAAC,CAAA,KACA,CAAA,CAAE,SAAA,CAAU,UAAS,CAAE,QAAA,CAAS,OAAO,CAAA,IACvC,CAAC,CAAA,CAAE,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,KAAK;AAAA,aACxC;AACA,YAAA,IAAI,SAAA,EAAW;AACd,cAAA,UAAA,GAAa,SAAA,CAAU,SAAA;AACvB,cAAA,GAAA,CAAI,IAAA;AAAA,gBACH,CAAA,mDAAA,EAAiD,UAAA,CAAW,QAAA,EAAU,CAAA;AAAA,eACvE;AAAA,YACD;AAIA,YAAA,MAAO,IAAA,CAAK,IAAA,CAAa,SAAA,CAAU,IAAA,CAAK,UAAA,EAAY;AAAA,cACnD,YAAY,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,SAAS;AAAA,aAC7C,CAAA;AAAA,UACF;AAAA,QACD;AAIA,QAAA,IAAI,MAAA;AACJ,QAAA,IAAI;AAEH,UAAA,MAAM,MAAA,GAAc,MAAM,IAAA,CAAK,IAAA,CAC7B,YAAA,CAAa,YAAY,sBAAsB,CAAA,CAC/C,KAAA,CAAM,CAAC,CAAA,KAAe;AAEtB,YAAA,IAAI,MAAA,CAAO,CAAC,CAAA,CAAE,QAAA,CAAS,aAAa,CAAA,EAAG;AACtC,cAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,YACjD;AACA,YAAA,MAAM,CAAA;AAAA,UACP,CAAC,CAAA;AACF,UAAA,MAAA,GAAS,OAAO,MAAA,IAAU,MAAA;AAAA,QAC3B,SAAS,OAAA,EAAS;AACjB,UAAA,IAAI,YAAY,YAAA,EAAc;AAC7B,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,2BAAA,EAA8B,SAAS,CAAA,OAAA,EAAU,YAAY,cAAc,OAAO,CAAA;AAAA,aACnF;AACA,YAAA,OAAO,IAAA;AAAA,UACR;AACA,UAAA,MAAM,KAAA,GAAQ,MAAM,CAAA,IAAK,OAAA;AACzB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,2BAAA,EAA8B,SAAS,CAAA,UAAA,EAAa,OAAO,kBAAkB,KAAK,CAAA,KAAA;AAAA,WACnF;AACA,UAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,KAAK,CAAC,CAAA;AAC7C,UAAA;AAAA,QACD;AAIA,QAAA,MAAM,MAAA,GACL,OAAO,MAAA,KACN,OAAO,OAAO,MAAA,CAAO,aAAa,CAAA,KAAM,UAAA,GAAa,MAAA,GAAS,IAAA,CAAA;AAEhE,QAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,UAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,QAC5D;AAEA,QAAA,MAAM,SAAuB,EAAC;AAC9B,QAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,QAAA,IAAI,qBAAA,GAAwB,CAAA,CAAA;AAG5B,QAAA,IAAI,iBAAA;AACJ,QAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAe,CAAC,GAAG,MAAA,KAAW;AACxD,UAAA,iBAAA,GAAoB,UAAA;AAAA,YACnB,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AAAA,YACtD;AAAA,WACD;AAAA,QACD,CAAC,CAAA;AAED,QAAA,IAAI;AACH,UAAA,MAAM,QAAQ,IAAA,CAAK;AAAA,YAAA,CACjB,YAAY;AACZ,cAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AACjC,gBAAA,IAAI,CAAC,KAAA,EAAO;AAIZ,gBAAA,MAAMC,IAAAA;AAAA;AAAA,kBAEL,OAAQ,KAAA,CAAc,QAAA,KAAa,UAAA,GAC/B,KAAA,CAAyC,QAAA,EAAS,GACnD,KAAA,YAAiB,UAAA,GAChB,KAAA,GACA,IAAI,UAAA,CAAW,CAAC;AAAA,iBAAA;AACrB,gBAAA,MAAM,QAAQ,MAAA,CAAO,IAAA;AAAA,kBACpBA,IAAAA,CAAI,MAAA;AAAA,kBACJA,IAAAA,CAAI,UAAA;AAAA,kBACJA,IAAAA,CAAI;AAAA,iBACL;AAEA,gBAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACrB,kBAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,kBAAA,aAAA,IAAiB,KAAA,CAAM,MAAA;AAGvB,kBAAA,IAAI,qBAAA,GAAwB,CAAA,IAAK,aAAA,IAAiB,CAAA,EAAG;AACpD,oBAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AACnC,oBAAA,qBAAA,GAAwB,MAAA,CAAO,aAAa,CAAC,CAAA;AAAA,kBAC9C;AAGA,kBAAA,IACC,qBAAA,IAAyB,CAAA,IACzB,aAAA,IAAiB,CAAA,GAAI,qBAAA,EACpB;AACD,oBAAA;AAAA,kBACD;AAAA,gBACD;AAAA,cACD;AAAA,YACD,CAAA,GAAG;AAAA,YACH;AAAA,WACA,CAAA;AAAA,QACF,SAAS,KAAA,EAAgB;AACxB,UAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,MAAM,KAAA;AAC/B,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,uCAAA,EAA0C,SAAS,CAAA,EAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,WAC/G;AAAA,QACD,CAAA,SAAE;AACD,UAAA,IAAI,iBAAA,eAAgC,iBAAiB,CAAA;AAAA,QACtD;AAEA,QAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAChC,QAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AACnB,UAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,QAC9D;AAGA,QAAA,MAAM,WAAA,GAAc,GAAA,CAAI,YAAA,CAAa,CAAC,CAAA;AACtC,QAAA,MAAM,OAAA,GAAU,IAAI,QAAA,CAAS,CAAA,EAAG,IAAI,WAAW,CAAA,CAAE,SAAS,OAAO,CAAA;AACjE,QAAA,MAAM,QAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAEjD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,mCAAA,EAAsC,SAAS,CAAA,EAAA,EAAK,QAAA,CAAS,MAAM,MAAM,CAAA,MAAA;AAAA,SAC1E;AACA,QAAA,IAAA,CAAK,yBAAyB,SAAS,CAAA;AAEvC,QAAA,OAAO,QAAA;AAAA,MACR,SAAS,GAAA,EAAc;AACtB,QAAA,IAAI,YAAY,YAAA,EAAc;AAC7B,UAAA,IAAA,CAAK,0BAA0B,SAAS,CAAA;AACxC,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,0CAAA,EAA6C,SAAS,CAAA,OAAA,EAAU,YAAY,CAAA,WAAA,EAAc,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,WAC3I;AACA,UAAA,OAAO,IAAA;AAAA,QACR;AACA,QAAA,MAAM,KAAA,GAAQ,MAAM,CAAA,IAAK,OAAA;AACzB,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,4BAAA,EAA+B,SAAS,CAAA,UAAA,EAAa,OAAO,CAAA,GAAA,EAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,iBAAiB,KAAK,CAAA,KAAA;AAAA,SACzI;AACA,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,MAC9C;AAAA,IACD;AACA,IAAA,OAAO,IAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,yBAAA,GAA+C;AACpD,IAAA,OAAO,IAAA,CAAK,cAAc,wBAAwB,CAAA;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAA,GAAkC;AACvC,IAAA,MAAM,IAAA,CAAK,mBAAmB,wBAAwB,CAAA;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,mBAAA,GAA8B;AAC7B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAEvB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,cAAc,IAAA,IAAQ,CAAA;AAAA,EACtD;AAAA,EAEA,SAAA,GAAoB;AACnB,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAA,EAAS;AAAA,EAClC;AAAA,EAEA,MAAM,KAAK,IAAA,EAAuC;AACjD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC3D;AAEA,IAAA,OAAO,OAAO,IAAA,CAAK,MAAM,KAAK,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,EACzD;AAAA,EAEA,aAAA,GAA0B;AACzB,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,OAAO,IAAA,CAAK,KAAK,aAAA,EAAc,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EACzD;AAAA,EAEA,MAAM,mBAAmB,IAAA,EAA6B;AACrD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAG1D,IAAA,IAAA,CAAK,qBAAA,CAAsB,IAAI,IAAI,CAAA;AAEnC,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,eAAA,CAAgB,IAAI,CAAA;AAC3C,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,mCAAA,EAAsC,IAAI,CAAA,OAAA,EAAU,GAAA,CAAI,UAAU,CAAA,CAAA;AAAA,OACnE;AAGA,MAAA,MAAM,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA;AAC1C,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,+CAAA,EAAkD,IAAI,CAAA,CAAE,CAAA;AAGjE,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAA,EAAS;AACzC,MAAA,WAAA,MAAiB,QAAQ,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe,aAAA,CAAc,GAAG,CAAA,EAAG;AACrE,QAAA,IAAI,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,KAAM,MAAA,EAAQ;AAClC,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,4DAA4D,IAAI,CAAA;AAAA,WACjE;AACA,UAAA;AAAA,QACD;AAAA,MACD;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAE,CAAA;AAAA,IAChE;AAAA,EACD;AAAA,EAEA,MAAM,cAAc,IAAA,EAAiC;AACpD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,eAAA,CAAgB,IAAI,CAAA;AAC3C,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,6BAAA,EAAgC,IAAI,CAAA,OAAA,EAAU,GAAA,CAAI,UAAU,CAAA,IAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,QAAA,GAAW,KAAA;AAGf,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,cAAA,MAAoB,MAAA,IAAU,CAAA;AAC5D,MAAA,MAAM,aAAA,GAAgB,WAAA,GAAc,CAAA,GAAI,IAAA,GAAO,GAAA;AAC/C,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,iEAAA,EAAoE,aAAa,CAAA,wBAAA,EAA2B,WAAW,CAAA,CAAA;AAAA,OACxH;AAGA,MAAA,MAAM,QAAA,GAAW,KAAK,IAAA,CAAK,cAAA,CACzB,cAAc,GAAG,CAAA,CACjB,MAAA,CAAO,aAAa,CAAA,EAAE;AACxB,MAAA,IAAI,MAAA,GAAS,KAAA;AAEb,MAAA,OAAO,CAAC,MAAA,EAAQ;AACf,QAAA,MAAM,WAAA,GAAc,SAAS,IAAA,EAAK;AAClC,QAAA,MAAM,iBAAiB,IAAI,OAAA;AAAA,UAA2B,CAACD,QAAAA,KACtD,UAAA,CAAW,MAAMA,QAAAA,CAAQ,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA,EAAG,aAAa;AAAA,SAC3D;AAEA,QAAA,IAAI;AACH,UAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,KAAK,CAAC,WAAA,EAAa,cAAc,CAAC,CAAA;AAE/D,UAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,aAAa,MAAA,EAAQ;AAChE,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,sEAAA;AAAA,aACD;AACA,YAAA,IAAI,OAAO,QAAA,CAAS,MAAA,KAAW,UAAA,EAAY;AAE1C,cAAA,QAAA,CAAS,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,cAAC,CAAC,CAAA;AAAA,YACjC;AACA,YAAA,MAAA,GAAS,IAAA;AACT,YAAA;AAAA,UACD;AAGA,UAAA,MAAM,QAAA,GAAW,MAAA;AACjB,UAAA,IAAI,SAAS,IAAA,EAAM;AAClB,YAAA,MAAA,GAAS,IAAA;AACT,YAAA;AAAA,UACD;AAEA,UAAA,QAAA,GAAW,IAAA;AACX,UAAA,MAAM,OAAO,QAAA,CAAS,KAAA;AACtB,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS;AAChC,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,4BAAA,EAA+B,MAAM,CAAA,CAAE,CAAA;AAChD,UAAA,IAAI,CAAC,SAAA,CAAU,QAAA,CAAS,MAAM,CAAA,EAAG;AAChC,YAAA,SAAA,CAAU,KAAK,MAAM,CAAA;AAAA,UACtB;AAAA,QACD,SAAS,CAAA,EAAY;AACpB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,oCAAoC,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,WAC/E;AACA,UAAA,MAAA,GAAS,IAAA;AACT,UAAA;AAAA,QACD;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,QAAA,GAAW,KAAK,IAAA,CAAK,QAAA;AAG3B,QAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,EAAK,YAAA,EAAc,IAAA,IAAQ,CAAA;AACpD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,2BAAA,EAA8B,IAAI,CAAA,4CAAA,EAA+C,OAAO,CAAA,CAAA;AAAA,SACzF;AAAA,MACD;AAIA,MAAA,IAAI,IAAA,CAAK,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA,EAAG;AACzC,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAA,EAAS;AACzC,QAAA,IAAI,CAAC,SAAA,CAAU,QAAA,CAAS,MAAM,CAAA,EAAG;AAChC,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,kCAAA,EAAqC,MAAM,CAAA,iBAAA,EAAoB,IAAI,CAAA;AAAA,WACpE;AACA,UAAA,SAAA,CAAU,KAAK,MAAM,CAAA;AAAA,QACtB;AAAA,MACD;AAAA,IACD,SAAS,KAAA,EAAgB;AACxB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,wCAAA,EAA2C,IAAI,CAAA,EAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,OAC3G;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,2BAAA,EAA8B,IAAI,CAAA,iBAAA,EAAoB,SAAA,CAAU,MAAM,CAAA,WAAA;AAAA,KACvE;AACA,IAAA,OAAO,SAAA;AAAA,EACR;AAAA,EAEA,MAAM,YAAY,SAAA,EAAsC;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,IAAI;AAEH,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,cAAA,EAAe;AAC7C,MAAA,KAAA,MAAW,QAAQ,WAAA,EAAa;AAC/B,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,QAAA,EAAS,KAAM,SAAA,EAAW;AAC7C,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,QAAA,EAAS;AAC5C,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,0BAAA,EAA6B,SAAS,CAAA,wBAAA,EAA2B,UAAU,CAAA;AAAA,WAC5E;AACA,UAAA,OAAO,CAAC,UAAU,CAAA;AAAA,QACnB;AAAA,MACD;AAGA,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,GAAA,EAAI;AAC/C,MAAA,KAAA,MAAW,QAAQ,QAAA,EAAU;AAC5B,QAAA,IAAI,IAAA,CAAK,GAAG,QAAA,EAAS,KAAM,aAAa,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAElE,UAAA,MAAM,KAAA,GAAQ,KAAK,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAW,CAAA,CAAE,SAAA,CAAU,QAAA,EAAU,CAAA;AACnE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,0BAAA,EAA6B,SAAS,CAAA,gBAAA,EAAmB,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,WAClE;AACA,UAAA,OAAO,KAAA;AAAA,QACR;AAAA,MACD;AAEA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oBAAoB,SAAS,CAAA,sCAAA;AAAA,OAC9B;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,mCAAA,EAAsC,SAAS,CAAA,EAAA,EAAK,KAAK,CAAA,CAAE,CAAA;AAAA,IACrE;AACA,IAAA,OAAO,EAAC;AAAA,EACT;AAAA,EAEO,SAAA,GAAqB;AAC3B,IAAA,OAAO,CAAC,CAAC,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,KAAK,MAAA,KAAW,SAAA;AAAA,EAC5C;AAAA,EAEO,QAAA,GAAqB;AAC3B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,EAAC;AACxB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,cAAA,EAAe,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,QAAA,EAAU,CAAA;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKO,gBAAA,GAA4B;AAClC,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKO,WAAA,GAAsC;AAC5C,IAAA,OAAO,KAAK,MAAA,CAAO,QAAA;AAAA,EACpB;AACD","file":"chunk-XRDN232O.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\nimport { noise } from \"@chainsafe/libp2p-noise\";\nimport { yamux } from \"@chainsafe/libp2p-yamux\";\nimport { autoNAT } from \"@libp2p/autonat\";\nimport { bootstrap } from \"@libp2p/bootstrap\";\nimport {\n\tcircuitRelayServer,\n\tcircuitRelayTransport,\n} from \"@libp2p/circuit-relay-v2\";\nimport { dcutr } from \"@libp2p/dcutr\";\nimport { identify } from \"@libp2p/identify\";\nimport { kadDHT } from \"@libp2p/kad-dht\";\nimport { mdns } from \"@libp2p/mdns\";\nimport { ping } from \"@libp2p/ping\";\nimport { tcp } from \"@libp2p/tcp\";\nimport { webSockets } from \"@libp2p/websockets\";\nimport { multiaddr } from \"@multiformats/multiaddr\";\nimport { pipe } from \"it-pipe\";\nimport type { Libp2p } from \"libp2p\";\nimport { createLibp2p } from \"libp2p\";\nimport { CID } from \"multiformats/cid\";\nimport { sha256 } from \"multiformats/hashes/sha2\";\nimport { log } from \"../utils/logger.js\";\n// import { pEvent } from \"p-event\"; // Disabled to avoid ESM conflicts in tests\n\n/**\n * Manifest describing a node's capabilities in the LIOP Mesh.\n * Exchanged via the /liop/manifest/1.0.0 protocol stream.\n */\nexport interface LiopManifest {\n\tpeerId: string;\n\tgrpcPort: number;\n\ttools: Array<{\n\t\tname: string;\n\t\tdescription?: string;\n\t\tinputSchema?: Record<string, unknown>;\n\t}>;\n\tresources: Array<{\n\t\tname: string;\n\t\turi: string;\n\t\tdescription?: string;\n\t\tmimeType?: string;\n\t\ttext?: string;\n\t}>;\n\tserverInfo: { name: string; version: string };\n\ttaxonomy?: {\n\t\tdomain: string;\n\t\tclearanceTier: number;\n\t\texecutionTypes: string[];\n\t};\n\tauthRequired?: boolean;\n\t/** Canonical slug for deterministic token resolution. Agents resolve LIOP_TOKEN_<tokenSlug>. Must match /^[A-Z][A-Z0-9_]*$/. */\n\ttokenSlug?: string;\n\t/** ML-DSA-65 (FIPS 204) Post-Quantum Digital Signature for Manifest Attestation (Base64) */\n\tpqcSignature?: string;\n\t/** ML-DSA-65 (FIPS 204) Post-Quantum Public Key (Base64) */\n\tpqcPublicKey?: string;\n}\n\nexport interface MeshNodeConfig {\n\tlistenAddresses?: string[];\n\tbootstrapNodes?: string[];\n\tidentityPath?: string;\n\tenableWAN?: boolean;\n\tdhtStoragePath?: string;\n\t/** Optional function to translate multiaddrs (e.g. for Docker NAT traversal). Return null to drop an address. */\n\taddressMapper?: (addr: string) => string | null;\n\t/** Enable AutoNAT reachability detection (default: true) */\n\tenableAutoNAT?: boolean;\n\t/** Enable Circuit Relay v2 transport & server for NAT traversal (default: true) */\n\tenableRelay?: boolean;\n\t/** Enable DCUtR decentralized hole punching (default: true) */\n\tenableDcutr?: boolean;\n\t/** Enable mDNS peer discovery for local networks (default: false in WAN, true in LAN) */\n\tenableMdns?: boolean;\n\t/**\n\t * Pre-Shared Key for libp2p Private Network isolation (Tier 1 Enclave Hardening).\n\t * When provided, the node will reject ALL connections from peers that do not\n\t * possess the identical 95-byte PSK at the transport framing layer,\n\t * BEFORE the Noise XX handshake is attempted.\n\t * @see https://github.com/libp2p/specs/blob/master/pnet/Private-Networks-PSK-V1.md\n\t */\n\tswarmKey?: Uint8Array;\n}\n\nconst DEFAULT_BOOTSTRAP_NODES = [\n\t\"/dnsaddr/bootstrap.libp2p.io/p2p/QmNnooDuVkcruPhcoXdia1vAHm1qrCEYWvmqVkMBjeEbFR\",\n\t\"/dnsaddr/bootstrap.libp2p.io/p2p/QmQCU2EcMqAqQPR2i9bChDtGNJchTbq5TbXJJ16u19uLTa\",\n\t\"/dnsaddr/bootstrap.libp2p.io/p2p/QmbLHAnMoJPWSCR5Zhtx6BHJX9KiKNN6tpvbUcqanj75Nb\",\n\t\"/dnsaddr/bootstrap.libp2p.io/p2p/QmcZf59bWwK5XFi76CZX8cbJ4BhTzzA3gU1ZjWZcYW7dwt\",\n];\n\nconst LIOP_MANIFEST_PROTOCOL = \"/liop/manifest/1.0.0\";\nconst LIOP_MANIFEST_CAPABILITY = \"liop:manifest\";\n\n/**\n * P2P Mesh Node backed by libp2p + Kademlia DHT.\n *\n * Provides capability advertisement via CID-based content routing\n * and decentralized peer discovery.\n */\nexport class MeshNode {\n\tprivate node: Libp2p | null = null;\n\tprivate config: MeshNodeConfig;\n\tprivate manifestDialFailureState: Map<\n\t\tstring,\n\t\t{ failures: number; cooldownUntil: number; lastSkipLogAt: number }\n\t> = new Map();\n\tprivate static readonly MANIFEST_DIAL_BASE_COOLDOWN_MS = 10_000;\n\tprivate static readonly MANIFEST_DIAL_MAX_COOLDOWN_MS = 2 * 60_000;\n\tprivate static readonly MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS = 30_000;\n\n\t/**\n\t * Buffer of capability hashes that have been announced.\n\t * Used to re-announce capabilities when new peers connect\n\t * (critical for small / isolated clusters where the initial\n\t * provide() finds zero peers in the routing table).\n\t */\n\tprivate announcedCapabilities: Set<string> = new Set();\n\n\t/** Guards against concurrent re-announcement storms. */\n\tprivate reannouncing = false;\n\n\t/** Callback that returns the local node's manifest on request. */\n\tprivate manifestProvider: (() => LiopManifest) | null = null;\n\n\t/** Flag to ensure the manifest protocol is only registered once. */\n\tprivate manifestProtocolRegistered = false;\n\n\t/** Local Ed25519 Private Key for protocol signatures */\n\t// biome-ignore lint/suspicious/noExplicitAny: libp2p keys type\n\tprivate localPrivateKey: any | null = null;\n\n\tconstructor(config: MeshNodeConfig = {}) {\n\t\tthis.config = {\n\t\t\tlistenAddresses: config.listenAddresses || [\n\t\t\t\t\"/ip4/0.0.0.0/tcp/0/ws\",\n\t\t\t\t\"/ip4/0.0.0.0/tcp/0\",\n\t\t\t],\n\t\t\tbootstrapNodes: config.bootstrapNodes || [],\n\t\t\tidentityPath: config.identityPath,\n\t\t\tenableWAN: config.enableWAN ?? false,\n\t\t\tdhtStoragePath: config.dhtStoragePath,\n\t\t\taddressMapper: config.addressMapper,\n\t\t\tswarmKey: config.swarmKey,\n\t\t};\n\t}\n\n\tprivate shouldSkipManifestDial(peerIdStr: string): boolean {\n\t\tconst state = this.manifestDialFailureState.get(peerIdStr);\n\t\tif (!state) return false;\n\t\tconst now = Date.now();\n\t\tif (now >= state.cooldownUntil) return false;\n\t\tif (\n\t\t\tnow - state.lastSkipLogAt >\n\t\t\tMeshNode.MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS\n\t\t) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Skipping manifest dial for ${peerIdStr} during cooldown (${Math.ceil((state.cooldownUntil - now) / 1000)}s remaining)`,\n\t\t\t);\n\t\t\tstate.lastSkipLogAt = now;\n\t\t}\n\t\treturn true;\n\t}\n\n\tprivate recordManifestDialFailure(peerIdStr: string): void {\n\t\tconst now = Date.now();\n\t\tconst prev = this.manifestDialFailureState.get(peerIdStr);\n\t\tconst failures = (prev?.failures || 0) + 1;\n\t\tconst backoff = Math.min(\n\t\t\tMeshNode.MANIFEST_DIAL_BASE_COOLDOWN_MS * 2 ** Math.max(0, failures - 1),\n\t\t\tMeshNode.MANIFEST_DIAL_MAX_COOLDOWN_MS,\n\t\t);\n\t\tthis.manifestDialFailureState.set(peerIdStr, {\n\t\t\tfailures,\n\t\t\tcooldownUntil: now + backoff,\n\t\t\tlastSkipLogAt: 0,\n\t\t});\n\t}\n\n\tprivate clearManifestDialFailure(peerIdStr: string): void {\n\t\tthis.manifestDialFailureState.delete(peerIdStr);\n\t}\n\n\t/**\n\t * Loads a persistent identity from disk or generates a new Ed25519 keypair.\n\t * Uses privateKeyToProtobuf/privateKeyFromProtobuf (libp2p v3.x official API).\n\t */\n\tprivate async loadOrCreateIdentity() {\n\t\ttry {\n\t\t\tconst { generateKeyPair, privateKeyFromProtobuf } = (await import(\n\t\t\t\t\"@libp2p/crypto/keys\"\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: <libp2p type workaround>\n\t\t\t)) as any;\n\t\t\tconst { fromString: u8FromString } = await import(\n\t\t\t\t\"uint8arrays/from-string\"\n\t\t\t);\n\n\t\t\tif (this.config.identityPath) {\n\t\t\t\tconst absolutePath = path.resolve(this.config.identityPath);\n\t\t\t\ttry {\n\t\t\t\t\tconst data = await fs.readFile(absolutePath, \"utf-8\");\n\t\t\t\t\tconst json = JSON.parse(data);\n\t\t\t\t\tconst protobufBytes = u8FromString(json.privKey, \"base64\");\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst privateKey = privateKeyFromProtobuf(protobufBytes);\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Loaded persistent identity from ${absolutePath}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn { privateKey, isNew: false };\n\t\t\t\t\t} catch (parseError: unknown) {\n\t\t\t\t\t\tlog.error(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Persistent identity at ${absolutePath} is invalid or corrupt. Generating new one. Error: ${\n\t\t\t\t\t\t\t\tparseError instanceof Error\n\t\t\t\t\t\t\t\t\t? parseError.message\n\t\t\t\t\t\t\t\t\t: String(parseError)\n\t\t\t\t\t\t\t}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\t// Fall through to generate new key\n\t\t\t\t\t}\n\t\t\t\t} catch (error: unknown) {\n\t\t\t\t\tconst e = error as Error & { code?: string };\n\t\t\t\t\tif (e.code !== \"ENOENT\") {\n\t\t\t\t\t\tlog.error(`[LIOP-Mesh] Error loading identity: ${e.message}`);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst privateKey = await generateKeyPair(\"Ed25519\");\n\t\t\treturn { privateKey, isNew: true };\n\t\t} catch (error) {\n\t\t\tlog.error(\n\t\t\t\t`[LIOP-Mesh] Critical error in identity management: ${error}. Falling back to ephemeral identity.`,\n\t\t\t);\n\n\t\t\t// EPOCH FALLBACK: In extreme cases (corrupt env), use a volatile in-memory identity\n\t\t\t// to allow the node to start and serve traffic.\n\t\t\ttry {\n\t\t\t\tconst { generateKeyPair } = (await import(\n\t\t\t\t\t\"@libp2p/crypto/keys\"\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: libp2p ESM dynamic import type workaround\n\t\t\t\t)) as any;\n\t\t\t\tconst ephemeralKey = await generateKeyPair(\"Ed25519\");\n\t\t\t\treturn { privateKey: ephemeralKey, isNew: true };\n\t\t\t} catch (fallbackError) {\n\t\t\t\tthrow new Error(`Identity system failure: ${fallbackError}`);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Persists the private key to disk using protobuf serialization (libp2p v3.x).\n\t */\n\t// biome-ignore lint/suspicious/noExplicitAny: Libp2p private key type is complex for Alpha\n\tprivate async saveIdentity(privateKey: any) {\n\t\tif (!this.config.identityPath || !this.node) return;\n\n\t\ttry {\n\t\t\tconst absolutePath = path.resolve(this.config.identityPath);\n\t\t\tconst { privateKeyToProtobuf } = (await import(\n\t\t\t\t\"@libp2p/crypto/keys\"\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: <libp2p type workaround>\n\t\t\t)) as any;\n\t\t\tconst { toString: u8ToString } = await import(\"uint8arrays/to-string\");\n\n\t\t\tconst protobufBytes = privateKeyToProtobuf(privateKey);\n\t\t\tconst privKeyEncoded = u8ToString(protobufBytes, \"base64\");\n\n\t\t\tconst json = {\n\t\t\t\tid: this.node.peerId.toString(),\n\t\t\t\tprivKey: privKeyEncoded,\n\t\t\t};\n\n\t\t\tawait fs.mkdir(path.dirname(absolutePath), { recursive: true });\n\t\t\tawait fs.writeFile(absolutePath, JSON.stringify(json, null, 2));\n\t\t\tlog.info(`[LIOP-Mesh] Identity persisted to ${absolutePath}`);\n\t\t} catch (error) {\n\t\t\tlog.error(`[LIOP-Mesh] FAILED to persist identity: ${error}`);\n\t\t}\n\t}\n\n\t/**\n\t * Creates a CID v1 (raw codec 0x55) from a SHA-256 hash of the capability string.\n\t * Required by @libp2p/kad-dht v16+ for provide/findProviders.\n\t */\n\tprivate async capabilityToCID(capability: string): Promise<CID> {\n\t\tconst hash = await sha256.digest(new TextEncoder().encode(capability));\n\t\treturn CID.create(1, 0x55, hash);\n\t}\n\n\t/**\n\t * Re-announces all buffered capabilities after a new peer connects.\n\t * Uses a small delay to allow the DHT protocol handshake to complete.\n\t */\n\tprivate async reannounceAll(): Promise<void> {\n\t\tif (\n\t\t\tthis.reannouncing ||\n\t\t\t!this.node ||\n\t\t\tthis.announcedCapabilities.size === 0\n\t\t)\n\t\t\treturn;\n\n\t\tthis.reannouncing = true;\n\t\ttry {\n\t\t\t// Wait for the DHT protocol handshake to settle\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, 500));\n\n\t\t\tif (!this.node) return;\n\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Re-announcing ${this.announcedCapabilities.size} capabilities to updated routing table...`,\n\t\t\t);\n\n\t\t\tfor (const hash of this.announcedCapabilities) {\n\t\t\t\ttry {\n\t\t\t\t\tconst cid = await this.capabilityToCID(hash);\n\t\t\t\t\tawait this.node.contentRouting.provide(cid);\n\t\t\t\t\tlog.info(`[LIOP-Mesh] Re-announced: ${hash}`);\n\t\t\t\t} catch (_e) {\n\t\t\t\t\tlog.info(`[LIOP-Mesh] Re-announce failed for ${hash}: ${_e}`);\n\t\t\t\t}\n\t\t\t}\n\t\t} finally {\n\t\t\tthis.reannouncing = false;\n\t\t}\n\t}\n\n\tasync start(): Promise<void> {\n\t\tif (this.node) return;\n\t\tconst result = await this.loadOrCreateIdentity();\n\t\tif (!result) throw new Error(\"Could not initialize P2P Identity\");\n\n\t\tconst { privateKey, isNew } = result;\n\t\tthis.localPrivateKey = privateKey;\n\n\t\tlet bootNodes = this.config.bootstrapNodes || [];\n\t\tif (bootNodes.length === 0 && this.config.enableWAN) {\n\t\t\tbootNodes = DEFAULT_BOOTSTRAP_NODES;\n\t\t}\n\n\t\tconst enableAutoNAT = this.config.enableAutoNAT ?? true;\n\t\tconst enableRelay = this.config.enableRelay ?? true;\n\t\tconst enableDcutr = this.config.enableDcutr ?? true;\n\t\tconst enableMdns = this.config.enableMdns ?? !this.config.enableWAN;\n\n\t\t// biome-ignore lint/suspicious/noExplicitAny: discovery polymorphic list\n\t\tconst discoveryList: any[] = [];\n\t\tif (bootNodes.length > 0) {\n\t\t\tdiscoveryList.push(\n\t\t\t\tbootstrap({\n\t\t\t\t\tlist: bootNodes,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tif (enableMdns) {\n\t\t\tdiscoveryList.push(mdns());\n\t\t}\n\n\t\tconst dhtProtocol = this.config.enableWAN\n\t\t\t? \"/ipfs/kad/1.0.0\"\n\t\t\t: \"/ipfs/lan/kad/1.0.0\";\n\n\t\t// biome-ignore lint/suspicious/noExplicitAny: transports list\n\t\tconst transports: any[] = [tcp(), webSockets()];\n\t\tif (enableRelay) {\n\t\t\ttransports.push(circuitRelayTransport());\n\t\t}\n\n\t\t// biome-ignore lint/suspicious/noExplicitAny: services map\n\t\tconst services: Record<string, any> = {\n\t\t\tidentify: identify(),\n\t\t\tping: ping(),\n\t\t\tdht: kadDHT({\n\t\t\t\tprotocol: dhtProtocol,\n\t\t\t\tclientMode: false,\n\t\t\t\t// Allow local/private IPs in the DHT routing table for development/testing\n\t\t\t\tallowQueryWithZeroPeers: true,\n\t\t\t\t// By default kadDHT drops local IP addresses. Override the mapper to keep them.\n\t\t\t\tpeerInfoMapper: (peer) => peer,\n\t\t\t}),\n\t\t};\n\n\t\tif (enableAutoNAT) {\n\t\t\tservices.autoNAT = autoNAT();\n\t\t}\n\t\tif (enableRelay) {\n\t\t\tservices.relay = circuitRelayServer();\n\t\t}\n\t\tif (enableDcutr) {\n\t\t\tservices.dcutr = dcutr();\n\t\t}\n\n\t\t// Tier 1 Enclave: Pre-Shared Key (pnet) Connection Protection\n\t\t// biome-ignore lint/suspicious/noExplicitAny: ConnectionProtector factory type\n\t\tlet connectionProtector: any;\n\t\tif (this.config.swarmKey) {\n\t\t\tconst { preSharedKey } = await import(\"@libp2p/pnet\");\n\t\t\tconnectionProtector = preSharedKey({\n\t\t\t\tpsk: this.config.swarmKey,\n\t\t\t});\n\t\t\tlog.info(\n\t\t\t\t\"[LIOP-Mesh] 🔒 Private Network (pnet) enabled — transport-layer PSK isolation active\",\n\t\t\t);\n\t\t}\n\n\t\tthis.node = await createLibp2p({\n\t\t\tprivateKey,\n\t\t\taddresses: {\n\t\t\t\tlisten: this.config.listenAddresses,\n\t\t\t},\n\t\t\ttransports,\n\t\t\tconnectionEncrypters: [noise()],\n\t\t\tstreamMuxers: [yamux()],\n\t\t\t...(connectionProtector ? { connectionProtector } : {}),\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: services polymorphic definition\n\t\t\tservices: services as any,\n\t\t\tpeerDiscovery:\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: discovery polymorphic list casting\n\t\t\t\tdiscoveryList.length > 0 ? (discoveryList as any) : undefined,\n\t\t});\n\n\t\t// Monitor Connectivity Events\n\t\tthis.node.addEventListener(\"peer:discovery\", (evt) => {\n\t\t\tconst peerId = evt.detail.id;\n\t\t\tlog.info(`[LIOP-Mesh] Discovered peer: ${peerId.toString()}`);\n\t\t\t// [Phase 104] Auto-dial discovered peers to bypass DHT propagation latency\n\t\t\tif (this.node) {\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: target polymorphic type\n\t\t\t\tlet dialTarget: any = peerId;\n\n\t\t\t\t// Apply port translation if necessary (Docker -> Windows Host)\n\t\t\t\tif (this.config.addressMapper && evt.detail.multiaddrs.length > 0) {\n\t\t\t\t\tconst translated = evt.detail.multiaddrs\n\t\t\t\t\t\t.map((ma) => {\n\t\t\t\t\t\t\t// biome-ignore lint/style/noNonNullAssertion: mapped conditionally\n\t\t\t\t\t\t\tconst mapped = this.config.addressMapper!(ma.toString());\n\t\t\t\t\t\t\treturn mapped ? multiaddr(mapped) : null;\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.filter((t): t is NonNullable<typeof t> => t !== null);\n\n\t\t\t\t\tconst directTCP = translated.find(\n\t\t\t\t\t\t(ma) =>\n\t\t\t\t\t\t\tma.toString().includes(\"/tcp/\") && !ma.toString().includes(\"/ws\"),\n\t\t\t\t\t);\n\t\t\t\t\tif (directTCP) dialTarget = directTCP;\n\t\t\t\t}\n\n\t\t\t\tthis.node.dial(dialTarget).catch(() => {});\n\t\t\t}\n\t\t});\n\n\t\tthis.node.addEventListener(\"peer:connect\", (evt) => {\n\t\t\tconst peerId = evt.detail;\n\t\t\tlog.info(`[LIOP-Mesh] Connected to peer: ${peerId.toString()}`);\n\n\t\t\tif (!this.node) return;\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: access internal services\n\t\t\tconst dht = (this.node.services as any).dht;\n\t\t\tif (dht?.routingTable) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] Adding ${peerId.toString()} to DHT Routing Table`,\n\t\t\t\t);\n\t\t\t\tdht.routingTable.add(peerId).catch((err: unknown) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Failed to add peer to routing table: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Trigger reactive re-announcement of all capabilities\n\t\t\t// so that ADD_PROVIDER messages reach the new peer\n\t\t\tthis.reannounceAll().catch((err: unknown) => {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] Re-announce error: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\t\t);\n\t\t\t});\n\t\t});\n\n\t\tawait this.node.start();\n\n\t\t// Load persisted DHT routing table to enable rapid cold-start reconnections\n\t\tawait this.loadRoutingTable();\n\n\t\t// [LIOP-ALPHA] Protocols and services setup\n\t\tthis.applyHandlers();\n\n\t\tif (isNew && this.config.identityPath) {\n\t\t\tawait this.saveIdentity(privateKey);\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[LIOP-Mesh] Node started with id: ${this.node.peerId.toString()}`,\n\t\t);\n\t\tthis.node.getMultiaddrs().forEach((addr) => {\n\t\t\tlog.info(`[LIOP-Mesh] Listening on: ${addr.toString()}`);\n\t\t});\n\n\t\t// Force explicit dialing of Bootstrap nodes with bounded backoff\n\t\tif (bootNodes.length > 0) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Forcing direct P2P dial to ${bootNodes.length} bootstrap nodes...`,\n\t\t\t);\n\n\t\t\tconst maxRetries = 5;\n\t\t\tfor (const addr of bootNodes) {\n\t\t\t\tlet success = false;\n\t\t\t\tlet attempt = 1;\n\n\t\t\t\twhile (attempt <= maxRetries && !success) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait this.node.dial(multiaddr(addr));\n\t\t\t\t\t\tlog.info(`[LIOP-Mesh] ✅ Successfully dialed ${addr}`);\n\t\t\t\t\t\tsuccess = true;\n\t\t\t\t\t} catch (_e) {\n\t\t\t\t\t\tconst delay = Math.min(1000 * 2 ** (attempt - 1), 3000);\n\t\t\t\t\t\tlog.warn(\n\t\t\t\t\t\t\t`[LIOP-Mesh] ⚠️ Dial attempt ${attempt}/${maxRetries} to ${addr} failed. Retrying in ${delay / 1000}s...`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tif (attempt < maxRetries) {\n\t\t\t\t\t\t\tawait new Promise((resolve) => setTimeout(resolve, delay));\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tlog.error(\n\t\t\t\t\t\t\t\t`[LIOP-Mesh] ❌ Could not connect to bootstrap ${addr} after ${maxRetries} attempts. Continuing...`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tattempt++;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tasync stop(): Promise<void> {\n\t\tif (this.node) {\n\t\t\tawait this.saveRoutingTable();\n\t\t\tawait this.node.stop();\n\t\t\tlog.info(\"[LIOP-Mesh] Node stopped\");\n\t\t}\n\t}\n\n\tprivate async loadRoutingTable() {\n\t\tif (!this.config.dhtStoragePath || !this.node) return;\n\t\ttry {\n\t\t\tconst absolutePath = path.resolve(this.config.dhtStoragePath);\n\t\t\tconst data = await fs.readFile(absolutePath, \"utf-8\");\n\t\t\tconst peers = JSON.parse(data);\n\t\t\tconst { peerIdFromString } = await import(\"@libp2p/peer-id\");\n\n\t\t\tlet loadedCount = 0;\n\t\t\tfor (const peer of peers) {\n\t\t\t\tif (!peer.id || !peer.addresses) continue;\n\t\t\t\ttry {\n\t\t\t\t\tconst peerId = peerIdFromString(peer.id);\n\t\t\t\t\tconst addrs = peer.addresses.map((a: string) => multiaddr(a));\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: bypass libp2p version-drift type mismatch on PeerId\n\t\t\t\t\tawait this.node.peerStore.save(peerId as any, { multiaddrs: addrs });\n\n\t\t\t\t\t// Pre-seed DHT routing table\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Internal service access\n\t\t\t\t\tconst dht = (this.node.services as any).dht;\n\t\t\t\t\tif (dht?.routingTable) {\n\t\t\t\t\t\tdht.routingTable.add(peerId).catch(() => {});\n\t\t\t\t\t}\n\t\t\t\t\tloadedCount++;\n\t\t\t\t} catch (_e) {}\n\t\t\t}\n\t\t\tlog.info(`[LIOP-Mesh] Loaded ${loadedCount} peers from DHT storage`);\n\t\t} catch (error: unknown) {\n\t\t\tconst e = error as Error & { code?: string };\n\t\t\tif (e.code !== \"ENOENT\") {\n\t\t\t\tlog.error(`[LIOP-Mesh] Failed to load DHT table: ${e.message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async saveRoutingTable() {\n\t\tif (!this.config.dhtStoragePath || !this.node) return;\n\t\ttry {\n\t\t\tconst absolutePath = path.resolve(this.config.dhtStoragePath);\n\t\t\tconst allPeers = await this.node.peerStore.all();\n\t\t\tconst peersToSave = [];\n\t\t\tfor (const peer of allPeers) {\n\t\t\t\tif (peer.addresses.length > 0) {\n\t\t\t\t\tpeersToSave.push({\n\t\t\t\t\t\tid: peer.id.toString(),\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: internal libp2p addr\n\t\t\t\t\t\taddresses: peer.addresses.map((a: any) => a.multiaddr.toString()),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t\tawait fs.mkdir(path.dirname(absolutePath), { recursive: true });\n\t\t\tawait fs.writeFile(absolutePath, JSON.stringify(peersToSave, null, 2));\n\t\t\tlog.info(`[LIOP-Mesh] Saved ${peersToSave.length} peers to DHT storage`);\n\t\t} catch (error) {\n\t\t\tlog.error(`[LIOP-Mesh] FAILED to save DHT routing table: ${error}`);\n\t\t}\n\t}\n\n\t/**\n\t * Internal logic to register protocol handlers against the libp2p node.\n\t * Can be called multiple times; handles idempotent registration.\n\t */\n\tprivate applyHandlers(): void {\n\t\tif (!this.node || this.manifestProtocolRegistered) return;\n\t\tif (!this.manifestProvider) return;\n\n\t\tthis.manifestProtocolRegistered = true;\n\n\t\t// Announce manifest capability to the Mesh DHT for discovery\n\t\tthis.announceCapability(LIOP_MANIFEST_CAPABILITY).catch((err) => {\n\t\t\tlog.info(`[LIOP-Mesh] Initial manifest announcement failed: ${err}`);\n\t\t});\n\n\t\t// libp2p v3.x: handler receives (stream, connection) as separate args\n\t\tthis.node.handle(\n\t\t\tLIOP_MANIFEST_PROTOCOL,\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: libp2p v3.x stream/connection types\n\t\t\tasync (streamArg: any, connectionArg?: any) => {\n\t\t\t\t// v3.x passes (stream, connection); v1.x passed ({ stream, connection })\n\t\t\t\tconst stream = streamArg?.stream ?? streamArg;\n\t\t\t\tconst conn = streamArg?.connection ?? connectionArg;\n\t\t\t\tconst remotePeer = conn?.remotePeer?.toString() || \"unknown\";\n\n\t\t\t\tlog.info(`[LIOP-Mesh] Incoming manifest request from ${remotePeer}.`);\n\n\t\t\t\ttry {\n\t\t\t\t\tconst manifest = this.manifestProvider?.();\n\t\t\t\t\tif (!manifest || !stream) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Skipping manifest request (no provider or stream)`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tif (typeof stream?.close === \"function\") await stream.close();\n\t\t\t\t\t\t} catch (_e) {}\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\n\t\t\t\t\tconst manifestStr = JSON.stringify(manifest);\n\t\t\t\t\tconst payload = new TextEncoder().encode(manifestStr);\n\n\t\t\t\t\t// Write length-prefixed payload (Big Endian 4 bytes)\n\t\t\t\t\tconst lengthBuf = Buffer.alloc(4);\n\t\t\t\t\tlengthBuf.writeUInt32BE(payload.length, 0);\n\t\t\t\t\tconst fullPacket = Buffer.concat([lengthBuf, Buffer.from(payload)]);\n\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Serving manifest (${fullPacket.length} bytes) to ${remotePeer} [Tools: ${manifest.tools.map((t) => t.name).join(\", \")}]`,\n\t\t\t\t\t);\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\t// libp2p v3.x: stream.send() for writing\n\t\t\t\t\t\tif (typeof stream.send === \"function\") {\n\t\t\t\t\t\t\tconst accepted = stream.send(fullPacket);\n\t\t\t\t\t\t\tif (!accepted && typeof stream.onDrain === \"function\") {\n\t\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\t\tawait stream.onDrain({ signal: AbortSignal.timeout(5000) });\n\t\t\t\t\t\t\t\t} catch (drainErr) {\n\t\t\t\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t\t\t\t`[LIOP-Mesh] WARN: Drain timeout for ${remotePeer}: ${drainErr instanceof Error ? drainErr.message : String(drainErr)}`,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t// Fallback for environments where stream.send is not available\n\t\t\t\t\t\t\tawait pipe([fullPacket], stream);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tlog.info(`[LIOP-Mesh] Manifest sent successfully to ${remotePeer}`);\n\t\t\t\t\t} catch (writeErr: unknown) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Write error serving manifest to ${remotePeer}: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t} finally {\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tif (typeof stream.close === \"function\") await stream.close();\n\t\t\t\t\t\t} catch (_e) {\n\t\t\t\t\t\t\t// Ignore close errors\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\treturn;\n\t\t\t\t} catch (err: unknown) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Error serving manifest to ${remotePeer}: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t},\n\t\t);\n\n\t\tlog.info(\n\t\t\t`[LIOP-Mesh] Manifest Protocol registered: ${LIOP_MANIFEST_PROTOCOL}`,\n\t\t);\n\t}\n\n\t/**\n\t * Registers a callback as the manifest provider.\n\t * Will be applied immediately if the node is already initialized.\n\t */\n\tregisterManifestHandler(provider: () => LiopManifest): void {\n\t\tthis.manifestProvider = provider;\n\t\tif (this.node) {\n\t\t\tthis.applyHandlers();\n\t\t}\n\t}\n\n\t/**\n\t * Queries a remote peer's manifest by opening a /liop/manifest/1.0.0 stream.\n\t * Returns null if the peer doesn't support the protocol or is unreachable.\n\t */\n\tasync queryManifest(peerIdStr: string): Promise<LiopManifest | null> {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\n\t\t// [ALPHA-OPTIMIZATION] Local Loopback Bypass\n\t\t// If we are querying our own manifest, return it directly from the provider.\n\t\tif (peerIdStr === this.node.peerId.toString()) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Loopback: Returning local manifest directly for ${peerIdStr}`,\n\t\t\t);\n\t\t\treturn this.manifestProvider?.() || null;\n\t\t}\n\t\tif (this.shouldSkipManifestDial(peerIdStr)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst MAX_ATTEMPTS = 3;\n\t\tfor (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {\n\t\t\ttry {\n\t\t\t\ttype DialTarget = Parameters<Libp2p[\"dialProtocol\"]>[0];\n\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: targetPeer can be from connections or from string\n\t\t\t\tlet targetPeer: any = null;\n\t\t\t\tconst connections = this.node.getConnections();\n\t\t\t\tconst activeConn = connections.find(\n\t\t\t\t\t(c) => c.remotePeer.toString() === peerIdStr,\n\t\t\t\t);\n\n\t\t\t\tif (activeConn) {\n\t\t\t\t\ttargetPeer = activeConn.remotePeer;\n\t\t\t\t} else {\n\t\t\t\t\t// Fallback: search peerStore to find a valid PeerId object that libp2p understands natively\n\t\t\t\t\tconst allPeers = await this.node.peerStore.all();\n\t\t\t\t\tconst stored = allPeers.find((p) => p.id.toString() === peerIdStr);\n\t\t\t\t\tif (stored) {\n\t\t\t\t\t\ttargetPeer = stored.id;\n\t\t\t\t\t} else {\n\t\t\t\t\t\t// Final fallback parsing.\n\t\t\t\t\t\t// [LIOP-CAUTION] This is where the toMultihash error usually triggers if libp2p version drift exists.\n\t\t\t\t\t\tconst { peerIdFromString } = await import(\"@libp2p/peer-id\");\n\t\t\t\t\t\ttargetPeer = peerIdFromString(peerIdStr);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// [LIOP-PORT-TRANSLATION] If an address mapper is configured (e.g. in the Host Agent),\n\t\t\t\t// ensure the targetPeer's addresses are translated before libp2p attempts to dial.\n\t\t\t\tconst dialTargetFromPeer = targetPeer as DialTarget;\n\t\t\t\tlet dialTarget: DialTarget = dialTargetFromPeer;\n\t\t\t\tif (this.config.addressMapper && this.node) {\n\t\t\t\t\tconst mapper = this.config.addressMapper;\n\t\t\t\t\tconst peer = await this.node.peerStore.get(targetPeer);\n\t\t\t\t\tif (peer && peer.addresses.length > 0) {\n\t\t\t\t\t\tconst translated = peer.addresses\n\t\t\t\t\t\t\t.map((oa) => {\n\t\t\t\t\t\t\t\tconst original = oa.multiaddr.toString();\n\t\t\t\t\t\t\t\tconst mapped = mapper(original);\n\t\t\t\t\t\t\t\tif (!mapped) return null;\n\t\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\t\tisCertified: oa.isCertified,\n\t\t\t\t\t\t\t\t\tmultiaddr: multiaddr(mapped),\n\t\t\t\t\t\t\t\t};\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.filter((t): t is NonNullable<typeof t> => t !== null);\n\n\t\t\t\t\t\t// Strategy: Force direct dial to the first translated TCP address to bypass DHT routing delays\n\t\t\t\t\t\tconst directTCP = translated.find(\n\t\t\t\t\t\t\t(t) =>\n\t\t\t\t\t\t\t\tt.multiaddr.toString().includes(\"/tcp/\") &&\n\t\t\t\t\t\t\t\t!t.multiaddr.toString().includes(\"/ws\"),\n\t\t\t\t\t\t);\n\t\t\t\t\t\tif (directTCP) {\n\t\t\t\t\t\t\tdialTarget = directTCP.multiaddr as DialTarget;\n\t\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t\t`[LIOP-Mesh] ⚡ Direct dial to translated addr: ${dialTarget.toString()}`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Update the peerStore so subsequent dials also use the right path\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: access internal peerStore\n\t\t\t\t\t\tawait (this.node as any).peerStore.save(targetPeer, {\n\t\t\t\t\t\t\tmultiaddrs: translated.map((t) => t.multiaddr),\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Open a protocol stream using high-level dialProtocol for automated it-stream wrapping\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: stream type varies by transport\n\t\t\t\tlet stream: any;\n\t\t\t\ttry {\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: libp2p returns polymorphic dialProtocol result\n\t\t\t\t\tconst result: any = await this.node\n\t\t\t\t\t\t.dialProtocol(dialTarget, LIOP_MANIFEST_PROTOCOL)\n\t\t\t\t\t\t.catch((e: unknown) => {\n\t\t\t\t\t\t\t// Catch specific TypeError that breaks the loop\n\t\t\t\t\t\t\tif (String(e).includes(\"toMultihash\")) {\n\t\t\t\t\t\t\t\tthrow new Error(\"INCOMPATIBLE_PEER_ID_INTERFACE\");\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tthrow e;\n\t\t\t\t\t\t});\n\t\t\t\t\tstream = result.stream || result;\n\t\t\t\t} catch (dialErr) {\n\t\t\t\t\tif (attempt === MAX_ATTEMPTS) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Dial error for ${peerIdStr} after ${MAX_ATTEMPTS} attempts: ${dialErr}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn null;\n\t\t\t\t\t}\n\t\t\t\t\tconst delay = 500 * 2 ** attempt;\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Dial error for ${peerIdStr} (Attempt ${attempt}). Retrying in ${delay}ms...`,\n\t\t\t\t\t);\n\t\t\t\t\tawait new Promise((r) => setTimeout(r, delay));\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// libp2p v3.x: stream IS the AsyncIterable<Uint8Array>\n\t\t\t\t// v1.x had stream.source; v3.x has the stream itself as iterable\n\t\t\t\tconst source: AsyncIterable<Uint8Array> =\n\t\t\t\t\tstream.source ??\n\t\t\t\t\t(typeof stream[Symbol.asyncIterator] === \"function\" ? stream : null);\n\n\t\t\t\tif (!source) {\n\t\t\t\t\tthrow new Error(\"Target stream has no AsyncIterable source\");\n\t\t\t\t}\n\n\t\t\t\tconst chunks: Uint8Array[] = [];\n\t\t\t\tlet totalReceived = 0;\n\t\t\t\tlet expectedPayloadLength = -1;\n\n\t\t\t\t// Read length-prefixed manifest: first 4 bytes = payload length (BE)\n\t\t\t\tlet manifestTimeoutId: NodeJS.Timeout | undefined;\n\t\t\t\tconst timeoutPromise = new Promise<never>((_, reject) => {\n\t\t\t\t\tmanifestTimeoutId = setTimeout(\n\t\t\t\t\t\t() => reject(new Error(\"Manifest read timeout (5.0s)\")),\n\t\t\t\t\t\t5000,\n\t\t\t\t\t);\n\t\t\t\t});\n\n\t\t\t\ttry {\n\t\t\t\t\tawait Promise.race([\n\t\t\t\t\t\t(async () => {\n\t\t\t\t\t\t\tfor await (const chunk of source) {\n\t\t\t\t\t\t\t\tif (!chunk) continue;\n\t\t\t\t\t\t\t\t// libp2p streams yield Uint8ArrayList (from uint8arraylist package)\n\t\t\t\t\t\t\t\t// which reports .length correctly but Buffer.from() produces zeros.\n\t\t\t\t\t\t\t\t// .subarray() returns a flat contiguous Uint8Array with actual data.\n\t\t\t\t\t\t\t\tconst raw =\n\t\t\t\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Uint8ArrayList type guard\n\t\t\t\t\t\t\t\t\ttypeof (chunk as any).subarray === \"function\"\n\t\t\t\t\t\t\t\t\t\t? (chunk as { subarray: () => Uint8Array }).subarray()\n\t\t\t\t\t\t\t\t\t\t: chunk instanceof Uint8Array\n\t\t\t\t\t\t\t\t\t\t\t? chunk\n\t\t\t\t\t\t\t\t\t\t\t: new Uint8Array(0);\n\t\t\t\t\t\t\t\tconst bytes = Buffer.from(\n\t\t\t\t\t\t\t\t\traw.buffer,\n\t\t\t\t\t\t\t\t\traw.byteOffset,\n\t\t\t\t\t\t\t\t\traw.byteLength,\n\t\t\t\t\t\t\t\t);\n\n\t\t\t\t\t\t\t\tif (bytes.length > 0) {\n\t\t\t\t\t\t\t\t\tchunks.push(bytes);\n\t\t\t\t\t\t\t\t\ttotalReceived += bytes.length;\n\n\t\t\t\t\t\t\t\t\t// Extract expected length from the first 4 bytes once available\n\t\t\t\t\t\t\t\t\tif (expectedPayloadLength < 0 && totalReceived >= 4) {\n\t\t\t\t\t\t\t\t\t\tconst header = Buffer.concat(chunks);\n\t\t\t\t\t\t\t\t\t\texpectedPayloadLength = header.readUInt32BE(0);\n\t\t\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t\t\t// Stop reading once we have the full payload (4 prefix + N payload)\n\t\t\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\t\t\texpectedPayloadLength >= 0 &&\n\t\t\t\t\t\t\t\t\t\ttotalReceived >= 4 + expectedPayloadLength\n\t\t\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t})(),\n\t\t\t\t\t\ttimeoutPromise,\n\t\t\t\t\t]);\n\t\t\t\t} catch (itErr: unknown) {\n\t\t\t\t\tif (chunks.length === 0) throw itErr;\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Partial manifest read from ${peerIdStr}: ${itErr instanceof Error ? itErr.message : String(itErr)}`,\n\t\t\t\t\t);\n\t\t\t\t} finally {\n\t\t\t\t\tif (manifestTimeoutId) clearTimeout(manifestTimeoutId);\n\t\t\t\t}\n\n\t\t\t\tconst raw = Buffer.concat(chunks);\n\t\t\t\tif (raw.length < 4) {\n\t\t\t\t\tthrow new Error(\"Received empty/invalid manifest (too short)\");\n\t\t\t\t}\n\n\t\t\t\t// Use the length prefix to extract exactly the expected JSON\n\t\t\t\tconst declaredLen = raw.readUInt32BE(0);\n\t\t\t\tconst jsonStr = raw.subarray(4, 4 + declaredLen).toString(\"utf-8\");\n\t\t\t\tconst manifest: LiopManifest = JSON.parse(jsonStr);\n\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] Received manifest from ${peerIdStr}: ${manifest.tools.length} tools`,\n\t\t\t\t);\n\t\t\t\tthis.clearManifestDialFailure(peerIdStr);\n\n\t\t\t\treturn manifest;\n\t\t\t} catch (err: unknown) {\n\t\t\t\tif (attempt === MAX_ATTEMPTS) {\n\t\t\t\t\tthis.recordManifestDialFailure(peerIdStr);\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Failed to query manifest from ${peerIdStr} after ${MAX_ATTEMPTS} attempts: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tconst delay = 500 * 2 ** attempt;\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] Query error for ${peerIdStr} (Attempt ${attempt}): ${err instanceof Error ? err.message : String(err)}. Retrying in ${delay}ms...`,\n\t\t\t\t);\n\t\t\t\tawait new Promise((r) => setTimeout(r, delay));\n\t\t\t}\n\t\t}\n\t\treturn null;\n\t}\n\n\t/**\n\t * Discovers all peers in the DHT that have announced \"liop:manifest\".\n\t * Returns their PeerIDs for subsequent manifest queries.\n\t */\n\tasync discoverManifestProviders(): Promise<string[]> {\n\t\treturn this.findProviders(LIOP_MANIFEST_CAPABILITY);\n\t}\n\n\t/**\n\t * Announces this node as a manifest provider in the DHT.\n\t * Should be called after tools/resources have been registered.\n\t */\n\tasync announceManifest(): Promise<void> {\n\t\tawait this.announceCapability(LIOP_MANIFEST_CAPABILITY);\n\t}\n\n\t/**\n\t * Returns the current size of the routing table for diagnostic purposes.\n\t */\n\tgetRoutingTableSize(): number {\n\t\tif (!this.node) return 0;\n\t\t// @ts-expect-error: Accessing internal routing table size for diagnostics\n\t\treturn this.node.services.dht?.routingTable?.size || 0;\n\t}\n\n\tgetPeerId(): string {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\t\treturn this.node.peerId.toString();\n\t}\n\n\tasync sign(data: Uint8Array): Promise<Uint8Array> {\n\t\tif (!this.localPrivateKey) {\n\t\t\tthrow new Error(\"Local identity not loaded or initialized\");\n\t\t}\n\t\t// libp2p private key implementations typically return a Promise<Uint8Array> or Uint8Array\n\t\treturn Buffer.from(await this.localPrivateKey.sign(data));\n\t}\n\n\tgetMultiaddrs(): string[] {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\t\treturn this.node.getMultiaddrs().map((a) => a.toString());\n\t}\n\n\tasync announceCapability(hash: string): Promise<void> {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\n\t\t// Buffer the capability for reactive re-announcement\n\t\tthis.announcedCapabilities.add(hash);\n\n\t\ttry {\n\t\t\tconst cid = await this.capabilityToCID(hash);\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Announcing capability: ${hash} (CID: ${cid.toString()})`,\n\t\t\t);\n\n\t\t\t// In libp2p v1.x, contentRouting.provide returns Promise<void>\n\t\t\tawait this.node.contentRouting.provide(cid);\n\t\t\tlog.info(`[LIOP-Mesh] Successfully announced capability: ${hash}`);\n\n\t\t\t// [DEV-ONLY] Self-verification\n\t\t\tconst selfId = this.node.peerId.toString();\n\t\t\tfor await (const peer of this.node.contentRouting.findProviders(cid)) {\n\t\t\t\tif (peer.id.toString() === selfId) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Self-verification success: Node is providing ${hash}`,\n\t\t\t\t\t);\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tlog.error(`[LIOP-Mesh] Failed to announce capability: ${error}`);\n\t\t}\n\t}\n\n\tasync findProviders(hash: string): Promise<string[]> {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\t\tconst providers: string[] = [];\n\t\ttry {\n\t\t\tconst cid = await this.capabilityToCID(hash);\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Querying DHT for ${hash} (CID: ${cid.toString()})...`,\n\t\t\t);\n\n\t\t\tlet foundAny = false;\n\n\t\t\t// Phase 103: Adaptive Tail-Wait Polling for DHT Discovery\n\t\t\tconst connections = this.node.getConnections?.()?.length || 0;\n\t\t\tconst idleTimeoutMs = connections > 1 ? 1500 : 3000;\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Starting DHT search with intelligent idle-timeout of ${idleTimeoutMs}ms (Active connections: ${connections})`,\n\t\t\t);\n\n\t\t\t// We manually iterate the AsyncIterable to abort it via Promise.race\n\t\t\tconst iterator = this.node.contentRouting\n\t\t\t\t.findProviders(cid)\n\t\t\t\t[Symbol.asyncIterator]();\n\t\t\tlet isDone = false;\n\n\t\t\twhile (!isDone) {\n\t\t\t\tconst nextPromise = iterator.next();\n\t\t\t\tconst timeoutPromise = new Promise<{ timeout: true }>((resolve) =>\n\t\t\t\t\tsetTimeout(() => resolve({ timeout: true }), idleTimeoutMs),\n\t\t\t\t);\n\n\t\t\t\ttry {\n\t\t\t\t\tconst result = await Promise.race([nextPromise, timeoutPromise]);\n\n\t\t\t\t\tif (result && typeof result === \"object\" && \"timeout\" in result) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] DHT discovery idle-timeout reached. Stopping search early.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tif (typeof iterator.return === \"function\") {\n\t\t\t\t\t\t\t// Fire-and-forget: Kademlia iterators can block for 30s on return()\n\t\t\t\t\t\t\titerator.return().catch(() => {});\n\t\t\t\t\t\t}\n\t\t\t\t\t\tisDone = true;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: polymorphic Kademlia peer result\n\t\t\t\t\tconst itResult = result as IteratorResult<any>;\n\t\t\t\t\tif (itResult.done) {\n\t\t\t\t\t\tisDone = true;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tfoundAny = true;\n\t\t\t\t\tconst peer = itResult.value;\n\t\t\t\t\tconst peerId = peer.id.toString();\n\t\t\t\t\tlog.info(`[LIOP-Mesh] Found provider: ${peerId}`);\n\t\t\t\t\tif (!providers.includes(peerId)) {\n\t\t\t\t\t\tproviders.push(peerId);\n\t\t\t\t\t}\n\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\tlog.warn(\n\t\t\t\t\t\t`[LIOP-Mesh] DHT iteration error: ${e instanceof Error ? e.message : String(e)}`,\n\t\t\t\t\t);\n\t\t\t\t\tisDone = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!foundAny) {\n\t\t\t\tconst services = this.node.services as {\n\t\t\t\t\tdht?: { routingTable?: { size: number } };\n\t\t\t\t};\n\t\t\t\tconst dhtSize = services.dht?.routingTable?.size || 0;\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] DHT search for ${hash} returned zero results (routing table size: ${dhtSize})`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// [DEVELOPER-EXPERIENCE] Local Loopback Discovery\n\t\t\t// If we are providing this capability, ensure we find ourselves even if DHT findProviders doesn't return us.\n\t\t\tif (this.announcedCapabilities.has(hash)) {\n\t\t\t\tconst selfId = this.node.peerId.toString();\n\t\t\t\tif (!providers.includes(selfId)) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Including local node (${selfId}) in results for ${hash}`,\n\t\t\t\t\t);\n\t\t\t\t\tproviders.push(selfId);\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (error: unknown) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Error finding providers for ${hash}: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[LIOP-Mesh] DHT search for ${hash} finished. Found ${providers.length} providers.`,\n\t\t);\n\t\treturn providers;\n\t}\n\n\tasync resolvePeer(peerIdStr: string): Promise<string[]> {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\t\ttry {\n\t\t\t// Strategy 1: Check active connections for the peer's multiaddrs\n\t\t\tconst connections = this.node.getConnections();\n\t\t\tfor (const conn of connections) {\n\t\t\t\tif (conn.remotePeer.toString() === peerIdStr) {\n\t\t\t\t\tconst remoteAddr = conn.remoteAddr.toString();\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Resolved peer ${peerIdStr} via active connection: ${remoteAddr}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn [remoteAddr];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Strategy 2: Try peerStore (iterate all peers to avoid toMultihash conflict)\n\t\t\tconst allPeers = await this.node.peerStore.all();\n\t\t\tfor (const peer of allPeers) {\n\t\t\t\tif (peer.id.toString() === peerIdStr && peer.addresses.length > 0) {\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Internal libp2p addr type\n\t\t\t\t\tconst addrs = peer.addresses.map((a: any) => a.multiaddr.toString());\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Resolved peer ${peerIdStr} via peerStore: ${addrs[0]}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn addrs;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Peer ${peerIdStr} not found in connections or peerStore`,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tlog.info(`[LIOP-Mesh] Failed to resolve peer ${peerIdStr}: ${error}`);\n\t\t}\n\t\treturn [];\n\t}\n\n\tpublic isStarted(): boolean {\n\t\treturn !!this.node && this.node.status === \"started\";\n\t}\n\n\tpublic getPeers(): string[] {\n\t\tif (!this.node) return [];\n\t\treturn this.node.getConnections().map((c) => c.remotePeer.toString());\n\t}\n\n\t/**\n\t * Returns true if this MeshNode was booted inside an isolated libp2p private network (pnet PSK).\n\t */\n\tpublic isPrivateNetwork(): boolean {\n\t\treturn Boolean(this.config.swarmKey);\n\t}\n\n\t/**\n\t * Returns the configured 95-byte Swarm Key, or undefined if running in a public/consortium mesh.\n\t */\n\tpublic getSwarmKey(): Uint8Array | undefined {\n\t\treturn this.config.swarmKey;\n\t}\n}\n"]}

package/dist/{chunk-JIJPZFR2.js → chunk-Y62GORQF.js}

@@ -47,5 +47,5 @@ function sanitizeOutput(output, config) {
 }
 
 export { sanitizeOutput };
-//# sourceMappingURL=chunk-JIJPZFR2.js.map
-//# sourceMappingURL=chunk-JIJPZFR2.js.map
+//# sourceMappingURL=chunk-Y62GORQF.js.map
+//# sourceMappingURL=chunk-Y62GORQF.js.map

package/dist/chunk-Y62GORQF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/output-sanitizer.ts"],"names":[],"mappings":";AAkBA,IAAM,cAAA,GAAkD;AAAA,EACvD,gBAAA,EAAkB,CAAA;AAAA,EAClB,gBAAA,EAAkB;AACnB,CAAA;AASO,SAAS,cAAA,CACf,QACA,MAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,MAAA,EAAO;AAC9C,EAAA,MAAM,IAAA,uBAAW,OAAA,EAAgB;AAEjC,EAAA,SAAS,KAAK,IAAA,EAAwB;AACrC,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACxC,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,QAAA,OAAO,IAAA;AAAA,MACR;AAEA,MAAA,IAAI,KAAA,GAAQ,IAAA;AAGZ,MAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,KAAA,GAAQ,CAAA,EAAG;AACzC,QAAA,KAAA,GAAQ,CAAA;AAAA,MACT;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,gBAAA;AAC5B,MAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA,GAAI,MAAA;AAErC,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,SAAS,SAAA,EAAW;AAC1D,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE7B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAc,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACR;AACA,MAAA,IAAA,CAAK,IAAI,IAAc,CAAA;AAEvB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,QAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MACrC;AAEA,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,QAC/B;AAAA,OACD,EAAG;AACF,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,MAAM,CAAA;AACnB","file":"chunk-Y62GORQF.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Egress Shield Output Sanitizer (NIST SP 800-226 and OWASP DLP 2025 compliant)\n * Recursively sanitizes execution outputs by rounding floating-point numbers\n * and clamping negative values to zero floor where appropriate.\n *\n * Implements absolute immutability, returning a fresh copy of the data.\n */\n\nexport interface OutputSanitizerConfig {\n\t/** Maximum decimal places for floating-point values (default: 4) */\n\tmaxDecimalPlaces?: number;\n\t/** Clamp negative values to zero floor (default: true) */\n\tclampNonNegative?: boolean;\n}\n\nconst DEFAULT_CONFIG: Required<OutputSanitizerConfig> = {\n\tmaxDecimalPlaces: 4,\n\tclampNonNegative: true,\n};\n\n/**\n * Recursively walks a JSON-like tree, rounding floats and clamping negative values.\n *\n * @param output - The raw or DP-modified output object/value to sanitize\n * @param config - Sanitization parameters (rounding depth, negative clamping)\n * @returns A sanitized deep copy of the output\n */\nexport function sanitizeOutput(\n\toutput: unknown,\n\tconfig?: OutputSanitizerConfig,\n): unknown {\n\tconst merged = { ...DEFAULT_CONFIG, ...config };\n\tconst seen = new WeakSet<object>();\n\n\tfunction walk(node: unknown): unknown {\n\t\tif (node === null || node === undefined) {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"number\") {\n\t\t\tif (!Number.isFinite(node)) {\n\t\t\t\treturn node;\n\t\t\t}\n\n\t\t\tlet value = node;\n\n\t\t\t// 1. Clamp negative values to 0 if configured\n\t\t\tif (merged.clampNonNegative && value < 0) {\n\t\t\t\tvalue = 0;\n\t\t\t}\n\n\t\t\t// 2. Round to maximum decimal places\n\t\t\tconst factor = 10 ** merged.maxDecimalPlaces;\n\t\t\tvalue = Math.round(value * factor) / factor;\n\n\t\t\treturn value;\n\t\t}\n\n\t\tif (typeof node === \"string\" || typeof node === \"boolean\") {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"object\") {\n\t\t\t// Circular reference protection\n\t\t\tif (seen.has(node as object)) {\n\t\t\t\treturn node;\n\t\t\t}\n\t\t\tseen.add(node as object);\n\n\t\t\tif (Array.isArray(node)) {\n\t\t\t\treturn node.map((item) => walk(item));\n\t\t\t}\n\n\t\t\tconst result: Record<string, unknown> = {};\n\t\t\tfor (const [key, val] of Object.entries(\n\t\t\t\tnode as Record<string, unknown>,\n\t\t\t)) {\n\t\t\t\tresult[key] = walk(val);\n\t\t\t}\n\t\t\treturn result;\n\t\t}\n\n\t\treturn node;\n\t}\n\n\treturn walk(output);\n}\n"]}

package/dist/chunk-ZP3VVXOI.js

@@ -0,0 +1,66 @@
+import { Buffer } from 'buffer';
+import { mkdir, writeFile, readFile } from 'fs/promises';
+import { dirname } from 'path';
+import { generateKey } from '@libp2p/pnet';
+
+// src/mesh/swarm-key.ts
+var SWARM_KEY_BYTE_LENGTH = 95;
+function createSwarmKey() {
+  const psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);
+  generateKey(psk);
+  return psk;
+}
+function serializeSwarmKey(psk) {
+  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
+    throw new Error(
+      `Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
+    );
+  }
+  return Buffer.from(psk).toString("base64");
+}
+function deserializeSwarmKey(base64Str) {
+  const trimmed = base64Str.trim();
+  const buf = Buffer.from(trimmed, "base64");
+  if (buf.length !== SWARM_KEY_BYTE_LENGTH) {
+    throw new Error(
+      `Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`
+    );
+  }
+  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+}
+function parseSwarmKey(rawText) {
+  const trimmed = rawText.trim();
+  if (trimmed.startsWith("/key/swarm/psk/")) {
+    const normalized = trimmed.replace(/\r\n/g, "\n").trimEnd();
+    const bytes = new TextEncoder().encode(normalized);
+    if (bytes.length === SWARM_KEY_BYTE_LENGTH) {
+      return bytes;
+    }
+  }
+  return deserializeSwarmKey(trimmed);
+}
+async function saveSwarmKey(psk, filePath) {
+  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
+    throw new Error(
+      `Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
+    );
+  }
+  await mkdir(dirname(filePath), { recursive: true });
+  await writeFile(filePath, psk);
+}
+async function loadSwarmKey(filePath) {
+  const fileBuffer = await readFile(filePath);
+  if (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {
+    return new Uint8Array(
+      fileBuffer.buffer,
+      fileBuffer.byteOffset,
+      fileBuffer.byteLength
+    );
+  }
+  const text = fileBuffer.toString("utf-8");
+  return parseSwarmKey(text);
+}
+
+export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey };
+//# sourceMappingURL=chunk-ZP3VVXOI.js.map
+//# sourceMappingURL=chunk-ZP3VVXOI.js.map

package/dist/chunk-ZP3VVXOI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mesh/swarm-key.ts"],"names":[],"mappings":";;;;;;AAQO,IAAM,qBAAA,GAAwB;AAM9B,SAAS,cAAA,GAA6B;AAC5C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,qBAAqB,CAAA;AAChD,EAAA,WAAA,CAAY,GAAG,CAAA;AACf,EAAA,OAAO,GAAA;AACR;AAKO,SAAS,kBAAkB,GAAA,EAAyB;AAC1D,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,mCAAA,EAAsC,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KACrF;AAAA,EACD;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC1C;AAKO,SAAS,oBAAoB,SAAA,EAA+B;AAClE,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AACzC,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,yCAAA,EAA4C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC3F;AAAA,EACD;AACA,EAAA,OAAO,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,GAAA,CAAI,UAAA,EAAY,IAAI,UAAU,CAAA;AACjE;AAMO,SAAS,cAAc,OAAA,EAA6B;AAC1D,EAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAK;AAE7B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,iBAAiB,CAAA,EAAG;AAC1C,IAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,OAAA,EAAS,IAAI,EAAE,OAAA,EAAQ;AAC1D,IAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AACjD,IAAA,IAAI,KAAA,CAAM,WAAW,qBAAA,EAAuB;AAC3C,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAEA,EAAA,OAAO,oBAAoB,OAAO,CAAA;AACnC;AAKA,eAAsB,YAAA,CACrB,KACA,QAAA,EACgB;AAChB,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,wCAAA,EAA2C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC1F;AAAA,EACD;AACA,EAAA,MAAM,MAAM,OAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,EAAA,MAAM,SAAA,CAAU,UAAU,GAAG,CAAA;AAC9B;AAMA,eAAsB,aAAa,QAAA,EAAuC;AACzE,EAAA,MAAM,UAAA,GAAa,MAAM,QAAA,CAAS,QAAQ,CAAA;AAC1C,EAAA,IAAI,UAAA,CAAW,WAAW,qBAAA,EAAuB;AAChD,IAAA,OAAO,IAAI,UAAA;AAAA,MACV,UAAA,CAAW,MAAA;AAAA,MACX,UAAA,CAAW,UAAA;AAAA,MACX,UAAA,CAAW;AAAA,KACZ;AAAA,EACD;AACA,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA;AACxC,EAAA,OAAO,cAAc,IAAI,CAAA;AAC1B","file":"chunk-ZP3VVXOI.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Buffer } from \"node:buffer\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { generateKey } from \"@libp2p/pnet\";\n\nexport const SWARM_KEY_BYTE_LENGTH = 95;\n\n/**\n * Creates a freshly generated 95-byte Pre-Shared Key (PSK) for libp2p Private Networks (pnet).\n * Follows the canonical format `/key/swarm/psk/1.0.0/\\n/base16/\\n<hex>\\n`.\n */\nexport function createSwarmKey(): Uint8Array {\n\tconst psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);\n\tgenerateKey(psk);\n\treturn psk;\n}\n\n/**\n * Serializes a 95-byte PSK into a Base64 string for safe environment variable passing or JSON config.\n */\nexport function serializeSwarmKey(psk: Uint8Array): string {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\treturn Buffer.from(psk).toString(\"base64\");\n}\n\n/**\n * Deserializes a Base64-encoded string into a 95-byte PSK Uint8Array.\n */\nexport function deserializeSwarmKey(base64Str: string): Uint8Array {\n\tconst trimmed = base64Str.trim();\n\tconst buf = Buffer.from(trimmed, \"base64\");\n\tif (buf.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`,\n\t\t);\n\t}\n\treturn new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);\n}\n\n/**\n * Parses raw text format PSK or Base64 string into a 95-byte PSK Uint8Array.\n * Allows loading either the canonical multiline text (`/key/swarm/psk/1.0.0/...`) or Base64.\n */\nexport function parseSwarmKey(rawText: string): Uint8Array {\n\tconst trimmed = rawText.trim();\n\t// Check if this is canonical raw text format\n\tif (trimmed.startsWith(\"/key/swarm/psk/\")) {\n\t\tconst normalized = trimmed.replace(/\\r\\n/g, \"\\n\").trimEnd();\n\t\tconst bytes = new TextEncoder().encode(normalized);\n\t\tif (bytes.length === SWARM_KEY_BYTE_LENGTH) {\n\t\t\treturn bytes;\n\t\t}\n\t}\n\t// Fallback to Base64 deserialization\n\treturn deserializeSwarmKey(trimmed);\n}\n\n/**\n * Saves a 95-byte Swarm Key to a file on disk (written as canonical text).\n */\nexport async function saveSwarmKey(\n\tpsk: Uint8Array,\n\tfilePath: string,\n): Promise<void> {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\tawait mkdir(dirname(filePath), { recursive: true });\n\tawait writeFile(filePath, psk);\n}\n\n/**\n * Loads a 95-byte Swarm Key from a file on disk.\n * Supports both raw binary/canonical format and Base64-encoded text.\n */\nexport async function loadSwarmKey(filePath: string): Promise<Uint8Array> {\n\tconst fileBuffer = await readFile(filePath);\n\tif (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {\n\t\treturn new Uint8Array(\n\t\t\tfileBuffer.buffer,\n\t\t\tfileBuffer.byteOffset,\n\t\t\tfileBuffer.byteLength,\n\t\t);\n\t}\n\tconst text = fileBuffer.toString(\"utf-8\");\n\treturn parseSwarmKey(text);\n}\n"]}

package/dist/client.d.ts

@@ -1,7 +1,8 @@
 import './verifier-COnid_dg.js';
-import './mesh.js';
-export { c as LiopClient } from './index-cMV0_yD9.js';
-import './types-lJIxBlWF.js';
+import './node-B0b2vUFS.js';
+export { c as LiopClient } from './index-BuEQtBHD.js';
+import './types-CzRSOlOo.js';
+import '@grpc/grpc-js';
 import 'node:events';
 import 'zod';
 import 'jose';

package/dist/client.js

@@ -1,10 +1,12 @@
-export { LiopClient } from './chunk-CRZBVFDV.js';
-import './chunk-32ADSAJS.js';
-import './chunk-OUUTDSOW.js';
-import './chunk-QLCOEP5J.js';
-import './chunk-WSW6YJNY.js';
-import './chunk-PYKRQAER.js';
-import './chunk-74CISO2I.js';
-import './chunk-72MNYFR6.js';
+export { LiopClient } from './chunk-FCFTYOAS.js';
+import './chunk-3QH44NKZ.js';
+import './chunk-2STZHJ24.js';
+import './chunk-IK7CGWAZ.js';
+import './chunk-7PITYWOV.js';
+import './chunk-UJFWPRDM.js';
+import './chunk-PAICJCKJ.js';
+import './chunk-2KSO3W4A.js';
+import './chunk-XRDN232O.js';
+import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=client.js.map
 //# sourceMappingURL=client.js.map

package/dist/gateway.d.ts

@@ -1,7 +1,7 @@
-import './mesh.js';
-import './index-BW95kAL4.js';
-export { L as LiopHybridGateway } from './hybrid-CF__0YnC.js';
+import './node-B0b2vUFS.js';
+import './index-CdW8j8Bn.js';
+import './types-CzRSOlOo.js';
+export { L as LiopHybridGateway } from './hybrid-DWe1bMoV.js';
 import 'zod';
-import './types-lJIxBlWF.js';
 import 'jose';
 import './verifier-COnid_dg.js';

package/dist/gateway.js

@@ -1,11 +1,12 @@
-export { LiopHybridGateway } from './chunk-T5IUZF47.js';
-import './chunk-547TYL27.js';
-import './chunk-32ADSAJS.js';
-import './chunk-OUUTDSOW.js';
-import './chunk-QLCOEP5J.js';
-import './chunk-U5BZ66VX.js';
-import './chunk-WSW6YJNY.js';
-import './chunk-PYKRQAER.js';
-import './chunk-72MNYFR6.js';
+export { LiopHybridGateway } from './chunk-EJ426URA.js';
+import './chunk-VRB5HUYU.js';
+import './chunk-2STZHJ24.js';
+import './chunk-IK7CGWAZ.js';
+import './chunk-7PITYWOV.js';
+import './chunk-WPTOJYN5.js';
+import './chunk-UJFWPRDM.js';
+import './chunk-PAICJCKJ.js';
+import './chunk-2KSO3W4A.js';
+import './chunk-K3DGJLUY.js';
 //# sourceMappingURL=gateway.js.map
 //# sourceMappingURL=gateway.js.map

package/dist/{hybrid-CF__0YnC.d.ts → hybrid-DWe1bMoV.d.ts}

@@ -1,7 +1,7 @@
-import { MeshNode } from './mesh.js';
-import { L as LiopServer } from './index-BW95kAL4.js';
+import { a as MeshNode } from './node-B0b2vUFS.js';
+import { L as LiopServer } from './index-CdW8j8Bn.js';
+import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse, G as GatewayInterceptorOptions } from './types-CzRSOlOo.js';
 import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { b as McpRequest, M as McpEra, A as AuthInfo, c as McpResponse } from './types-lJIxBlWF.js';
 
 /**
  * LIOP Sliding-Window Rate Limiter
@@ -153,9 +153,10 @@ declare class LiopHybridGateway {
     private jwtValidator?;
     private oauthProvider?;
     private rateLimiter;
+    private readonly interceptorOptions?;
     private isDraining;
     private activeRequests;
-    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number, rateLimiterOptions?: RateLimiterOptions);
+    constructor(liopServer: LiopServer, meshNode?: MeshNode | null, rpcPort?: number, rateLimiterOptions?: RateLimiterOptions, interceptorOptions?: GatewayInterceptorOptions);
     private setupH2Routes;
     private setupH1Routes;
     private handleGrpcStream;

package/dist/{index-cMV0_yD9.d.ts → index-BuEQtBHD.d.ts}

@@ -1,17 +1,8 @@
 import { L as LiopVerifier } from './verifier-COnid_dg.js';
-import { MeshNodeConfig } from './mesh.js';
+import { M as MeshNodeConfig } from './node-B0b2vUFS.js';
+import * as grpc from '@grpc/grpc-js';
 import { EventEmitter } from 'node:events';
-import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-lJIxBlWF.js';
-
-/**
- * LIOP Certificate Manager (CertManager)
- * Provides automated certificate monitoring, X.509 validity inspection,
- * and hot-reloading for mutual TLS (mTLS) without node restarts.
- *
- * Compliance:
- * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS
- * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification
- */
+import { M as McpEra, C as CallToolRequest, a as CallToolResult } from './types-CzRSOlOo.js';
 
 interface CertManagerOptions {
     /** Path to the root CA certificate (PEM format) */
@@ -77,23 +68,6 @@ declare class CertManager extends EventEmitter {
     dispose(): void;
 }
 
-/**
- * LIOP TLS Configuration
- *
- * Provides conditional TLS credential factories for gRPC connections.
- * When TLS options are provided, connections are secured with mutual TLS.
- * Otherwise, falls back to insecure credentials (alpha/development mode).
- *
- * Production Hardening (Phase 128):
- * - When NODE_ENV=production and TLS is configured but certificate loading
- *   fails, the system throws a fatal error instead of silently degrading
- *   to insecure credentials. This prevents MITM/eavesdropping attacks
- *   caused by misconfigured certificate paths going unnoticed.
- * - Reference: gRPC-node official docs — "Using insecure credentials in
- *   production poses significant security risks including eavesdropping,
- *   MITM attacks, and lack of authentication."
- */
-
 interface LiopTlsOptions {
     /** Path to the root CA certificate (PEM format) */
     rootCert?: string;
@@ -105,7 +79,28 @@ interface LiopTlsOptions {
     mutualTls?: boolean;
     /** Optional CertManager instance for automated certificate management and hot reloading */
     certManager?: CertManager;
+    /**
+     * Explicitly permit unencrypted (insecure) credentials for local development,
+     * Docker testbeds, or tooling harnesses without emitting console warnings.
+     * Ignored if isTlsEnforced() is true (production/enforced mode always throws).
+     */
+    insecure?: boolean;
+    /**
+     * Explicitly suppress the fallback warning when insecure credentials are created.
+     */
+    suppressWarning?: boolean;
 }
+/**
+ * Creates gRPC server credentials from TLS options.
+ * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.
+ * When mutualTls=true, enforces client certificate authentication against root CA.
+ */
+declare function createServerCredentials(tls?: LiopTlsOptions): grpc.ServerCredentials;
+/**
+ * Creates gRPC channel credentials from TLS options.
+ * In production or when LIOP_ENFORCE_TLS=true, refuses to fall back to insecure.
+ */
+declare function createChannelCredentials(tls?: LiopTlsOptions): grpc.ChannelCredentials;
 
 /**
  * LIOP Client
@@ -119,15 +114,12 @@ declare class LiopClient {
     private serverInfo?;
     verifier: LiopVerifier;
     private oauthToken?;
+    private tokenManager?;
     /** Protocol negotiation era */
     era: McpEra;
     /** Negotiated protocol version */
     protocolVersion: string;
     constructor(tls?: LiopTlsOptions);
-    /**
-     * Requests an M2M access token from the Nexus Authorization Server using Client Credentials.
-     */
-    private acquireM2MToken;
     /**
      * Discovers and connects to the target server or mesh capability.
      * If address is omitted, it sets up the MeshNode to act purely dynamically.
@@ -187,6 +179,19 @@ declare class LiopClient {
             text: string;
         }>;
     }>;
+    /**
+     * Returns the local PeerId string if the mesh node is active, null otherwise.
+     * PeerIds are public identifiers by libp2p protocol design (Ed25519 public key hash).
+     */
+    get peerId(): string | null;
+    /**
+     * Returns true if the mesh node is initialized and running.
+     */
+    get isMeshActive(): boolean;
+    /**
+     * Returns the number of active P2P connections, or 0 if the mesh is inactive.
+     */
+    get connectionCount(): number;
     getServerInfo(): {
         name: string;
         version: string;
@@ -197,4 +202,4 @@ declare class LiopClient {
     close(): Promise<void>;
 }
 
-export { type CertInfo as C, type LiopTlsOptions as L, CertManager as a, type CertManagerOptions as b, LiopClient as c };
+export { type CertInfo as C, type LiopTlsOptions as L, CertManager as a, type CertManagerOptions as b, LiopClient as c, createChannelCredentials as d, createServerCredentials as e };