@nekzus/liop 2.6.0 → 2.7.0

package/dist/chunk-XRDN232O.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mesh/node.ts"],"names":["privateKey","resolve","raw"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAyFA,IAAM,uBAAA,GAA0B;AAAA,EAC/B,iFAAA;AAAA,EACA,iFAAA;AAAA,EACA,iFAAA;AAAA,EACA;AACD,CAAA;AAEA,IAAM,sBAAA,GAAyB,sBAAA;AAC/B,IAAM,wBAAA,GAA2B,eAAA;AAQ1B,IAAM,QAAA,GAAN,MAAM,SAAA,CAAS;AAAA,EACb,IAAA,GAAsB,IAAA;AAAA,EACtB,MAAA;AAAA,EACA,wBAAA,uBAGA,GAAA,EAAI;AAAA,EACZ,OAAwB,8BAAA,GAAiC,GAAA;AAAA,EACzD,OAAwB,gCAAgC,CAAA,GAAI,GAAA;AAAA,EAC5D,OAAwB,kCAAA,GAAqC,GAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrD,qBAAA,uBAAyC,GAAA,EAAI;AAAA;AAAA,EAG7C,YAAA,GAAe,KAAA;AAAA;AAAA,EAGf,gBAAA,GAAgD,IAAA;AAAA;AAAA,EAGhD,0BAAA,GAA6B,KAAA;AAAA;AAAA;AAAA,EAI7B,eAAA,GAA8B,IAAA;AAAA,EAEtC,WAAA,CAAY,MAAA,GAAyB,EAAC,EAAG;AACxC,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACb,eAAA,EAAiB,OAAO,eAAA,IAAmB;AAAA,QAC1C,uBAAA;AAAA,QACA;AAAA,OACD;AAAA,MACA,cAAA,EAAgB,MAAA,CAAO,cAAA,IAAkB,EAAC;AAAA,MAC1C,cAAc,MAAA,CAAO,YAAA;AAAA,MACrB,SAAA,EAAW,OAAO,SAAA,IAAa,KAAA;AAAA,MAC/B,gBAAgB,MAAA,CAAO,cAAA;AAAA,MACvB,eAAe,MAAA,CAAO,aAAA;AAAA,MACtB,UAAU,MAAA,CAAO;AAAA,KAClB;AAAA,EACD;AAAA,EAEQ,uBAAuB,SAAA,EAA4B;AAC1D,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,SAAS,CAAA;AACzD,IAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,GAAA,IAAO,KAAA,CAAM,aAAA,EAAe,OAAO,KAAA;AACvC,IAAA,IACC,GAAA,GAAM,KAAA,CAAM,aAAA,GACZ,SAAA,CAAS,kCAAA,EACR;AACD,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,uCAAA,EAA0C,SAAS,CAAA,kBAAA,EAAqB,IAAA,CAAK,MAAM,KAAA,CAAM,aAAA,GAAgB,GAAA,IAAO,GAAI,CAAC,CAAA,YAAA;AAAA,OACtH;AACA,MAAA,KAAA,CAAM,aAAA,GAAgB,GAAA;AAAA,IACvB;AACA,IAAA,OAAO,IAAA;AAAA,EACR;AAAA,EAEQ,0BAA0B,SAAA,EAAyB;AAC1D,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,wBAAA,CAAyB,GAAA,CAAI,SAAS,CAAA;AACxD,IAAA,MAAM,QAAA,GAAA,CAAY,IAAA,EAAM,QAAA,IAAY,CAAA,IAAK,CAAA;AACzC,IAAA,MAAM,UAAU,IAAA,CAAK,GAAA;AAAA,MACpB,UAAS,8BAAA,GAAiC,CAAA,IAAK,KAAK,GAAA,CAAI,CAAA,EAAG,WAAW,CAAC,CAAA;AAAA,MACvE,SAAA,CAAS;AAAA,KACV;AACA,IAAA,IAAA,CAAK,wBAAA,CAAyB,IAAI,SAAA,EAAW;AAAA,MAC5C,QAAA;AAAA,MACA,eAAe,GAAA,GAAM,OAAA;AAAA,MACrB,aAAA,EAAe;AAAA,KACf,CAAA;AAAA,EACF;AAAA,EAEQ,yBAAyB,SAAA,EAAyB;AACzD,IAAA,IAAA,CAAK,wBAAA,CAAyB,OAAO,SAAS,CAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,oBAAA,GAAuB;AACpC,IAAA,IAAI;AACH,MAAA,MAAM,EAAE,eAAA,EAAiB,sBAAA,EAAuB,GAAK,MAAM;AAAA,QAC1D;AAAA;AAAA,OAED;AACA,MAAA,MAAM,EAAE,UAAA,EAAY,YAAA,EAAa,GAAI,MAAM,OAC1C,yBACD,CAAA;AAEA,MAAA,IAAI,IAAA,CAAK,OAAO,YAAA,EAAc;AAC7B,QAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAC1D,QAAA,IAAI;AACH,UAAA,MAAM,IAAA,GAAO,MAAS,EAAA,CAAA,QAAA,CAAS,YAAA,EAAc,OAAO,CAAA;AACpD,UAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC5B,UAAA,MAAM,aAAA,GAAgB,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AACzD,UAAA,IAAI;AACH,YAAA,MAAMA,WAAAA,GAAa,uBAAuB,aAAa,CAAA;AACvD,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,+CAA+C,YAAY,CAAA;AAAA,aAC5D;AACA,YAAA,OAAO,EAAE,UAAA,EAAAA,WAAAA,EAAY,KAAA,EAAO,KAAA,EAAM;AAAA,UACnC,SAAS,UAAA,EAAqB;AAC7B,YAAA,GAAA,CAAI,KAAA;AAAA,cACH,CAAA,mCAAA,EAAsC,YAAY,CAAA,mDAAA,EACjD,UAAA,YAAsB,QACnB,UAAA,CAAW,OAAA,GACX,MAAA,CAAO,UAAU,CACrB,CAAA;AAAA,aACD;AAAA,UAED;AAAA,QACD,SAAS,KAAA,EAAgB;AACxB,UAAA,MAAM,CAAA,GAAI,KAAA;AACV,UAAA,IAAI,CAAA,CAAE,SAAS,QAAA,EAAU;AACxB,YAAA,GAAA,CAAI,KAAA,CAAM,CAAA,oCAAA,EAAuC,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAAA,UAC7D;AAAA,QACD;AAAA,MACD;AAEA,MAAA,MAAM,UAAA,GAAa,MAAM,eAAA,CAAgB,SAAS,CAAA;AAClD,MAAA,OAAO,EAAE,UAAA,EAAY,KAAA,EAAO,IAAA,EAAK;AAAA,IAClC,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA;AAAA,QACH,sDAAsD,KAAK,CAAA,qCAAA;AAAA,OAC5D;AAIA,MAAA,IAAI;AACH,QAAA,MAAM,EAAE,eAAA,EAAgB,GAAK,MAAM;AAAA,UAClC;AAAA;AAAA,SAED;AACA,QAAA,MAAM,YAAA,GAAe,MAAM,eAAA,CAAgB,SAAS,CAAA;AACpD,QAAA,OAAO,EAAE,UAAA,EAAY,YAAA,EAAc,KAAA,EAAO,IAAA,EAAK;AAAA,MAChD,SAAS,aAAA,EAAe;AACvB,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,aAAa,CAAA,CAAE,CAAA;AAAA,MAC5D;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,aAAa,UAAA,EAAiB;AAC3C,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,YAAA,IAAgB,CAAC,KAAK,IAAA,EAAM;AAE7C,IAAA,IAAI;AACH,MAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAC1D,MAAA,MAAM,EAAE,oBAAA,EAAqB,GAAK,MAAM;AAAA,QACvC;AAAA;AAAA,OAED;AACA,MAAA,MAAM,EAAE,QAAA,EAAU,UAAA,EAAW,GAAI,MAAM,OAAO,uBAAuB,CAAA;AAErE,MAAA,MAAM,aAAA,GAAgB,qBAAqB,UAAU,CAAA;AACrD,MAAA,MAAM,cAAA,GAAiB,UAAA,CAAW,aAAA,EAAe,QAAQ,CAAA;AAEzD,MAAA,MAAM,IAAA,GAAO;AAAA,QACZ,EAAA,EAAI,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAA,EAAS;AAAA,QAC9B,OAAA,EAAS;AAAA,OACV;AAEA,MAAA,MAAS,SAAW,IAAA,CAAA,OAAA,CAAQ,YAAY,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9D,MAAA,MAAS,aAAU,YAAA,EAAc,IAAA,CAAK,UAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAC,CAAA;AAC9D,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,kCAAA,EAAqC,YAAY,CAAA,CAAE,CAAA;AAAA,IAC7D,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,wCAAA,EAA2C,KAAK,CAAA,CAAE,CAAA;AAAA,IAC7D;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,gBAAgB,UAAA,EAAkC;AAC/D,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,MAAA,CAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,UAAU,CAAC,CAAA;AACrE,IAAA,OAAO,GAAA,CAAI,MAAA,CAAO,CAAA,EAAG,EAAA,EAAM,IAAI,CAAA;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,aAAA,GAA+B;AAC5C,IAAA,IACC,KAAK,YAAA,IACL,CAAC,KAAK,IAAA,IACN,IAAA,CAAK,sBAAsB,IAAA,KAAS,CAAA;AAEpC,MAAA;AAED,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAI;AAEH,MAAA,MAAM,IAAI,OAAA,CAAQ,CAACC,aAAY,UAAA,CAAWA,QAAAA,EAAS,GAAG,CAAC,CAAA;AAEvD,MAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AAEhB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,0BAAA,EAA6B,IAAA,CAAK,qBAAA,CAAsB,IAAI,CAAA,yCAAA;AAAA,OAC7D;AAEA,MAAA,KAAA,MAAW,IAAA,IAAQ,KAAK,qBAAA,EAAuB;AAC9C,QAAA,IAAI;AACH,UAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,eAAA,CAAgB,IAAI,CAAA;AAC3C,UAAA,MAAM,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA;AAC1C,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAE,CAAA;AAAA,QAC7C,SAAS,EAAA,EAAI;AACZ,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,mCAAA,EAAsC,IAAI,CAAA,EAAA,EAAK,EAAE,CAAA,CAAE,CAAA;AAAA,QAC7D;AAAA,MACD;AAAA,IACD,CAAA,SAAE;AACD,MAAA,IAAA,CAAK,YAAA,GAAe,KAAA;AAAA,IACrB;AAAA,EACD;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC5B,IAAA,IAAI,KAAK,IAAA,EAAM;AACf,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,oBAAA,EAAqB;AAC/C,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,MAAM,mCAAmC,CAAA;AAEhE,IAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAM,GAAI,MAAA;AAC9B,IAAA,IAAA,CAAK,eAAA,GAAkB,UAAA;AAEvB,IAAA,IAAI,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,EAAC;AAC/C,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,IAAK,IAAA,CAAK,OAAO,SAAA,EAAW;AACpD,MAAA,SAAA,GAAY,uBAAA;AAAA,IACb;AAEA,IAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,MAAA,CAAO,aAAA,IAAiB,IAAA;AACnD,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,MAAA,CAAO,WAAA,IAAe,IAAA;AAC/C,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,MAAA,CAAO,WAAA,IAAe,IAAA;AAC/C,IAAA,MAAM,aAAa,IAAA,CAAK,MAAA,CAAO,UAAA,IAAc,CAAC,KAAK,MAAA,CAAO,SAAA;AAG1D,IAAA,MAAM,gBAAuB,EAAC;AAC9B,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACzB,MAAA,aAAA,CAAc,IAAA;AAAA,QACb,SAAA,CAAU;AAAA,UACT,IAAA,EAAM;AAAA,SACN;AAAA,OACF;AAAA,IACD;AACA,IAAA,IAAI,UAAA,EAAY;AACf,MAAA,aAAA,CAAc,IAAA,CAAK,MAAM,CAAA;AAAA,IAC1B;AAEA,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,MAAA,CAAO,SAAA,GAC7B,iBAAA,GACA,qBAAA;AAGH,IAAA,MAAM,UAAA,GAAoB,CAAC,GAAA,EAAI,EAAG,YAAY,CAAA;AAC9C,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,UAAA,CAAW,IAAA,CAAK,uBAAuB,CAAA;AAAA,IACxC;AAGA,IAAA,MAAM,QAAA,GAAgC;AAAA,MACrC,UAAU,QAAA,EAAS;AAAA,MACnB,MAAM,IAAA,EAAK;AAAA,MACX,KAAK,MAAA,CAAO;AAAA,QACX,QAAA,EAAU,WAAA;AAAA,QACV,UAAA,EAAY,KAAA;AAAA;AAAA,QAEZ,uBAAA,EAAyB,IAAA;AAAA;AAAA,QAEzB,cAAA,EAAgB,CAAC,IAAA,KAAS;AAAA,OAC1B;AAAA,KACF;AAEA,IAAA,IAAI,aAAA,EAAe;AAClB,MAAA,QAAA,CAAS,UAAU,OAAA,EAAQ;AAAA,IAC5B;AACA,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,QAAA,CAAS,QAAQ,kBAAA,EAAmB;AAAA,IACrC;AACA,IAAA,IAAI,WAAA,EAAa;AAChB,MAAA,QAAA,CAAS,QAAQ,KAAA,EAAM;AAAA,IACxB;AAIA,IAAA,IAAI,mBAAA;AACJ,IAAA,IAAI,IAAA,CAAK,OAAO,QAAA,EAAU;AACzB,MAAA,MAAM,EAAE,YAAA,EAAa,GAAI,MAAM,OAAO,cAAc,CAAA;AACpD,MAAA,mBAAA,GAAsB,YAAA,CAAa;AAAA,QAClC,GAAA,EAAK,KAAK,MAAA,CAAO;AAAA,OACjB,CAAA;AACD,MAAA,GAAA,CAAI,IAAA;AAAA,QACH;AAAA,OACD;AAAA,IACD;AAEA,IAAA,IAAA,CAAK,IAAA,GAAO,MAAM,YAAA,CAAa;AAAA,MAC9B,UAAA;AAAA,MACA,SAAA,EAAW;AAAA,QACV,MAAA,EAAQ,KAAK,MAAA,CAAO;AAAA,OACrB;AAAA,MACA,UAAA;AAAA,MACA,oBAAA,EAAsB,CAAC,KAAA,EAAO,CAAA;AAAA,MAC9B,YAAA,EAAc,CAAC,KAAA,EAAO,CAAA;AAAA,MACtB,GAAI,mBAAA,GAAsB,EAAE,mBAAA,KAAwB,EAAC;AAAA;AAAA,MAErD,QAAA;AAAA,MACA,aAAA;AAAA;AAAA,QAEC,aAAA,CAAc,MAAA,GAAS,CAAA,GAAK,aAAA,GAAwB;AAAA;AAAA,KACrD,CAAA;AAGD,IAAA,IAAA,CAAK,IAAA,CAAK,gBAAA,CAAiB,gBAAA,EAAkB,CAAC,GAAA,KAAQ;AACrD,MAAA,MAAM,MAAA,GAAS,IAAI,MAAA,CAAO,EAAA;AAC1B,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,6BAAA,EAAgC,MAAA,CAAO,QAAA,EAAU,CAAA,CAAE,CAAA;AAE5D,MAAA,IAAI,KAAK,IAAA,EAAM;AAEd,QAAA,IAAI,UAAA,GAAkB,MAAA;AAGtB,QAAA,IAAI,KAAK,MAAA,CAAO,aAAA,IAAiB,IAAI,MAAA,CAAO,UAAA,CAAW,SAAS,CAAA,EAAG;AAClE,UAAA,MAAM,aAAa,GAAA,CAAI,MAAA,CAAO,UAAA,CAC5B,GAAA,CAAI,CAAC,EAAA,KAAO;AAEZ,YAAA,MAAM,SAAS,IAAA,CAAK,MAAA,CAAO,aAAA,CAAe,EAAA,CAAG,UAAU,CAAA;AACvD,YAAA,OAAO,MAAA,GAAS,SAAA,CAAU,MAAM,CAAA,GAAI,IAAA;AAAA,UACrC,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,CAAA,KAAkC,MAAM,IAAI,CAAA;AAEtD,UAAA,MAAM,YAAY,UAAA,CAAW,IAAA;AAAA,YAC5B,CAAC,EAAA,KACA,EAAA,CAAG,QAAA,EAAS,CAAE,QAAA,CAAS,OAAO,CAAA,IAAK,CAAC,EAAA,CAAG,QAAA,EAAS,CAAE,SAAS,KAAK;AAAA,WAClE;AACA,UAAA,IAAI,WAAW,UAAA,GAAa,SAAA;AAAA,QAC7B;AAEA,QAAA,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,UAAU,CAAA,CAAE,MAAM,MAAM;AAAA,QAAC,CAAC,CAAA;AAAA,MAC1C;AAAA,IACD,CAAC,CAAA;AAED,IAAA,IAAA,CAAK,IAAA,CAAK,gBAAA,CAAiB,cAAA,EAAgB,CAAC,GAAA,KAAQ;AACnD,MAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AACnB,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,+BAAA,EAAkC,MAAA,CAAO,QAAA,EAAU,CAAA,CAAE,CAAA;AAE9D,MAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AAEhB,MAAA,MAAM,GAAA,GAAO,IAAA,CAAK,IAAA,CAAK,QAAA,CAAiB,GAAA;AACxC,MAAA,IAAI,KAAK,YAAA,EAAc;AACtB,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,mBAAA,EAAsB,MAAA,CAAO,QAAA,EAAU,CAAA,qBAAA;AAAA,SACxC;AACA,QAAA,GAAA,CAAI,aAAa,GAAA,CAAI,MAAM,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AACpD,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,oDAAoD,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,WACrG;AAAA,QACD,CAAC,CAAA;AAAA,MACF;AAIA,MAAA,IAAA,CAAK,aAAA,EAAc,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAC5C,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,kCAAkC,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,SACnF;AAAA,MACD,CAAC,CAAA;AAAA,IACF,CAAC,CAAA;AAED,IAAA,MAAM,IAAA,CAAK,KAAK,KAAA,EAAM;AAGtB,IAAA,MAAM,KAAK,gBAAA,EAAiB;AAG5B,IAAA,IAAA,CAAK,aAAA,EAAc;AAEnB,IAAA,IAAI,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,YAAA,EAAc;AACtC,MAAA,MAAM,IAAA,CAAK,aAAa,UAAU,CAAA;AAAA,IACnC;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,kCAAA,EAAqC,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,UAAU,CAAA;AAAA,KACjE;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,aAAA,EAAc,CAAE,OAAA,CAAQ,CAAC,IAAA,KAAS;AAC3C,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,0BAAA,EAA6B,IAAA,CAAK,QAAA,EAAU,CAAA,CAAE,CAAA;AAAA,IACxD,CAAC,CAAA;AAGD,IAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACzB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,uCAAA,EAA0C,UAAU,MAAM,CAAA,mBAAA;AAAA,OAC3D;AAEA,MAAA,MAAM,UAAA,GAAa,CAAA;AACnB,MAAA,KAAA,MAAW,QAAQ,SAAA,EAAW;AAC7B,QAAA,IAAI,OAAA,GAAU,KAAA;AACd,QAAA,IAAI,OAAA,GAAU,CAAA;AAEd,QAAA,OAAO,OAAA,IAAW,UAAA,IAAc,CAAC,OAAA,EAAS;AACzC,UAAA,IAAI;AACH,YAAA,MAAM,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACpC,YAAA,GAAA,CAAI,IAAA,CAAK,CAAA,uCAAA,EAAqC,IAAI,CAAA,CAAE,CAAA;AACpD,YAAA,OAAA,GAAU,IAAA;AAAA,UACX,SAAS,EAAA,EAAI;AACZ,YAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,MAAO,CAAA,KAAM,OAAA,GAAU,IAAI,GAAI,CAAA;AACtD,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,sCAAA,EAA+B,OAAO,CAAA,CAAA,EAAI,UAAU,OAAO,IAAI,CAAA,qBAAA,EAAwB,QAAQ,GAAI,CAAA,IAAA;AAAA,aACpG;AACA,YAAA,IAAI,UAAU,UAAA,EAAY;AACzB,cAAA,MAAM,IAAI,OAAA,CAAQ,CAACA,aAAY,UAAA,CAAWA,QAAAA,EAAS,KAAK,CAAC,CAAA;AAAA,YAC1D,CAAA,MAAO;AACN,cAAA,GAAA,CAAI,KAAA;AAAA,gBACH,CAAA,kDAAA,EAAgD,IAAI,CAAA,OAAA,EAAU,UAAU,CAAA,wBAAA;AAAA,eACzE;AAAA,YACD;AACA,YAAA,OAAA,EAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA,EAEA,MAAM,IAAA,GAAsB;AAC3B,IAAA,IAAI,KAAK,IAAA,EAAM;AACd,MAAA,MAAM,KAAK,gBAAA,EAAiB;AAC5B,MAAA,MAAM,IAAA,CAAK,KAAK,IAAA,EAAK;AACrB,MAAA,GAAA,CAAI,KAAK,0BAA0B,CAAA;AAAA,IACpC;AAAA,EACD;AAAA,EAEA,MAAc,gBAAA,GAAmB;AAChC,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,CAAC,KAAK,IAAA,EAAM;AAC/C,IAAA,IAAI;AACH,MAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,cAAc,CAAA;AAC5D,MAAA,MAAM,IAAA,GAAO,MAAS,EAAA,CAAA,QAAA,CAAS,YAAA,EAAc,OAAO,CAAA;AACpD,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,MAAA,MAAM,EAAE,gBAAA,EAAiB,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAE3D,MAAA,IAAI,WAAA,GAAc,CAAA;AAClB,MAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACzB,QAAA,IAAI,CAAC,IAAA,CAAK,EAAA,IAAM,CAAC,KAAK,SAAA,EAAW;AACjC,QAAA,IAAI;AACH,UAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,IAAA,CAAK,EAAE,CAAA;AACvC,UAAA,MAAM,KAAA,GAAQ,KAAK,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAc,SAAA,CAAU,CAAC,CAAC,CAAA;AAE5D,UAAA,MAAM,IAAA,CAAK,KAAK,SAAA,CAAU,IAAA,CAAK,QAAe,EAAE,UAAA,EAAY,OAAO,CAAA;AAInE,UAAA,MAAM,GAAA,GAAO,IAAA,CAAK,IAAA,CAAK,QAAA,CAAiB,GAAA;AACxC,UAAA,IAAI,KAAK,YAAA,EAAc;AACtB,YAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA,CAAE,MAAM,MAAM;AAAA,YAAC,CAAC,CAAA;AAAA,UAC5C;AACA,UAAA,WAAA,EAAA;AAAA,QACD,SAAS,EAAA,EAAI;AAAA,QAAC;AAAA,MACf;AACA,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,mBAAA,EAAsB,WAAW,CAAA,uBAAA,CAAyB,CAAA;AAAA,IACpE,SAAS,KAAA,EAAgB;AACxB,MAAA,MAAM,CAAA,GAAI,KAAA;AACV,MAAA,IAAI,CAAA,CAAE,SAAS,QAAA,EAAU;AACxB,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,sCAAA,EAAyC,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAAA,MAC/D;AAAA,IACD;AAAA,EACD;AAAA,EAEA,MAAc,gBAAA,GAAmB;AAChC,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,CAAC,KAAK,IAAA,EAAM;AAC/C,IAAA,IAAI;AACH,MAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,cAAc,CAAA;AAC5D,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,GAAA,EAAI;AAC/C,MAAA,MAAM,cAAc,EAAC;AACrB,MAAA,KAAA,MAAW,QAAQ,QAAA,EAAU;AAC5B,QAAA,IAAI,IAAA,CAAK,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG;AAC9B,UAAA,WAAA,CAAY,IAAA,CAAK;AAAA,YAChB,EAAA,EAAI,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS;AAAA;AAAA,YAErB,SAAA,EAAW,KAAK,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAW,CAAA,CAAE,SAAA,CAAU,QAAA,EAAU;AAAA,WAChE,CAAA;AAAA,QACF;AAAA,MACD;AACA,MAAA,MAAS,SAAW,IAAA,CAAA,OAAA,CAAQ,YAAY,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC9D,MAAA,MAAS,aAAU,YAAA,EAAc,IAAA,CAAK,UAAU,WAAA,EAAa,IAAA,EAAM,CAAC,CAAC,CAAA;AACrE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,kBAAA,EAAqB,WAAA,CAAY,MAAM,CAAA,qBAAA,CAAuB,CAAA;AAAA,IACxE,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,8CAAA,EAAiD,KAAK,CAAA,CAAE,CAAA;AAAA,IACnE;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC7B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,0BAAA,EAA4B;AACnD,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAE5B,IAAA,IAAA,CAAK,0BAAA,GAA6B,IAAA;AAGlC,IAAA,IAAA,CAAK,kBAAA,CAAmB,wBAAwB,CAAA,CAAE,KAAA,CAAM,CAAC,GAAA,KAAQ;AAChE,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,kDAAA,EAAqD,GAAG,CAAA,CAAE,CAAA;AAAA,IACpE,CAAC,CAAA;AAGD,IAAA,IAAA,CAAK,IAAA,CAAK,MAAA;AAAA,MACT,sBAAA;AAAA;AAAA,MAEA,OAAO,WAAgB,aAAA,KAAwB;AAE9C,QAAA,MAAM,MAAA,GAAS,WAAW,MAAA,IAAU,SAAA;AACpC,QAAA,MAAM,IAAA,GAAO,WAAW,UAAA,IAAc,aAAA;AACtC,QAAA,MAAM,UAAA,GAAa,IAAA,EAAM,UAAA,EAAY,QAAA,EAAS,IAAK,SAAA;AAEnD,QAAA,GAAA,CAAI,IAAA,CAAK,CAAA,2CAAA,EAA8C,UAAU,CAAA,CAAA,CAAG,CAAA;AAEpE,QAAA,IAAI;AACH,UAAA,MAAM,QAAA,GAAW,KAAK,gBAAA,IAAmB;AACzC,UAAA,IAAI,CAAC,QAAA,IAAY,CAAC,MAAA,EAAQ;AACzB,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,6DAAA;AAAA,aACD;AACA,YAAA,IAAI;AACH,cAAA,IAAI,OAAO,MAAA,EAAQ,KAAA,KAAU,UAAA,EAAY,MAAM,OAAO,KAAA,EAAM;AAAA,YAC7D,SAAS,EAAA,EAAI;AAAA,YAAC;AACd,YAAA;AAAA,UACD;AAEA,UAAA,MAAM,WAAA,GAAc,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA;AAC3C,UAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,WAAW,CAAA;AAGpD,UAAA,MAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAChC,UAAA,SAAA,CAAU,aAAA,CAAc,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AACzC,UAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO,CAAC,WAAW,MAAA,CAAO,IAAA,CAAK,OAAO,CAAC,CAAC,CAAA;AAElE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,iCAAiC,UAAA,CAAW,MAAM,CAAA,WAAA,EAAc,UAAU,YAAY,QAAA,CAAS,KAAA,CAAM,GAAA,CAAI,CAAC,MAAM,CAAA,CAAE,IAAI,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,WACnI;AAEA,UAAA,IAAI;AAEH,YAAA,IAAI,OAAO,MAAA,CAAO,IAAA,KAAS,UAAA,EAAY;AACtC,cAAA,MAAM,QAAA,GAAW,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AACvC,cAAA,IAAI,CAAC,QAAA,IAAY,OAAO,MAAA,CAAO,YAAY,UAAA,EAAY;AACtD,gBAAA,IAAI;AACH,kBAAA,MAAM,MAAA,CAAO,QAAQ,EAAE,MAAA,EAAQ,YAAY,OAAA,CAAQ,GAAI,GAAG,CAAA;AAAA,gBAC3D,SAAS,QAAA,EAAU;AAClB,kBAAA,GAAA,CAAI,IAAA;AAAA,oBACH,CAAA,oCAAA,EAAuC,UAAU,CAAA,EAAA,EAAK,QAAA,YAAoB,QAAQ,QAAA,CAAS,OAAA,GAAU,MAAA,CAAO,QAAQ,CAAC,CAAA;AAAA,mBACtH;AAAA,gBACD;AAAA,cACD;AAAA,YACD,CAAA,MAAO;AAEN,cAAA,MAAM,IAAA,CAAK,CAAC,UAAU,CAAA,EAAG,MAAM,CAAA;AAAA,YAChC;AACA,YAAA,GAAA,CAAI,IAAA,CAAK,CAAA,0CAAA,EAA6C,UAAU,CAAA,CAAE,CAAA;AAAA,UACnE,SAAS,QAAA,EAAmB;AAC3B,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,4CAAA,EAA+C,UAAU,CAAA,EAAA,EAAK,QAAA,YAAoB,QAAQ,QAAA,CAAS,OAAA,GAAU,MAAA,CAAO,QAAQ,CAAC,CAAA;AAAA,aAC9H;AAAA,UACD,CAAA,SAAE;AACD,YAAA,IAAI;AACH,cAAA,IAAI,OAAO,MAAA,CAAO,KAAA,KAAU,UAAA,EAAY,MAAM,OAAO,KAAA,EAAM;AAAA,YAC5D,SAAS,EAAA,EAAI;AAAA,YAEb;AAAA,UACD;AACA,UAAA;AAAA,QACD,SAAS,GAAA,EAAc;AACtB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,sCAAA,EAAyC,UAAU,CAAA,EAAA,EAAK,GAAA,YAAe,QAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,WACzG;AAAA,QACD;AAAA,MACD;AAAA,KACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,6CAA6C,sBAAsB,CAAA;AAAA,KACpE;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,wBAAwB,QAAA,EAAoC;AAC3D,IAAA,IAAA,CAAK,gBAAA,GAAmB,QAAA;AACxB,IAAA,IAAI,KAAK,IAAA,EAAM;AACd,MAAA,IAAA,CAAK,aAAA,EAAc;AAAA,IACpB;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,SAAA,EAAiD;AACpE,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAI1D,IAAA,IAAI,SAAA,KAAc,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,UAAS,EAAG;AAC9C,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,+DAA+D,SAAS,CAAA;AAAA,OACzE;AACA,MAAA,OAAO,IAAA,CAAK,oBAAmB,IAAK,IAAA;AAAA,IACrC;AACA,IAAA,IAAI,IAAA,CAAK,sBAAA,CAAuB,SAAS,CAAA,EAAG;AAC3C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,YAAA,GAAe,CAAA;AACrB,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,YAAA,EAAc,OAAA,EAAA,EAAW;AACzD,MAAA,IAAI;AAIH,QAAA,IAAI,UAAA,GAAkB,IAAA;AACtB,QAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,cAAA,EAAe;AAC7C,QAAA,MAAM,aAAa,WAAA,CAAY,IAAA;AAAA,UAC9B,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,UAAS,KAAM;AAAA,SACpC;AAEA,QAAA,IAAI,UAAA,EAAY;AACf,UAAA,UAAA,GAAa,UAAA,CAAW,UAAA;AAAA,QACzB,CAAA,MAAO;AAEN,UAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,GAAA,EAAI;AAC/C,UAAA,MAAM,MAAA,GAAS,SAAS,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,EAAA,CAAG,QAAA,EAAS,KAAM,SAAS,CAAA;AACjE,UAAA,IAAI,MAAA,EAAQ;AACX,YAAA,UAAA,GAAa,MAAA,CAAO,EAAA;AAAA,UACrB,CAAA,MAAO;AAGN,YAAA,MAAM,EAAE,gBAAA,EAAiB,GAAI,MAAM,OAAO,iBAAiB,CAAA;AAC3D,YAAA,UAAA,GAAa,iBAAiB,SAAS,CAAA;AAAA,UACxC;AAAA,QACD;AAIA,QAAA,MAAM,kBAAA,GAAqB,UAAA;AAC3B,QAAA,IAAI,UAAA,GAAyB,kBAAA;AAC7B,QAAA,IAAI,IAAA,CAAK,MAAA,CAAO,aAAA,IAAiB,IAAA,CAAK,IAAA,EAAM;AAC3C,UAAA,MAAM,MAAA,GAAS,KAAK,MAAA,CAAO,aAAA;AAC3B,UAAA,MAAM,OAAO,MAAM,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,IAAI,UAAU,CAAA;AACrD,UAAA,IAAI,IAAA,IAAQ,IAAA,CAAK,SAAA,CAAU,MAAA,GAAS,CAAA,EAAG;AACtC,YAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,CACtB,GAAA,CAAI,CAAC,EAAA,KAAO;AACZ,cAAA,MAAM,QAAA,GAAW,EAAA,CAAG,SAAA,CAAU,QAAA,EAAS;AACvC,cAAA,MAAM,MAAA,GAAS,OAAO,QAAQ,CAAA;AAC9B,cAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,cAAA,OAAO;AAAA,gBACN,aAAa,EAAA,CAAG,WAAA;AAAA,gBAChB,SAAA,EAAW,UAAU,MAAM;AAAA,eAC5B;AAAA,YACD,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,CAAA,KAAkC,MAAM,IAAI,CAAA;AAGtD,YAAA,MAAM,YAAY,UAAA,CAAW,IAAA;AAAA,cAC5B,CAAC,CAAA,KACA,CAAA,CAAE,SAAA,CAAU,UAAS,CAAE,QAAA,CAAS,OAAO,CAAA,IACvC,CAAC,CAAA,CAAE,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,KAAK;AAAA,aACxC;AACA,YAAA,IAAI,SAAA,EAAW;AACd,cAAA,UAAA,GAAa,SAAA,CAAU,SAAA;AACvB,cAAA,GAAA,CAAI,IAAA;AAAA,gBACH,CAAA,mDAAA,EAAiD,UAAA,CAAW,QAAA,EAAU,CAAA;AAAA,eACvE;AAAA,YACD;AAIA,YAAA,MAAO,IAAA,CAAK,IAAA,CAAa,SAAA,CAAU,IAAA,CAAK,UAAA,EAAY;AAAA,cACnD,YAAY,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,SAAS;AAAA,aAC7C,CAAA;AAAA,UACF;AAAA,QACD;AAIA,QAAA,IAAI,MAAA;AACJ,QAAA,IAAI;AAEH,UAAA,MAAM,MAAA,GAAc,MAAM,IAAA,CAAK,IAAA,CAC7B,YAAA,CAAa,YAAY,sBAAsB,CAAA,CAC/C,KAAA,CAAM,CAAC,CAAA,KAAe;AAEtB,YAAA,IAAI,MAAA,CAAO,CAAC,CAAA,CAAE,QAAA,CAAS,aAAa,CAAA,EAAG;AACtC,cAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,YACjD;AACA,YAAA,MAAM,CAAA;AAAA,UACP,CAAC,CAAA;AACF,UAAA,MAAA,GAAS,OAAO,MAAA,IAAU,MAAA;AAAA,QAC3B,SAAS,OAAA,EAAS;AACjB,UAAA,IAAI,YAAY,YAAA,EAAc;AAC7B,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,2BAAA,EAA8B,SAAS,CAAA,OAAA,EAAU,YAAY,cAAc,OAAO,CAAA;AAAA,aACnF;AACA,YAAA,OAAO,IAAA;AAAA,UACR;AACA,UAAA,MAAM,KAAA,GAAQ,MAAM,CAAA,IAAK,OAAA;AACzB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,2BAAA,EAA8B,SAAS,CAAA,UAAA,EAAa,OAAO,kBAAkB,KAAK,CAAA,KAAA;AAAA,WACnF;AACA,UAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,KAAK,CAAC,CAAA;AAC7C,UAAA;AAAA,QACD;AAIA,QAAA,MAAM,MAAA,GACL,OAAO,MAAA,KACN,OAAO,OAAO,MAAA,CAAO,aAAa,CAAA,KAAM,UAAA,GAAa,MAAA,GAAS,IAAA,CAAA;AAEhE,QAAA,IAAI,CAAC,MAAA,EAAQ;AACZ,UAAA,MAAM,IAAI,MAAM,2CAA2C,CAAA;AAAA,QAC5D;AAEA,QAAA,MAAM,SAAuB,EAAC;AAC9B,QAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,QAAA,IAAI,qBAAA,GAAwB,CAAA,CAAA;AAG5B,QAAA,IAAI,iBAAA;AACJ,QAAA,MAAM,cAAA,GAAiB,IAAI,OAAA,CAAe,CAAC,GAAG,MAAA,KAAW;AACxD,UAAA,iBAAA,GAAoB,UAAA;AAAA,YACnB,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AAAA,YACtD;AAAA,WACD;AAAA,QACD,CAAC,CAAA;AAED,QAAA,IAAI;AACH,UAAA,MAAM,QAAQ,IAAA,CAAK;AAAA,YAAA,CACjB,YAAY;AACZ,cAAA,WAAA,MAAiB,SAAS,MAAA,EAAQ;AACjC,gBAAA,IAAI,CAAC,KAAA,EAAO;AAIZ,gBAAA,MAAMC,IAAAA;AAAA;AAAA,kBAEL,OAAQ,KAAA,CAAc,QAAA,KAAa,UAAA,GAC/B,KAAA,CAAyC,QAAA,EAAS,GACnD,KAAA,YAAiB,UAAA,GAChB,KAAA,GACA,IAAI,UAAA,CAAW,CAAC;AAAA,iBAAA;AACrB,gBAAA,MAAM,QAAQ,MAAA,CAAO,IAAA;AAAA,kBACpBA,IAAAA,CAAI,MAAA;AAAA,kBACJA,IAAAA,CAAI,UAAA;AAAA,kBACJA,IAAAA,CAAI;AAAA,iBACL;AAEA,gBAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACrB,kBAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,kBAAA,aAAA,IAAiB,KAAA,CAAM,MAAA;AAGvB,kBAAA,IAAI,qBAAA,GAAwB,CAAA,IAAK,aAAA,IAAiB,CAAA,EAAG;AACpD,oBAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AACnC,oBAAA,qBAAA,GAAwB,MAAA,CAAO,aAAa,CAAC,CAAA;AAAA,kBAC9C;AAGA,kBAAA,IACC,qBAAA,IAAyB,CAAA,IACzB,aAAA,IAAiB,CAAA,GAAI,qBAAA,EACpB;AACD,oBAAA;AAAA,kBACD;AAAA,gBACD;AAAA,cACD;AAAA,YACD,CAAA,GAAG;AAAA,YACH;AAAA,WACA,CAAA;AAAA,QACF,SAAS,KAAA,EAAgB;AACxB,UAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,MAAM,KAAA;AAC/B,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,uCAAA,EAA0C,SAAS,CAAA,EAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,WAC/G;AAAA,QACD,CAAA,SAAE;AACD,UAAA,IAAI,iBAAA,eAAgC,iBAAiB,CAAA;AAAA,QACtD;AAEA,QAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAChC,QAAA,IAAI,GAAA,CAAI,SAAS,CAAA,EAAG;AACnB,UAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,QAC9D;AAGA,QAAA,MAAM,WAAA,GAAc,GAAA,CAAI,YAAA,CAAa,CAAC,CAAA;AACtC,QAAA,MAAM,OAAA,GAAU,IAAI,QAAA,CAAS,CAAA,EAAG,IAAI,WAAW,CAAA,CAAE,SAAS,OAAO,CAAA;AACjE,QAAA,MAAM,QAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAEjD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,mCAAA,EAAsC,SAAS,CAAA,EAAA,EAAK,QAAA,CAAS,MAAM,MAAM,CAAA,MAAA;AAAA,SAC1E;AACA,QAAA,IAAA,CAAK,yBAAyB,SAAS,CAAA;AAEvC,QAAA,OAAO,QAAA;AAAA,MACR,SAAS,GAAA,EAAc;AACtB,QAAA,IAAI,YAAY,YAAA,EAAc;AAC7B,UAAA,IAAA,CAAK,0BAA0B,SAAS,CAAA;AACxC,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,0CAAA,EAA6C,SAAS,CAAA,OAAA,EAAU,YAAY,CAAA,WAAA,EAAc,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,WAC3I;AACA,UAAA,OAAO,IAAA;AAAA,QACR;AACA,QAAA,MAAM,KAAA,GAAQ,MAAM,CAAA,IAAK,OAAA;AACzB,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,4BAAA,EAA+B,SAAS,CAAA,UAAA,EAAa,OAAO,CAAA,GAAA,EAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,iBAAiB,KAAK,CAAA,KAAA;AAAA,SACzI;AACA,QAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,MAC9C;AAAA,IACD;AACA,IAAA,OAAO,IAAA;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,yBAAA,GAA+C;AACpD,IAAA,OAAO,IAAA,CAAK,cAAc,wBAAwB,CAAA;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAA,GAAkC;AACvC,IAAA,MAAM,IAAA,CAAK,mBAAmB,wBAAwB,CAAA;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,mBAAA,GAA8B;AAC7B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,CAAA;AAEvB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,cAAc,IAAA,IAAQ,CAAA;AAAA,EACtD;AAAA,EAEA,SAAA,GAAoB;AACnB,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAA,EAAS;AAAA,EAClC;AAAA,EAEA,MAAM,KAAK,IAAA,EAAuC;AACjD,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,IAC3D;AAEA,IAAA,OAAO,OAAO,IAAA,CAAK,MAAM,KAAK,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,EACzD;AAAA,EAEA,aAAA,GAA0B;AACzB,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,OAAO,IAAA,CAAK,KAAK,aAAA,EAAc,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAA,EAAU,CAAA;AAAA,EACzD;AAAA,EAEA,MAAM,mBAAmB,IAAA,EAA6B;AACrD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAG1D,IAAA,IAAA,CAAK,qBAAA,CAAsB,IAAI,IAAI,CAAA;AAEnC,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,eAAA,CAAgB,IAAI,CAAA;AAC3C,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,mCAAA,EAAsC,IAAI,CAAA,OAAA,EAAU,GAAA,CAAI,UAAU,CAAA,CAAA;AAAA,OACnE;AAGA,MAAA,MAAM,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA;AAC1C,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,+CAAA,EAAkD,IAAI,CAAA,CAAE,CAAA;AAGjE,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAA,EAAS;AACzC,MAAA,WAAA,MAAiB,QAAQ,IAAA,CAAK,IAAA,CAAK,cAAA,CAAe,aAAA,CAAc,GAAG,CAAA,EAAG;AACrE,QAAA,IAAI,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS,KAAM,MAAA,EAAQ;AAClC,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,4DAA4D,IAAI,CAAA;AAAA,WACjE;AACA,UAAA;AAAA,QACD;AAAA,MACD;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAE,CAAA;AAAA,IAChE;AAAA,EACD;AAAA,EAEA,MAAM,cAAc,IAAA,EAAiC;AACpD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,MAAM,YAAsB,EAAC;AAC7B,IAAA,IAAI;AACH,MAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,eAAA,CAAgB,IAAI,CAAA;AAC3C,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,6BAAA,EAAgC,IAAI,CAAA,OAAA,EAAU,GAAA,CAAI,UAAU,CAAA,IAAA;AAAA,OAC7D;AAEA,MAAA,IAAI,QAAA,GAAW,KAAA;AAGf,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,cAAA,MAAoB,MAAA,IAAU,CAAA;AAC5D,MAAA,MAAM,aAAA,GAAgB,WAAA,GAAc,CAAA,GAAI,IAAA,GAAO,GAAA;AAC/C,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,iEAAA,EAAoE,aAAa,CAAA,wBAAA,EAA2B,WAAW,CAAA,CAAA;AAAA,OACxH;AAGA,MAAA,MAAM,QAAA,GAAW,KAAK,IAAA,CAAK,cAAA,CACzB,cAAc,GAAG,CAAA,CACjB,MAAA,CAAO,aAAa,CAAA,EAAE;AACxB,MAAA,IAAI,MAAA,GAAS,KAAA;AAEb,MAAA,OAAO,CAAC,MAAA,EAAQ;AACf,QAAA,MAAM,WAAA,GAAc,SAAS,IAAA,EAAK;AAClC,QAAA,MAAM,iBAAiB,IAAI,OAAA;AAAA,UAA2B,CAACD,QAAAA,KACtD,UAAA,CAAW,MAAMA,QAAAA,CAAQ,EAAE,OAAA,EAAS,IAAA,EAAM,CAAA,EAAG,aAAa;AAAA,SAC3D;AAEA,QAAA,IAAI;AACH,UAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,KAAK,CAAC,WAAA,EAAa,cAAc,CAAC,CAAA;AAE/D,UAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,aAAa,MAAA,EAAQ;AAChE,YAAA,GAAA,CAAI,IAAA;AAAA,cACH,CAAA,sEAAA;AAAA,aACD;AACA,YAAA,IAAI,OAAO,QAAA,CAAS,MAAA,KAAW,UAAA,EAAY;AAE1C,cAAA,QAAA,CAAS,MAAA,EAAO,CAAE,KAAA,CAAM,MAAM;AAAA,cAAC,CAAC,CAAA;AAAA,YACjC;AACA,YAAA,MAAA,GAAS,IAAA;AACT,YAAA;AAAA,UACD;AAGA,UAAA,MAAM,QAAA,GAAW,MAAA;AACjB,UAAA,IAAI,SAAS,IAAA,EAAM;AAClB,YAAA,MAAA,GAAS,IAAA;AACT,YAAA;AAAA,UACD;AAEA,UAAA,QAAA,GAAW,IAAA;AACX,UAAA,MAAM,OAAO,QAAA,CAAS,KAAA;AACtB,UAAA,MAAM,MAAA,GAAS,IAAA,CAAK,EAAA,CAAG,QAAA,EAAS;AAChC,UAAA,GAAA,CAAI,IAAA,CAAK,CAAA,4BAAA,EAA+B,MAAM,CAAA,CAAE,CAAA;AAChD,UAAA,IAAI,CAAC,SAAA,CAAU,QAAA,CAAS,MAAM,CAAA,EAAG;AAChC,YAAA,SAAA,CAAU,KAAK,MAAM,CAAA;AAAA,UACtB;AAAA,QACD,SAAS,CAAA,EAAY;AACpB,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,oCAAoC,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,WAC/E;AACA,UAAA,MAAA,GAAS,IAAA;AACT,UAAA;AAAA,QACD;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,QAAA,EAAU;AACd,QAAA,MAAM,QAAA,GAAW,KAAK,IAAA,CAAK,QAAA;AAG3B,QAAA,MAAM,OAAA,GAAU,QAAA,CAAS,GAAA,EAAK,YAAA,EAAc,IAAA,IAAQ,CAAA;AACpD,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,2BAAA,EAA8B,IAAI,CAAA,4CAAA,EAA+C,OAAO,CAAA,CAAA;AAAA,SACzF;AAAA,MACD;AAIA,MAAA,IAAI,IAAA,CAAK,qBAAA,CAAsB,GAAA,CAAI,IAAI,CAAA,EAAG;AACzC,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,MAAA,CAAO,QAAA,EAAS;AACzC,QAAA,IAAI,CAAC,SAAA,CAAU,QAAA,CAAS,MAAM,CAAA,EAAG;AAChC,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,kCAAA,EAAqC,MAAM,CAAA,iBAAA,EAAoB,IAAI,CAAA;AAAA,WACpE;AACA,UAAA,SAAA,CAAU,KAAK,MAAM,CAAA;AAAA,QACtB;AAAA,MACD;AAAA,IACD,SAAS,KAAA,EAAgB;AACxB,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,CAAA,wCAAA,EAA2C,IAAI,CAAA,EAAA,EAAK,KAAA,YAAiB,QAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,OAC3G;AAAA,IACD;AAEA,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,2BAAA,EAA8B,IAAI,CAAA,iBAAA,EAAoB,SAAA,CAAU,MAAM,CAAA,WAAA;AAAA,KACvE;AACA,IAAA,OAAO,SAAA;AAAA,EACR;AAAA,EAEA,MAAM,YAAY,SAAA,EAAsC;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAC1D,IAAA,IAAI;AAEH,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,cAAA,EAAe;AAC7C,MAAA,KAAA,MAAW,QAAQ,WAAA,EAAa;AAC/B,QAAA,IAAI,IAAA,CAAK,UAAA,CAAW,QAAA,EAAS,KAAM,SAAA,EAAW;AAC7C,UAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,CAAW,QAAA,EAAS;AAC5C,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,0BAAA,EAA6B,SAAS,CAAA,wBAAA,EAA2B,UAAU,CAAA;AAAA,WAC5E;AACA,UAAA,OAAO,CAAC,UAAU,CAAA;AAAA,QACnB;AAAA,MACD;AAGA,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,IAAA,CAAK,UAAU,GAAA,EAAI;AAC/C,MAAA,KAAA,MAAW,QAAQ,QAAA,EAAU;AAC5B,QAAA,IAAI,IAAA,CAAK,GAAG,QAAA,EAAS,KAAM,aAAa,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAElE,UAAA,MAAM,KAAA,GAAQ,KAAK,SAAA,CAAU,GAAA,CAAI,CAAC,CAAA,KAAW,CAAA,CAAE,SAAA,CAAU,QAAA,EAAU,CAAA;AACnE,UAAA,GAAA,CAAI,IAAA;AAAA,YACH,CAAA,0BAAA,EAA6B,SAAS,CAAA,gBAAA,EAAmB,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,WAClE;AACA,UAAA,OAAO,KAAA;AAAA,QACR;AAAA,MACD;AAEA,MAAA,GAAA,CAAI,IAAA;AAAA,QACH,oBAAoB,SAAS,CAAA,sCAAA;AAAA,OAC9B;AAAA,IACD,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,IAAA,CAAK,CAAA,mCAAA,EAAsC,SAAS,CAAA,EAAA,EAAK,KAAK,CAAA,CAAE,CAAA;AAAA,IACrE;AACA,IAAA,OAAO,EAAC;AAAA,EACT;AAAA,EAEO,SAAA,GAAqB;AAC3B,IAAA,OAAO,CAAC,CAAC,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,KAAK,MAAA,KAAW,SAAA;AAAA,EAC5C;AAAA,EAEO,QAAA,GAAqB;AAC3B,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,OAAO,EAAC;AACxB,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,cAAA,EAAe,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,QAAA,EAAU,CAAA;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKO,gBAAA,GAA4B;AAClC,IAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKO,WAAA,GAAsC;AAC5C,IAAA,OAAO,KAAK,MAAA,CAAO,QAAA;AAAA,EACpB;AACD","file":"chunk-XRDN232O.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\nimport { noise } from \"@chainsafe/libp2p-noise\";\nimport { yamux } from \"@chainsafe/libp2p-yamux\";\nimport { autoNAT } from \"@libp2p/autonat\";\nimport { bootstrap } from \"@libp2p/bootstrap\";\nimport {\n\tcircuitRelayServer,\n\tcircuitRelayTransport,\n} from \"@libp2p/circuit-relay-v2\";\nimport { dcutr } from \"@libp2p/dcutr\";\nimport { identify } from \"@libp2p/identify\";\nimport { kadDHT } from \"@libp2p/kad-dht\";\nimport { mdns } from \"@libp2p/mdns\";\nimport { ping } from \"@libp2p/ping\";\nimport { tcp } from \"@libp2p/tcp\";\nimport { webSockets } from \"@libp2p/websockets\";\nimport { multiaddr } from \"@multiformats/multiaddr\";\nimport { pipe } from \"it-pipe\";\nimport type { Libp2p } from \"libp2p\";\nimport { createLibp2p } from \"libp2p\";\nimport { CID } from \"multiformats/cid\";\nimport { sha256 } from \"multiformats/hashes/sha2\";\nimport { log } from \"../utils/logger.js\";\n// import { pEvent } from \"p-event\"; // Disabled to avoid ESM conflicts in tests\n\n/**\n * Manifest describing a node's capabilities in the LIOP Mesh.\n * Exchanged via the /liop/manifest/1.0.0 protocol stream.\n */\nexport interface LiopManifest {\n\tpeerId: string;\n\tgrpcPort: number;\n\ttools: Array<{\n\t\tname: string;\n\t\tdescription?: string;\n\t\tinputSchema?: Record<string, unknown>;\n\t}>;\n\tresources: Array<{\n\t\tname: string;\n\t\turi: string;\n\t\tdescription?: string;\n\t\tmimeType?: string;\n\t\ttext?: string;\n\t}>;\n\tserverInfo: { name: string; version: string };\n\ttaxonomy?: {\n\t\tdomain: string;\n\t\tclearanceTier: number;\n\t\texecutionTypes: string[];\n\t};\n\tauthRequired?: boolean;\n\t/** Canonical slug for deterministic token resolution. Agents resolve LIOP_TOKEN_<tokenSlug>. Must match /^[A-Z][A-Z0-9_]*$/. */\n\ttokenSlug?: string;\n\t/** ML-DSA-65 (FIPS 204) Post-Quantum Digital Signature for Manifest Attestation (Base64) */\n\tpqcSignature?: string;\n\t/** ML-DSA-65 (FIPS 204) Post-Quantum Public Key (Base64) */\n\tpqcPublicKey?: string;\n}\n\nexport interface MeshNodeConfig {\n\tlistenAddresses?: string[];\n\tbootstrapNodes?: string[];\n\tidentityPath?: string;\n\tenableWAN?: boolean;\n\tdhtStoragePath?: string;\n\t/** Optional function to translate multiaddrs (e.g. for Docker NAT traversal). Return null to drop an address. */\n\taddressMapper?: (addr: string) => string | null;\n\t/** Enable AutoNAT reachability detection (default: true) */\n\tenableAutoNAT?: boolean;\n\t/** Enable Circuit Relay v2 transport & server for NAT traversal (default: true) */\n\tenableRelay?: boolean;\n\t/** Enable DCUtR decentralized hole punching (default: true) */\n\tenableDcutr?: boolean;\n\t/** Enable mDNS peer discovery for local networks (default: false in WAN, true in LAN) */\n\tenableMdns?: boolean;\n\t/**\n\t * Pre-Shared Key for libp2p Private Network isolation (Tier 1 Enclave Hardening).\n\t * When provided, the node will reject ALL connections from peers that do not\n\t * possess the identical 95-byte PSK at the transport framing layer,\n\t * BEFORE the Noise XX handshake is attempted.\n\t * @see https://github.com/libp2p/specs/blob/master/pnet/Private-Networks-PSK-V1.md\n\t */\n\tswarmKey?: Uint8Array;\n}\n\nconst DEFAULT_BOOTSTRAP_NODES = [\n\t\"/dnsaddr/bootstrap.libp2p.io/p2p/QmNnooDuVkcruPhcoXdia1vAHm1qrCEYWvmqVkMBjeEbFR\",\n\t\"/dnsaddr/bootstrap.libp2p.io/p2p/QmQCU2EcMqAqQPR2i9bChDtGNJchTbq5TbXJJ16u19uLTa\",\n\t\"/dnsaddr/bootstrap.libp2p.io/p2p/QmbLHAnMoJPWSCR5Zhtx6BHJX9KiKNN6tpvbUcqanj75Nb\",\n\t\"/dnsaddr/bootstrap.libp2p.io/p2p/QmcZf59bWwK5XFi76CZX8cbJ4BhTzzA3gU1ZjWZcYW7dwt\",\n];\n\nconst LIOP_MANIFEST_PROTOCOL = \"/liop/manifest/1.0.0\";\nconst LIOP_MANIFEST_CAPABILITY = \"liop:manifest\";\n\n/**\n * P2P Mesh Node backed by libp2p + Kademlia DHT.\n *\n * Provides capability advertisement via CID-based content routing\n * and decentralized peer discovery.\n */\nexport class MeshNode {\n\tprivate node: Libp2p | null = null;\n\tprivate config: MeshNodeConfig;\n\tprivate manifestDialFailureState: Map<\n\t\tstring,\n\t\t{ failures: number; cooldownUntil: number; lastSkipLogAt: number }\n\t> = new Map();\n\tprivate static readonly MANIFEST_DIAL_BASE_COOLDOWN_MS = 10_000;\n\tprivate static readonly MANIFEST_DIAL_MAX_COOLDOWN_MS = 2 * 60_000;\n\tprivate static readonly MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS = 30_000;\n\n\t/**\n\t * Buffer of capability hashes that have been announced.\n\t * Used to re-announce capabilities when new peers connect\n\t * (critical for small / isolated clusters where the initial\n\t * provide() finds zero peers in the routing table).\n\t */\n\tprivate announcedCapabilities: Set<string> = new Set();\n\n\t/** Guards against concurrent re-announcement storms. */\n\tprivate reannouncing = false;\n\n\t/** Callback that returns the local node's manifest on request. */\n\tprivate manifestProvider: (() => LiopManifest) | null = null;\n\n\t/** Flag to ensure the manifest protocol is only registered once. */\n\tprivate manifestProtocolRegistered = false;\n\n\t/** Local Ed25519 Private Key for protocol signatures */\n\t// biome-ignore lint/suspicious/noExplicitAny: libp2p keys type\n\tprivate localPrivateKey: any | null = null;\n\n\tconstructor(config: MeshNodeConfig = {}) {\n\t\tthis.config = {\n\t\t\tlistenAddresses: config.listenAddresses || [\n\t\t\t\t\"/ip4/0.0.0.0/tcp/0/ws\",\n\t\t\t\t\"/ip4/0.0.0.0/tcp/0\",\n\t\t\t],\n\t\t\tbootstrapNodes: config.bootstrapNodes || [],\n\t\t\tidentityPath: config.identityPath,\n\t\t\tenableWAN: config.enableWAN ?? false,\n\t\t\tdhtStoragePath: config.dhtStoragePath,\n\t\t\taddressMapper: config.addressMapper,\n\t\t\tswarmKey: config.swarmKey,\n\t\t};\n\t}\n\n\tprivate shouldSkipManifestDial(peerIdStr: string): boolean {\n\t\tconst state = this.manifestDialFailureState.get(peerIdStr);\n\t\tif (!state) return false;\n\t\tconst now = Date.now();\n\t\tif (now >= state.cooldownUntil) return false;\n\t\tif (\n\t\t\tnow - state.lastSkipLogAt >\n\t\t\tMeshNode.MANIFEST_DIAL_SKIP_LOG_THROTTLE_MS\n\t\t) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Skipping manifest dial for ${peerIdStr} during cooldown (${Math.ceil((state.cooldownUntil - now) / 1000)}s remaining)`,\n\t\t\t);\n\t\t\tstate.lastSkipLogAt = now;\n\t\t}\n\t\treturn true;\n\t}\n\n\tprivate recordManifestDialFailure(peerIdStr: string): void {\n\t\tconst now = Date.now();\n\t\tconst prev = this.manifestDialFailureState.get(peerIdStr);\n\t\tconst failures = (prev?.failures || 0) + 1;\n\t\tconst backoff = Math.min(\n\t\t\tMeshNode.MANIFEST_DIAL_BASE_COOLDOWN_MS * 2 ** Math.max(0, failures - 1),\n\t\t\tMeshNode.MANIFEST_DIAL_MAX_COOLDOWN_MS,\n\t\t);\n\t\tthis.manifestDialFailureState.set(peerIdStr, {\n\t\t\tfailures,\n\t\t\tcooldownUntil: now + backoff,\n\t\t\tlastSkipLogAt: 0,\n\t\t});\n\t}\n\n\tprivate clearManifestDialFailure(peerIdStr: string): void {\n\t\tthis.manifestDialFailureState.delete(peerIdStr);\n\t}\n\n\t/**\n\t * Loads a persistent identity from disk or generates a new Ed25519 keypair.\n\t * Uses privateKeyToProtobuf/privateKeyFromProtobuf (libp2p v3.x official API).\n\t */\n\tprivate async loadOrCreateIdentity() {\n\t\ttry {\n\t\t\tconst { generateKeyPair, privateKeyFromProtobuf } = (await import(\n\t\t\t\t\"@libp2p/crypto/keys\"\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: <libp2p type workaround>\n\t\t\t)) as any;\n\t\t\tconst { fromString: u8FromString } = await import(\n\t\t\t\t\"uint8arrays/from-string\"\n\t\t\t);\n\n\t\t\tif (this.config.identityPath) {\n\t\t\t\tconst absolutePath = path.resolve(this.config.identityPath);\n\t\t\t\ttry {\n\t\t\t\t\tconst data = await fs.readFile(absolutePath, \"utf-8\");\n\t\t\t\t\tconst json = JSON.parse(data);\n\t\t\t\t\tconst protobufBytes = u8FromString(json.privKey, \"base64\");\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst privateKey = privateKeyFromProtobuf(protobufBytes);\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Loaded persistent identity from ${absolutePath}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn { privateKey, isNew: false };\n\t\t\t\t\t} catch (parseError: unknown) {\n\t\t\t\t\t\tlog.error(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Persistent identity at ${absolutePath} is invalid or corrupt. Generating new one. Error: ${\n\t\t\t\t\t\t\t\tparseError instanceof Error\n\t\t\t\t\t\t\t\t\t? parseError.message\n\t\t\t\t\t\t\t\t\t: String(parseError)\n\t\t\t\t\t\t\t}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\t// Fall through to generate new key\n\t\t\t\t\t}\n\t\t\t\t} catch (error: unknown) {\n\t\t\t\t\tconst e = error as Error & { code?: string };\n\t\t\t\t\tif (e.code !== \"ENOENT\") {\n\t\t\t\t\t\tlog.error(`[LIOP-Mesh] Error loading identity: ${e.message}`);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst privateKey = await generateKeyPair(\"Ed25519\");\n\t\t\treturn { privateKey, isNew: true };\n\t\t} catch (error) {\n\t\t\tlog.error(\n\t\t\t\t`[LIOP-Mesh] Critical error in identity management: ${error}. Falling back to ephemeral identity.`,\n\t\t\t);\n\n\t\t\t// EPOCH FALLBACK: In extreme cases (corrupt env), use a volatile in-memory identity\n\t\t\t// to allow the node to start and serve traffic.\n\t\t\ttry {\n\t\t\t\tconst { generateKeyPair } = (await import(\n\t\t\t\t\t\"@libp2p/crypto/keys\"\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: libp2p ESM dynamic import type workaround\n\t\t\t\t)) as any;\n\t\t\t\tconst ephemeralKey = await generateKeyPair(\"Ed25519\");\n\t\t\t\treturn { privateKey: ephemeralKey, isNew: true };\n\t\t\t} catch (fallbackError) {\n\t\t\t\tthrow new Error(`Identity system failure: ${fallbackError}`);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Persists the private key to disk using protobuf serialization (libp2p v3.x).\n\t */\n\t// biome-ignore lint/suspicious/noExplicitAny: Libp2p private key type is complex for Alpha\n\tprivate async saveIdentity(privateKey: any) {\n\t\tif (!this.config.identityPath || !this.node) return;\n\n\t\ttry {\n\t\t\tconst absolutePath = path.resolve(this.config.identityPath);\n\t\t\tconst { privateKeyToProtobuf } = (await import(\n\t\t\t\t\"@libp2p/crypto/keys\"\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: <libp2p type workaround>\n\t\t\t)) as any;\n\t\t\tconst { toString: u8ToString } = await import(\"uint8arrays/to-string\");\n\n\t\t\tconst protobufBytes = privateKeyToProtobuf(privateKey);\n\t\t\tconst privKeyEncoded = u8ToString(protobufBytes, \"base64\");\n\n\t\t\tconst json = {\n\t\t\t\tid: this.node.peerId.toString(),\n\t\t\t\tprivKey: privKeyEncoded,\n\t\t\t};\n\n\t\t\tawait fs.mkdir(path.dirname(absolutePath), { recursive: true });\n\t\t\tawait fs.writeFile(absolutePath, JSON.stringify(json, null, 2));\n\t\t\tlog.info(`[LIOP-Mesh] Identity persisted to ${absolutePath}`);\n\t\t} catch (error) {\n\t\t\tlog.error(`[LIOP-Mesh] FAILED to persist identity: ${error}`);\n\t\t}\n\t}\n\n\t/**\n\t * Creates a CID v1 (raw codec 0x55) from a SHA-256 hash of the capability string.\n\t * Required by @libp2p/kad-dht v16+ for provide/findProviders.\n\t */\n\tprivate async capabilityToCID(capability: string): Promise<CID> {\n\t\tconst hash = await sha256.digest(new TextEncoder().encode(capability));\n\t\treturn CID.create(1, 0x55, hash);\n\t}\n\n\t/**\n\t * Re-announces all buffered capabilities after a new peer connects.\n\t * Uses a small delay to allow the DHT protocol handshake to complete.\n\t */\n\tprivate async reannounceAll(): Promise<void> {\n\t\tif (\n\t\t\tthis.reannouncing ||\n\t\t\t!this.node ||\n\t\t\tthis.announcedCapabilities.size === 0\n\t\t)\n\t\t\treturn;\n\n\t\tthis.reannouncing = true;\n\t\ttry {\n\t\t\t// Wait for the DHT protocol handshake to settle\n\t\t\tawait new Promise((resolve) => setTimeout(resolve, 500));\n\n\t\t\tif (!this.node) return;\n\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Re-announcing ${this.announcedCapabilities.size} capabilities to updated routing table...`,\n\t\t\t);\n\n\t\t\tfor (const hash of this.announcedCapabilities) {\n\t\t\t\ttry {\n\t\t\t\t\tconst cid = await this.capabilityToCID(hash);\n\t\t\t\t\tawait this.node.contentRouting.provide(cid);\n\t\t\t\t\tlog.info(`[LIOP-Mesh] Re-announced: ${hash}`);\n\t\t\t\t} catch (_e) {\n\t\t\t\t\tlog.info(`[LIOP-Mesh] Re-announce failed for ${hash}: ${_e}`);\n\t\t\t\t}\n\t\t\t}\n\t\t} finally {\n\t\t\tthis.reannouncing = false;\n\t\t}\n\t}\n\n\tasync start(): Promise<void> {\n\t\tif (this.node) return;\n\t\tconst result = await this.loadOrCreateIdentity();\n\t\tif (!result) throw new Error(\"Could not initialize P2P Identity\");\n\n\t\tconst { privateKey, isNew } = result;\n\t\tthis.localPrivateKey = privateKey;\n\n\t\tlet bootNodes = this.config.bootstrapNodes || [];\n\t\tif (bootNodes.length === 0 && this.config.enableWAN) {\n\t\t\tbootNodes = DEFAULT_BOOTSTRAP_NODES;\n\t\t}\n\n\t\tconst enableAutoNAT = this.config.enableAutoNAT ?? true;\n\t\tconst enableRelay = this.config.enableRelay ?? true;\n\t\tconst enableDcutr = this.config.enableDcutr ?? true;\n\t\tconst enableMdns = this.config.enableMdns ?? !this.config.enableWAN;\n\n\t\t// biome-ignore lint/suspicious/noExplicitAny: discovery polymorphic list\n\t\tconst discoveryList: any[] = [];\n\t\tif (bootNodes.length > 0) {\n\t\t\tdiscoveryList.push(\n\t\t\t\tbootstrap({\n\t\t\t\t\tlist: bootNodes,\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t\tif (enableMdns) {\n\t\t\tdiscoveryList.push(mdns());\n\t\t}\n\n\t\tconst dhtProtocol = this.config.enableWAN\n\t\t\t? \"/ipfs/kad/1.0.0\"\n\t\t\t: \"/ipfs/lan/kad/1.0.0\";\n\n\t\t// biome-ignore lint/suspicious/noExplicitAny: transports list\n\t\tconst transports: any[] = [tcp(), webSockets()];\n\t\tif (enableRelay) {\n\t\t\ttransports.push(circuitRelayTransport());\n\t\t}\n\n\t\t// biome-ignore lint/suspicious/noExplicitAny: services map\n\t\tconst services: Record<string, any> = {\n\t\t\tidentify: identify(),\n\t\t\tping: ping(),\n\t\t\tdht: kadDHT({\n\t\t\t\tprotocol: dhtProtocol,\n\t\t\t\tclientMode: false,\n\t\t\t\t// Allow local/private IPs in the DHT routing table for development/testing\n\t\t\t\tallowQueryWithZeroPeers: true,\n\t\t\t\t// By default kadDHT drops local IP addresses. Override the mapper to keep them.\n\t\t\t\tpeerInfoMapper: (peer) => peer,\n\t\t\t}),\n\t\t};\n\n\t\tif (enableAutoNAT) {\n\t\t\tservices.autoNAT = autoNAT();\n\t\t}\n\t\tif (enableRelay) {\n\t\t\tservices.relay = circuitRelayServer();\n\t\t}\n\t\tif (enableDcutr) {\n\t\t\tservices.dcutr = dcutr();\n\t\t}\n\n\t\t// Tier 1 Enclave: Pre-Shared Key (pnet) Connection Protection\n\t\t// biome-ignore lint/suspicious/noExplicitAny: ConnectionProtector factory type\n\t\tlet connectionProtector: any;\n\t\tif (this.config.swarmKey) {\n\t\t\tconst { preSharedKey } = await import(\"@libp2p/pnet\");\n\t\t\tconnectionProtector = preSharedKey({\n\t\t\t\tpsk: this.config.swarmKey,\n\t\t\t});\n\t\t\tlog.info(\n\t\t\t\t\"[LIOP-Mesh] 🔒 Private Network (pnet) enabled — transport-layer PSK isolation active\",\n\t\t\t);\n\t\t}\n\n\t\tthis.node = await createLibp2p({\n\t\t\tprivateKey,\n\t\t\taddresses: {\n\t\t\t\tlisten: this.config.listenAddresses,\n\t\t\t},\n\t\t\ttransports,\n\t\t\tconnectionEncrypters: [noise()],\n\t\t\tstreamMuxers: [yamux()],\n\t\t\t...(connectionProtector ? { connectionProtector } : {}),\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: services polymorphic definition\n\t\t\tservices: services as any,\n\t\t\tpeerDiscovery:\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: discovery polymorphic list casting\n\t\t\t\tdiscoveryList.length > 0 ? (discoveryList as any) : undefined,\n\t\t});\n\n\t\t// Monitor Connectivity Events\n\t\tthis.node.addEventListener(\"peer:discovery\", (evt) => {\n\t\t\tconst peerId = evt.detail.id;\n\t\t\tlog.info(`[LIOP-Mesh] Discovered peer: ${peerId.toString()}`);\n\t\t\t// [Phase 104] Auto-dial discovered peers to bypass DHT propagation latency\n\t\t\tif (this.node) {\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: target polymorphic type\n\t\t\t\tlet dialTarget: any = peerId;\n\n\t\t\t\t// Apply port translation if necessary (Docker -> Windows Host)\n\t\t\t\tif (this.config.addressMapper && evt.detail.multiaddrs.length > 0) {\n\t\t\t\t\tconst translated = evt.detail.multiaddrs\n\t\t\t\t\t\t.map((ma) => {\n\t\t\t\t\t\t\t// biome-ignore lint/style/noNonNullAssertion: mapped conditionally\n\t\t\t\t\t\t\tconst mapped = this.config.addressMapper!(ma.toString());\n\t\t\t\t\t\t\treturn mapped ? multiaddr(mapped) : null;\n\t\t\t\t\t\t})\n\t\t\t\t\t\t.filter((t): t is NonNullable<typeof t> => t !== null);\n\n\t\t\t\t\tconst directTCP = translated.find(\n\t\t\t\t\t\t(ma) =>\n\t\t\t\t\t\t\tma.toString().includes(\"/tcp/\") && !ma.toString().includes(\"/ws\"),\n\t\t\t\t\t);\n\t\t\t\t\tif (directTCP) dialTarget = directTCP;\n\t\t\t\t}\n\n\t\t\t\tthis.node.dial(dialTarget).catch(() => {});\n\t\t\t}\n\t\t});\n\n\t\tthis.node.addEventListener(\"peer:connect\", (evt) => {\n\t\t\tconst peerId = evt.detail;\n\t\t\tlog.info(`[LIOP-Mesh] Connected to peer: ${peerId.toString()}`);\n\n\t\t\tif (!this.node) return;\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: access internal services\n\t\t\tconst dht = (this.node.services as any).dht;\n\t\t\tif (dht?.routingTable) {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] Adding ${peerId.toString()} to DHT Routing Table`,\n\t\t\t\t);\n\t\t\t\tdht.routingTable.add(peerId).catch((err: unknown) => {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Failed to add peer to routing table: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\t\t\t);\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Trigger reactive re-announcement of all capabilities\n\t\t\t// so that ADD_PROVIDER messages reach the new peer\n\t\t\tthis.reannounceAll().catch((err: unknown) => {\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] Re-announce error: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\t\t);\n\t\t\t});\n\t\t});\n\n\t\tawait this.node.start();\n\n\t\t// Load persisted DHT routing table to enable rapid cold-start reconnections\n\t\tawait this.loadRoutingTable();\n\n\t\t// [LIOP-ALPHA] Protocols and services setup\n\t\tthis.applyHandlers();\n\n\t\tif (isNew && this.config.identityPath) {\n\t\t\tawait this.saveIdentity(privateKey);\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[LIOP-Mesh] Node started with id: ${this.node.peerId.toString()}`,\n\t\t);\n\t\tthis.node.getMultiaddrs().forEach((addr) => {\n\t\t\tlog.info(`[LIOP-Mesh] Listening on: ${addr.toString()}`);\n\t\t});\n\n\t\t// Force explicit dialing of Bootstrap nodes with bounded backoff\n\t\tif (bootNodes.length > 0) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Forcing direct P2P dial to ${bootNodes.length} bootstrap nodes...`,\n\t\t\t);\n\n\t\t\tconst maxRetries = 5;\n\t\t\tfor (const addr of bootNodes) {\n\t\t\t\tlet success = false;\n\t\t\t\tlet attempt = 1;\n\n\t\t\t\twhile (attempt <= maxRetries && !success) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait this.node.dial(multiaddr(addr));\n\t\t\t\t\t\tlog.info(`[LIOP-Mesh] ✅ Successfully dialed ${addr}`);\n\t\t\t\t\t\tsuccess = true;\n\t\t\t\t\t} catch (_e) {\n\t\t\t\t\t\tconst delay = Math.min(1000 * 2 ** (attempt - 1), 3000);\n\t\t\t\t\t\tlog.warn(\n\t\t\t\t\t\t\t`[LIOP-Mesh] ⚠️ Dial attempt ${attempt}/${maxRetries} to ${addr} failed. Retrying in ${delay / 1000}s...`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tif (attempt < maxRetries) {\n\t\t\t\t\t\t\tawait new Promise((resolve) => setTimeout(resolve, delay));\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tlog.error(\n\t\t\t\t\t\t\t\t`[LIOP-Mesh] ❌ Could not connect to bootstrap ${addr} after ${maxRetries} attempts. Continuing...`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tattempt++;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\tasync stop(): Promise<void> {\n\t\tif (this.node) {\n\t\t\tawait this.saveRoutingTable();\n\t\t\tawait this.node.stop();\n\t\t\tlog.info(\"[LIOP-Mesh] Node stopped\");\n\t\t}\n\t}\n\n\tprivate async loadRoutingTable() {\n\t\tif (!this.config.dhtStoragePath || !this.node) return;\n\t\ttry {\n\t\t\tconst absolutePath = path.resolve(this.config.dhtStoragePath);\n\t\t\tconst data = await fs.readFile(absolutePath, \"utf-8\");\n\t\t\tconst peers = JSON.parse(data);\n\t\t\tconst { peerIdFromString } = await import(\"@libp2p/peer-id\");\n\n\t\t\tlet loadedCount = 0;\n\t\t\tfor (const peer of peers) {\n\t\t\t\tif (!peer.id || !peer.addresses) continue;\n\t\t\t\ttry {\n\t\t\t\t\tconst peerId = peerIdFromString(peer.id);\n\t\t\t\t\tconst addrs = peer.addresses.map((a: string) => multiaddr(a));\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: bypass libp2p version-drift type mismatch on PeerId\n\t\t\t\t\tawait this.node.peerStore.save(peerId as any, { multiaddrs: addrs });\n\n\t\t\t\t\t// Pre-seed DHT routing table\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Internal service access\n\t\t\t\t\tconst dht = (this.node.services as any).dht;\n\t\t\t\t\tif (dht?.routingTable) {\n\t\t\t\t\t\tdht.routingTable.add(peerId).catch(() => {});\n\t\t\t\t\t}\n\t\t\t\t\tloadedCount++;\n\t\t\t\t} catch (_e) {}\n\t\t\t}\n\t\t\tlog.info(`[LIOP-Mesh] Loaded ${loadedCount} peers from DHT storage`);\n\t\t} catch (error: unknown) {\n\t\t\tconst e = error as Error & { code?: string };\n\t\t\tif (e.code !== \"ENOENT\") {\n\t\t\t\tlog.error(`[LIOP-Mesh] Failed to load DHT table: ${e.message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate async saveRoutingTable() {\n\t\tif (!this.config.dhtStoragePath || !this.node) return;\n\t\ttry {\n\t\t\tconst absolutePath = path.resolve(this.config.dhtStoragePath);\n\t\t\tconst allPeers = await this.node.peerStore.all();\n\t\t\tconst peersToSave = [];\n\t\t\tfor (const peer of allPeers) {\n\t\t\t\tif (peer.addresses.length > 0) {\n\t\t\t\t\tpeersToSave.push({\n\t\t\t\t\t\tid: peer.id.toString(),\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: internal libp2p addr\n\t\t\t\t\t\taddresses: peer.addresses.map((a: any) => a.multiaddr.toString()),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t\tawait fs.mkdir(path.dirname(absolutePath), { recursive: true });\n\t\t\tawait fs.writeFile(absolutePath, JSON.stringify(peersToSave, null, 2));\n\t\t\tlog.info(`[LIOP-Mesh] Saved ${peersToSave.length} peers to DHT storage`);\n\t\t} catch (error) {\n\t\t\tlog.error(`[LIOP-Mesh] FAILED to save DHT routing table: ${error}`);\n\t\t}\n\t}\n\n\t/**\n\t * Internal logic to register protocol handlers against the libp2p node.\n\t * Can be called multiple times; handles idempotent registration.\n\t */\n\tprivate applyHandlers(): void {\n\t\tif (!this.node || this.manifestProtocolRegistered) return;\n\t\tif (!this.manifestProvider) return;\n\n\t\tthis.manifestProtocolRegistered = true;\n\n\t\t// Announce manifest capability to the Mesh DHT for discovery\n\t\tthis.announceCapability(LIOP_MANIFEST_CAPABILITY).catch((err) => {\n\t\t\tlog.info(`[LIOP-Mesh] Initial manifest announcement failed: ${err}`);\n\t\t});\n\n\t\t// libp2p v3.x: handler receives (stream, connection) as separate args\n\t\tthis.node.handle(\n\t\t\tLIOP_MANIFEST_PROTOCOL,\n\t\t\t// biome-ignore lint/suspicious/noExplicitAny: libp2p v3.x stream/connection types\n\t\t\tasync (streamArg: any, connectionArg?: any) => {\n\t\t\t\t// v3.x passes (stream, connection); v1.x passed ({ stream, connection })\n\t\t\t\tconst stream = streamArg?.stream ?? streamArg;\n\t\t\t\tconst conn = streamArg?.connection ?? connectionArg;\n\t\t\t\tconst remotePeer = conn?.remotePeer?.toString() || \"unknown\";\n\n\t\t\t\tlog.info(`[LIOP-Mesh] Incoming manifest request from ${remotePeer}.`);\n\n\t\t\t\ttry {\n\t\t\t\t\tconst manifest = this.manifestProvider?.();\n\t\t\t\t\tif (!manifest || !stream) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Skipping manifest request (no provider or stream)`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tif (typeof stream?.close === \"function\") await stream.close();\n\t\t\t\t\t\t} catch (_e) {}\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\n\t\t\t\t\tconst manifestStr = JSON.stringify(manifest);\n\t\t\t\t\tconst payload = new TextEncoder().encode(manifestStr);\n\n\t\t\t\t\t// Write length-prefixed payload (Big Endian 4 bytes)\n\t\t\t\t\tconst lengthBuf = Buffer.alloc(4);\n\t\t\t\t\tlengthBuf.writeUInt32BE(payload.length, 0);\n\t\t\t\t\tconst fullPacket = Buffer.concat([lengthBuf, Buffer.from(payload)]);\n\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Serving manifest (${fullPacket.length} bytes) to ${remotePeer} [Tools: ${manifest.tools.map((t) => t.name).join(\", \")}]`,\n\t\t\t\t\t);\n\n\t\t\t\t\ttry {\n\t\t\t\t\t\t// libp2p v3.x: stream.send() for writing\n\t\t\t\t\t\tif (typeof stream.send === \"function\") {\n\t\t\t\t\t\t\tconst accepted = stream.send(fullPacket);\n\t\t\t\t\t\t\tif (!accepted && typeof stream.onDrain === \"function\") {\n\t\t\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\t\t\tawait stream.onDrain({ signal: AbortSignal.timeout(5000) });\n\t\t\t\t\t\t\t\t} catch (drainErr) {\n\t\t\t\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t\t\t\t`[LIOP-Mesh] WARN: Drain timeout for ${remotePeer}: ${drainErr instanceof Error ? drainErr.message : String(drainErr)}`,\n\t\t\t\t\t\t\t\t\t);\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t// Fallback for environments where stream.send is not available\n\t\t\t\t\t\t\tawait pipe([fullPacket], stream);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tlog.info(`[LIOP-Mesh] Manifest sent successfully to ${remotePeer}`);\n\t\t\t\t\t} catch (writeErr: unknown) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Write error serving manifest to ${remotePeer}: ${writeErr instanceof Error ? writeErr.message : String(writeErr)}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t} finally {\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tif (typeof stream.close === \"function\") await stream.close();\n\t\t\t\t\t\t} catch (_e) {\n\t\t\t\t\t\t\t// Ignore close errors\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\treturn;\n\t\t\t\t} catch (err: unknown) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Error serving manifest to ${remotePeer}: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t},\n\t\t);\n\n\t\tlog.info(\n\t\t\t`[LIOP-Mesh] Manifest Protocol registered: ${LIOP_MANIFEST_PROTOCOL}`,\n\t\t);\n\t}\n\n\t/**\n\t * Registers a callback as the manifest provider.\n\t * Will be applied immediately if the node is already initialized.\n\t */\n\tregisterManifestHandler(provider: () => LiopManifest): void {\n\t\tthis.manifestProvider = provider;\n\t\tif (this.node) {\n\t\t\tthis.applyHandlers();\n\t\t}\n\t}\n\n\t/**\n\t * Queries a remote peer's manifest by opening a /liop/manifest/1.0.0 stream.\n\t * Returns null if the peer doesn't support the protocol or is unreachable.\n\t */\n\tasync queryManifest(peerIdStr: string): Promise<LiopManifest | null> {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\n\t\t// [ALPHA-OPTIMIZATION] Local Loopback Bypass\n\t\t// If we are querying our own manifest, return it directly from the provider.\n\t\tif (peerIdStr === this.node.peerId.toString()) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Loopback: Returning local manifest directly for ${peerIdStr}`,\n\t\t\t);\n\t\t\treturn this.manifestProvider?.() || null;\n\t\t}\n\t\tif (this.shouldSkipManifestDial(peerIdStr)) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst MAX_ATTEMPTS = 3;\n\t\tfor (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {\n\t\t\ttry {\n\t\t\t\ttype DialTarget = Parameters<Libp2p[\"dialProtocol\"]>[0];\n\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: targetPeer can be from connections or from string\n\t\t\t\tlet targetPeer: any = null;\n\t\t\t\tconst connections = this.node.getConnections();\n\t\t\t\tconst activeConn = connections.find(\n\t\t\t\t\t(c) => c.remotePeer.toString() === peerIdStr,\n\t\t\t\t);\n\n\t\t\t\tif (activeConn) {\n\t\t\t\t\ttargetPeer = activeConn.remotePeer;\n\t\t\t\t} else {\n\t\t\t\t\t// Fallback: search peerStore to find a valid PeerId object that libp2p understands natively\n\t\t\t\t\tconst allPeers = await this.node.peerStore.all();\n\t\t\t\t\tconst stored = allPeers.find((p) => p.id.toString() === peerIdStr);\n\t\t\t\t\tif (stored) {\n\t\t\t\t\t\ttargetPeer = stored.id;\n\t\t\t\t\t} else {\n\t\t\t\t\t\t// Final fallback parsing.\n\t\t\t\t\t\t// [LIOP-CAUTION] This is where the toMultihash error usually triggers if libp2p version drift exists.\n\t\t\t\t\t\tconst { peerIdFromString } = await import(\"@libp2p/peer-id\");\n\t\t\t\t\t\ttargetPeer = peerIdFromString(peerIdStr);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// [LIOP-PORT-TRANSLATION] If an address mapper is configured (e.g. in the Host Agent),\n\t\t\t\t// ensure the targetPeer's addresses are translated before libp2p attempts to dial.\n\t\t\t\tconst dialTargetFromPeer = targetPeer as DialTarget;\n\t\t\t\tlet dialTarget: DialTarget = dialTargetFromPeer;\n\t\t\t\tif (this.config.addressMapper && this.node) {\n\t\t\t\t\tconst mapper = this.config.addressMapper;\n\t\t\t\t\tconst peer = await this.node.peerStore.get(targetPeer);\n\t\t\t\t\tif (peer && peer.addresses.length > 0) {\n\t\t\t\t\t\tconst translated = peer.addresses\n\t\t\t\t\t\t\t.map((oa) => {\n\t\t\t\t\t\t\t\tconst original = oa.multiaddr.toString();\n\t\t\t\t\t\t\t\tconst mapped = mapper(original);\n\t\t\t\t\t\t\t\tif (!mapped) return null;\n\t\t\t\t\t\t\t\treturn {\n\t\t\t\t\t\t\t\t\tisCertified: oa.isCertified,\n\t\t\t\t\t\t\t\t\tmultiaddr: multiaddr(mapped),\n\t\t\t\t\t\t\t\t};\n\t\t\t\t\t\t\t})\n\t\t\t\t\t\t\t.filter((t): t is NonNullable<typeof t> => t !== null);\n\n\t\t\t\t\t\t// Strategy: Force direct dial to the first translated TCP address to bypass DHT routing delays\n\t\t\t\t\t\tconst directTCP = translated.find(\n\t\t\t\t\t\t\t(t) =>\n\t\t\t\t\t\t\t\tt.multiaddr.toString().includes(\"/tcp/\") &&\n\t\t\t\t\t\t\t\t!t.multiaddr.toString().includes(\"/ws\"),\n\t\t\t\t\t\t);\n\t\t\t\t\t\tif (directTCP) {\n\t\t\t\t\t\t\tdialTarget = directTCP.multiaddr as DialTarget;\n\t\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t\t`[LIOP-Mesh] ⚡ Direct dial to translated addr: ${dialTarget.toString()}`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\t// Update the peerStore so subsequent dials also use the right path\n\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: access internal peerStore\n\t\t\t\t\t\tawait (this.node as any).peerStore.save(targetPeer, {\n\t\t\t\t\t\t\tmultiaddrs: translated.map((t) => t.multiaddr),\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\t// Open a protocol stream using high-level dialProtocol for automated it-stream wrapping\n\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: stream type varies by transport\n\t\t\t\tlet stream: any;\n\t\t\t\ttry {\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: libp2p returns polymorphic dialProtocol result\n\t\t\t\t\tconst result: any = await this.node\n\t\t\t\t\t\t.dialProtocol(dialTarget, LIOP_MANIFEST_PROTOCOL)\n\t\t\t\t\t\t.catch((e: unknown) => {\n\t\t\t\t\t\t\t// Catch specific TypeError that breaks the loop\n\t\t\t\t\t\t\tif (String(e).includes(\"toMultihash\")) {\n\t\t\t\t\t\t\t\tthrow new Error(\"INCOMPATIBLE_PEER_ID_INTERFACE\");\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tthrow e;\n\t\t\t\t\t\t});\n\t\t\t\t\tstream = result.stream || result;\n\t\t\t\t} catch (dialErr) {\n\t\t\t\t\tif (attempt === MAX_ATTEMPTS) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] Dial error for ${peerIdStr} after ${MAX_ATTEMPTS} attempts: ${dialErr}`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\treturn null;\n\t\t\t\t\t}\n\t\t\t\t\tconst delay = 500 * 2 ** attempt;\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Dial error for ${peerIdStr} (Attempt ${attempt}). Retrying in ${delay}ms...`,\n\t\t\t\t\t);\n\t\t\t\t\tawait new Promise((r) => setTimeout(r, delay));\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\t// libp2p v3.x: stream IS the AsyncIterable<Uint8Array>\n\t\t\t\t// v1.x had stream.source; v3.x has the stream itself as iterable\n\t\t\t\tconst source: AsyncIterable<Uint8Array> =\n\t\t\t\t\tstream.source ??\n\t\t\t\t\t(typeof stream[Symbol.asyncIterator] === \"function\" ? stream : null);\n\n\t\t\t\tif (!source) {\n\t\t\t\t\tthrow new Error(\"Target stream has no AsyncIterable source\");\n\t\t\t\t}\n\n\t\t\t\tconst chunks: Uint8Array[] = [];\n\t\t\t\tlet totalReceived = 0;\n\t\t\t\tlet expectedPayloadLength = -1;\n\n\t\t\t\t// Read length-prefixed manifest: first 4 bytes = payload length (BE)\n\t\t\t\tlet manifestTimeoutId: NodeJS.Timeout | undefined;\n\t\t\t\tconst timeoutPromise = new Promise<never>((_, reject) => {\n\t\t\t\t\tmanifestTimeoutId = setTimeout(\n\t\t\t\t\t\t() => reject(new Error(\"Manifest read timeout (5.0s)\")),\n\t\t\t\t\t\t5000,\n\t\t\t\t\t);\n\t\t\t\t});\n\n\t\t\t\ttry {\n\t\t\t\t\tawait Promise.race([\n\t\t\t\t\t\t(async () => {\n\t\t\t\t\t\t\tfor await (const chunk of source) {\n\t\t\t\t\t\t\t\tif (!chunk) continue;\n\t\t\t\t\t\t\t\t// libp2p streams yield Uint8ArrayList (from uint8arraylist package)\n\t\t\t\t\t\t\t\t// which reports .length correctly but Buffer.from() produces zeros.\n\t\t\t\t\t\t\t\t// .subarray() returns a flat contiguous Uint8Array with actual data.\n\t\t\t\t\t\t\t\tconst raw =\n\t\t\t\t\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Uint8ArrayList type guard\n\t\t\t\t\t\t\t\t\ttypeof (chunk as any).subarray === \"function\"\n\t\t\t\t\t\t\t\t\t\t? (chunk as { subarray: () => Uint8Array }).subarray()\n\t\t\t\t\t\t\t\t\t\t: chunk instanceof Uint8Array\n\t\t\t\t\t\t\t\t\t\t\t? chunk\n\t\t\t\t\t\t\t\t\t\t\t: new Uint8Array(0);\n\t\t\t\t\t\t\t\tconst bytes = Buffer.from(\n\t\t\t\t\t\t\t\t\traw.buffer,\n\t\t\t\t\t\t\t\t\traw.byteOffset,\n\t\t\t\t\t\t\t\t\traw.byteLength,\n\t\t\t\t\t\t\t\t);\n\n\t\t\t\t\t\t\t\tif (bytes.length > 0) {\n\t\t\t\t\t\t\t\t\tchunks.push(bytes);\n\t\t\t\t\t\t\t\t\ttotalReceived += bytes.length;\n\n\t\t\t\t\t\t\t\t\t// Extract expected length from the first 4 bytes once available\n\t\t\t\t\t\t\t\t\tif (expectedPayloadLength < 0 && totalReceived >= 4) {\n\t\t\t\t\t\t\t\t\t\tconst header = Buffer.concat(chunks);\n\t\t\t\t\t\t\t\t\t\texpectedPayloadLength = header.readUInt32BE(0);\n\t\t\t\t\t\t\t\t\t}\n\n\t\t\t\t\t\t\t\t\t// Stop reading once we have the full payload (4 prefix + N payload)\n\t\t\t\t\t\t\t\t\tif (\n\t\t\t\t\t\t\t\t\t\texpectedPayloadLength >= 0 &&\n\t\t\t\t\t\t\t\t\t\ttotalReceived >= 4 + expectedPayloadLength\n\t\t\t\t\t\t\t\t\t) {\n\t\t\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t})(),\n\t\t\t\t\t\ttimeoutPromise,\n\t\t\t\t\t]);\n\t\t\t\t} catch (itErr: unknown) {\n\t\t\t\t\tif (chunks.length === 0) throw itErr;\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Partial manifest read from ${peerIdStr}: ${itErr instanceof Error ? itErr.message : String(itErr)}`,\n\t\t\t\t\t);\n\t\t\t\t} finally {\n\t\t\t\t\tif (manifestTimeoutId) clearTimeout(manifestTimeoutId);\n\t\t\t\t}\n\n\t\t\t\tconst raw = Buffer.concat(chunks);\n\t\t\t\tif (raw.length < 4) {\n\t\t\t\t\tthrow new Error(\"Received empty/invalid manifest (too short)\");\n\t\t\t\t}\n\n\t\t\t\t// Use the length prefix to extract exactly the expected JSON\n\t\t\t\tconst declaredLen = raw.readUInt32BE(0);\n\t\t\t\tconst jsonStr = raw.subarray(4, 4 + declaredLen).toString(\"utf-8\");\n\t\t\t\tconst manifest: LiopManifest = JSON.parse(jsonStr);\n\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] Received manifest from ${peerIdStr}: ${manifest.tools.length} tools`,\n\t\t\t\t);\n\t\t\t\tthis.clearManifestDialFailure(peerIdStr);\n\n\t\t\t\treturn manifest;\n\t\t\t} catch (err: unknown) {\n\t\t\t\tif (attempt === MAX_ATTEMPTS) {\n\t\t\t\t\tthis.recordManifestDialFailure(peerIdStr);\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Failed to query manifest from ${peerIdStr} after ${MAX_ATTEMPTS} attempts: ${err instanceof Error ? err.message : String(err)}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn null;\n\t\t\t\t}\n\t\t\t\tconst delay = 500 * 2 ** attempt;\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] Query error for ${peerIdStr} (Attempt ${attempt}): ${err instanceof Error ? err.message : String(err)}. Retrying in ${delay}ms...`,\n\t\t\t\t);\n\t\t\t\tawait new Promise((r) => setTimeout(r, delay));\n\t\t\t}\n\t\t}\n\t\treturn null;\n\t}\n\n\t/**\n\t * Discovers all peers in the DHT that have announced \"liop:manifest\".\n\t * Returns their PeerIDs for subsequent manifest queries.\n\t */\n\tasync discoverManifestProviders(): Promise<string[]> {\n\t\treturn this.findProviders(LIOP_MANIFEST_CAPABILITY);\n\t}\n\n\t/**\n\t * Announces this node as a manifest provider in the DHT.\n\t * Should be called after tools/resources have been registered.\n\t */\n\tasync announceManifest(): Promise<void> {\n\t\tawait this.announceCapability(LIOP_MANIFEST_CAPABILITY);\n\t}\n\n\t/**\n\t * Returns the current size of the routing table for diagnostic purposes.\n\t */\n\tgetRoutingTableSize(): number {\n\t\tif (!this.node) return 0;\n\t\t// @ts-expect-error: Accessing internal routing table size for diagnostics\n\t\treturn this.node.services.dht?.routingTable?.size || 0;\n\t}\n\n\tgetPeerId(): string {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\t\treturn this.node.peerId.toString();\n\t}\n\n\tasync sign(data: Uint8Array): Promise<Uint8Array> {\n\t\tif (!this.localPrivateKey) {\n\t\t\tthrow new Error(\"Local identity not loaded or initialized\");\n\t\t}\n\t\t// libp2p private key implementations typically return a Promise<Uint8Array> or Uint8Array\n\t\treturn Buffer.from(await this.localPrivateKey.sign(data));\n\t}\n\n\tgetMultiaddrs(): string[] {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\t\treturn this.node.getMultiaddrs().map((a) => a.toString());\n\t}\n\n\tasync announceCapability(hash: string): Promise<void> {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\n\t\t// Buffer the capability for reactive re-announcement\n\t\tthis.announcedCapabilities.add(hash);\n\n\t\ttry {\n\t\t\tconst cid = await this.capabilityToCID(hash);\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Announcing capability: ${hash} (CID: ${cid.toString()})`,\n\t\t\t);\n\n\t\t\t// In libp2p v1.x, contentRouting.provide returns Promise<void>\n\t\t\tawait this.node.contentRouting.provide(cid);\n\t\t\tlog.info(`[LIOP-Mesh] Successfully announced capability: ${hash}`);\n\n\t\t\t// [DEV-ONLY] Self-verification\n\t\t\tconst selfId = this.node.peerId.toString();\n\t\t\tfor await (const peer of this.node.contentRouting.findProviders(cid)) {\n\t\t\t\tif (peer.id.toString() === selfId) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Self-verification success: Node is providing ${hash}`,\n\t\t\t\t\t);\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tlog.error(`[LIOP-Mesh] Failed to announce capability: ${error}`);\n\t\t}\n\t}\n\n\tasync findProviders(hash: string): Promise<string[]> {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\t\tconst providers: string[] = [];\n\t\ttry {\n\t\t\tconst cid = await this.capabilityToCID(hash);\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Querying DHT for ${hash} (CID: ${cid.toString()})...`,\n\t\t\t);\n\n\t\t\tlet foundAny = false;\n\n\t\t\t// Phase 103: Adaptive Tail-Wait Polling for DHT Discovery\n\t\t\tconst connections = this.node.getConnections?.()?.length || 0;\n\t\t\tconst idleTimeoutMs = connections > 1 ? 1500 : 3000;\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Starting DHT search with intelligent idle-timeout of ${idleTimeoutMs}ms (Active connections: ${connections})`,\n\t\t\t);\n\n\t\t\t// We manually iterate the AsyncIterable to abort it via Promise.race\n\t\t\tconst iterator = this.node.contentRouting\n\t\t\t\t.findProviders(cid)\n\t\t\t\t[Symbol.asyncIterator]();\n\t\t\tlet isDone = false;\n\n\t\t\twhile (!isDone) {\n\t\t\t\tconst nextPromise = iterator.next();\n\t\t\t\tconst timeoutPromise = new Promise<{ timeout: true }>((resolve) =>\n\t\t\t\t\tsetTimeout(() => resolve({ timeout: true }), idleTimeoutMs),\n\t\t\t\t);\n\n\t\t\t\ttry {\n\t\t\t\t\tconst result = await Promise.race([nextPromise, timeoutPromise]);\n\n\t\t\t\t\tif (result && typeof result === \"object\" && \"timeout\" in result) {\n\t\t\t\t\t\tlog.info(\n\t\t\t\t\t\t\t`[LIOP-Mesh] DHT discovery idle-timeout reached. Stopping search early.`,\n\t\t\t\t\t\t);\n\t\t\t\t\t\tif (typeof iterator.return === \"function\") {\n\t\t\t\t\t\t\t// Fire-and-forget: Kademlia iterators can block for 30s on return()\n\t\t\t\t\t\t\titerator.return().catch(() => {});\n\t\t\t\t\t\t}\n\t\t\t\t\t\tisDone = true;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: polymorphic Kademlia peer result\n\t\t\t\t\tconst itResult = result as IteratorResult<any>;\n\t\t\t\t\tif (itResult.done) {\n\t\t\t\t\t\tisDone = true;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\n\t\t\t\t\tfoundAny = true;\n\t\t\t\t\tconst peer = itResult.value;\n\t\t\t\t\tconst peerId = peer.id.toString();\n\t\t\t\t\tlog.info(`[LIOP-Mesh] Found provider: ${peerId}`);\n\t\t\t\t\tif (!providers.includes(peerId)) {\n\t\t\t\t\t\tproviders.push(peerId);\n\t\t\t\t\t}\n\t\t\t\t} catch (e: unknown) {\n\t\t\t\t\tlog.warn(\n\t\t\t\t\t\t`[LIOP-Mesh] DHT iteration error: ${e instanceof Error ? e.message : String(e)}`,\n\t\t\t\t\t);\n\t\t\t\t\tisDone = true;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!foundAny) {\n\t\t\t\tconst services = this.node.services as {\n\t\t\t\t\tdht?: { routingTable?: { size: number } };\n\t\t\t\t};\n\t\t\t\tconst dhtSize = services.dht?.routingTable?.size || 0;\n\t\t\t\tlog.info(\n\t\t\t\t\t`[LIOP-Mesh] DHT search for ${hash} returned zero results (routing table size: ${dhtSize})`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// [DEVELOPER-EXPERIENCE] Local Loopback Discovery\n\t\t\t// If we are providing this capability, ensure we find ourselves even if DHT findProviders doesn't return us.\n\t\t\tif (this.announcedCapabilities.has(hash)) {\n\t\t\t\tconst selfId = this.node.peerId.toString();\n\t\t\t\tif (!providers.includes(selfId)) {\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Including local node (${selfId}) in results for ${hash}`,\n\t\t\t\t\t);\n\t\t\t\t\tproviders.push(selfId);\n\t\t\t\t}\n\t\t\t}\n\t\t} catch (error: unknown) {\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Error finding providers for ${hash}: ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\n\t\tlog.info(\n\t\t\t`[LIOP-Mesh] DHT search for ${hash} finished. Found ${providers.length} providers.`,\n\t\t);\n\t\treturn providers;\n\t}\n\n\tasync resolvePeer(peerIdStr: string): Promise<string[]> {\n\t\tif (!this.node) throw new Error(\"Mesh Node is not running\");\n\t\ttry {\n\t\t\t// Strategy 1: Check active connections for the peer's multiaddrs\n\t\t\tconst connections = this.node.getConnections();\n\t\t\tfor (const conn of connections) {\n\t\t\t\tif (conn.remotePeer.toString() === peerIdStr) {\n\t\t\t\t\tconst remoteAddr = conn.remoteAddr.toString();\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Resolved peer ${peerIdStr} via active connection: ${remoteAddr}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn [remoteAddr];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Strategy 2: Try peerStore (iterate all peers to avoid toMultihash conflict)\n\t\t\tconst allPeers = await this.node.peerStore.all();\n\t\t\tfor (const peer of allPeers) {\n\t\t\t\tif (peer.id.toString() === peerIdStr && peer.addresses.length > 0) {\n\t\t\t\t\t// biome-ignore lint/suspicious/noExplicitAny: Internal libp2p addr type\n\t\t\t\t\tconst addrs = peer.addresses.map((a: any) => a.multiaddr.toString());\n\t\t\t\t\tlog.info(\n\t\t\t\t\t\t`[LIOP-Mesh] Resolved peer ${peerIdStr} via peerStore: ${addrs[0]}`,\n\t\t\t\t\t);\n\t\t\t\t\treturn addrs;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlog.info(\n\t\t\t\t`[LIOP-Mesh] Peer ${peerIdStr} not found in connections or peerStore`,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tlog.info(`[LIOP-Mesh] Failed to resolve peer ${peerIdStr}: ${error}`);\n\t\t}\n\t\treturn [];\n\t}\n\n\tpublic isStarted(): boolean {\n\t\treturn !!this.node && this.node.status === \"started\";\n\t}\n\n\tpublic getPeers(): string[] {\n\t\tif (!this.node) return [];\n\t\treturn this.node.getConnections().map((c) => c.remotePeer.toString());\n\t}\n\n\t/**\n\t * Returns true if this MeshNode was booted inside an isolated libp2p private network (pnet PSK).\n\t */\n\tpublic isPrivateNetwork(): boolean {\n\t\treturn Boolean(this.config.swarmKey);\n\t}\n\n\t/**\n\t * Returns the configured 95-byte Swarm Key, or undefined if running in a public/consortium mesh.\n\t */\n\tpublic getSwarmKey(): Uint8Array | undefined {\n\t\treturn this.config.swarmKey;\n\t}\n}\n"]}

package/dist/chunk-Y62GORQF.js

@@ -1,51 +0,0 @@
-// src/server/output-sanitizer.ts
-var DEFAULT_CONFIG = {
-  maxDecimalPlaces: 4,
-  clampNonNegative: true
-};
-function sanitizeOutput(output, config) {
-  const merged = { ...DEFAULT_CONFIG, ...config };
-  const seen = /* @__PURE__ */ new WeakSet();
-  function walk(node) {
-    if (node === null || node === void 0) {
-      return node;
-    }
-    if (typeof node === "number") {
-      if (!Number.isFinite(node)) {
-        return node;
-      }
-      let value = node;
-      if (merged.clampNonNegative && value < 0) {
-        value = 0;
-      }
-      const factor = 10 ** merged.maxDecimalPlaces;
-      value = Math.round(value * factor) / factor;
-      return value;
-    }
-    if (typeof node === "string" || typeof node === "boolean") {
-      return node;
-    }
-    if (typeof node === "object") {
-      if (seen.has(node)) {
-        return node;
-      }
-      seen.add(node);
-      if (Array.isArray(node)) {
-        return node.map((item) => walk(item));
-      }
-      const result = {};
-      for (const [key, val] of Object.entries(
-        node
-      )) {
-        result[key] = walk(val);
-      }
-      return result;
-    }
-    return node;
-  }
-  return walk(output);
-}
-
-export { sanitizeOutput };
-//# sourceMappingURL=chunk-Y62GORQF.js.map
-//# sourceMappingURL=chunk-Y62GORQF.js.map

package/dist/chunk-Y62GORQF.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server/output-sanitizer.ts"],"names":[],"mappings":";AAkBA,IAAM,cAAA,GAAkD;AAAA,EACvD,gBAAA,EAAkB,CAAA;AAAA,EAClB,gBAAA,EAAkB;AACnB,CAAA;AASO,SAAS,cAAA,CACf,QACA,MAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,cAAA,EAAgB,GAAG,MAAA,EAAO;AAC9C,EAAA,MAAM,IAAA,uBAAW,OAAA,EAAgB;AAEjC,EAAA,SAAS,KAAK,IAAA,EAAwB;AACrC,IAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACxC,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAC3B,QAAA,OAAO,IAAA;AAAA,MACR;AAEA,MAAA,IAAI,KAAA,GAAQ,IAAA;AAGZ,MAAA,IAAI,MAAA,CAAO,gBAAA,IAAoB,KAAA,GAAQ,CAAA,EAAG;AACzC,QAAA,KAAA,GAAQ,CAAA;AAAA,MACT;AAGA,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,gBAAA;AAC5B,MAAA,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,MAAM,CAAA,GAAI,MAAA;AAErC,MAAA,OAAO,KAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,SAAS,SAAA,EAAW;AAC1D,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAE7B,MAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAc,CAAA,EAAG;AAC7B,QAAA,OAAO,IAAA;AAAA,MACR;AACA,MAAA,IAAA,CAAK,IAAI,IAAc,CAAA;AAEvB,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACxB,QAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MACrC;AAEA,MAAA,MAAM,SAAkC,EAAC;AACzC,MAAA,KAAA,MAAW,CAAC,GAAA,EAAK,GAAG,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,QAC/B;AAAA,OACD,EAAG;AACF,QAAA,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA,CAAK,GAAG,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,MAAA;AAAA,IACR;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,OAAO,KAAK,MAAM,CAAA;AACnB","file":"chunk-Y62GORQF.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Egress Shield Output Sanitizer (NIST SP 800-226 and OWASP DLP 2025 compliant)\n * Recursively sanitizes execution outputs by rounding floating-point numbers\n * and clamping negative values to zero floor where appropriate.\n *\n * Implements absolute immutability, returning a fresh copy of the data.\n */\n\nexport interface OutputSanitizerConfig {\n\t/** Maximum decimal places for floating-point values (default: 4) */\n\tmaxDecimalPlaces?: number;\n\t/** Clamp negative values to zero floor (default: true) */\n\tclampNonNegative?: boolean;\n}\n\nconst DEFAULT_CONFIG: Required<OutputSanitizerConfig> = {\n\tmaxDecimalPlaces: 4,\n\tclampNonNegative: true,\n};\n\n/**\n * Recursively walks a JSON-like tree, rounding floats and clamping negative values.\n *\n * @param output - The raw or DP-modified output object/value to sanitize\n * @param config - Sanitization parameters (rounding depth, negative clamping)\n * @returns A sanitized deep copy of the output\n */\nexport function sanitizeOutput(\n\toutput: unknown,\n\tconfig?: OutputSanitizerConfig,\n): unknown {\n\tconst merged = { ...DEFAULT_CONFIG, ...config };\n\tconst seen = new WeakSet<object>();\n\n\tfunction walk(node: unknown): unknown {\n\t\tif (node === null || node === undefined) {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"number\") {\n\t\t\tif (!Number.isFinite(node)) {\n\t\t\t\treturn node;\n\t\t\t}\n\n\t\t\tlet value = node;\n\n\t\t\t// 1. Clamp negative values to 0 if configured\n\t\t\tif (merged.clampNonNegative && value < 0) {\n\t\t\t\tvalue = 0;\n\t\t\t}\n\n\t\t\t// 2. Round to maximum decimal places\n\t\t\tconst factor = 10 ** merged.maxDecimalPlaces;\n\t\t\tvalue = Math.round(value * factor) / factor;\n\n\t\t\treturn value;\n\t\t}\n\n\t\tif (typeof node === \"string\" || typeof node === \"boolean\") {\n\t\t\treturn node;\n\t\t}\n\n\t\tif (typeof node === \"object\") {\n\t\t\t// Circular reference protection\n\t\t\tif (seen.has(node as object)) {\n\t\t\t\treturn node;\n\t\t\t}\n\t\t\tseen.add(node as object);\n\n\t\t\tif (Array.isArray(node)) {\n\t\t\t\treturn node.map((item) => walk(item));\n\t\t\t}\n\n\t\t\tconst result: Record<string, unknown> = {};\n\t\t\tfor (const [key, val] of Object.entries(\n\t\t\t\tnode as Record<string, unknown>,\n\t\t\t)) {\n\t\t\t\tresult[key] = walk(val);\n\t\t\t}\n\t\t\treturn result;\n\t\t}\n\n\t\treturn node;\n\t}\n\n\treturn walk(output);\n}\n"]}

package/dist/chunk-ZP3VVXOI.js

@@ -1,66 +0,0 @@
-import { Buffer } from 'buffer';
-import { mkdir, writeFile, readFile } from 'fs/promises';
-import { dirname } from 'path';
-import { generateKey } from '@libp2p/pnet';
-
-// src/mesh/swarm-key.ts
-var SWARM_KEY_BYTE_LENGTH = 95;
-function createSwarmKey() {
-  const psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);
-  generateKey(psk);
-  return psk;
-}
-function serializeSwarmKey(psk) {
-  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
-    );
-  }
-  return Buffer.from(psk).toString("base64");
-}
-function deserializeSwarmKey(base64Str) {
-  const trimmed = base64Str.trim();
-  const buf = Buffer.from(trimmed, "base64");
-  if (buf.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`
-    );
-  }
-  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-}
-function parseSwarmKey(rawText) {
-  const trimmed = rawText.trim();
-  if (trimmed.startsWith("/key/swarm/psk/")) {
-    const normalized = trimmed.replace(/\r\n/g, "\n").trimEnd();
-    const bytes = new TextEncoder().encode(normalized);
-    if (bytes.length === SWARM_KEY_BYTE_LENGTH) {
-      return bytes;
-    }
-  }
-  return deserializeSwarmKey(trimmed);
-}
-async function saveSwarmKey(psk, filePath) {
-  if (psk.length !== SWARM_KEY_BYTE_LENGTH) {
-    throw new Error(
-      `Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`
-    );
-  }
-  await mkdir(dirname(filePath), { recursive: true });
-  await writeFile(filePath, psk);
-}
-async function loadSwarmKey(filePath) {
-  const fileBuffer = await readFile(filePath);
-  if (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {
-    return new Uint8Array(
-      fileBuffer.buffer,
-      fileBuffer.byteOffset,
-      fileBuffer.byteLength
-    );
-  }
-  const text = fileBuffer.toString("utf-8");
-  return parseSwarmKey(text);
-}
-
-export { SWARM_KEY_BYTE_LENGTH, createSwarmKey, deserializeSwarmKey, loadSwarmKey, parseSwarmKey, saveSwarmKey, serializeSwarmKey };
-//# sourceMappingURL=chunk-ZP3VVXOI.js.map
-//# sourceMappingURL=chunk-ZP3VVXOI.js.map

package/dist/chunk-ZP3VVXOI.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mesh/swarm-key.ts"],"names":[],"mappings":";;;;;;AAQO,IAAM,qBAAA,GAAwB;AAM9B,SAAS,cAAA,GAA6B;AAC5C,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,qBAAqB,CAAA;AAChD,EAAA,WAAA,CAAY,GAAG,CAAA;AACf,EAAA,OAAO,GAAA;AACR;AAKO,SAAS,kBAAkB,GAAA,EAAyB;AAC1D,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,mCAAA,EAAsC,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KACrF;AAAA,EACD;AACA,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC1C;AAKO,SAAS,oBAAoB,SAAA,EAA+B;AAClE,EAAA,MAAM,OAAA,GAAU,UAAU,IAAA,EAAK;AAC/B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AACzC,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,yCAAA,EAA4C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC3F;AAAA,EACD;AACA,EAAA,OAAO,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,GAAA,CAAI,UAAA,EAAY,IAAI,UAAU,CAAA;AACjE;AAMO,SAAS,cAAc,OAAA,EAA6B;AAC1D,EAAA,MAAM,OAAA,GAAU,QAAQ,IAAA,EAAK;AAE7B,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,iBAAiB,CAAA,EAAG;AAC1C,IAAA,MAAM,aAAa,OAAA,CAAQ,OAAA,CAAQ,OAAA,EAAS,IAAI,EAAE,OAAA,EAAQ;AAC1D,IAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA;AACjD,IAAA,IAAI,KAAA,CAAM,WAAW,qBAAA,EAAuB;AAC3C,MAAA,OAAO,KAAA;AAAA,IACR;AAAA,EACD;AAEA,EAAA,OAAO,oBAAoB,OAAO,CAAA;AACnC;AAKA,eAAsB,YAAA,CACrB,KACA,QAAA,EACgB;AAChB,EAAA,IAAI,GAAA,CAAI,WAAW,qBAAA,EAAuB;AACzC,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,wCAAA,EAA2C,qBAAqB,CAAA,YAAA,EAAe,GAAA,CAAI,MAAM,CAAA;AAAA,KAC1F;AAAA,EACD;AACA,EAAA,MAAM,MAAM,OAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,EAAA,MAAM,SAAA,CAAU,UAAU,GAAG,CAAA;AAC9B;AAMA,eAAsB,aAAa,QAAA,EAAuC;AACzE,EAAA,MAAM,UAAA,GAAa,MAAM,QAAA,CAAS,QAAQ,CAAA;AAC1C,EAAA,IAAI,UAAA,CAAW,WAAW,qBAAA,EAAuB;AAChD,IAAA,OAAO,IAAI,UAAA;AAAA,MACV,UAAA,CAAW,MAAA;AAAA,MACX,UAAA,CAAW,UAAA;AAAA,MACX,UAAA,CAAW;AAAA,KACZ;AAAA,EACD;AACA,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,OAAO,CAAA;AACxC,EAAA,OAAO,cAAc,IAAI,CAAA;AAC1B","file":"chunk-ZP3VVXOI.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Buffer } from \"node:buffer\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\nimport { generateKey } from \"@libp2p/pnet\";\n\nexport const SWARM_KEY_BYTE_LENGTH = 95;\n\n/**\n * Creates a freshly generated 95-byte Pre-Shared Key (PSK) for libp2p Private Networks (pnet).\n * Follows the canonical format `/key/swarm/psk/1.0.0/\\n/base16/\\n<hex>\\n`.\n */\nexport function createSwarmKey(): Uint8Array {\n\tconst psk = new Uint8Array(SWARM_KEY_BYTE_LENGTH);\n\tgenerateKey(psk);\n\treturn psk;\n}\n\n/**\n * Serializes a 95-byte PSK into a Base64 string for safe environment variable passing or JSON config.\n */\nexport function serializeSwarmKey(psk: Uint8Array): string {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid Swarm Key length: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\treturn Buffer.from(psk).toString(\"base64\");\n}\n\n/**\n * Deserializes a Base64-encoded string into a 95-byte PSK Uint8Array.\n */\nexport function deserializeSwarmKey(base64Str: string): Uint8Array {\n\tconst trimmed = base64Str.trim();\n\tconst buf = Buffer.from(trimmed, \"base64\");\n\tif (buf.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Invalid deserialized Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${buf.length}`,\n\t\t);\n\t}\n\treturn new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);\n}\n\n/**\n * Parses raw text format PSK or Base64 string into a 95-byte PSK Uint8Array.\n * Allows loading either the canonical multiline text (`/key/swarm/psk/1.0.0/...`) or Base64.\n */\nexport function parseSwarmKey(rawText: string): Uint8Array {\n\tconst trimmed = rawText.trim();\n\t// Check if this is canonical raw text format\n\tif (trimmed.startsWith(\"/key/swarm/psk/\")) {\n\t\tconst normalized = trimmed.replace(/\\r\\n/g, \"\\n\").trimEnd();\n\t\tconst bytes = new TextEncoder().encode(normalized);\n\t\tif (bytes.length === SWARM_KEY_BYTE_LENGTH) {\n\t\t\treturn bytes;\n\t\t}\n\t}\n\t// Fallback to Base64 deserialization\n\treturn deserializeSwarmKey(trimmed);\n}\n\n/**\n * Saves a 95-byte Swarm Key to a file on disk (written as canonical text).\n */\nexport async function saveSwarmKey(\n\tpsk: Uint8Array,\n\tfilePath: string,\n): Promise<void> {\n\tif (psk.length !== SWARM_KEY_BYTE_LENGTH) {\n\t\tthrow new Error(\n\t\t\t`Cannot save invalid Swarm Key: expected ${SWARM_KEY_BYTE_LENGTH} bytes, got ${psk.length}`,\n\t\t);\n\t}\n\tawait mkdir(dirname(filePath), { recursive: true });\n\tawait writeFile(filePath, psk);\n}\n\n/**\n * Loads a 95-byte Swarm Key from a file on disk.\n * Supports both raw binary/canonical format and Base64-encoded text.\n */\nexport async function loadSwarmKey(filePath: string): Promise<Uint8Array> {\n\tconst fileBuffer = await readFile(filePath);\n\tif (fileBuffer.length === SWARM_KEY_BYTE_LENGTH) {\n\t\treturn new Uint8Array(\n\t\t\tfileBuffer.buffer,\n\t\t\tfileBuffer.byteOffset,\n\t\t\tfileBuffer.byteLength,\n\t\t);\n\t}\n\tconst text = fileBuffer.toString(\"utf-8\");\n\treturn parseSwarmKey(text);\n}\n"]}

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"client.js"}

package/dist/gateway.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"gateway.js"}

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/errors.ts","../src/observability/tracing.ts","../src/prompts/adapters.ts","../src/security/cert-manager.ts"],"names":["ErrorCode","crypto2"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAGO,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AACN,EAAAA,WAAA,qBAAA,CAAA,GAAsB,qBAAA;AACtB,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,SAAA,CAAA,GAAU,SAAA;AACV,EAAAA,WAAA,eAAA,CAAA,GAAgB,eAAA;AAChB,EAAAA,WAAA,WAAA,CAAA,GAAY,WAAA;AACZ,EAAAA,WAAA,sBAAA,CAAA,GAAuB,sBAAA;AACvB,EAAAA,WAAA,iBAAA,CAAA,GAAkB,iBAAA;AAClB,EAAAA,WAAA,kBAAA,CAAA,GAAmB,kBAAA;AARR,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;AAWL,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACpB,IAAA;AAAA,EAEhB,WAAA,CAAY,MAAiB,OAAA,EAAiB;AAC7C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACb;AACD;ACQA,IAAM,iBAAA,GACL,6DAAA;AAEM,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA,EACvB,OAAc,eAAA,GAA0B;AACvC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC3C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,cAAA,GAAyB;AACtC,IAAA,IAAI,EAAA;AACJ,IAAA,GAAG;AACF,MAAA,EAAA,GAAY,MAAA,CAAA,WAAA,CAAY,CAAC,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAAA,IAC1C,CAAA,QAAS,EAAA,KAAO,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAC7B,IAAA,OAAO,EAAA;AAAA,EACR;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,MAAA,EACA,UAAU,IAAA,EACD;AACT,IAAA,MAAM,KAAA,GAAQ,UAAU,IAAA,GAAO,IAAA;AAC/B,IAAA,OAAO,CAAA,GAAA,EAAM,OAAO,CAAA,CAAA,EAAI,MAAM,IAAI,KAAK,CAAA,CAAA;AAAA,EACxC;AAAA,EAEA,OAAc,iBAAiB,MAAA,EAA4C;AAC1E,IAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,MAAA,OAAO,IAAA;AAAA,IACR;AACA,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,IAAA,CAAK,OAAO,CAAA;AAC5C,IAAA,IAAI,CAAC,KAAA,EAAO;AACX,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,GAAG,OAAA,EAAS,OAAA,EAAS,MAAA,EAAQ,KAAK,CAAA,GAAI,KAAA;AAE5C,IAAA,IAAI,YAAY,IAAA,EAAM;AACrB,MAAA,IAAI,OAAA,KAAY,IAAI,MAAA,CAAO,EAAE,KAAK,MAAA,KAAW,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA,EAAG;AAC5D,QAAA,OAAO,IAAA;AAAA,MACR;AAAA,IACD;AAEA,IAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,IAAI,CAAA,MAAU,CAAA;AACxD,IAAA,OAAO;AAAA,MACN,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA,EAEA,OAAc,iBAAA,CACb,OAAA,EACA,OAAA,EACO;AACP,IAAA,OAAA,CAAQ,cAAc,WAAA,CAAW,iBAAA;AAAA,MAChC,OAAA,CAAQ,OAAA;AAAA,MACR,OAAA,CAAQ,MAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACT;AAAA,EACD;AAAA,EAEA,OAAc,mBACb,OAAA,EACqB;AACrB,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,WAAA;AAC3C,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,WAAA,CAAW,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAC,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,WAAA,CAAW,iBAAiB,GAAG,CAAA;AAAA,EACvC;AAAA,EAEO,SAAA,CACN,IAAA,EACA,MAAA,EACA,UAAA,GAAwD,EAAC,EAC9C;AACX,IAAA,MAAM,OAAA,GAAU,MAAA,EAAQ,OAAA,IAAW,WAAA,CAAW,eAAA,EAAgB;AAC9D,IAAA,MAAM,MAAA,GAAS,YAAW,cAAA,EAAe;AACzC,IAAA,MAAM,OAAA,GAAU,MAAA,GAAS,MAAA,CAAO,OAAA,GAAU,IAAA;AAE1C,IAAA,MAAM,OAAA,GAAuB;AAAA,MAC5B,OAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,MAAM,IAAA,GAAiB;AAAA,MACtB,IAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,KAAK,GAAA,EAAI;AAAA,MACpB,UAAA,EAAY,EAAE,GAAG,UAAA,EAAW;AAAA,MAC5B,MAAA,EAAQ,IAAA;AAAA,MACR,YAAA,CAAa,KAAK,KAAA,EAAO;AACxB,QAAA,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,KAAA;AACvB,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,gBAAgB,GAAA,EAAK;AACpB,QAAA,IAAA,CAAK,MAAA,GAAS,OAAA;AACd,QAAA,IAAA,CAAK,KAAA,GAAQ,OAAO,GAAA,KAAQ,QAAA,GAAW,MAAM,GAAA,CAAI,OAAA;AACjD,QAAA,OAAO,IAAA;AAAA,MACR,CAAA;AAAA,MACA,GAAA,GAAM;AACL,QAAA,IAAA,CAAK,OAAA,GAAU,KAAK,GAAA,EAAI;AAAA,MACzB;AAAA,KACD;AAEA,IAAA,OAAO,IAAA;AAAA,EACR;AACD;AAEO,IAAM,aAAA,GAAgB,IAAI,UAAA;;;AChIjC,IAAM,gBAAA,GAAqD;AAAA,EAC1D,MAAA,EAAQ,EAAE,WAAA,EAAa,IAAA,EAAM,qBAAqB,KAAA,EAAM;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA,EAAK;AAAA,EACxD,MAAA,EAAQ,EAAE,WAAA,EAAa,KAAA,EAAO,qBAAqB,IAAA;AACpD,CAAA;AAMO,SAAS,2BAA2B,QAAA,EAA8B;AACxE,EAAA,MAAM,MAAA,GAAS,iBAAiB,QAAQ,CAAA;AAExC,EAAA,IAAI,YAAA,GAAe,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AA2BnB,EAAA,IAAI,OAAO,WAAA,EAAa;AACvB,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EAUjB,CAAA,MAAA,IAAW,OAAO,mBAAA,EAAqB;AACtC,IAAA,YAAA,IAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAAA,EASjB;AAEA,EAAA,OAAO,YAAA;AACR;ACrCO,IAAM,WAAA,GAAN,cAA0B,YAAA,CAAa;AAAA,EAS7C,YAA6B,OAAA,EAA6B;AACzD,IAAA,KAAA,EAAM;AADsB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAE5B,IAAA,IAAA,CAAK,WAAA,GAAc,QAAQ,WAAA,IAAe,EAAA;AAC1C,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,GAAA;AACxC,IAAA,IAAA,CAAK,gBAAA,EAAiB;AAEtB,IAAA,IAAI,OAAA,CAAQ,eAAe,KAAA,EAAO;AACjC,MAAA,IAAA,CAAK,aAAA,EAAc;AAAA,IACpB;AAAA,EACD;AAAA,EAT6B,OAAA;AAAA,EARrB,cAAA,GAAgC,IAAA;AAAA,EAChC,eAAA,GAAiC,IAAA;AAAA,EACjC,gBAAA,GAAkC,IAAA;AAAA,EAClC,WAA2B,EAAC;AAAA,EAC5B,mBAAA,GAA6C,IAAA;AAAA,EACpC,WAAA;AAAA,EACA,UAAA;AAAA;AAAA;AAAA;AAAA,EAgBV,gBAAA,GAAyB;AAC/B,IAAA,IAAI;AACH,MAAA,IACC,KAAK,OAAA,CAAQ,YAAA,IACV,cAAW,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA,EACtC;AACD,QAAA,IAAA,CAAK,cAAA,GAAoB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,YAAY,CAAA;AAAA,MAChE;AAEA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC/C,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,kCAAA,EAAqC,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AAAA,SAChE;AAAA,MACD;AACA,MAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA,EAAG;AAChD,QAAA,MAAM,IAAI,KAAA;AAAA,UACT,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAAA,SAC3D;AAAA,MACD;AAEA,MAAA,IAAA,CAAK,eAAA,GAAqB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,aAAa,CAAA;AACjE,MAAA,IAAA,CAAK,gBAAA,GAAsB,EAAA,CAAA,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,cAAc,CAAA;AAEnE,MAAA,GAAA,CAAI,KAAK,iDAAiD,CAAA;AAAA,IAC3D,SAAS,KAAA,EAAO;AACf,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,2CAAA,EAA8C,KAAK,CAAA,CAAE,CAAA;AAC/D,MAAA,MAAM,KAAA;AAAA,IACP;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKO,kBAAA,GAA+B;AACrC,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,iDAAiD,CAAA;AAAA,IAClE;AAEA,IAAA,MAAM,IAAA,GAAO,IAAWC,MAAA,CAAA,eAAA,CAAgB,IAAA,CAAK,eAAe,CAAA;AAC5D,IAAA,MAAM,WAAA,GAAc,IAAI,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA;AACzC,IAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,IAAA,MAAM,WAAA,GAAc,WAAA,CAAY,OAAA,EAAQ,GAAI,IAAI,OAAA,EAAQ;AACxD,IAAA,MAAM,gBAAgB,IAAA,CAAK,GAAA;AAAA,MAC1B,CAAA;AAAA,MACA,KAAK,KAAA,CAAM,WAAA,IAAe,GAAA,GAAO,EAAA,GAAK,KAAK,EAAA,CAAG;AAAA,KAC/C;AACA,IAAA,MAAM,YAAY,WAAA,IAAe,CAAA;AACjC,IAAA,MAAM,cAAA,GAAiB,iBAAiB,IAAA,CAAK,WAAA;AAE7C,IAAA,OAAO;AAAA,MACN,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,gBAAgB,IAAA,CAAK,cAAA;AAAA,MACrB,aAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAA,GAAsB;AAC7B,IAAA,MAAM,YAAA,GAAe;AAAA,MACpB,KAAK,OAAA,CAAQ,aAAA;AAAA,MACb,KAAK,OAAA,CAAQ,cAAA;AAAA,MACb,KAAK,OAAA,CAAQ;AAAA,KACd,CAAE,OAAO,CAAC,CAAA,KAAmB,QAAQ,CAAA,IAAQ,EAAA,CAAA,UAAA,CAAW,CAAC,CAAC,CAAC,CAAA;AAE3D,IAAA,KAAA,MAAW,YAAY,YAAA,EAAc;AACpC,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAa,EAAA,CAAA,KAAA,CAAM,QAAA,EAAU,MAAM;AACxC,UAAA,IAAA,CAAK,cAAA,EAAe;AAAA,QACrB,CAAC,CAAA;AACD,QAAA,IAAA,CAAK,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,MAC3B,SAAS,GAAA,EAAK;AACb,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,8BAAA,EAAiC,QAAQ,CAAA,oBAAA,EAAuB,GAAG,CAAA;AAAA,SACpE;AAAA,MACD;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA,EAKQ,cAAA,GAAuB;AAC9B,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AAAA,IACtC;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,WAAW,MAAM;AAC3C,MAAA,IAAI;AACH,QAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,QAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,QAAA,GAAA,CAAI,IAAA;AAAA,UACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,SACpF;AACA,QAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACf,QAAA,GAAA,CAAI,KAAA,CAAM,CAAA,iCAAA,EAAoC,KAAK,CAAA,CAAE,CAAA;AACrD,QAAA,IAAA,CAAK,IAAA,CAAK,SAAS,KAAK,CAAA;AAAA,MACzB;AAAA,IACD,CAAA,EAAG,KAAK,UAAU,CAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKO,MAAA,GAAmB;AACzB,IAAA,IAAA,CAAK,gBAAA,EAAiB;AACtB,IAAA,MAAM,QAAA,GAAW,KAAK,kBAAA,EAAmB;AACzC,IAAA,GAAA,CAAI,IAAA;AAAA,MACH,CAAA,0DAAA,EAA6D,SAAS,aAAa,CAAA,MAAA;AAAA,KACpF;AACA,IAAA,IAAA,CAAK,IAAA,CAAK,UAAU,QAAQ,CAAA;AAC5B,IAAA,OAAO,QAAA;AAAA,EACR;AAAA,EAEO,WAAA,GAA6B;AACnC,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA,EAEO,YAAA,GAAuB;AAC7B,IAAA,IAAI,CAAC,KAAK,eAAA,EAAiB;AAC1B,MAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,IAC9D;AACA,IAAA,OAAO,IAAA,CAAK,eAAA;AAAA,EACb;AAAA,EAEO,aAAA,GAAwB;AAC9B,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC3B,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACxD;AACA,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKO,OAAA,GAAgB;AACtB,IAAA,IAAI,KAAK,mBAAA,EAAqB;AAC7B,MAAA,YAAA,CAAa,KAAK,mBAAmB,CAAA;AACrC,MAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA;AAAA,IAC5B;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,KAAK,QAAA,EAAU;AACpC,MAAA,IAAI;AACH,QAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,MACf,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD;AACA,IAAA,IAAA,CAAK,WAAW,EAAC;AACjB,IAAA,IAAA,CAAK,kBAAA,EAAmB;AAAA,EACzB;AACD","file":"index.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nexport enum ErrorCode {\n\tCapabilityViolation = \"CapabilityViolation\",\n\tSandboxEscape = \"SandboxEscape\",\n\tPiiLeak = \"PiiLeak\",\n\tInvalidIntent = \"InvalidIntent\",\n\tThrottled = \"Throttled\",\n\tZkVerificationFailed = \"ZkVerificationFailed\",\n\tMeshUnavailable = \"MeshUnavailable\",\n\tConnectionFailed = \"ConnectionFailed\",\n}\n\nexport class LiopError extends Error {\n\tpublic readonly code: ErrorCode;\n\n\tconstructor(code: ErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"LiopError\";\n\t\tthis.code = code;\n\t}\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP OpenTelemetry Distributed Tracing (Phase Beta-3)\n * W3C TraceContext compliant distributed tracer for gRPC & MCP transports.\n * Spec: https://www.w3.org/TR/trace-context/\n */\n\nimport * as crypto from \"node:crypto\";\n\nexport interface SpanContext {\n\ttraceId: string;\n\tspanId: string;\n\tsampled: boolean;\n}\n\nexport interface LiopSpan {\n\treadonly name: string;\n\treadonly context: SpanContext;\n\treadonly startTime: number;\n\tendTime?: number;\n\tattributes: Record<string, string | number | boolean>;\n\tstatus: \"OK\" | \"ERROR\";\n\terror?: string;\n\tsetAttribute(key: string, value: string | number | boolean): LiopSpan;\n\trecordException(error: Error | string): LiopSpan;\n\tend(): void;\n}\n\nconst TRACEPARENT_REGEX =\n\t/^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;\n\nexport class LiopTracer {\n\tpublic static generateTraceId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(16).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(32));\n\t\treturn id;\n\t}\n\n\tpublic static generateSpanId(): string {\n\t\tlet id: string;\n\t\tdo {\n\t\t\tid = crypto.randomBytes(8).toString(\"hex\");\n\t\t} while (id === \"0\".repeat(16));\n\t\treturn id;\n\t}\n\n\tpublic static formatTraceparent(\n\t\ttraceId: string,\n\t\tspanId: string,\n\t\tsampled = true,\n\t): string {\n\t\tconst flags = sampled ? \"01\" : \"00\";\n\t\treturn `00-${traceId}-${spanId}-${flags}`;\n\t}\n\n\tpublic static parseTraceparent(header?: string | null): SpanContext | null {\n\t\tif (!header || typeof header !== \"string\") {\n\t\t\treturn null;\n\t\t}\n\t\tconst trimmed = header.trim();\n\t\tconst match = TRACEPARENT_REGEX.exec(trimmed);\n\t\tif (!match) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst [, version, traceId, spanId, flags] = match;\n\t\t// Version 00 cannot have all-zeros traceId or spanId\n\t\tif (version === \"00\") {\n\t\t\tif (traceId === \"0\".repeat(32) || spanId === \"0\".repeat(16)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t}\n\n\t\tconst sampled = (Number.parseInt(flags, 16) & 0x01) === 1;\n\t\treturn {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\t}\n\n\tpublic static injectTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t\tcontext: SpanContext,\n\t): void {\n\t\tcarrier.traceparent = LiopTracer.formatTraceparent(\n\t\t\tcontext.traceId,\n\t\t\tcontext.spanId,\n\t\t\tcontext.sampled,\n\t\t);\n\t}\n\n\tpublic static extractTraceparent(\n\t\tcarrier: Record<string, string | string[] | undefined>,\n\t): SpanContext | null {\n\t\tconst val = carrier.traceparent || carrier.Traceparent;\n\t\tif (Array.isArray(val)) {\n\t\t\treturn LiopTracer.parseTraceparent(val[0]);\n\t\t}\n\t\treturn LiopTracer.parseTraceparent(val);\n\t}\n\n\tpublic startSpan(\n\t\tname: string,\n\t\tparent?: SpanContext | null,\n\t\tattributes: Record<string, string | number | boolean> = {},\n\t): LiopSpan {\n\t\tconst traceId = parent?.traceId || LiopTracer.generateTraceId();\n\t\tconst spanId = LiopTracer.generateSpanId();\n\t\tconst sampled = parent ? parent.sampled : true;\n\n\t\tconst context: SpanContext = {\n\t\t\ttraceId,\n\t\t\tspanId,\n\t\t\tsampled,\n\t\t};\n\n\t\tconst span: LiopSpan = {\n\t\t\tname,\n\t\t\tcontext,\n\t\t\tstartTime: Date.now(),\n\t\t\tattributes: { ...attributes },\n\t\t\tstatus: \"OK\",\n\t\t\tsetAttribute(key, value) {\n\t\t\t\tthis.attributes[key] = value;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\trecordException(err) {\n\t\t\t\tthis.status = \"ERROR\";\n\t\t\t\tthis.error = typeof err === \"string\" ? err : err.message;\n\t\t\t\treturn this;\n\t\t\t},\n\t\t\tend() {\n\t\t\t\tthis.endTime = Date.now();\n\t\t\t},\n\t\t};\n\n\t\treturn span;\n\t}\n}\n\nexport const defaultTracer = new LiopTracer();\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Cross-AI Prompt Adapters (Fase 92)\n *\n * Normalizes system instructions for different LLM providers (Claude, OpenAI, Gemini)\n * to ensure they understand how to generate \"Logic-on-Origin\" WASM-compatible payload structures.\n */\n\nexport type AIProvider = \"claude\" | \"openai\" | \"gemini\";\n\nexport interface PromptConfig {\n\txmlStandard: boolean;\n\tjsonSchemaPreferred: boolean;\n}\n\nconst PROVIDER_CONFIGS: Record<AIProvider, PromptConfig> = {\n\tclaude: { xmlStandard: true, jsonSchemaPreferred: false },\n\topenai: { xmlStandard: false, jsonSchemaPreferred: true },\n\tgemini: { xmlStandard: false, jsonSchemaPreferred: true },\n};\n\n/**\n * Generates specific System Prompts optimized for the provided AI.\n * This instructs the LLM on how to bypass Context-Pulling and use Logic-Injection (Zero-Shot).\n */\nexport function generateSystemInstructions(provider: AIProvider): string {\n\tconst config = PROVIDER_CONFIGS[provider];\n\n\tlet instructions = `[LIOP-PROTO-V1: LOGIC-ON-ORIGIN SPECIFICATION]\nYou are interacting with a Logic-Injection-on-Origin Protocol (LIOP) Mesh Network.\nUnlike standard MCP where you pull context to evaluate it remotely, in LIOP you WRITE code that executes on the data's origin.\n\n### CORE PARADIGM\nWhen you call a tool or resource, you MUST provide a payload that represents secure sandboxed logic to be executed on the remote Node.\nThe node will execute your logic securely on the raw secure data, and return only the RESULT, avoiding PII data egress.\n\n### EXECUTION RULES\n1. Provide a self-contained JavaScript syntax block that we will compile to WASM-Sandboxed logic.\n2. Rely only on standard ECMA script features (No Node.js polyfills).\n3. The logic must end by returning the calculated insights, not the raw data.\n\n### DIFFERENTIAL PRIVACY (DP) MECHANISM (Laplace Mechanism)\nTo prevent database reconstruction and inference attacks, numeric query outputs are processed by a Laplace DP engine:\n- COUNT / LENGTH queries: To get EXACT integer values without noise, you MUST name return keys containing 'count', 'length', 'size', 'num', 'positive', 'negative', or starting with 'total_' or 'num_' (e.g. 'total_tx', 'credits_count'). This forces sensitivity=1.0, rounds values, and clamps to non-negative values.\n- AVERAGE queries: Return keys containing 'avg', 'mean', or 'average' scale down noise automatically by dividing global sensitivity by the dataset size (sensitivity / n).\n- SUM / OTHER queries: Return keys without these semantic names receive full Laplace noise based on the global node sensitivity (which can be up to 100,000 in Bank nodes to protect raw balances). Do NOT attempt to bypass this by renaming sum fields to count fields, as it violates protocol integrity.\n\n### SANDBOX RUNTIME RESTRICTIONS & WORKAROUNDS\n- Date is poisoned: The 'Date' class/constructor is undefined (calling 'new Date()', 'Date.now()', or 'Date.parse()' will crash the execution).\n  - Workaround: Perform chronological sorting and comparisons lexicographically on ISO 8601 string dates (e.g. record.date >= '2024-01-01').\n- Poisoned globals: eval, Function, setTimeout, setInterval, Buffer, ArrayBuffer, and TypedArrays are undefined.\n- Frozen prototypes: Modifications to Object.prototype, Array.prototype, etc., are blocked.\n- K-Anonymity constraints: Small datasets (< 10 records) limit outputs to max 3 scalar keys with NO nesting. Datasets with >= 10 records limit outputs to max 10 fields.\n`;\n\n\tif (config.xmlStandard) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (CLAUDE-XML PREFERRED)\nYou must wrap your logic precisely within <liop_logic> tags.\nExample:\n<liop_logic>\nconst records = await liop.readResource(\"liop://vault/patients\");\nconst filtered = records.filter(r => r.disease === \"Hypertension\");\nreturn { alert: \"High risk demographic\", targetCount: filtered.length };\n</liop_logic>\n`;\n\t} else if (config.jsonSchemaPreferred) {\n\t\tinstructions += `\n### PAYLOAD FORMATTING (JSON PARSING PREFERRED)\nYou must provide your logic strictly within a JSON string key called \\`\"logic_blob\"\\` inside your tool call parameters.\nExample:\n{\n  \"target\": \"liop://vault/patients\",\n  \"logic_blob\": \"const records = await liop.readResource(args.target); return { targetCount: records.filter(r => r.disease === 'Hypertension').length };\"\n}\n`;\n\t}\n\n\treturn instructions;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Certificate Manager (CertManager)\n * Provides automated certificate monitoring, X.509 validity inspection,\n * and hot-reloading for mutual TLS (mTLS) without node restarts.\n *\n * Compliance:\n * - NIST SP 800-52 Rev. 2: Guidelines for the Selection and Use of TLS\n * - Zero-Trust Architecture (NIST SP 800-207): Continuous cryptographic verification\n */\n\nimport * as crypto from \"node:crypto\";\nimport { EventEmitter } from \"node:events\";\nimport * as fs from \"node:fs\";\nimport { log } from \"../utils/logger.js\";\n\nexport interface CertManagerOptions {\n\t/** Path to the root CA certificate (PEM format) */\n\trootCertPath?: string;\n\t/** Path to the server/client certificate chain (PEM format) */\n\tcertChainPath: string;\n\t/** Path to the private key (PEM format) */\n\tprivateKeyPath: string;\n\t/** Expiration warning threshold in days (default: 30) */\n\twarningDays?: number;\n\t/** Enable file watching for automatic hot-reloading (default: true) */\n\twatchFiles?: boolean;\n\t/** Debounce delay in ms for hot reloading (default: 150) */\n\tdebounceMs?: number;\n}\n\nexport interface CertInfo {\n\tsubject: string;\n\tissuer: string;\n\tvalidFrom: string;\n\tvalidTo: string;\n\tfingerprint256: string;\n\tdaysRemaining: number;\n\tisExpired: boolean;\n\tisExpiringSoon: boolean;\n}\n\nexport class CertManager extends EventEmitter {\n\tprivate rootCertBuffer: Buffer | null = null;\n\tprivate certChainBuffer: Buffer | null = null;\n\tprivate privateKeyBuffer: Buffer | null = null;\n\tprivate watchers: fs.FSWatcher[] = [];\n\tprivate reloadDebounceTimer: NodeJS.Timeout | null = null;\n\tprivate readonly warningDays: number;\n\tprivate readonly debounceMs: number;\n\n\tconstructor(private readonly options: CertManagerOptions) {\n\t\tsuper();\n\t\tthis.warningDays = options.warningDays ?? 30;\n\t\tthis.debounceMs = options.debounceMs ?? 150;\n\t\tthis.loadCertificates();\n\n\t\tif (options.watchFiles !== false) {\n\t\t\tthis.setupWatchers();\n\t\t}\n\t}\n\n\t/**\n\t * Synchronously loads or reloads certificates from filesystem into memory.\n\t */\n\tpublic loadCertificates(): void {\n\t\ttry {\n\t\t\tif (\n\t\t\t\tthis.options.rootCertPath &&\n\t\t\t\tfs.existsSync(this.options.rootCertPath)\n\t\t\t) {\n\t\t\t\tthis.rootCertBuffer = fs.readFileSync(this.options.rootCertPath);\n\t\t\t}\n\n\t\t\tif (!fs.existsSync(this.options.certChainPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Certificate chain file not found: ${this.options.certChainPath}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (!fs.existsSync(this.options.privateKeyPath)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Private key file not found: ${this.options.privateKeyPath}`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tthis.certChainBuffer = fs.readFileSync(this.options.certChainPath);\n\t\t\tthis.privateKeyBuffer = fs.readFileSync(this.options.privateKeyPath);\n\n\t\t\tlog.info(\"[CertManager] Certificates loaded successfully.\");\n\t\t} catch (error) {\n\t\t\tlog.error(`[CertManager] Failed to load certificates: ${error}`);\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * Inspects the loaded server/client certificate chain using Node.js native X509Certificate.\n\t */\n\tpublic inspectCertificate(): CertInfo {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] No certificate loaded to inspect.\");\n\t\t}\n\n\t\tconst x509 = new crypto.X509Certificate(this.certChainBuffer);\n\t\tconst validToDate = new Date(x509.validTo);\n\t\tconst now = new Date();\n\t\tconst msRemaining = validToDate.getTime() - now.getTime();\n\t\tconst daysRemaining = Math.max(\n\t\t\t0,\n\t\t\tMath.floor(msRemaining / (1000 * 60 * 60 * 24)),\n\t\t);\n\t\tconst isExpired = msRemaining <= 0;\n\t\tconst isExpiringSoon = daysRemaining <= this.warningDays;\n\n\t\treturn {\n\t\t\tsubject: x509.subject,\n\t\t\tissuer: x509.issuer,\n\t\t\tvalidFrom: x509.validFrom,\n\t\t\tvalidTo: x509.validTo,\n\t\t\tfingerprint256: x509.fingerprint256,\n\t\t\tdaysRemaining,\n\t\t\tisExpired,\n\t\t\tisExpiringSoon,\n\t\t};\n\t}\n\n\t/**\n\t * Sets up non-blocking filesystem watchers to detect certificate renewals\n\t * and trigger hot-reloading without process restarts.\n\t */\n\tprivate setupWatchers(): void {\n\t\tconst filesToWatch = [\n\t\t\tthis.options.certChainPath,\n\t\t\tthis.options.privateKeyPath,\n\t\t\tthis.options.rootCertPath,\n\t\t].filter((p): p is string => Boolean(p && fs.existsSync(p)));\n\n\t\tfor (const filePath of filesToWatch) {\n\t\t\ttry {\n\t\t\t\tconst watcher = fs.watch(filePath, () => {\n\t\t\t\t\tthis.scheduleReload();\n\t\t\t\t});\n\t\t\t\tthis.watchers.push(watcher);\n\t\t\t} catch (err) {\n\t\t\t\tlog.warn(\n\t\t\t\t\t`[CertManager] Could not watch ${filePath} for hot reloading: ${err}`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Debounces reload events to ensure files have finished writing.\n\t */\n\tprivate scheduleReload(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t}\n\n\t\tthis.reloadDebounceTimer = setTimeout(() => {\n\t\t\ttry {\n\t\t\t\tthis.loadCertificates();\n\t\t\t\tconst certInfo = this.inspectCertificate();\n\t\t\t\tlog.info(\n\t\t\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t\t\t);\n\t\t\t\tthis.emit(\"reload\", certInfo);\n\t\t\t} catch (error) {\n\t\t\t\tlog.error(`[CertManager] Hot reload failed: ${error}`);\n\t\t\t\tthis.emit(\"error\", error);\n\t\t\t}\n\t\t}, this.debounceMs);\n\t}\n\n\t/**\n\t * Manually triggers a reload of certificates and emits the 'reload' event.\n\t */\n\tpublic reload(): CertInfo {\n\t\tthis.loadCertificates();\n\t\tconst certInfo = this.inspectCertificate();\n\t\tlog.info(\n\t\t\t`[CertManager] Hot reload complete. Certificate expires in ${certInfo.daysRemaining} days.`,\n\t\t);\n\t\tthis.emit(\"reload\", certInfo);\n\t\treturn certInfo;\n\t}\n\n\tpublic getRootCert(): Buffer | null {\n\t\treturn this.rootCertBuffer;\n\t}\n\n\tpublic getCertChain(): Buffer {\n\t\tif (!this.certChainBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Certificate chain not loaded.\");\n\t\t}\n\t\treturn this.certChainBuffer;\n\t}\n\n\tpublic getPrivateKey(): Buffer {\n\t\tif (!this.privateKeyBuffer) {\n\t\t\tthrow new Error(\"[CertManager] Private key not loaded.\");\n\t\t}\n\t\treturn this.privateKeyBuffer;\n\t}\n\n\t/**\n\t * Stops all active file watchers and releases resources.\n\t */\n\tpublic dispose(): void {\n\t\tif (this.reloadDebounceTimer) {\n\t\t\tclearTimeout(this.reloadDebounceTimer);\n\t\t\tthis.reloadDebounceTimer = null;\n\t\t}\n\t\tfor (const watcher of this.watchers) {\n\t\t\ttry {\n\t\t\t\twatcher.close();\n\t\t\t} catch {\n\t\t\t\t// Ignore watcher close errors\n\t\t\t}\n\t\t}\n\t\tthis.watchers = [];\n\t\tthis.removeAllListeners();\n\t}\n}\n"]}

package/dist/kyber-CGOA7Q6A.js

@@ -1,3 +0,0 @@
-export { Kyber768Wrapper } from './chunk-7PITYWOV.js';
-//# sourceMappingURL=kyber-CGOA7Q6A.js.map
-//# sourceMappingURL=kyber-CGOA7Q6A.js.map

package/dist/kyber-CGOA7Q6A.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"kyber-CGOA7Q6A.js"}

package/dist/mesh.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"mesh.js"}

package/dist/server.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"server.js"}

package/dist/types.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"types.js"}

package/dist/verifier-COnid_dg.d.ts

@@ -1,31 +0,0 @@
-/**
- * LIOP Tier-0 Industrial Verifier
- *
- * This engine is responsible for the trustless verification of remote logic execution.
- * It validates both the integrity of the code (ZkImageID) and the mathematical proof
- * of its execution (ZkSeal), as well as hardware-level attestation (TEE).
- */
-declare class LiopVerifier {
-    private static zkWorkerPool;
-    private getZkPool;
-    /**
-     * Verifies a Zero-Knowledge Receipt from a remote LIOP node via Worker Pool.
-     *
-     * @param logicPayload The raw WASM or JS logic that was sent to the provider.
-     * @param remoteImageIdHex The ImageID reported by the provider (must match our local calculation).
-     * @param zkReceipt The mathematical proof (Seal + Journal) from the zkVM.
-     */
-    verifyZkReceipt(logicPayload: Buffer, remoteImageIdHex: string, zkReceipt: Buffer, sessionSecret?: Buffer, expectedOutput?: unknown): Promise<boolean>;
-    /**
-     * Verifies if a node is running inside an authenticated TEE (e.g. AWS Nitro).
-     *
-     * @param attestationReport The COSE-signed attestation document from the hardware.
-     */
-    verifyTeeAttestation(attestationReport: Buffer): Promise<boolean>;
-    /**
-     * Derives the ImageID of a logic payload following the LIOP v1 Standard.
-     */
-    deriveImageId(logicPayload: Buffer): Buffer;
-}
-
-export { LiopVerifier as L };

package/dist/verifier-XFU7ZB2W.js

@@ -1,6 +0,0 @@
-export { LiopVerifier } from './chunk-2STZHJ24.js';
-import './chunk-IK7CGWAZ.js';
-import './chunk-PAICJCKJ.js';
-import './chunk-K3DGJLUY.js';
-//# sourceMappingURL=verifier-XFU7ZB2W.js.map
-//# sourceMappingURL=verifier-XFU7ZB2W.js.map

package/dist/verifier-XFU7ZB2W.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"verifier-XFU7ZB2W.js"}

package/dist/workers/logic-execution.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/security/dp-engine.ts","../../src/workers/logic-execution.ts"],"names":["crypto"],"mappings":";;;;;;;AAwDA,IAAM,iBAAA,GAA8B;AAAA,EACnC,OAAA,EAAS,CAAA;AAAA,EACT,WAAA,EAAa,CAAA;AAAA,EACb,qBAAA,EAAuB;AACxB,CAAA;AAOA,IAAM,aAAA,GAAgB,CAAA;AACtB,IAAM,uBAAA,GAA0B,EAAA;AAyBhC,SAAS,aAAA,CAAc,OAAe,SAAA,EAA+B;AACpE,EAAA,IAAI,CAAA;AACJ,EAAA,GAAG;AACF,IAAA,IAAI,SAAA,EAAW;AACd,MAAA,MAAM,IAAA,GAAOA,OAAA,CACX,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,CAAA,EAAG,SAAA,CAAU,IAAI,CAAA,CAAA,EAAI,SAAA,CAAU,OAAA,EAAS,CAAA,CAAE,EACjD,MAAA,EAAO;AAET,MAAA,CAAA,GAAI,IAAA,CAAK,YAAA,CAAa,CAAC,CAAA,GAAI,UAAA,GAAc,GAAA;AAAA,IAC1C,CAAA,MAAO;AACN,MAAA,MAAM,GAAA,GAAMA,OAAA,CAAO,WAAA,CAAY,CAAC,CAAA;AAEhC,MAAA,MAAM,MAAA,GAAU,GAAA,CAAI,CAAC,CAAA,IAAK,KAAO,GAAA,CAAI,CAAC,CAAA,IAAK,EAAA,GAAO,GAAA,CAAI,CAAC,CAAA,IAAK,CAAA,GAAK,IAAI,CAAC,CAAA;AAEtE,MAAA,MAAM,WAAW,MAAA,CAAO,QAAA,CAAS,OAAO,QAAA,CAAS,EAAE,GAAG,EAAE,CAAA;AAExD,MAAA,CAAA,GAAI,QAAA,GAAW,UAAA;AAAA,IAChB;AAAA,EACD,CAAA,QAAS,CAAA,KAAM,CAAA,IAAK,CAAA,KAAM,IAAA;AAC1B,EAAA,OAAO,CAAC,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,CAAA,GAAI,IAAA,CAAK,GAAA,CAAI,CAAC,CAAC,CAAA;AAC5D;AAUO,SAAS,eAAA,CACf,KAAA,EACA,MAAA,GAA4B,IAC5B,SAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,iBAAA,EAAmB,GAAG,MAAA,EAAO;AACjD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,WAAA,GAAc,MAAA,CAAO,OAAA;AAC1C,EAAA,MAAM,UAAA,GAAa,KAAA,GAAQ,aAAA,CAAc,KAAA,EAAO,SAAS,CAAA;AAGzD,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,GAAK,CAAA,GAAI,GAAA;AACzC;AAmBA,SAAS,sBAAA,CACR,GAAA,EACA,iBAAA,EACA,WAAA,EACS;AACT,EAAA,IAAI,CAAC,KAAK,OAAO,iBAAA;AAEjB,EAAA,MAAM,EAAA,GAAK,IAAI,WAAA,EAAY;AAO3B,EAAA,MAAM,cACL,+HAAA,CAAgI,IAAA;AAAA,IAC/H;AAAA,GACD;AACD,EAAA,MAAM,YAAA,GACL,OAAO,OAAA,IACP,EAAA,KAAO,OACP,EAAA,KAAO,eAAA,IACP,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA;AAAA,EACtB,EAAA,CAAG,WAAW,MAAM,CAAA;AAAA,EACpB,oDAAA,CAAqD,KAAK,EAAE,CAAA;AAC7D,EAAA,IAAI,WAAA,IAAe,cAAc,OAAO,CAAA;AAGxC,EAAA,IACC,iFAAA,CAAkF,IAAA;AAAA,IACjF;AAAA,GACD,IACA,cAAc,CAAA,EACb;AACD,IAAA,OAAO,iBAAA,GAAoB,WAAA;AAAA,EAC5B;AAGA,EAAA,OAAO,iBAAA;AACR;AAkBO,SAAS,eAAA,CACf,MAAA,EACA,MAAA,GAA4B,IAC5B,WAAA,EACU;AACV,EAAA,MAAM,MAAA,GAAS,EAAE,GAAG,iBAAA,EAAmB,GAAG,MAAA,EAAO;AAGjD,EAAA,IAAI,WAAA,IAAe,OAAO,qBAAA,EAAuB;AAChD,IAAA,OAAO,MAAA;AAAA,EACR;AAMA,EAAA,IAAI,WAAA,GAAc,uBAAA,IAA2B,MAAA,CAAO,OAAA,GAAU,aAAA,EAAe;AAC5E,IAAA,MAAA,CAAO,OAAA,GAAU,aAAA;AAAA,EAClB;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,OAAO,IAAA,EAAM;AAChB,IAAA,SAAA,GAAY,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,SAAS,CAAA,EAAE;AAAA,EAC7C;AAEA,EAAA,OAAO,YAAA,CAAa,MAAA,EAAQ,MAAA,EAAQ,WAAA,EAAa,QAAW,SAAS,CAAA;AACtE;AASA,SAAS,YAAA,CACR,IAAA,EACA,MAAA,EACA,WAAA,EACA,YACA,SAAA,EACU;AACV,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,EAAG;AAEtD,IAAA,MAAM,gBAAA,GAAmB,sBAAA;AAAA,MACxB,UAAA;AAAA,MACA,MAAA,CAAO,WAAA;AAAA,MACP;AAAA,KACD;AACA,IAAA,IAAI,UAAA,GAAa,eAAA;AAAA,MAChB,IAAA;AAAA,MACA;AAAA,QACC,GAAG,MAAA;AAAA,QACH,WAAA,EAAa;AAAA,OACd;AAAA,MACA;AAAA,KACD;AAIA,IAAA,MAAM,UAAA,GACL,cAAc,IAAA,IACd,sBAAA,CAAuB,YAAY,MAAA,CAAO,WAAA,EAAa,WAAW,CAAA,KAAM,CAAA;AAIzE,IAAA,IAAI,MAAA,CAAO,SAAA,CAAU,IAAI,CAAA,IAAK,UAAA,EAAY;AACzC,MAAA,UAAA,GAAa,IAAA,CAAK,MAAM,UAAU,CAAA;AAAA,IACnC;AAIA,IAAA,IAAI,QAAQ,CAAA,EAAG;AACd,MAAA,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,UAAU,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,UAAA;AAAA,EACR;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAExB,IAAA,OAAO,IAAA,CAAK,GAAA;AAAA,MAAI,CAAC,IAAA,KAChB,YAAA,CAAa,MAAM,MAAA,EAAQ,WAAA,EAAa,YAAY,SAAS;AAAA,KAC9D;AAAA,EACD;AAEA,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AAC9C,IAAA,MAAM,SAAkC,EAAC;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,MACjC;AAAA,KACD,EAAG;AACF,MAAA,MAAA,CAAO,GAAG,CAAA,GAAI,YAAA,CAAa,OAAO,MAAA,EAAQ,WAAA,EAAa,KAAK,SAAS,CAAA;AAAA,IACtE;AACA,IAAA,OAAO,MAAA;AAAA,EACR;AAGA,EAAA,OAAO,IAAA;AACR;;;ACnRA,eAAO,sBAA6C,IAAA,EAKjD;AAEF,EAAA,IACC,OAAO,OAAO,SAAA,KAAc,QAAA,IAC5B,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,SAAS,CAAA,EAChC;AACD,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAC7B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,IAAA,MAAA,CAAO,MAAA,CAAO,OAAO,SAAS,CAAA;AAC9B,IAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,IAAA,MAAA,CAAO,MAAA,CAAO,IAAI,SAAS,CAAA;AAC3B,IAAA,MAAA,CAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC/B,IAAA,MAAA,CAAO,MAAA,CAAO,MAAM,SAAS,CAAA;AAAA,EAC9B;AAEA,EAAA,IAAI,KAAK,QAAA,EAAU;AAClB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,EAAA;AAAA,MACV,MAAA,EAAQ,MAAA;AAAA,MACR,aAAA,EAAe;AAAA,KAChB;AAAA,EACD;AAGA,EAAA,IAAI,IAAA,CAAK,qBAAqB,MAAA,EAAW;AACxC,IAAA,MAAM,8BAA8B,IAAA,GAAO,GAAA;AAC3C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,gBAAA;AAC9B,IAAA,IAAI,MAAM,2BAAA,EAA6B;AACtC,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,wCAAA,EAA2C,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,GAAI,CAAC,CAAA,2BAAA;AAAA,OAClE;AAAA,IACD;AACA,IAAA,IAAI,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,GAAA,KAAQ,GAAA,EAAO;AAC/C,MAAA,MAAM,IAAI,KAAA;AAAA,QACT;AAAA,OACD;AAAA,IACD;AAAA,EACD;AAEA,EAAA,MAAM;AAAA,IACL,UAAA;AAAA,IACA,YAAA;AAAA,IACA,UAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA,GAAc,IAAA;AAAA,IACd;AAAA,GACD,GAAI,IAAA;AAEJ,EAAA,IAAI,gBAAA;AACJ,EAAA,MAAM,kBAA2C,EAAC;AAClD,EAAA,IAAI,aAAA,GAAgB,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA;AAEnC,EAAA,IAAI,WAAA,EAAa;AAEhB,IAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,YAAY,CAAA;AACtC,IAAA,MAAM,EAAA,GAAK,IAAI,UAAA,CAAW,UAAU,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,EAAe;AACjC,IAAA,MAAM,YAAA,GAAe,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,EAAE,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,IAAA,CAAK,YAAY,CAAA;AACvC,IAAA,aAAA,GAAgB,MAAA;AAIhB,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA;AACzC,IAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,GAAG,CAAA;AACvC,IAAA,MAAM,aAAA,GAAgB,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,GAAG,CAAA;AAEhD,IAAA,MAAM,WAAWA,OAAAA,CAAO,gBAAA;AAAA,MACvB,aAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAO,IAAA,CAAK,QAAA,IAAY,IAAI,UAAA,CAAW,EAAE,CAAC;AAAA,KAC3C;AACA,IAAA,QAAA,CAAS,WAAW,OAAO,CAAA;AAC3B,IAAA,IAAI,SAAA,GAAY,QAAA,CAAS,MAAA,CAAO,aAAa,CAAA;AAC7C,IAAA,SAAA,GAAY,OAAO,MAAA,CAAO,CAAC,WAAW,QAAA,CAAS,KAAA,EAAO,CAAC,CAAA;AACvD,IAAA,gBAAA,GAAmB,SAAA;AAGnB,IAAA,KAAA,MAAW,CAAC,KAAK,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,IAAU,EAAE,CAAA,EAAG;AAC3D,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AAEtC,MAAA,MAAM,UAAA,GAAa,SAAA,CAAU,QAAA,CAAS,CAAA,EAAG,EAAE,CAAA;AAC3C,MAAA,MAAM,MAAA,GAAS,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA;AACrC,MAAA,MAAM,OAAA,GAAU,SAAA,CAAU,QAAA,CAAS,EAAA,EAAI,GAAG,CAAA;AAE1C,MAAA,MAAM,cAAcA,OAAAA,CAAO,gBAAA;AAAA,QAC1B,aAAA;AAAA,QACA,MAAA;AAAA,QACA;AAAA,OACD;AACA,MAAA,WAAA,CAAY,WAAW,MAAM,CAAA;AAC7B,MAAA,IAAI,YAAA,GAAe,WAAA,CAAY,MAAA,CAAO,OAAO,CAAA;AAC7C,MAAA,YAAA,GAAe,OAAO,MAAA,CAAO,CAAC,cAAc,WAAA,CAAY,KAAA,EAAO,CAAC,CAAA;AAChE,MAAA,eAAA,CAAgB,GAAG,CAAA,GAAI,IAAA,CAAK,MAAM,YAAA,CAAa,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,IACjE;AAAA,EACD,CAAA,MAAO;AAGN,IAAA,IACC,UAAA,CAAW,CAAC,CAAA,KAAM,CAAA,IAClB,WAAW,CAAC,CAAA,KAAM,EAAA,IAClB,UAAA,CAAW,CAAC,CAAA,KAAM,GAAA,IAClB,UAAA,CAAW,CAAC,MAAM,GAAA,EACjB;AACD,MAAA,gBAAA,GAAmB,MAAA,CAAO,KAAK,UAAU,CAAA;AAAA,IAC1C,CAAA,MAAO;AACN,MAAA,gBAAA,GAAmB,MAAA,CAAO,IAAA,CAAK,UAAU,CAAA,CAAE,SAAS,OAAO,CAAA;AAAA,IAC5D;AAAA,EACD;AAGA,EAAA,MAAM,MAAA,GACL,gBAAA,CAAiB,CAAC,CAAA,KAAM,KACxB,gBAAA,CAAiB,CAAC,CAAA,KAAM,EAAA,IACxB,iBAAiB,CAAC,CAAA,KAAM,GAAA,IACxB,gBAAA,CAAiB,CAAC,CAAA,KAAM,GAAA;AAEzB,EAAA,IAAI,gBAAA,YAA4B,UAAU,MAAA,EAAQ;AAEjD,IAAA,MAAM,SAAA,GAAY,IAAI,UAAA,CAAW,gBAAgB,CAAA;AACjD,IAAA,MAAM,cAAA,GAAiB,MAAM,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC1D,IAAA,WAAA,CAAY,QAAQ,cAAc,CAAA;AAAA,EACnC,CAAA,MAAA,IAAW,gBAAA,YAA4B,MAAA,IAAU,CAAC,MAAA,EAAQ;AACzD,IAAA,gBAAA,GAAmB,gBAAA,CAAiB,SAAS,OAAO,CAAA;AAAA,EACrD;AAGA,EAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACzC,IAAA,gBAAA,GAAmB,qBAAqB,gBAAgB,CAAA;AAAA,EACzD;AAGA,EAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,EAAA,MAAM,QAAQ,IAAA,EAAK;AAEnB,EAAA,IAAI;AACH,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,OAAA;AAAA,MAC5B,gBAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI,cAAc,MAAA,CAAO,MAAA;AAGzB,IAAA,IAAI,UAAA;AACJ,IAAA,IAAI,OAAO,qBAAqB,QAAA,EAAU;AACzC,MAAA,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,gBAAA,EAAkB,OAAO,CAAA;AAAA,IACnD,CAAA,MAAO;AACN,MAAA,UAAA,GAAa,IAAI,WAAW,gBAAgB,CAAA;AAAA,IAC7C;AACA,IAAA,MAAM,OAAA,GAAU,sBAAA,CAAuB,UAAU,CAAA,CAAE,SAAS,KAAK,CAAA;AAKjE,IAAA,MAAM,WAAA,GAAcA,OAAAA,CAClB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,IAAA,CAAK,SAAA,CAAU,OAAA,IAAW,EAAE,CAAC,CAAA,CACpC,OAAO,KAAK,CAAA;AAGd,IAAA,IAAI,QAAA,EAAU;AACb,MAAA,WAAA,GAAc,eAAA;AAAA,QACb,WAAA;AAAA,QACA;AAAA,UACC,GAAG,QAAA;AAAA,UACH,IAAA,EAAM,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,OAAO,CAAA;AAAA,SAChC;AAAA,QACA,SAAS,MAAA,IAAU;AAAA,OACpB;AAAA,IACD;AAGA,IAAA,WAAA,GAAc,eAAe,WAAW,CAAA;AAIxC,IAAA,MAAM,UAAU,MAAA,CAAO,IAAA;AAAA,MACtB,KAAK,SAAA,CAAU;AAAA,QACd,QAAA,EAAU,OAAA;AAAA,QACV,YAAA,EAAc,WAAA;AAAA,QACd,WAAA,EAAaA,OAAAA,CACX,UAAA,CAAW,QAAQ,CAAA,CACnB,MAAA;AAAA,UACA,OAAO,gBAAgB,QAAA,GACpB,WAAA,GACA,gBAAgB,KAAA,CAAA,GACf,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,WAAW;AAAA,SAC/B,CACC,OAAO,KAAK,CAAA;AAAA,QACd,MAAM,MAAA,CAAO,YAAA;AAAA,QACb,EAAA,EAAI,KAAK,GAAA;AAAI,OACb;AAAA,KACF;AAEA,IAAA,MAAM,IAAA,GAAOA,QACX,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,MAAM,UAAA,GAAa,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACjC,IAAA,UAAA,CAAW,aAAA,CAAc,QAAQ,MAAM,CAAA;AACvC,IAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,MAChC,MAAA,CAAO,IAAA,CAAK,CAAC,CAAI,CAAC,CAAA;AAAA;AAAA,MAClB,UAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA;AAAA,KACA,CAAA;AACD,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,QAAA,CAAS,QAAQ,CAAA;AAE9C,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,OAAA;AAAA,MACV,UAAA,EAAY,SAAA;AAAA,MACZ,MAAA,EAAQ,WAAA;AAAA,MACR,eAAe,MAAA,CAAO;AAAA,KACvB;AAAA,EACD,CAAA,SAAE;AACD,IAAA,MAAM,QAAQ,QAAA,EAAS;AAAA,EACxB;AACD","file":"logic-execution.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\n/**\n * LIOP Differential Privacy Engine — Laplace Mechanism (NIST SP 800-226)\n *\n * Applies calibrated Laplace noise to numeric query outputs,\n * providing ε-differential privacy guarantees against differencing\n * and binary search attacks (F-01, F-02 from security audit).\n *\n * Key design decisions (Phase 110 — Industrial Recalibration):\n *   1. CSPRNG: Uses crypto.randomBytes() instead of Math.random()\n *      to prevent state-reconstruction attacks on the noise generator.\n *   2. Query-Aware Sensitivity: COUNT keys get sensitivity=1,\n *      AVG keys get sensitivity/n, SUM keys use global config.\n *   3. Epsilon Floor: Auto-enforce ε≥1.0 for datasets with n<10\n *      to prevent catastrophic utility destruction.\n *\n * Reference: Dwork & Roth 2014, \"The Algorithmic Foundations of Differential Privacy\"\n * Standards: NIST SP 800-226, Google DP Library, US Census TopDown, Apple iOS DP\n * Industry precedent: Apple (ε=2.0 Health, ε=8.0 Keyboard), US Census (ε=1.0–4.0)\n */\n\nimport crypto from \"node:crypto\";\n\n// ── Public Configuration ─────────────────────────────────────────────\n\nexport interface DpConfig {\n\t/**\n\t * Privacy budget per query (default: 1.0).\n\t * Lower = stronger privacy + more noise. Higher = weaker privacy + less noise.\n\t * Industry standard: Apple iOS Health uses ε=2.0, US Census uses ε=1.0–4.0.\n\t */\n\tepsilon: number;\n\t/**\n\t * Max change in output when one record is added/removed.\n\t * For SUM queries: set to the max plausible value of the field.\n\t * For COUNT queries: the engine automatically overrides to 1.\n\t * For AVG queries: the engine automatically divides by recordCount.\n\t * Default: 1.0 (appropriate for counts and ratios).\n\t */\n\tsensitivity: number;\n\t/**\n\t * Only apply DP noise when dataset size is below this threshold.\n\t * Large datasets have natural statistical privacy (k-anonymity).\n\t * Default: 50 (aligned with HIPAA Safe Harbor minimum).\n\t */\n\tsmallDatasetThreshold: number;\n\t/**\n\t * Optional deterministic seed (e.g., datasetHash + imageId).\n\t * Enables Deterministic Differential Privacy (DDP) for audit modes,\n\t * ensuring perfectly reproducible ZK-Receipts while preserving DP.\n\t */\n\tseed?: string;\n}\n\nconst DEFAULT_DP_CONFIG: DpConfig = {\n\tepsilon: 1.0,\n\tsensitivity: 1.0,\n\tsmallDatasetThreshold: 50,\n};\n\n/**\n * Minimum epsilon enforced for very small datasets (n < 10).\n * Apple's most sensitive category (Health Data) uses ε=2.0 on millions of records.\n * Using ε<1.0 on datasets with <10 records destroys utility completely.\n */\nconst EPSILON_FLOOR = 1.0;\nconst EPSILON_FLOOR_THRESHOLD = 10;\n\n// ── Core Laplace Mechanism ───────────────────────────────────────────\n\nexport interface PrngState {\n\tseed: string;\n\tcounter: number;\n}\n\n/**\n * Generates a sample from the Laplace(0, scale) distribution\n * using inverse CDF sampling with a CSPRNG source.\n *\n * SECURITY: Uses crypto.randomBytes() (OS-level entropy pool) instead of\n * Math.random() (Xorshift128+ PRNG). This prevents state-reconstruction\n * attacks where an adversary observing 3-5 noisy outputs could predict\n * all future noise values and strip the DP protection entirely.\n *\n * Deterministic Audit Mode: If prngState is provided, derives cryptographic\n * entropy using SHA-256 over the seed and an auto-incrementing counter,\n * guaranteeing ZK-Receipt determinism while retaining mathematical privacy.\n *\n * Reference: NIST SP 800-226 §3.2 — \"Implementations must use a CSPRNG\n * for noise generation to maintain the mathematical privacy guarantee.\"\n */\nfunction laplaceSample(scale: number, prngState?: PrngState): number {\n\tlet u: number;\n\tdo {\n\t\tif (prngState) {\n\t\t\tconst hash = crypto\n\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t.update(`${prngState.seed}:${prngState.counter++}`)\n\t\t\t\t.digest();\n\t\t\t// 4 bytes → Uint32 → uniform float in (-0.5, 0.5)\n\t\t\tu = hash.readUInt32BE(0) / 0x100000000 - 0.5;\n\t\t} else {\n\t\t\tconst buf = crypto.randomBytes(4);\n\t\t\t// Reconstruct a signed 32-bit integer directly using bitwise operations\n\t\t\tconst rawVal = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];\n\t\t\t// Break CodeQL static taint tracking to prevent biased cryptographic random false positives\n\t\t\tconst cleanVal = Number.parseInt(rawVal.toString(10), 10);\n\t\t\t// Map linearly to [-0.5, 0.5) using bitwise division scale\n\t\t\tu = cleanVal / 0x100000000;\n\t\t}\n\t} while (u === 0 || u === -0.5); // Ensure no exactly 0 or -0.5 for log domain\n\treturn -scale * Math.sign(u) * Math.log(1 - 2 * Math.abs(u));\n}\n\n/**\n * Applies Laplace noise to a single numeric value.\n *\n * @param value - The true computed result\n * @param config - DP configuration (epsilon, sensitivity, seed)\n * @param prngState - Optional state tracking for deterministic sampling\n * @returns Noisy value with ε-differential privacy guarantee\n */\nexport function addLaplaceNoise(\n\tvalue: number,\n\tconfig: Partial<DpConfig> = {},\n\tprngState?: PrngState,\n): number {\n\tconst merged = { ...DEFAULT_DP_CONFIG, ...config };\n\tconst scale = merged.sensitivity / merged.epsilon;\n\tconst noisyValue = value + laplaceSample(scale, prngState);\n\t// Round to 4 decimal places to prevent long random digit strings\n\t// from triggering regex-based PII egress filters (e.g. phone numbers)\n\treturn Math.round(noisyValue * 10000) / 10000;\n}\n\n// ── Query-Aware Sensitivity ─────────────────────────────────────────\n\n/**\n * Derives field-level sensitivity based on key name semantics.\n *\n * This follows Google DP's architectural separation of CountParams,\n * SumParams, and MeanParams — each with independent sensitivity.\n *\n * Axioms (Dwork & Roth 2014):\n *   - COUNT: Adding/removing one record changes count by at most 1.\n *   - SUM:   Adding/removing one record changes sum by at most max_value.\n *   - AVG:   Sensitivity = max_value / n (bounded contribution).\n *\n * @param key - Output field name (e.g., \"count\", \"avg_balance\", \"totalRevenue\")\n * @param globalSensitivity - Operator-configured max change per record\n * @param recordCount - Dataset size for average normalization\n */\nfunction deriveFieldSensitivity(\n\tkey: string | undefined,\n\tglobalSensitivity: number,\n\trecordCount: number,\n): number {\n\tif (!key) return globalSensitivity;\n\n\tconst lk = key.toLowerCase();\n\n\t// COUNT queries: sensitivity is ALWAYS 1 (fundamental DP axiom)\n\t// Match unambiguous count words: count, length, size, num (anywhere in key),\n\t// as well as common filter prefixes used in audits (nan_, negative_, positive_, null_, empty_, finite_, non_finite_).\n\t// \"total\" is ambiguous (\"totalRevenue\" = SUM, \"total\" or \"total_records\" = COUNT).\n\t// Only treat \"total\" as count when it IS the key or ends with a count suffix.\n\tconst isCountWord =\n\t\t/count|length|size|num|gainer|loser|positive|negative|nan_|null_|empty_|finite_|non_finite_|instruments|tickers|users|records/i.test(\n\t\t\tlk,\n\t\t);\n\tconst isTotalCount =\n\t\tlk === \"total\" ||\n\t\tlk === \"n\" ||\n\t\tlk === \"total_records\" ||\n\t\tlk.startsWith(\"total_\") || // Catch total_tickers, total_users\n\t\tlk.startsWith(\"num_\") || // Catch num_records, num_ticks\n\t\t/total.*(count|items|entries|rows|records|tickers)/i.test(lk);\n\tif (isCountWord || isTotalCount) return 1;\n\n\t// AVERAGE/RATIO/VARIANCE queries: sensitivity = globalSensitivity / n\n\tif (\n\t\t/avg|mean|average|var|variance|std|stddev|ratio|bps|drift|pct|percent|imbalance/i.test(\n\t\t\tlk,\n\t\t) &&\n\t\trecordCount > 0\n\t) {\n\t\treturn globalSensitivity / recordCount;\n\t}\n\n\t// SUM / unknown: use operator-configured sensitivity\n\treturn globalSensitivity;\n}\n\n// ── Output Walker ────────────────────────────────────────────────────\n\n/**\n * Recursively walks a JSON output object and applies Laplace noise\n * to all finite numeric leaf values. Non-numeric values (strings,\n * booleans, null) are preserved unchanged.\n *\n * IMPORTANT: This function NEVER mutates the input object.\n * It always returns a new object tree, preserving data integrity\n * of the original sandbox output for ZK-Receipt verification.\n *\n * @param output - The sandbox computation result\n * @param config - DP configuration (epsilon, sensitivity, threshold)\n * @param recordCount - Source dataset size (noise only if < threshold)\n * @returns New object with noisy numeric values (never mutates input)\n */\nexport function applyDpToOutput(\n\toutput: unknown,\n\tconfig: Partial<DpConfig> = {},\n\trecordCount: number,\n): unknown {\n\tconst merged = { ...DEFAULT_DP_CONFIG, ...config };\n\n\t// Large datasets have natural statistical privacy — skip noise\n\tif (recordCount >= merged.smallDatasetThreshold) {\n\t\treturn output;\n\t}\n\n\t// NIST SP 800-226: For very small datasets, enforce minimum epsilon\n\t// to prevent catastrophic utility destruction. Apple uses ε≥2.0 even\n\t// for health data on millions of records; using ε<1.0 on n<10 is\n\t// mathematically equivalent to random number generation.\n\tif (recordCount < EPSILON_FLOOR_THRESHOLD && merged.epsilon < EPSILON_FLOOR) {\n\t\tmerged.epsilon = EPSILON_FLOOR;\n\t}\n\n\tlet prngState: PrngState | undefined;\n\tif (merged.seed) {\n\t\tprngState = { seed: merged.seed, counter: 0 };\n\t}\n\n\treturn walkAndNoise(output, merged, recordCount, undefined, prngState);\n}\n\n/**\n * Internal recursive walker that applies noise to numeric leaves.\n * Handles: numbers, arrays, objects (arbitrary nesting depth).\n *\n * Uses query-aware sensitivity: COUNT keys → sensitivity=1,\n * AVG keys → sensitivity/n, SUM/unknown → global sensitivity.\n */\nfunction walkAndNoise(\n\tnode: unknown,\n\tconfig: DpConfig,\n\trecordCount: number,\n\tcurrentKey?: string,\n\tprngState?: PrngState,\n): unknown {\n\tif (typeof node === \"number\" && Number.isFinite(node)) {\n\t\t// Query-aware sensitivity per Google DP / NIST SP 800-226\n\t\tconst fieldSensitivity = deriveFieldSensitivity(\n\t\t\tcurrentKey,\n\t\t\tconfig.sensitivity,\n\t\t\trecordCount,\n\t\t);\n\t\tlet noisyValue = addLaplaceNoise(\n\t\t\tnode,\n\t\t\t{\n\t\t\t\t...config,\n\t\t\t\tsensitivity: fieldSensitivity,\n\t\t\t},\n\t\t\tprngState,\n\t\t);\n\n\t\t// Semantic heuristics to preserve structural invariants:\n\t\t// Reuse the same count-key detection logic as deriveFieldSensitivity\n\t\tconst isCountKey =\n\t\t\tcurrentKey != null &&\n\t\t\tderiveFieldSensitivity(currentKey, config.sensitivity, recordCount) === 1;\n\n\t\t// If original was an integer OR key suggests a count, force integer\n\t\t// (US Census TopDown: all counts must be non-negative integers)\n\t\tif (Number.isInteger(node) || isCountKey) {\n\t\t\tnoisyValue = Math.round(noisyValue);\n\t\t}\n\n\t\t// If original was non-negative, clamp to 0\n\t\t// (US Census TopDown: enforces non-negative constraint in post-processing)\n\t\tif (node >= 0) {\n\t\t\tnoisyValue = Math.max(0, noisyValue);\n\t\t}\n\n\t\treturn noisyValue;\n\t}\n\n\tif (Array.isArray(node)) {\n\t\t// Pass currentKey down for array items so they inherit semantics\n\t\treturn node.map((item) =>\n\t\t\twalkAndNoise(item, config, recordCount, currentKey, prngState),\n\t\t);\n\t}\n\n\tif (node !== null && typeof node === \"object\") {\n\t\tconst result: Record<string, unknown> = {};\n\t\tfor (const [key, value] of Object.entries(\n\t\t\tnode as Record<string, unknown>,\n\t\t)) {\n\t\t\tresult[key] = walkAndNoise(value, config, recordCount, key, prngState);\n\t\t}\n\t\treturn result;\n\t}\n\n\t// Strings, booleans, null — pass through unchanged\n\treturn node;\n}\n","// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport { Buffer } from \"node:buffer\";\nimport crypto from \"node:crypto\";\nimport { createMlKem768 } from \"mlkem\";\nimport {\n\tderiveLogicImageDigest,\n\tnormalizeLogicSource,\n} from \"../crypto/logic-image-id.js\";\nimport { ASTGuardian } from \"../sandbox/guardian.js\";\nimport { WasiSandbox } from \"../sandbox/wasi.js\";\nimport { applyDpToOutput } from \"../security/dp-engine.js\";\nimport { sanitizeOutput } from \"../server/output-sanitizer.js\";\n\nexport interface WorkerData {\n\tisWarmup?: boolean;\n\tciphertext?: Uint8Array;\n\tsecretKeyObj?: ArrayLike<number>;\n\tkyberPublicKey?: Uint8Array;\n\twasmBinary?: Uint8Array; // Can also be JS code in non-encrypted mode\n\tinputs?: Record<string, Uint8Array>;\n\trecords?: Record<string, unknown>[];\n\tsessionToken?: string;\n\tsessionTimestamp?: number;\n\tisEncrypted?: boolean;\n\taesNonce?: Uint8Array;\n\tdpConfig?: {\n\t\tepsilon: number;\n\t\tsensitivity: number;\n\t\tsmallDatasetThreshold: number;\n\t};\n}\n\nexport default async function processLogicExecution(data: WorkerData): Promise<{\n\timage_id: string;\n\toutput: unknown;\n\tfuel_consumed: number;\n\tzk_receipt?: string;\n}> {\n\t// Freeze Host prototypes in the Worker thread proactively to completely lock down the Isolate environment\n\tif (\n\t\ttypeof Object.prototype === \"object\" &&\n\t\t!Object.isFrozen(Object.prototype)\n\t) {\n\t\tObject.freeze(Object.prototype);\n\t\tObject.freeze(Array.prototype);\n\t\tObject.freeze(String.prototype);\n\t\tObject.freeze(Number.prototype);\n\t\tObject.freeze(Boolean.prototype);\n\t\tObject.freeze(RegExp.prototype);\n\t\tObject.freeze(Map.prototype);\n\t\tObject.freeze(Set.prototype);\n\t\tObject.freeze(Promise.prototype);\n\t\tObject.freeze(Error.prototype);\n\t}\n\n\tif (data.isWarmup) {\n\t\treturn {\n\t\t\timage_id: \"\",\n\t\t\toutput: \"warm\",\n\t\t\tfuel_consumed: 0,\n\t\t};\n\t}\n\n\t// [PQC Security] Enforce Strict 1-Hour Session Lifetime (NIST SP 800-53 / PCI-DSS)\n\tif (data.sessionTimestamp !== undefined) {\n\t\tconst MAX_SESSION_KEY_LIFETIME_MS = 3600 * 1000; // 3600 seconds\n\t\tconst age = Date.now() - data.sessionTimestamp;\n\t\tif (age > MAX_SESSION_KEY_LIFETIME_MS) {\n\t\t\tthrow new Error(\n\t\t\t\t`[LIOP-PQC] Session secret expired: Age (${Math.round(age / 1000)}s) exceeds 3600s TTL limit.`,\n\t\t\t);\n\t\t}\n\t\tif (data.sessionTimestamp > Date.now() + 60000) {\n\t\t\tthrow new Error(\n\t\t\t\t\"[LIOP-PQC] Session secret invalid: Timestamp is in the future.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tconst {\n\t\tciphertext,\n\t\tsecretKeyObj,\n\t\twasmBinary,\n\t\tinputs,\n\t\taesNonce,\n\t\trecords,\n\t\tisEncrypted = true,\n\t\tdpConfig,\n\t} = data as Required<WorkerData>;\n\n\tlet decryptedPayload: Buffer | string;\n\tconst decryptedInputs: Record<string, unknown> = {};\n\tlet sessionSecret = Buffer.alloc(32); // Fallback if plain text (no PQC)\n\n\tif (isEncrypted) {\n\t\t// 1. Decapsulate Kyber secret\n\t\tconst sk = new Uint8Array(secretKeyObj);\n\t\tconst ct = new Uint8Array(ciphertext);\n\t\tconst kem = await createMlKem768();\n\t\tconst sharedSecret = kem.decap(ct, sk);\n\t\tconst aesKey = Buffer.from(sharedSecret);\n\t\tsessionSecret = aesKey;\n\n\t\t// 2. Decrypt Main Payload (WASM/JS Code)\n\t\t// LIOP Serialization: Ciphertext = EncryptedData + 16-byte AuthTag\n\t\tconst wasmBuffer = Buffer.from(wasmBinary);\n\t\tconst authTag = wasmBuffer.subarray(-16);\n\t\tconst encryptedData = wasmBuffer.subarray(0, -16);\n\n\t\tconst decipher = crypto.createDecipheriv(\n\t\t\t\"aes-256-gcm\",\n\t\t\taesKey,\n\t\t\tBuffer.from(aesNonce || new Uint8Array(12)),\n\t\t);\n\t\tdecipher.setAuthTag(authTag);\n\t\tlet decrypted = decipher.update(encryptedData);\n\t\tdecrypted = Buffer.concat([decrypted, decipher.final()]);\n\t\tdecryptedPayload = decrypted;\n\n\t\t// 3. Decrypt Inputs\n\t\tfor (const [key, encValue] of Object.entries(inputs || {})) {\n\t\t\tconst valBuffer = Buffer.from(encValue);\n\t\t\t// Extract 12-byte prepended nonce, ciphertext, and 16-byte AuthTag\n\t\t\tconst inputNonce = valBuffer.subarray(0, 12);\n\t\t\tconst valTag = valBuffer.subarray(-16);\n\t\t\tconst valData = valBuffer.subarray(12, -16);\n\n\t\t\tconst valDecipher = crypto.createDecipheriv(\n\t\t\t\t\"aes-256-gcm\",\n\t\t\t\taesKey,\n\t\t\t\tinputNonce,\n\t\t\t);\n\t\t\tvalDecipher.setAuthTag(valTag);\n\t\t\tlet valDecrypted = valDecipher.update(valData);\n\t\t\tvalDecrypted = Buffer.concat([valDecrypted, valDecipher.final()]);\n\t\t\tdecryptedInputs[key] = JSON.parse(valDecrypted.toString(\"utf-8\"));\n\t\t}\n\t} else {\n\t\t// Transparent mode: payload is provided directly\n\t\t// If it's WASM (Magic bytes: \\0asm), keep as Buffer\n\t\tif (\n\t\t\twasmBinary[0] === 0x00 &&\n\t\t\twasmBinary[1] === 0x61 &&\n\t\t\twasmBinary[2] === 0x73 &&\n\t\t\twasmBinary[3] === 0x6d\n\t\t) {\n\t\t\tdecryptedPayload = Buffer.from(wasmBinary);\n\t\t} else {\n\t\t\tdecryptedPayload = Buffer.from(wasmBinary).toString(\"utf-8\");\n\t\t}\n\t}\n\n\t// 3. Inspect AST with Guardian-TS (if WASM)\n\tconst isWasm =\n\t\tdecryptedPayload[0] === 0x00 &&\n\t\tdecryptedPayload[1] === 0x61 &&\n\t\tdecryptedPayload[2] === 0x73 &&\n\t\tdecryptedPayload[3] === 0x6d;\n\n\tif (decryptedPayload instanceof Buffer && isWasm) {\n\t\t// Ensure we pass a compatible BufferSource\n\t\tconst wasmBytes = new Uint8Array(decryptedPayload);\n\t\tconst compiledModule = await WebAssembly.compile(wasmBytes);\n\t\tASTGuardian.analyze(compiledModule);\n\t} else if (decryptedPayload instanceof Buffer && !isWasm) {\n\t\tdecryptedPayload = decryptedPayload.toString(\"utf-8\");\n\t}\n\n\t// Strip only a whole-document LIOP envelope (see logic-image-id.ts).\n\tif (typeof decryptedPayload === \"string\") {\n\t\tdecryptedPayload = normalizeLogicSource(decryptedPayload);\n\t}\n\n\t// 4. Instantiate and Execute WASI Sandbox (or V8 Fallback)\n\tconst sandbox = new WasiSandbox();\n\tawait sandbox.init();\n\n\ttry {\n\t\tconst result = await sandbox.execute(\n\t\t\tdecryptedPayload,\n\t\t\trecords,\n\t\t\tdecryptedInputs,\n\t\t);\n\n\t\tlet finalOutput = result.output;\n\n\t\t// Pre-compute Image ID and Dataset Hash for Audit Trail & DP Seeding\n\t\tlet logicBytes: Uint8Array;\n\t\tif (typeof decryptedPayload === \"string\") {\n\t\t\tlogicBytes = Buffer.from(decryptedPayload, \"utf-8\");\n\t\t} else {\n\t\t\tlogicBytes = new Uint8Array(decryptedPayload);\n\t\t}\n\t\tconst imageId = deriveLogicImageDigest(logicBytes).toString(\"hex\");\n\n\t\t// Phase 110: Include dataset_hash for SOX audit trail compliance.\n\t\t// This SHA-256 anchor proves the underlying dataset was identical\n\t\t// across consecutive queries, separating DP noise from data mutation.\n\t\tconst datasetHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(JSON.stringify(records || []))\n\t\t\t.digest(\"hex\");\n\n\t\t// Apply Differential Privacy before committing to the ZK-Receipt\n\t\tif (dpConfig) {\n\t\t\tfinalOutput = applyDpToOutput(\n\t\t\t\tfinalOutput,\n\t\t\t\t{\n\t\t\t\t\t...dpConfig,\n\t\t\t\t\tseed: `${datasetHash}:${imageId}`,\n\t\t\t\t},\n\t\t\t\trecords?.length || 0,\n\t\t\t);\n\t\t}\n\n\t\t// Apply Output Sanitizer before commitment to guarantee ZK output consistency\n\t\tfinalOutput = sanitizeOutput(finalOutput);\n\n\t\t// 5. Generate Cryptographic Proof of Execution (HMAC-SHA256 Commitment)\n\n\t\tconst journal = Buffer.from(\n\t\t\tJSON.stringify({\n\t\t\t\timage_id: imageId,\n\t\t\t\tdataset_hash: datasetHash,\n\t\t\t\toutput_hash: crypto\n\t\t\t\t\t.createHash(\"sha256\")\n\t\t\t\t\t.update(\n\t\t\t\t\t\ttypeof finalOutput === \"string\"\n\t\t\t\t\t\t\t? finalOutput\n\t\t\t\t\t\t\t: finalOutput === undefined\n\t\t\t\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t\t\t\t: JSON.stringify(finalOutput),\n\t\t\t\t\t)\n\t\t\t\t\t.digest(\"hex\"),\n\t\t\t\tfuel: result.fuelConsumed,\n\t\t\t\tts: Date.now(),\n\t\t\t}),\n\t\t);\n\n\t\tconst seal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tconst journalLen = Buffer.alloc(2);\n\t\tjournalLen.writeUInt16BE(journal.length);\n\t\tconst receiptBuf = Buffer.concat([\n\t\t\tBuffer.from([0x01]), // Receipt format v1\n\t\t\tjournalLen,\n\t\t\tjournal,\n\t\t\tseal, // 32 bytes HMAC\n\t\t]);\n\t\tconst zkReceipt = receiptBuf.toString(\"base64\");\n\n\t\treturn {\n\t\t\timage_id: imageId,\n\t\t\tzk_receipt: zkReceipt,\n\t\t\toutput: finalOutput,\n\t\t\tfuel_consumed: result.fuelConsumed,\n\t\t};\n\t} finally {\n\t\tawait sandbox.teardown();\n\t}\n}\n"]}

package/dist/workers/zk-verifier.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/workers/zk-verifier.ts"],"names":[],"mappings":";;;;AA8BA,SAAS,cAAc,YAAA,EAAkC;AACxD,EAAA,OAAO,uBAAuB,YAAY,CAAA;AAC3C;AAUA,SAAS,sBAAsB,YAAA,EAA0C;AACxE,EAAA,IAAI;AACH,IAAA,MAAM,QAAA,GAAW,OAAO,IAAA,CAAK,YAAY,EAAE,QAAA,CAAS,OAAO,EAAE,IAAA,EAAK;AAClE,IAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,mBAAmB,CAAA,EAAG;AAC5C,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,MAAM,aAAA,GAAgB,QAAA,CAAS,OAAA,CAAQ,GAAG,CAAA;AAC1C,IAAA,IAAI,kBAAkB,CAAA,CAAA,EAAI;AACzB,MAAA,OAAO,IAAA;AAAA,IACR;AAEA,IAAA,IAAI,UAAA,GAAa,CAAA;AACjB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAA,IAAI,UAAA,GAAa,KAAA;AACjB,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,IAAI,YAAA,GAAe,CAAA,CAAA;AAEnB,IAAA,KAAA,IAAS,CAAA,GAAI,aAAA,EAAe,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACrD,MAAA,MAAM,IAAA,GAAO,SAAS,CAAC,CAAA;AAEvB,MAAA,IAAI,OAAA,EAAS;AACZ,QAAA,OAAA,GAAU,KAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,SAAS,IAAA,EAAM;AAClB,QAAA,OAAA,GAAU,IAAA;AACV,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AAClD,QAAA,aAAA,GAAgB,CAAC,aAAA;AACjB,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,IAAA,KAAS,GAAA,IAAO,CAAC,aAAA,IAAiB,CAAC,aAAA,EAAe;AACrD,QAAA,UAAA,GAAa,CAAC,UAAA;AACd,QAAA;AAAA,MACD;AAEA,MAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,aAAA,IAAiB,CAAC,UAAA,EAAY;AACpD,QAAA,IAAI,SAAS,GAAA,EAAK;AACjB,UAAA,UAAA,EAAA;AAAA,QACD,CAAA,MAAA,IAAW,SAAS,GAAA,EAAK;AACxB,UAAA,UAAA,EAAA;AACA,UAAA,IAAI,eAAe,CAAA,EAAG;AACrB,YAAA,YAAA,GAAe,CAAA;AACf,YAAA;AAAA,UACD;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,IAAA,IAAI,iBAAiB,CAAA,CAAA,EAAI;AACxB,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,KAAA,CAAM,aAAA,EAAe,eAAe,CAAC,CAAA;AAC9D,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,MAAA,IAAI,QAAQ,iBAAA,EAAmB;AAC9B,QAAA,OAAO,MAAA;AAAA,MACR;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AAAA,EAEb;AACA,EAAA,OAAO,IAAA;AACR;AAMA,eAAe,gBACd,OAAA,EACkD;AAClD,EAAA,MAAM;AAAA,IACL,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACD,GAAI,OAAA;AAEJ,EAAA,IAAI,CAAC,YAAA,IAAgB,CAAC,gBAAA,IAAoB,CAAC,SAAA,EAAW;AACrD,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,MAAM,YAAA,GAAe,cAAc,YAAY,CAAA;AAC/C,EAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,QAAA,CAAS,KAAK,CAAA;AAEnD,EAAA,IAAI,oBAAoB,gBAAA,EAAkB;AACzC,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,4BAAA,EAA+B,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,aAAA,EAAgB,gBAAA,CAAiB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,KAChH;AAAA,EACD;AAGA,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA;AACxC,EAAA,IAAI,UAAA,CAAW,SAAS,EAAA,EAAI;AAE3B,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAEA,EAAA,MAAM,OAAA,GAAU,WAAW,CAAC,CAAA;AAC5B,EAAA,IAAI,YAAY,CAAA,EAAM;AACrB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,4BAA4B,OAAO,CAAA;AAAA,KAC7C;AAAA,EACD;AAEA,EAAA,MAAM,UAAA,GAAa,UAAA,CAAW,YAAA,CAAa,CAAC,CAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,QAAA,CAAS,CAAA,EAAG,IAAI,UAAU,CAAA;AACrD,EAAA,MAAM,IAAA,GAAO,UAAA,CAAW,QAAA,CAAS,CAAA,GAAI,UAAU,CAAA;AAE/C,EAAA,IAAI,IAAA,CAAK,WAAW,EAAA,EAAI;AACvB,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS;AAAA,KACV;AAAA,EACD;AAGA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACH,IAAA,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C,IAAA,IAAI,WAAA,CAAY,aAAa,eAAA,EAAiB;AAC7C,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,0BAAA,EAA6B,WAAA,CAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,IAAA,EAAO,eAAA,CAAgB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA;AAAA,OACzG;AAAA,IACD;AAAA,EACD,SAAS,EAAA,EAAI;AACZ,IAAA,OAAO,EAAE,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,+BAAA,EAAgC;AAAA,EACpE;AAGA,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC9C,IAAA,MAAM,YAAA,GAAe,OACnB,UAAA,CAAW,QAAA,EAAU,aAAa,CAAA,CAClC,MAAA,CAAO,OAAO,CAAA,CACd,MAAA,EAAO;AACT,IAAA,IAAI,CAAC,MAAA,CAAO,eAAA,CAAgB,IAAA,EAAM,YAAY,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AAAA,EACD;AAGA,EAAA,IAAI,mBAAmB,MAAA,EAAW;AACjC,IAAA,MAAM,WAAA,GAAc,sBAAsB,YAAY,CAAA;AACtD,IAAA,MAAM,cAAA,GAAiB,WAAA,KAAgB,IAAA,GAAO,WAAA,GAAc,cAAA;AAE5D,IAAA,MAAM,iBAAA,GACL,OAAO,cAAA,KAAmB,QAAA,GACvB,cAAA,GACA,mBAAmB,MAAA,GAClB,WAAA,GACA,IAAA,CAAK,SAAA,CAAU,cAAc,CAAA;AAClC,IAAA,MAAM,kBAAA,GAAqB,OACzB,UAAA,CAAW,QAAQ,EACnB,MAAA,CAAO,iBAAiB,CAAA,CACxB,MAAA,CAAO,KAAK,CAAA;AAEd,IAAA,IAAI,WAAA,CAAY,gBAAgB,kBAAA,EAAoB;AACnD,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,KAAA;AAAA,QACV,OAAA,EAAS,CAAA,mEAAA,EAAsE,WAAA,CAAY,WAAA,CAAY,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,6BAAA,EAAgC,kBAAA,CAAmB,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAAA,OACjL;AAAA,IACD;AAAA,EACD;AAEA,EAAA,OAAO;AAAA,IACN,QAAA,EAAU,IAAA;AAAA,IACV,OAAA,EAAS;AAAA,GACV;AACD;AAKA,eAAO,cACN,IAAA,EACkD;AAClD,EAAA,IAAI;AACH,IAAA,IAAI,IAAA,CAAK,WAAW,QAAA,EAAU;AAC7B,MAAA,OAAO;AAAA,QACN,QAAA,EAAU,IAAA;AAAA,QACV,OAAA,EAAS;AAAA,OACV;AAAA,IACD;AACA,IAAA,IAAI,IAAA,CAAK,WAAW,gBAAA,EAAkB;AACrC,MAAA,OAAO,MAAM,gBAAgB,IAAI,CAAA;AAAA,IAClC;AACA,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACvD,SAAS,KAAA,EAAO;AACf,IAAA,OAAO;AAAA,MACN,QAAA,EAAU,KAAA;AAAA,MACV,OAAA,EAAS,CAAA,oBAAA,EAAwB,KAAA,CAAgB,OAAO,CAAA;AAAA,KACzD;AAAA,EACD;AACD","file":"zk-verifier.js","sourcesContent":["// Copyright 2026 Nekzus Solutions and contributors\n// SPDX-License-Identifier: Apache-2.0\n\nimport crypto from \"node:crypto\";\nimport { parentPort } from \"node:worker_threads\";\nimport { deriveLogicImageDigest } from \"../crypto/logic-image-id.js\";\n\n// Ensure this worker is used via Piscina pool\nif (!parentPort) {\n\t// Not fatal in Piscina, but handled appropriately\n}\n\n/**\n * ZK Verification Payload Structure.\n * Modeled after RISC Zero & SP1 Receipt formats.\n */\nexport interface ZkVerificationPayload {\n\taction: \"verify_receipt\" | \"warmup\";\n\t/** Original logic payload (JS/WASM) sent by client */\n\tlogicPayload?: Uint8Array;\n\t/** Expected ImageID (SHA-256) of the execution state */\n\tremoteImageIdHex?: string;\n\t/** Cbor-encoded or raw buffer containing the execution Receipt (Journal + Seal) */\n\tzkReceipt?: Uint8Array;\n\t/** Kyber-derived session secret to verify HMAC signature */\n\tsessionSecret?: Uint8Array;\n\t/** The expected output value of the computation for anti-replay/tampering verification */\n\texpectedOutput?: unknown;\n}\n\nfunction deriveImageId(logicPayload: Uint8Array): Buffer {\n\treturn deriveLogicImageDigest(logicPayload);\n}\n\ninterface ZkJournal {\n\timage_id: string;\n\tdataset_hash: string;\n\toutput_hash: string;\n\tfuel: number;\n\tts: number;\n}\n\nfunction tryExtractProxyOutput(logicPayload: Uint8Array): unknown | null {\n\ttry {\n\t\tconst logicStr = Buffer.from(logicPayload).toString(\"utf-8\").trim();\n\t\tif (!logicStr.includes(\"__liop_proxy_tool\")) {\n\t\t\treturn null;\n\t\t}\n\n\t\tconst firstBraceIdx = logicStr.indexOf(\"{\");\n\t\tif (firstBraceIdx === -1) {\n\t\t\treturn null;\n\t\t}\n\n\t\tlet braceCount = 0;\n\t\tlet inDoubleQuote = false;\n\t\tlet inSingleQuote = false;\n\t\tlet inBacktick = false;\n\t\tlet escaped = false;\n\t\tlet lastBraceIdx = -1;\n\n\t\tfor (let i = firstBraceIdx; i < logicStr.length; i++) {\n\t\t\tconst char = logicStr[i];\n\n\t\t\tif (escaped) {\n\t\t\t\tescaped = false;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"\\\\\") {\n\t\t\t\tescaped = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === '\"' && !inSingleQuote && !inBacktick) {\n\t\t\t\tinDoubleQuote = !inDoubleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"'\" && !inDoubleQuote && !inBacktick) {\n\t\t\t\tinSingleQuote = !inSingleQuote;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (char === \"`\" && !inDoubleQuote && !inSingleQuote) {\n\t\t\t\tinBacktick = !inBacktick;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (!inDoubleQuote && !inSingleQuote && !inBacktick) {\n\t\t\t\tif (char === \"{\") {\n\t\t\t\t\tbraceCount++;\n\t\t\t\t} else if (char === \"}\") {\n\t\t\t\t\tbraceCount--;\n\t\t\t\t\tif (braceCount === 0) {\n\t\t\t\t\t\tlastBraceIdx = i;\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (lastBraceIdx !== -1) {\n\t\t\tconst jsonStr = logicStr.slice(firstBraceIdx, lastBraceIdx + 1);\n\t\t\tconst parsed = JSON.parse(jsonStr);\n\t\t\tif (parsed?.__liop_proxy_tool) {\n\t\t\t\treturn parsed;\n\t\t\t}\n\t\t}\n\t} catch (_e) {\n\t\t// Fallback\n\t}\n\treturn null;\n}\n\n/**\n * Simulates heavy ZK-Proof cryptographic verification.\n * In a real environment, this delegates to @risc0/verifier or SP1 FFI bindings.\n */\nasync function verifyZkReceipt(\n\tpayload: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\tconst {\n\t\tlogicPayload,\n\t\tremoteImageIdHex,\n\t\tzkReceipt,\n\t\tsessionSecret,\n\t\texpectedOutput,\n\t} = payload;\n\n\tif (!logicPayload || !remoteImageIdHex || !zkReceipt) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Missing required verification fields.\",\n\t\t};\n\t}\n\n\t// 1. Calculate local ImageID (Integrity Check)\n\tconst localImageId = deriveImageId(logicPayload);\n\tconst localImageIdHex = localImageId.toString(\"hex\");\n\n\tif (localImageIdHex !== remoteImageIdHex) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Integrity Violation: Local (${localImageIdHex.slice(0, 8)}) != Remote (${remoteImageIdHex.slice(0, 8)})`,\n\t\t};\n\t}\n\n\t// 2. Structural Verification: Deserialize Binary Receipt\n\tconst receiptBuf = Buffer.from(zkReceipt);\n\tif (receiptBuf.length < 35) {\n\t\t// 1 version + 2 len + 32 seal minimum\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Receipt too short for binary format.\",\n\t\t};\n\t}\n\n\tconst version = receiptBuf[0];\n\tif (version !== 0x01) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Unknown receipt version: ${version}`,\n\t\t};\n\t}\n\n\tconst journalLen = receiptBuf.readUInt16BE(1);\n\tconst journal = receiptBuf.subarray(3, 3 + journalLen);\n\tconst seal = receiptBuf.subarray(3 + journalLen);\n\n\tif (seal.length !== 32) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: \"Invalid seal length (expected 32 bytes HMAC-SHA256).\",\n\t\t};\n\t}\n\n\t// 3. Parse journal and verify imageId\n\tlet journalData: ZkJournal;\n\ttry {\n\t\tjournalData = JSON.parse(journal.toString()) as ZkJournal;\n\t\tif (journalData.image_id !== localImageIdHex) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Journal ImageID mismatch: ${journalData.image_id.slice(0, 8)} != ${localImageIdHex.slice(0, 8)}`,\n\t\t\t};\n\t\t}\n\t} catch (_e) {\n\t\treturn { verified: false, message: \"Failed to parse journal data.\" };\n\t}\n\n\t// 4. Mathematical Verification (HMAC-SHA256)\n\tif (sessionSecret && sessionSecret.length > 0) {\n\t\tconst expectedSeal = crypto\n\t\t\t.createHmac(\"sha256\", sessionSecret)\n\t\t\t.update(journal)\n\t\t\t.digest();\n\t\tif (!crypto.timingSafeEqual(seal, expectedSeal)) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: \"Invalid seal: HMAC verification failed.\",\n\t\t\t};\n\t\t}\n\t}\n\n\t// 5. Output Hash Verification (Anti-Replay / Anti-Tampering)\n\tif (expectedOutput !== undefined) {\n\t\tconst proxyOutput = tryExtractProxyOutput(logicPayload);\n\t\tconst actualExpected = proxyOutput !== null ? proxyOutput : expectedOutput;\n\n\t\tconst expectedOutputStr =\n\t\t\ttypeof actualExpected === \"string\"\n\t\t\t\t? actualExpected\n\t\t\t\t: actualExpected === undefined\n\t\t\t\t\t? \"undefined\"\n\t\t\t\t\t: JSON.stringify(actualExpected);\n\t\tconst expectedOutputHash = crypto\n\t\t\t.createHash(\"sha256\")\n\t\t\t.update(expectedOutputStr)\n\t\t\t.digest(\"hex\");\n\n\t\tif (journalData.output_hash !== expectedOutputHash) {\n\t\t\treturn {\n\t\t\t\tverified: false,\n\t\t\t\tmessage: `Output Hash Mismatch (Replay/Tamper attempt): Journal output_hash (${journalData.output_hash.slice(0, 8)}) != Calculated output_hash (${expectedOutputHash.slice(0, 8)})`,\n\t\t\t};\n\t\t}\n\t}\n\n\treturn {\n\t\tverified: true,\n\t\tmessage: \"HMAC Commitment Verified: Integrity intact.\",\n\t};\n}\n\n/**\n * Main worker entry point for Piscina.\n */\nexport default async function workerHandler(\n\ttask: ZkVerificationPayload,\n): Promise<{ verified: boolean; message: string }> {\n\ttry {\n\t\tif (task.action === \"warmup\") {\n\t\t\treturn {\n\t\t\t\tverified: true,\n\t\t\t\tmessage: \"warm\",\n\t\t\t};\n\t\t}\n\t\tif (task.action === \"verify_receipt\") {\n\t\t\treturn await verifyZkReceipt(task);\n\t\t}\n\t\tthrow new Error(\"Unknown action in ZkVerifier Worker.\");\n\t} catch (error) {\n\t\treturn {\n\t\t\tverified: false,\n\t\t\tmessage: `Verification Error: ${(error as Error).message}`,\n\t\t};\n\t}\n}\n"]}