@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/cli/preflight-report.js

@@ -0,0 +1,135 @@
+/**
+ * preflight-report.ts
+ *
+ * Formatter: pretty-prints per-agent preflight results with status icons
+ * and a final summary line. Pure function -- no I/O.
+ *
+ * F-NEW-PRODUCT-AGENT-DIR-WRAPPER slice 4
+ * @connexum/ai-governance
+ */
+// ---------------------------------------------------------------------------
+// ANSI colour helpers (used only when colours are enabled)
+// ---------------------------------------------------------------------------
+const ANSI = {
+    reset: '\x1b[0m',
+    green: '\x1b[32m',
+    red: '\x1b[31m',
+    yellow: '\x1b[33m',
+    cyan: '\x1b[36m',
+    bold: '\x1b[1m',
+    dim: '\x1b[2m',
+};
+function c(text, colour, useColour) {
+    if (!useColour)
+        return text;
+    return `${ANSI[colour]}${text}${ANSI.reset}`;
+}
+export function statusDisplay(status) {
+    switch (status) {
+        case 'ok':
+            return { icon: '[ok]', label: 'GOVERNED', colour: 'green' };
+        case 'denied':
+            return { icon: '[denied]', label: 'GOVERNED', colour: 'yellow' };
+        case 'error':
+            return { icon: '[error]', label: 'FAILED', colour: 'red' };
+        case 'skipped':
+            return { icon: '[skip]', label: 'SKIPPED', colour: 'dim' };
+        case 'pending':
+            return { icon: '[pending]', label: 'PENDING', colour: 'cyan' };
+        default:
+            return { icon: '[?]', label: 'UNKNOWN', colour: 'dim' };
+    }
+}
+// ---------------------------------------------------------------------------
+// Per-agent line
+// ---------------------------------------------------------------------------
+export function formatAgentLine(result, useColour) {
+    const { icon, label, colour } = statusDisplay(result.status);
+    const iconStr = c(icon, colour, useColour);
+    const labelStr = c(`[${label}]`, colour, useColour);
+    const fileStr = c(result.filePath, 'bold', useColour);
+    const idStr = c(`(${result.agentId})`, 'dim', useColour);
+    const provStr = result.provider
+        ? c(`provider=${result.provider}`, 'dim', useColour)
+        : c('provider=unknown', 'dim', useColour);
+    const fwStr = result.framework
+        ? c(` framework=${result.framework}`, 'dim', useColour)
+        : '';
+    return `  ${iconStr} ${fileStr} ${idStr} ${provStr}${fwStr} ${labelStr}`;
+}
+// ---------------------------------------------------------------------------
+// Detail line (indented, only when there is a message to show)
+// ---------------------------------------------------------------------------
+export function formatDetailLine(result, useColour) {
+    if (!result.detail)
+        return null;
+    return `       ${c(result.detail, 'dim', useColour)}`;
+}
+export function computeSummary(results) {
+    let governed = 0, denied = 0, errors = 0, skipped = 0, pending = 0;
+    for (const r of results) {
+        if (r.status === 'ok')
+            governed++;
+        if (r.status === 'denied') {
+            governed++;
+            denied++;
+        }
+        if (r.status === 'error')
+            errors++;
+        if (r.status === 'skipped')
+            skipped++;
+        if (r.status === 'pending')
+            pending++;
+    }
+    return { total: results.length, governed, denied, errors, skipped, pending };
+}
+export function formatSummaryLine(summary, useColour) {
+    const parts = [];
+    const govStr = c(`${summary.governed} governed successfully`, 'green', useColour);
+    parts.push(govStr);
+    if (summary.denied > 0) {
+        parts.push(c(`${summary.denied} rule-blocked (still governed)`, 'yellow', useColour));
+    }
+    if (summary.errors > 0) {
+        parts.push(c(`${summary.errors} need manual review`, 'red', useColour));
+    }
+    if (summary.skipped > 0) {
+        parts.push(c(`${summary.skipped} skipped (unsupported provider)`, 'dim', useColour));
+    }
+    if (summary.pending > 0) {
+        parts.push(c(`${summary.pending} pending (sidecar unreachable)`, 'cyan', useColour));
+    }
+    return (c(`${summary.total} agents detected, `, 'bold', useColour) +
+        parts.join(', '));
+}
+/**
+ * Format the full preflight report as a string suitable for stdout.
+ */
+export function formatPreflightReport(results, opts = {}) {
+    const useColour = opts.useColour ?? false;
+    const showDetail = opts.showDetail !== false;
+    const header = opts.header ?? 'Preflight report';
+    const lines = [];
+    lines.push('');
+    lines.push(c(`=== ${header} ===`, 'bold', useColour));
+    lines.push('');
+    if (results.length === 0) {
+        lines.push(c('  No agents to check.', 'dim', useColour));
+    }
+    else {
+        for (const r of results) {
+            lines.push(formatAgentLine(r, useColour));
+            if (showDetail) {
+                const detail = formatDetailLine(r, useColour);
+                if (detail)
+                    lines.push(detail);
+            }
+        }
+    }
+    lines.push('');
+    const summary = computeSummary(results);
+    lines.push(formatSummaryLine(summary, useColour));
+    lines.push('');
+    return lines.join('\n');
+}
+//# sourceMappingURL=preflight-report.js.map

package/dist/esm/cli/preflight-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight-report.js","sourceRoot":"","sources":["../../../src/cli/preflight-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAM,IAAI,GAAG;IACX,KAAK,EAAG,SAAS;IACjB,KAAK,EAAG,UAAU;IAClB,GAAG,EAAK,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAI,UAAU;IAClB,IAAI,EAAI,SAAS;IACjB,GAAG,EAAK,SAAS;CACT,CAAC;AAEX,SAAS,CAAC,CAAC,IAAY,EAAE,MAAyB,EAAE,SAAkB;IACpE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;AAC/C,CAAC;AAYD,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,IAAI;YACP,OAAO,EAAE,IAAI,EAAE,MAAM,EAAO,KAAK,EAAE,UAAU,EAAK,MAAM,EAAE,OAAO,EAAG,CAAC;QACvE,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,UAAU,EAAG,KAAK,EAAE,UAAU,EAAK,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvE,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,SAAS,EAAI,KAAK,EAAE,QAAQ,EAAO,MAAM,EAAE,KAAK,EAAK,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAK,KAAK,EAAE,SAAS,EAAM,MAAM,EAAE,KAAK,EAAK,CAAC;QACvE,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAM,MAAM,EAAE,MAAM,EAAI,CAAC;QACvE;YACE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAQ,KAAK,EAAE,SAAS,EAAM,MAAM,EAAE,KAAK,EAAK,CAAC;IACzE,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAC7B,MAAuB,EACvB,SAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAK,CAAC,CAAC,IAAI,EAAwB,MAAM,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAgB,MAAM,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,OAAO,GAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAc,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,KAAK,GAAO,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,EAAQ,KAAK,EAAG,SAAS,CAAC,CAAC;IACpE,MAAM,OAAO,GAAK,MAAM,CAAC,QAAQ;QAC/B,CAAC,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC;QACpD,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAa,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,KAAK,GAAO,MAAM,CAAC,SAAS;QAChC,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,KAAK,OAAO,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,QAAQ,EAAE,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAC9B,MAAuB,EACvB,SAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;AACxD,CAAC;AAeD,MAAM,UAAU,cAAc,CAAC,OAA0B;IACvD,IAAI,QAAQ,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;YAAO,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAG,CAAC;YAAC,QAAQ,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC;QAAC,CAAC;QACrD,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAI,MAAM,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAyB,EACzB,SAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,wBAAwB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,gCAAgC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,qBAAqB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,iCAAiC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,gCAAgC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,OAAO,CACL,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,oBAAoB,EAAE,MAAM,EAAE,SAAS,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACjB,CAAC;AACJ,CAAC;AAeD;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAC1B,OAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;IAEjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1C,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC9C,IAAI,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/esm/cli/preflight.js

@@ -0,0 +1,339 @@
+/**
+ * preflight.ts
+ *
+ * Boot each detected agent in dry-run mode against the running governance-sidecar.
+ * For each agent: fires a PreToolUse-equivalent check-action call, asserts that
+ * an audit chain entry lands, and returns per-agent status.
+ *
+ * Pure async function -- no process.exit, no stdout writes.
+ *
+ * F-NEW-PRODUCT-AGENT-DIR-WRAPPER slice 4
+ * @connexum/ai-governance
+ */
+import * as http from 'node:http';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+// ---------------------------------------------------------------------------
+// Providers with a governed wrapper in this SDK version
+// ---------------------------------------------------------------------------
+const SUPPORTED_PROVIDERS = new Set([
+    'openai',
+    'anthropic',
+    'google',
+    'langchain',
+    'crewai',
+    'autogen',
+    'langgraph',
+    'pydantic_ai',
+    'haystack',
+    'semantic_kernel',
+    'llama_index',
+    'replicate',
+    'bedrock',
+    'azure_openai',
+]);
+// ---------------------------------------------------------------------------
+// HTTP helper (no external dependencies)
+// ---------------------------------------------------------------------------
+function httpRequest(url, method, body, headers, timeoutMs = 8_000) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const bodyStr = body !== undefined ? JSON.stringify(body) : undefined;
+        const reqHeaders = {
+            'Content-Type': 'application/json',
+            ...headers,
+        };
+        if (bodyStr !== undefined) {
+            reqHeaders['Content-Length'] = String(Buffer.byteLength(bodyStr));
+        }
+        const opts = {
+            hostname: parsed.hostname,
+            port: parsed.port ? parseInt(parsed.port, 10) : 80,
+            path: parsed.pathname + (parsed.search ?? ''),
+            method,
+            headers: reqHeaders,
+        };
+        const req = http.request(opts, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => {
+                const raw = Buffer.concat(chunks).toString('utf-8');
+                let parsed2 = {};
+                try {
+                    parsed2 = JSON.parse(raw);
+                }
+                catch { /* non-JSON body */ }
+                resolve({ status: res.statusCode ?? 0, body: parsed2, raw });
+            });
+        });
+        req.setTimeout(timeoutMs, () => {
+            req.destroy(new Error(`Request timed out after ${timeoutMs}ms`));
+        });
+        req.on('error', reject);
+        if (bodyStr !== undefined)
+            req.write(bodyStr);
+        req.end();
+    });
+}
+// ---------------------------------------------------------------------------
+// Sidecar reachability check
+// ---------------------------------------------------------------------------
+async function isSidecarReachable(sidecarUrl) {
+    // Accept both 4200 (public) and 4201 (internal) -- try /api/v1/health on
+    // whichever port/path is provided.
+    try {
+        const healthUrl = sidecarUrl.replace(/\/$/, '') + '/api/v1/health';
+        const res = await httpRequest(healthUrl, 'GET', undefined, undefined, 3_000);
+        return res.status >= 200 && res.status < 500;
+    }
+    catch {
+        return false;
+    }
+}
+// ---------------------------------------------------------------------------
+// Mint a preflight auth token via the sidecar's /auth/register endpoint.
+// Used when no external authToken is provided.
+// Returns the accessToken string, or null on failure.
+// ---------------------------------------------------------------------------
+async function mintPreflightToken(sidecarUrl, orgId) {
+    const base = sidecarUrl.replace(/\/$/, '');
+    try {
+        const res = await httpRequest(`${base}/api/v1/auth/register`, 'POST', {
+            email: `preflight-${orgId}@connexum-preflight.internal`,
+            password: 'PreflightPass1!',
+            orgId,
+        }, {}, 5_000);
+        if (res.status === 200 || res.status === 201) {
+            return res.body.accessToken ?? null;
+        }
+        // 409 = already registered — try login
+        if (res.status === 409) {
+            const login = await httpRequest(`${base}/api/v1/auth/login`, 'POST', {
+                email: `preflight-${orgId}@connexum-preflight.internal`,
+                password: 'PreflightPass1!',
+            }, {}, 5_000);
+            return login.body.accessToken ?? null;
+        }
+    }
+    catch {
+        // swallow -- caller handles null
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Resolve the shim path for an agent (if it exists)
+// ---------------------------------------------------------------------------
+function shimExists(agent, agentDir) {
+    const ext = path.extname(agent.filePath);
+    const base = agent.filePath.replace(new RegExp(`\\${ext}$`), '');
+    const shimPy = path.join(agentDir, `${base}.governed.py`);
+    const shimTs = path.join(agentDir, `${base}.governed.ts`);
+    const shimJs = path.join(agentDir, `${base}.governed.js`);
+    return fs.existsSync(shimPy) || fs.existsSync(shimTs) || fs.existsSync(shimJs);
+}
+async function firePreflight(sidecarUrl, agent, orgId, authToken) {
+    const base = sidecarUrl.replace(/\/$/, '');
+    // Fire a dry-run PreToolUse equivalent against /governance/check-action
+    const checkRes = await httpRequest(`${base}/api/v1/governance/check-action`, 'POST', {
+        toolName: 'preflight-dry-run',
+        input: {
+            preflight: true,
+            agentId: agent.agentId,
+            provider: agent.provider,
+            framework: agent.framework,
+            filePath: agent.filePath,
+            dryRun: true,
+        },
+        agent: {
+            name: agent.agentId,
+            orgId,
+        },
+        userId: 'preflight-system',
+        sessionId: `preflight-${agent.agentId}-${Date.now()}`,
+    }, { Authorization: `Bearer ${authToken}` }, 8_000);
+    const decision = checkRes.body.decision ?? checkRes.body.action ?? 'unknown';
+    const auditEntryId = checkRes.body.auditId ?? null;
+    return { decision, auditEntryId };
+}
+// ---------------------------------------------------------------------------
+// Verify audit chain entry landed
+//
+// The governance-server appends to the audit chain in a non-blocking async
+// IIFE (fire-and-forget). The HTTP response for check-action returns before
+// the chain write completes. We poll with short backoff to give it time.
+// ---------------------------------------------------------------------------
+const CHAIN_POLL_ATTEMPTS = 6;
+const CHAIN_POLL_DELAY_MS = 120; // 6 x 120ms = up to ~720ms wait
+function delay(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+async function verifyAuditEntry(sidecarUrl, orgId, authToken, expectedAuditId, agentId) {
+    const base = sidecarUrl.replace(/\/$/, '');
+    for (let attempt = 0; attempt < CHAIN_POLL_ATTEMPTS; attempt++) {
+        if (attempt > 0)
+            await delay(CHAIN_POLL_DELAY_MS);
+        // The audit-chain response format: each entry is AuditChainEntry { id, orgId, entryData, ... }
+        // The server's check-action response returns `auditId` which equals `entryData.auditId`,
+        // NOT `AuditChainEntry.id` (which is a separate crypto.randomUUID()).
+        // So we always scan `entryData` fields for matching.
+        try {
+            const chainRes = await httpRequest(`${base}/api/v1/governance/audit-chain?limit=100`, 'GET', undefined, { Authorization: `Bearer ${authToken}` }, 5_000);
+            if (chainRes.status !== 200)
+                continue;
+            const chain = chainRes.body.chain ?? [];
+            const found = chain.some((e) => {
+                const ed = e.entryData ?? {};
+                // Match by auditId in entryData (primary)
+                if (expectedAuditId && ed.auditId === expectedAuditId) {
+                    return true;
+                }
+                // Match by toolName = preflight-dry-run OR agentName contains our agentId
+                if (ed.toolName === 'preflight-dry-run')
+                    return true;
+                if (ed.agentName?.includes(agentId))
+                    return true;
+                return false;
+            });
+            if (found)
+                return true;
+        }
+        catch {
+            // retry on next attempt
+        }
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Public entry point
+// ---------------------------------------------------------------------------
+/**
+ * Run a preflight check for every detected agent against the governance-sidecar.
+ *
+ * For each agent:
+ *   1. Checks the sidecar is reachable.
+ *   2. Skips unsupported providers (status: 'skipped').
+ *   3. Verifies the .governed shim exists (status: 'error' if missing).
+ *   4. Fires a dry-run PreToolUse check-action.
+ *   5. Asserts an audit chain entry lands.
+ *   6. Returns status 'ok', 'denied', or 'error'.
+ *
+ * Never throws -- all errors are captured in the result.
+ *
+ * @param agents    Detected agents from scanAgentDirectory()
+ * @param agentDir  Absolute path to the agent directory (for shim resolution)
+ * @param opts      Preflight options
+ */
+export async function preflightAgents(agents, agentDir, opts) {
+    const orgId = opts.orgId ?? 'preflight-org';
+    const skipUnsupported = opts.skipUnsupported !== false;
+    // Early-exit if no agents
+    if (agents.length === 0)
+        return [];
+    // 1. Reachability check (one call for the whole batch)
+    const reachable = await isSidecarReachable(opts.sidecarUrl);
+    if (!reachable) {
+        return agents.map((a) => ({
+            agentId: a.agentId,
+            filePath: a.filePath,
+            provider: a.provider,
+            framework: a.framework,
+            status: 'pending',
+            detail: `Sidecar not reachable at ${opts.sidecarUrl} — preflight skipped. Start the sidecar or use --skip-preflight.`,
+            checkedAt: new Date().toISOString(),
+            auditEntryId: null,
+        }));
+    }
+    // 2. Obtain auth token
+    const authToken = opts.authToken ?? (await mintPreflightToken(opts.sidecarUrl, orgId));
+    if (!authToken) {
+        return agents.map((a) => ({
+            agentId: a.agentId,
+            filePath: a.filePath,
+            provider: a.provider,
+            framework: a.framework,
+            status: 'error',
+            detail: 'Could not obtain auth token from sidecar. Check sidecar logs.',
+            checkedAt: new Date().toISOString(),
+            auditEntryId: null,
+        }));
+    }
+    // 3. Run checks in parallel (bounded by Promise.all -- no artificial cap
+    //    because sidecar is local and 30 concurrent HTTP calls are fine)
+    const results = await Promise.all(agents.map(async (agent) => {
+        const now = new Date().toISOString();
+        // Unsupported provider
+        const effectiveProvider = agent.framework ?? agent.provider;
+        if (skipUnsupported &&
+            effectiveProvider !== null &&
+            !SUPPORTED_PROVIDERS.has(effectiveProvider)) {
+            return {
+                agentId: agent.agentId,
+                filePath: agent.filePath,
+                provider: agent.provider,
+                framework: agent.framework,
+                status: 'skipped',
+                detail: `Provider '${effectiveProvider}' has no governed wrapper yet. Skipping preflight.`,
+                checkedAt: now,
+                auditEntryId: null,
+            };
+        }
+        // Shim existence check
+        if (!shimExists(agent, agentDir)) {
+            return {
+                agentId: agent.agentId,
+                filePath: agent.filePath,
+                provider: agent.provider,
+                framework: agent.framework,
+                status: 'error',
+                detail: `Governed shim not found next to ${agent.filePath}. Run 'ai-governance init --agent-dir <path>' to generate it.`,
+                checkedAt: now,
+                auditEntryId: null,
+            };
+        }
+        // Fire the check-action and verify audit chain
+        try {
+            const check = await firePreflight(opts.sidecarUrl, agent, orgId, authToken);
+            const auditLanded = await verifyAuditEntry(opts.sidecarUrl, orgId, authToken, check.auditEntryId, agent.agentId);
+            const decisionUpper = (check.decision ?? '').toUpperCase();
+            const isDenied = decisionUpper === 'DENY' || decisionUpper === 'DENIED' || decisionUpper === 'BLOCK';
+            if (!auditLanded) {
+                return {
+                    agentId: agent.agentId,
+                    filePath: agent.filePath,
+                    provider: agent.provider,
+                    framework: agent.framework,
+                    status: 'error',
+                    detail: `Governance hook fired but audit chain entry was NOT confirmed. Check sidecar storage adapter.`,
+                    checkedAt: now,
+                    auditEntryId: check.auditEntryId,
+                };
+            }
+            return {
+                agentId: agent.agentId,
+                filePath: agent.filePath,
+                provider: agent.provider,
+                framework: agent.framework,
+                status: isDenied ? 'denied' : 'ok',
+                detail: isDenied
+                    ? `Pack policy DENIED tool 'preflight-dry-run' for this agent. Agent IS governed — rule blocked the action.`
+                    : `Governance hooks fired. Audit chain entry confirmed. Pack policy applied.`,
+                checkedAt: now,
+                auditEntryId: check.auditEntryId,
+            };
+        }
+        catch (err) {
+            return {
+                agentId: agent.agentId,
+                filePath: agent.filePath,
+                provider: agent.provider,
+                framework: agent.framework,
+                status: 'error',
+                detail: `Preflight threw: ${err.message}`,
+                checkedAt: now,
+                auditEntryId: null,
+            };
+        }
+    }));
+    return results;
+}
+//# sourceMappingURL=preflight.js.map

package/dist/esm/cli/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../src/cli/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAmClC,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,iBAAiB;IACjB,aAAa;IACb,WAAW;IACX,SAAS;IACT,cAAc;CACf,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,SAAS,WAAW,CAClB,GAAW,EACX,MAAc,EACd,IAAc,EACd,OAAgC,EAChC,SAAS,GAAG,KAAK;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,MAAM,UAAU,GAA2B;YACzC,cAAc,EAAE,kBAAkB;YAClC,GAAG,OAAO;SACX,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,GAAwB;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;YAClD,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAC7C,MAAM;YACN,OAAO,EAAE,UAAU;SACpB,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;YACrC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACpD,IAAI,OAAO,GAA4B,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;gBAChE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;YAC7B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,2BAA2B,SAAS,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExB,IAAI,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IAClD,yEAAyE;IACzE,mCAAmC;IACnC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACnE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,+CAA+C;AAC/C,sDAAsD;AACtD,8EAA8E;AAE9E,KAAK,UAAU,kBAAkB,CAC/B,UAAkB,EAClB,KAAa;IAEb,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,GAAG,IAAI,uBAAuB,EAC9B,MAAM,EACN;YACE,KAAK,EAAE,aAAa,KAAK,8BAA8B;YACvD,QAAQ,EAAE,iBAAiB;YAC3B,KAAK;SACN,EACD,EAAE,EACF,KAAK,CACN,CAAC;QACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAQ,GAAG,CAAC,IAAI,CAAC,WAAsB,IAAI,IAAI,CAAC;QAClD,CAAC;QACD,uCAAuC;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,GAAG,IAAI,oBAAoB,EAC3B,MAAM,EACN;gBACE,KAAK,EAAE,aAAa,KAAK,8BAA8B;gBACvD,QAAQ,EAAE,iBAAiB;aAC5B,EACD,EAAE,EACF,KAAK,CACN,CAAC;YACF,OAAQ,KAAK,CAAC,IAAI,CAAC,WAAsB,IAAI,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAE9E,SAAS,UAAU,CAAC,KAAoB,EAAE,QAAgB;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,cAAc,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAYD,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,KAAoB,EACpB,KAAa,EACb,SAAiB;IAEjB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE3C,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,GAAG,IAAI,iCAAiC,EACxC,MAAM,EACN;QACE,QAAQ,EAAE,mBAAmB;QAC7B,KAAK,EAAE;YACL,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,IAAI;SACb;QACD,KAAK,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,KAAK;SACN;QACD,MAAM,EAAE,kBAAkB;QAC1B,SAAS,EAAE,aAAa,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;KACtD,EACD,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE,EACxC,KAAK,CACN,CAAC;IAEF,MAAM,QAAQ,GAAI,QAAQ,CAAC,IAAI,CAAC,QAAmB,IAAK,QAAQ,CAAC,IAAI,CAAC,MAAiB,IAAI,SAAS,CAAC;IACrG,MAAM,YAAY,GAAI,QAAQ,CAAC,IAAI,CAAC,OAAkB,IAAI,IAAI,CAAC;IAE/D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,mBAAmB,GAAG,GAAG,CAAC,CAAC,gCAAgC;AAEjE,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,UAAkB,EAClB,KAAa,EACb,SAAiB,EACjB,eAA8B,EAC9B,OAAe;IAEf,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE3C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAElD,+FAA+F;QAC/F,yFAAyF;QACzF,sEAAsE;QACtE,qDAAqD;QACrD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,GAAG,IAAI,0CAA0C,EACjD,KAAK,EACL,SAAS,EACT,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE,EACxC,KAAK,CACN,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,SAAS;YACtC,MAAM,KAAK,GAAI,QAAQ,CAAC,IAAI,CAAC,KAAwC,IAAI,EAAE,CAAC;YAE5E,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7B,MAAM,EAAE,GAAI,CAAC,CAAC,SAAiD,IAAI,EAAE,CAAC;gBACtE,0CAA0C;gBAC1C,IAAI,eAAe,IAAK,EAAE,CAAC,OAA8B,KAAK,eAAe,EAAE,CAAC;oBAC9E,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,0EAA0E;gBAC1E,IAAK,EAAE,CAAC,QAA+B,KAAK,mBAAmB;oBAAE,OAAO,IAAI,CAAC;gBAC7E,IAAK,EAAE,CAAC,SAAgC,EAAE,QAAQ,CAAC,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzE,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YACH,IAAI,KAAK;gBAAE,OAAO,IAAI,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,QAAgB,EAChB,IAAsB;IAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC;IAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC;IAEvD,0BAA0B;IAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnC,uDAAuD;IACvD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,4BAA4B,IAAI,CAAC,UAAU,kEAAkE;YACrH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,uBAAuB;IACvB,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IAEvE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,+DAA+D;YACvE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,OAAO,GAAsB,MAAM,OAAO,CAAC,GAAG,CAClD,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAA4B,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,uBAAuB;QACvB,MAAM,iBAAiB,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC;QAC5D,IACE,eAAe;YACf,iBAAiB,KAAK,IAAI;YAC1B,CAAC,mBAAmB,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAC3C,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,aAAa,iBAAiB,oDAAoD;gBAC1F,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,mCAAmC,KAAK,CAAC,QAAQ,+DAA+D;gBACxH,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,IAAI,CAAC,UAAU,EACf,KAAK,EACL,KAAK,EACL,SAAS,CACV,CAAC;YAEF,MAAM,WAAW,GAAG,MAAM,gBAAgB,CACxC,IAAI,CAAC,UAAU,EACf,KAAK,EACL,SAAS,EACT,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,OAAO,CACd,CAAC;YAEF,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3D,MAAM,QAAQ,GAAG,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,OAAO,CAAC;YAErG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,+FAA+F;oBACvG,SAAS,EAAE,GAAG;oBACd,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;gBAClC,MAAM,EAAE,QAAQ;oBACd,CAAC,CAAC,0GAA0G;oBAC5G,CAAC,CAAC,2EAA2E;gBAC/E,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,oBAAqB,GAAa,CAAC,OAAO,EAAE;gBACpD,SAAS,EAAE,GAAG;gBACd,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC"}