@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/security/agent-auth.js

@@ -0,0 +1,253 @@
+/**
+ * AgentAuth -- Inter-agent authentication via HMAC-signed handoffs.
+ *
+ * Prevents handoff forgery between agents. Each agent has a derived
+ * secret from its name + SOUL content. All handoffs carry HMAC-SHA256
+ * signatures that are verified before acceptance.
+ *
+ * Addresses OWASP ASI07 (Inter-Agent Authentication).
+ *
+ * @connexum/ai-governance
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { NonceStore } from './nonce-store.js';
+export class AgentAuth {
+    config;
+    /** Cache of agent secrets derived from identity files */
+    secretCache = new Map();
+    /** Used nonces with timestamps (prevent replay with TTL-based expiry) */
+    usedNonces = new Map();
+    /** Persistent nonce store (survives process restart) */
+    nonceStore = null;
+    constructor(config) {
+        this.config = {
+            agentsDir: config.agentsDir,
+            secretSeed: config.secretSeed,
+            handoffLogPath: config.handoffLogPath || path.join(config.agentsDir, '..', 'audit', 'handoffs.jsonl'),
+            signatureWindowMs: config.signatureWindowMs ?? 300000,
+            nonceStoreDir: config.nonceStoreDir || '',
+        };
+        // Initialize persistent nonce store if directory is provided
+        if (this.config.nonceStoreDir) {
+            this.nonceStore = new NonceStore({
+                storePath: path.join(this.config.nonceStoreDir, 'handoff-nonces.jsonl'),
+                ttlMs: this.config.signatureWindowMs * 2,
+            });
+        }
+    }
+    /**
+     * Create a signed handoff from one agent to another.
+     */
+    createHandoff(from, to, task, payload) {
+        const timestamp = new Date().toISOString();
+        const nonce = crypto.randomBytes(16).toString('hex');
+        const id = `handoff_${Date.now()}_${nonce.slice(0, 8)}`;
+        const message = this.buildSignatureMessage(from, to, task, timestamp, nonce);
+        const secret = this.deriveAgentSecret(from);
+        const signature = crypto.createHmac('sha256', secret)
+            .update(message)
+            .digest('hex');
+        const handoff = { id, from, to, task, payload, timestamp, signature, nonce };
+        this.logHandoff('created', handoff);
+        return handoff;
+    }
+    /**
+     * Verify a signed handoff is authentic and hasn't been tampered with.
+     */
+    verifyHandoff(handoff) {
+        // Prune expired nonces before checking (TTL = 2x signature window)
+        this.pruneExpiredNonces();
+        // Check replay (nonce reuse) -- both in-memory and persistent store
+        if (this.usedNonces.has(handoff.nonce) ||
+            (this.nonceStore && this.nonceStore.has(handoff.nonce))) {
+            this.logHandoff('replay-rejected', handoff);
+            return { valid: false, handoff, reason: 'Nonce already used (replay attack)' };
+        }
+        // Check timestamp window
+        const handoffTime = new Date(handoff.timestamp).getTime();
+        const now = Date.now();
+        if (Math.abs(now - handoffTime) > this.config.signatureWindowMs) {
+            this.logHandoff('expired', handoff);
+            return { valid: false, handoff, reason: `Handoff expired (${Math.round(Math.abs(now - handoffTime) / 1000)}s old, max ${this.config.signatureWindowMs / 1000}s)` };
+        }
+        // Verify HMAC signature
+        const message = this.buildSignatureMessage(handoff.from, handoff.to, handoff.task, handoff.timestamp, handoff.nonce);
+        const secret = this.deriveAgentSecret(handoff.from);
+        const expectedSignature = crypto.createHmac('sha256', secret)
+            .update(message)
+            .digest('hex');
+        // F-NEW-CRIT-35: length-check before timingSafeEqual (Node throws
+        // ERR_CRYPTO_TIMING_SAFE_EQUAL_LENGTH on unequal-length buffers).
+        // A malformed handoff.signature (wrong length / non-hex) would crash
+        // the verifier with an uncaught RangeError. Treat length mismatch as
+        // signature-invalid (fail-closed).
+        const sigBuf = Buffer.from(handoff.signature, 'hex');
+        const expBuf = Buffer.from(expectedSignature, 'hex');
+        if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) {
+            this.logHandoff('signature-invalid', handoff);
+            return { valid: false, handoff, reason: 'HMAC signature verification failed' };
+        }
+        // Mark nonce as used with timestamp for TTL expiry
+        this.usedNonces.set(handoff.nonce, Date.now());
+        // Persist to disk for cross-restart replay protection
+        if (this.nonceStore) {
+            this.nonceStore.add(handoff.nonce);
+        }
+        this.logHandoff('verified', handoff);
+        return { valid: true, handoff };
+    }
+    /**
+     * Accept a handoff: verify + mark as accepted.
+     */
+    acceptHandoff(handoff, acceptingAgent) {
+        // Verify the handoff is addressed to this agent
+        if (handoff.to !== acceptingAgent) {
+            return {
+                valid: false,
+                handoff,
+                reason: `Handoff addressed to '${handoff.to}', not '${acceptingAgent}'`,
+            };
+        }
+        const verification = this.verifyHandoff(handoff);
+        if (verification.valid) {
+            this.logHandoff('accepted', handoff, { acceptedBy: acceptingAgent });
+        }
+        return verification;
+    }
+    /**
+     * Get the agent secret for signing. Derives using HKDF from agent identity + seed.
+     * Cached for performance with file modification tracking.
+     */
+    deriveAgentSecret(agentName) {
+        // Check cache with file modification invalidation
+        const cached = this.secretCache.get(agentName);
+        const cacheKey = `${agentName}:mtime`;
+        const cachedMtime = this.secretCache.get(cacheKey);
+        // Try to read agent's SOUL/identity content for additional entropy
+        let identityContent = '';
+        let fileMtime = '';
+        const possibleFiles = [
+            path.join(this.config.agentsDir, `${agentName}.md`),
+            path.join(this.config.agentsDir, `${agentName}-agent.md`),
+        ];
+        for (const file of possibleFiles) {
+            if (fs.existsSync(file)) {
+                try {
+                    const stat = fs.statSync(file);
+                    fileMtime = stat.mtimeMs.toString();
+                    const content = fs.readFileSync(file, 'utf-8');
+                    // Extract SOUL section if present
+                    const soulMatch = content.match(/## SOUL[^\n]*\n([\s\S]*?)(?=\n## |\n---|\Z)/);
+                    identityContent = soulMatch ? soulMatch[1] : content.slice(0, 200);
+                }
+                catch {
+                    // Fall through to seed-only derivation
+                }
+                break;
+            }
+        }
+        // Return cached secret only if file hasn't changed
+        if (cached && cachedMtime === fileMtime)
+            return cached;
+        // HKDF-like derivation: extract then expand
+        // Step 1: Extract -- PRK from seed + identity
+        const salt = crypto.createHash('sha256')
+            .update(`connexum-agent-auth-salt:${agentName}`)
+            .digest();
+        const ikm = `${this.config.secretSeed}:${agentName}:${identityContent}`;
+        const prk = crypto.createHmac('sha256', salt)
+            .update(ikm)
+            .digest();
+        // Step 2: Expand -- derive final key
+        const info = Buffer.from(`connexum-agent-secret-v1:${agentName}`);
+        const secret = crypto.createHmac('sha256', prk)
+            .update(Buffer.concat([info, Buffer.from([1])]))
+            .digest('hex');
+        this.secretCache.set(agentName, secret);
+        this.secretCache.set(cacheKey, fileMtime);
+        return secret;
+    }
+    /**
+     * Generate a shared verification token that two agents can use
+     * to establish a trusted channel.
+     */
+    createChannelToken(agent1, agent2) {
+        const secret1 = this.deriveAgentSecret(agent1);
+        const secret2 = this.deriveAgentSecret(agent2);
+        // Deterministic: always combine in sorted order
+        const [a, b] = [secret1, secret2].sort();
+        return crypto.createHash('sha256')
+            .update(`channel:${a}:${b}`)
+            .digest('hex');
+    }
+    /**
+     * List recent handoffs from the log.
+     */
+    getRecentHandoffs(limit = 50) {
+        const logPath = this.config.handoffLogPath;
+        if (!fs.existsSync(logPath))
+            return [];
+        const lines = fs.readFileSync(logPath, 'utf-8')
+            .split('\n')
+            .filter(Boolean)
+            .slice(-limit);
+        return lines.map(line => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                return { raw: line };
+            }
+        });
+    }
+    /**
+     * Clear the nonce cache (for testing or maintenance).
+     */
+    clearNonces() {
+        this.usedNonces.clear();
+    }
+    /**
+     * Prune nonces older than 2x the signature window.
+     * Prevents unbounded memory growth while maintaining replay protection
+     * for all nonces within the validity window.
+     */
+    pruneExpiredNonces() {
+        const ttl = this.config.signatureWindowMs * 2;
+        const now = Date.now();
+        for (const [nonce, timestamp] of this.usedNonces) {
+            if (now - timestamp > ttl) {
+                this.usedNonces.delete(nonce);
+            }
+        }
+    }
+    /**
+     * Clear the secret cache (if agent files change).
+     */
+    clearSecretCache() {
+        this.secretCache.clear();
+    }
+    // --- Private helpers ---
+    buildSignatureMessage(from, to, task, timestamp, nonce) {
+        // Use JSON canonical form to avoid delimiter collision (pipe chars in field values)
+        return JSON.stringify([from, to, task, timestamp, nonce]);
+    }
+    logHandoff(event, handoff, extra) {
+        const logDir = path.dirname(this.config.handoffLogPath);
+        if (!fs.existsSync(logDir)) {
+            fs.mkdirSync(logDir, { recursive: true });
+        }
+        const entry = {
+            timestamp: new Date().toISOString(),
+            event: `handoff:${event}`,
+            handoffId: handoff.id,
+            from: handoff.from,
+            to: handoff.to,
+            task: handoff.task,
+            ...extra,
+        };
+        fs.appendFileSync(this.config.handoffLogPath, JSON.stringify(entry) + '\n');
+    }
+}
+//# sourceMappingURL=agent-auth.js.map

package/dist/esm/security/agent-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-auth.js","sourceRoot":"","sources":["../../../src/security/agent-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAiC3C,MAAM,OAAO,SAAS;IACZ,MAAM,CAA4B;IAC1C,yDAAyD;IACjD,WAAW,GAAwB,IAAI,GAAG,EAAE,CAAC;IACrD,yEAAyE;IACjE,UAAU,GAAwB,IAAI,GAAG,EAAE,CAAC;IACpD,wDAAwD;IAChD,UAAU,GAAsB,IAAI,CAAC;IAE7C,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC;YACrG,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,MAAM;YACrD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;SAC1C,CAAC;QAEF,6DAA6D;QAC7D,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC;gBAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;gBACvE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY,EAAE,OAAiC;QACrF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAExD,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAClD,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,MAAM,OAAO,GAAkB,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAE5F,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAsB;QAClC,mEAAmE;QACnE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,oEAAoE;QACpE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;YAClC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACjF,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC;QACrK,CAAC;QAED,wBAAwB;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CACxC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CACzE,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC1D,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACjF,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,sDAAsD;QACtD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAsB,EAAE,cAAsB;QAC1D,gDAAgD;QAChD,IAAI,OAAO,CAAC,EAAE,KAAK,cAAc,EAAE,CAAC;YAClC,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO;gBACP,MAAM,EAAE,yBAAyB,OAAO,CAAC,EAAE,WAAW,cAAc,GAAG;aACxE,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,SAAiB;QACjC,kDAAkD;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,GAAG,SAAS,QAAQ,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnD,mEAAmE;QACnE,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG;YACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,SAAS,KAAK,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,SAAS,WAAW,CAAC;SAC1D,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC/B,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACpC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC/C,kCAAkC;oBAClC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;oBAC/E,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACrE,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,MAAM,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QAEvD,4CAA4C;QAC5C,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aACrC,MAAM,CAAC,4BAA4B,SAAS,EAAE,CAAC;aAC/C,MAAM,EAAE,CAAC;QAEZ,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,IAAI,eAAe,EAAE,CAAC;QAExE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC;aAC1C,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,EAAE,CAAC;QAEZ,qCAAqC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;aAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAC/C,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,MAAc,EAAE,MAAc;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE/C,gDAAgD;QAChD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;aAC/B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;aAC3B,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,QAAgB,EAAE;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;aAC5C,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QAEjB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YACtB,IAAI,CAAC;gBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAChC,MAAM,CAAC;gBAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACK,kBAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,IAAI,GAAG,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,0BAA0B;IAElB,qBAAqB,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY,EAAE,SAAiB,EAAE,KAAa;QACpG,oFAAoF;QACpF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC;IAEO,UAAU,CAAC,KAAa,EAAE,OAAsB,EAAE,KAA+B;QACvF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,WAAW,KAAK,EAAE;YACzB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,KAAK;SACT,CAAC;QAEF,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9E,CAAC;CACF"}

package/dist/esm/security/anomaly-auto-suspend.js

@@ -0,0 +1,345 @@
+/**
+ * AnomalyAutoSuspend -- wires AnomalyDetector events to the agent state machine.
+ *
+ * When an anomaly exceeds the configured severity threshold, this module
+ * automatically calls the same suspend action that a human operator would
+ * invoke via the dashboard (POST /api/v1/agents/:agentId/pause).
+ *
+ * Default thresholds:
+ *   - Behavioral baseline deviation > 3 sigma -> suspend
+ *   - Sudden permission escalation attempt     -> suspend immediately
+ *   - Communication with known-bad endpoints   -> suspend
+ *   - Unusual tool call burst (10x baseline within 60s) -> suspend
+ *
+ * Integration:
+ *   The module subscribes to an AnomalyEventBus and calls the AgentStateMachine
+ *   suspend() method on threshold breach. The state machine accepts the same
+ *   payload as the dashboard hook, so human override via resume() is unchanged.
+ *
+ * Audit chain:
+ *   Every auto-suspension produces a signed audit event (written to the
+ *   provided WebhookDelivery or stderr if no delivery is configured).
+ *
+ * Onyx #8 gap closure: Anomaly Auto-Suspend Wiring.
+ *
+ * @connexum/ai-governance
+ */
+import * as crypto from 'node:crypto';
+// ---------------------------------------------------------------------------
+// AnomalyAutoSuspend
+// ---------------------------------------------------------------------------
+export class AnomalyAutoSuspend {
+    stateMachine;
+    siemDelivery;
+    thresholds;
+    anomalyTypes;
+    /** Track recent tool call counts per agent for burst detection. */
+    burstCounters = new Map();
+    /** Audit log of all auto-suspension events (capped at 1000). */
+    suspensionLog = [];
+    constructor(config) {
+        this.stateMachine = config.stateMachine;
+        this.siemDelivery = config.siemDelivery;
+        this.thresholds = {
+            baselineDeviationSigma: config.thresholds?.baselineDeviationSigma ?? 3,
+            suspendOnPermissionEscalation: config.thresholds?.suspendOnPermissionEscalation ?? true,
+            badEndpointPatterns: config.thresholds?.badEndpointPatterns ?? [],
+            toolCallBurstMultiplier: config.thresholds?.toolCallBurstMultiplier ?? 10,
+            burstWindowMs: config.thresholds?.burstWindowMs ?? 60_000,
+        };
+        this.anomalyTypes = new Set(config.anomalyTypes ?? ['DEVIATION']);
+        // Subscribe to the event bus using both wiring paths (interceptEmit + on())
+        this.subscribeToEventBus(config.eventBus);
+    }
+    /**
+     * Subscribe the auto-suspend logic to an already-constructed event bus.
+     *
+     * Two wiring paths are registered (defense-in-depth):
+     *
+     * Path 1 -- interceptEmit (existing):
+     *   Patches `bus.emit` so that any local emit() call on this pod triggers
+     *   handleAnomaly synchronously. Works for both EventBus and RedisEventBus.
+     *   Does NOT fire for cross-pod events that arrive via Redis subscriber
+     *   (handleIncoming -> dispatch) because those bypass emit().
+     *
+     * Path 2 -- explicit on('anomaly:detected') (NEW):
+     *   Registers a handler via the bus's `on()` method when the bus supports it.
+     *   This fires for BOTH local dispatches AND cross-pod Redis events, because
+     *   both code paths ultimately call dispatch() which invokes registered handlers.
+     *
+     * Double-fire protection:
+     *   A local emit on this pod triggers both paths (interceptEmit first, then
+     *   dispatch calls the on() handler). handleAnomaly() is idempotent: if the
+     *   agent is already suspended after the first path fires, the second path's
+     *   call returns early at the status check. No duplicate suspension, audit
+     *   entry, or webhook fire results.
+     *
+     * Cross-pod behaviour (Option a -- chosen):
+     *   Pod B receives an anomaly for an agent that doesn't run on Pod B. Pod B's
+     *   on() handler fires, handleAnomaly() looks up the agent in Pod B's state
+     *   machine, finds status='running' (default), evaluates thresholds, and
+     *   suspends in Pod B's local state machine. If the agent does not exist on
+     *   Pod B (getStatus returns 'running' which is the default), the suspension
+     *   is a no-op at the state machine level and is logged at debug level only.
+     *   This keeps the architecture compatible with a future federated state machine
+     *   without further refactor.
+     */
+    subscribeToEventBus(eventBus) {
+        // -- Path 1: interceptEmit (defense-in-depth for local emits) ----
+        const originalEmit = eventBus.emit.bind(eventBus);
+        eventBus.emit = (type, data, target) => {
+            originalEmit(type, data, target);
+            if (type === 'anomaly:detected') {
+                this.handleAnomaly(data);
+            }
+        };
+        // -- Path 2: explicit on() handler (cross-pod Redis events) --------
+        // Only available on buses that implement the SubscribableEventBus interface.
+        const subscribable = eventBus;
+        if (typeof subscribable.on === 'function') {
+            subscribable.on('anomaly:detected', (event) => {
+                // handleAnomaly is idempotent -- safe to call even if interceptEmit
+                // already fired for the same event on this pod.
+                this.handleAnomaly(event.data);
+            });
+        }
+    }
+    /**
+     * Evaluate an anomaly and suspend the agent if any threshold is crossed.
+     */
+    handleAnomaly(anomaly) {
+        const agentId = anomaly.agentName;
+        // Skip if agent is already suspended
+        const currentStatus = this.stateMachine.getStatus(agentId);
+        if (currentStatus === 'paused' || currentStatus === 'stopped' || currentStatus === 'auto-suspended-pending-review') {
+            return;
+        }
+        // Filter by configured anomaly types
+        if (!this.anomalyTypes.has(anomaly.type)) {
+            return;
+        }
+        let shouldSuspend = false;
+        let suspendReason = '';
+        // ---- Threshold 1: Behavioral baseline deviation > N sigma ----
+        // The AnomalyDetector.endCycle() fires when value > baseline * multiplier.
+        // Treat any DEVIATION anomaly as a > 3-sigma event (the detector already
+        // gates on its configured multiplier, which defaults to 3).
+        if (anomaly.type === 'DEVIATION') {
+            const sigma = anomaly.baseline > 0
+                ? (anomaly.value - anomaly.baseline) / Math.max(anomaly.baseline * 0.3, 1)
+                : 0;
+            if (sigma > this.thresholds.baselineDeviationSigma) {
+                shouldSuspend = true;
+                suspendReason = `Behavioral baseline deviation: ${anomaly.metric} = ${anomaly.value} ` +
+                    `(baseline=${anomaly.baseline}, sigma_approx=${sigma.toFixed(1)}, ` +
+                    `threshold=${this.thresholds.baselineDeviationSigma}sigma)`;
+            }
+        }
+        // ---- Threshold 2: Permission escalation attempt ----
+        // Detected when the metric is 'File writes' and they include
+        // paths outside the agent's declared directory, or when toolName
+        // contains escalation keywords.
+        if (!shouldSuspend && this.thresholds.suspendOnPermissionEscalation) {
+            const isEscalation = anomaly.metric.toLowerCase().includes('permission') ||
+                anomaly.metric.toLowerCase().includes('escalat') ||
+                anomaly.metric.toLowerCase().includes('privilege');
+            if (isEscalation) {
+                shouldSuspend = true;
+                suspendReason = `Permission escalation attempt detected: ${anomaly.metric}`;
+            }
+        }
+        // ---- Threshold 3: Communication with known-bad endpoints ----
+        if (!shouldSuspend && this.thresholds.badEndpointPatterns.length > 0) {
+            const metricLower = anomaly.metric.toLowerCase();
+            const agentNameLower = agentId.toLowerCase();
+            const combined = metricLower + ' ' + agentNameLower;
+            const badMatch = this.thresholds.badEndpointPatterns.find(p => combined.includes(p.toLowerCase()));
+            if (badMatch) {
+                shouldSuspend = true;
+                suspendReason = `Communication with known-bad endpoint pattern '${badMatch}': ${anomaly.metric}`;
+            }
+        }
+        // ---- Threshold 4: Unusual tool call burst ----
+        if (!shouldSuspend && anomaly.metric.toLowerCase().includes('tool call')) {
+            const now = Date.now();
+            const counter = this.burstCounters.get(agentId) ?? { count: 0, windowStart: now };
+            // Reset window if expired
+            if (now - counter.windowStart > this.thresholds.burstWindowMs) {
+                counter.count = 0;
+                counter.windowStart = now;
+            }
+            counter.count++;
+            this.burstCounters.set(agentId, counter);
+            // Burst if count exceeds baseline * multiplier within the window
+            const burstThreshold = Math.max(10, anomaly.baseline * this.thresholds.toolCallBurstMultiplier);
+            if (counter.count > burstThreshold) {
+                shouldSuspend = true;
+                suspendReason = `Tool call burst: ${counter.count} calls in ${this.thresholds.burstWindowMs}ms ` +
+                    `(threshold=${burstThreshold}, baseline=${anomaly.baseline})`;
+                // Reset counter after triggering to avoid repeated suspensions
+                this.burstCounters.delete(agentId);
+            }
+        }
+        if (!shouldSuspend)
+            return;
+        // Execute suspension
+        this.suspend(agentId, suspendReason, anomaly);
+    }
+    /**
+     * Execute the suspension: update state machine, emit audit event, notify SIEM.
+     */
+    suspend(agentId, reason, triggeredBy) {
+        const suspendedAt = new Date().toISOString();
+        const contentHash = crypto
+            .createHash('sha256')
+            .update(JSON.stringify({ agentId, reason, triggeredBy, suspendedAt }))
+            .digest('hex');
+        const event = {
+            eventId: crypto.randomUUID(),
+            agentId,
+            triggeredBy,
+            threshold: reason,
+            suspendedAt,
+            contentHash,
+        };
+        // Update state machine -- same path as human operator clicking "pause"
+        const fullReason = `[AUTO-SUSPEND] ${reason}. Status: auto-suspended-pending-review. ` +
+            `Human review required before resuming via dashboard.`;
+        this.stateMachine.suspend(agentId, fullReason);
+        // Log suspension event
+        this.suspensionLog.push(event);
+        if (this.suspensionLog.length > 1000) {
+            this.suspensionLog.shift();
+        }
+        // Stderr audit (always -- even if SIEM delivery fails)
+        process.stderr.write(`[AnomalyAutoSuspend] AGENT SUSPENDED: agentId=${agentId} ` +
+            `reason="${reason}" eventId=${event.eventId} hash=${contentHash}\n`);
+        // SIEM notification via webhook delivery
+        if (this.siemDelivery) {
+            this.siemDelivery.deliver({
+                type: 'agent:auto-suspended',
+                source: 'anomaly-auto-suspend',
+                data: {
+                    agentId,
+                    reason,
+                    triggeredByAnomaly: {
+                        type: triggeredBy.type,
+                        metric: triggeredBy.metric,
+                        value: triggeredBy.value,
+                        baseline: triggeredBy.baseline,
+                        threshold: triggeredBy.threshold,
+                    },
+                    suspendedAt,
+                    eventId: event.eventId,
+                    contentHash,
+                    humanReviewRequired: true,
+                    resumeVia: `POST /api/v1/agents/${agentId}/resume`,
+                },
+                timestamp: suspendedAt,
+            }).catch((err) => {
+                process.stderr.write(`[AnomalyAutoSuspend] SIEM delivery failed for agentId=${agentId}: ${err.message}\n`);
+            });
+        }
+    }
+    /**
+     * Get the suspension audit log.
+     */
+    getSuspensionLog() {
+        return [...this.suspensionLog];
+    }
+    /**
+     * Update thresholds at runtime (without restarting the subscription).
+     */
+    updateThresholds(thresholds) {
+        Object.assign(this.thresholds, thresholds);
+    }
+    /**
+     * Get current effective thresholds.
+     */
+    getThresholds() {
+        return { ...this.thresholds };
+    }
+}
+// ---------------------------------------------------------------------------
+// InMemoryAgentStateMachine
+// ---------------------------------------------------------------------------
+/**
+ * Concrete AgentStateMachine backed by an in-memory Map.
+ * Matches the shape of agentControlState in packages/governance-server/src/index.ts.
+ *
+ * Production: inject the real agentControlState Map via the adapter below.
+ * Testing: use this standalone implementation.
+ */
+export class InMemoryAgentStateMachine {
+    state = new Map();
+    suspend(agentId, reason) {
+        this.state.set(agentId, {
+            status: 'auto-suspended-pending-review',
+            updatedAt: new Date().toISOString(),
+            reason,
+        });
+    }
+    resume(agentId) {
+        this.state.set(agentId, {
+            status: 'running',
+            updatedAt: new Date().toISOString(),
+        });
+    }
+    getStatus(agentId) {
+        return this.state.get(agentId)?.status ?? 'running';
+    }
+    canExecute(agentId) {
+        const status = this.getStatus(agentId);
+        return status === 'running';
+    }
+    /** Expose the underlying map for governance server integration. */
+    getStateMap() {
+        return this.state;
+    }
+}
+/**
+ * Adapt the governance server's existing agentControlState Map to the
+ * AgentStateMachine interface without modifying the Map's existing shape.
+ *
+ * Usage (in packages/governance-server/src/index.ts):
+ *
+ *   const autoSuspendMachine = new GovernanceServerStateMachineAdapter(agentControlState);
+ *   const autoSuspend = new AnomalyAutoSuspend({
+ *     eventBus: anomalyEventBus,
+ *     stateMachine: autoSuspendMachine,
+ *     siemDelivery: webhookDelivery,
+ *   });
+ */
+export class GovernanceServerStateMachineAdapter {
+    agentControlState;
+    onSuspend;
+    onResume;
+    constructor(agentControlState, onSuspend, onResume) {
+        this.agentControlState = agentControlState;
+        this.onSuspend = onSuspend;
+        this.onResume = onResume;
+    }
+    suspend(agentId, reason) {
+        this.agentControlState.set(agentId, {
+            status: 'paused',
+            updatedAt: new Date().toISOString(),
+            reason,
+        });
+        this.onSuspend?.(agentId, reason);
+    }
+    resume(agentId) {
+        this.agentControlState.set(agentId, {
+            status: 'running',
+            updatedAt: new Date().toISOString(),
+        });
+        this.onResume?.(agentId);
+    }
+    getStatus(agentId) {
+        return this.agentControlState.get(agentId)?.status ?? 'running';
+    }
+    canExecute(agentId) {
+        const status = this.getStatus(agentId);
+        return status === 'running';
+    }
+}
+//# sourceMappingURL=anomaly-auto-suspend.js.map

package/dist/esm/security/anomaly-auto-suspend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anomaly-auto-suspend.js","sourceRoot":"","sources":["../../../src/security/anomaly-auto-suspend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAyHtC,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,OAAO,kBAAkB;IACZ,YAAY,CAAoB;IAChC,YAAY,CAAgB;IAC5B,UAAU,CAAkC;IAC5C,YAAY,CAAc;IAE3C,mEAAmE;IAC3D,aAAa,GAAG,IAAI,GAAG,EAAkD,CAAC;IAElF,gEAAgE;IACxD,aAAa,GAAuB,EAAE,CAAC;IAE/C,YAAY,MAAgC;QAC1C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAExC,IAAI,CAAC,UAAU,GAAG;YAChB,sBAAsB,EAAE,MAAM,CAAC,UAAU,EAAE,sBAAsB,IAAI,CAAC;YACtE,6BAA6B,EAAE,MAAM,CAAC,UAAU,EAAE,6BAA6B,IAAI,IAAI;YACvF,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,mBAAmB,IAAI,EAAE;YACjE,uBAAuB,EAAE,MAAM,CAAC,UAAU,EAAE,uBAAuB,IAAI,EAAE;YACzE,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,IAAI,MAAM;SAC1D,CAAC;QAEF,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAElE,4EAA4E;QAC5E,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,mBAAmB,CAAC,QAAyB;QAC3C,mEAAmE;QACnE,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClD,QAAQ,CAAC,IAAI,GAAG,CACd,IAAwB,EACxB,IAA6B,EAC7B,MAAe,EACf,EAAE;YACF,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAChC,IAAI,CAAC,aAAa,CAAC,IAA0B,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QAEF,qEAAqE;QACrE,6EAA6E;QAC7E,MAAM,YAAY,GAAG,QAAyC,CAAC;QAC/D,IAAI,OAAO,YAAY,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YAC1C,YAAY,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,KAAmB,EAAE,EAAE;gBAC1D,oEAAoE;gBACpE,gDAAgD;gBAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAA0B,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAgB;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;QAElC,qCAAqC;QACrC,MAAM,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,+BAA+B,EAAE,CAAC;YACnH,OAAO;QACT,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,aAAa,GAAG,EAAE,CAAC;QAEvB,iEAAiE;QACjE,2EAA2E;QAC3E,yEAAyE;QACzE,4DAA4D;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAChC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC,CAAC;YACN,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBACnD,aAAa,GAAG,IAAI,CAAC;gBACrB,aAAa,GAAG,kCAAkC,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,KAAK,GAAG;oBACpF,aAAa,OAAO,CAAC,QAAQ,kBAAkB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;oBACnE,aAAa,IAAI,CAAC,UAAU,CAAC,sBAAsB,QAAQ,CAAC;YAChE,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,6DAA6D;QAC7D,iEAAiE;QACjE,gCAAgC;QAChC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,6BAA6B,EAAE,CAAC;YACpE,MAAM,YAAY,GAChB,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACnD,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAChD,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,YAAY,EAAE,CAAC;gBACjB,aAAa,GAAG,IAAI,CAAC;gBACrB,aAAa,GAAG,2CAA2C,OAAO,CAAC,MAAM,EAAE,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,WAAW,GAAG,GAAG,GAAG,cAAc,CAAC;YACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CACvD,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CACxC,CAAC;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,aAAa,GAAG,IAAI,CAAC;gBACrB,aAAa,GAAG,kDAAkD,QAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;YACnG,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;YAElF,0BAA0B;YAC1B,IAAI,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBAC9D,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;gBAClB,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC;YAC5B,CAAC;YAED,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEzC,iEAAiE;YACjE,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YAChG,IAAI,OAAO,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC;gBACnC,aAAa,GAAG,IAAI,CAAC;gBACrB,aAAa,GAAG,oBAAoB,OAAO,CAAC,KAAK,aAAa,IAAI,CAAC,UAAU,CAAC,aAAa,KAAK;oBAC9F,cAAc,cAAc,cAAc,OAAO,CAAC,QAAQ,GAAG,CAAC;gBAChE,+DAA+D;gBAC/D,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa;YAAE,OAAO;QAE3B,qBAAqB;QACrB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,OAAe,EAAE,MAAc,EAAE,WAAoB;QACnE,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM;aACvB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;aACrE,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,MAAM,KAAK,GAAqB;YAC9B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;YAC5B,OAAO;YACP,WAAW;YACX,SAAS,EAAE,MAAM;YACjB,WAAW;YACX,WAAW;SACZ,CAAC;QAEF,uEAAuE;QACvE,MAAM,UAAU,GAAG,kBAAkB,MAAM,2CAA2C;YACpF,sDAAsD,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE/C,uBAAuB;QACvB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QAED,uDAAuD;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD,OAAO,GAAG;YAC3D,WAAW,MAAM,aAAa,KAAK,CAAC,OAAO,SAAS,WAAW,IAAI,CACpE,CAAC;QAEF,yCAAyC;QACzC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;gBACxB,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,sBAAsB;gBAC9B,IAAI,EAAE;oBACJ,OAAO;oBACP,MAAM;oBACN,kBAAkB,EAAE;wBAClB,IAAI,EAAE,WAAW,CAAC,IAAI;wBACtB,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,KAAK,EAAE,WAAW,CAAC,KAAK;wBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,SAAS,EAAE,WAAW,CAAC,SAAS;qBACjC;oBACD,WAAW;oBACX,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,WAAW;oBACX,mBAAmB,EAAE,IAAI;oBACzB,SAAS,EAAE,uBAAuB,OAAO,SAAS;iBACnD;gBACD,SAAS,EAAE,WAAW;aACvB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yDAAyD,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,CACrF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,UAA0C;QACzD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAChC,CAAC;CACF;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IACnB,KAAK,GAAG,IAAI,GAAG,EAI5B,CAAC;IAEL,OAAO,CAAC,OAAe,EAAE,MAAc;QACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;YACtB,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;YACtB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,OAAe;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC;IACtD,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,MAAM,KAAK,SAAS,CAAC;IAC9B,CAAC;IAED,mEAAmE;IACnE,WAAW;QACT,OAAO,IAAI,CAAC,KAA4E,CAAC;IAC3F,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,mCAAmC;IAE3B;IAKA;IACA;IAPnB,YACmB,iBAIf,EACe,SAAqD,EACrD,QAAoC;QANpC,sBAAiB,GAAjB,iBAAiB,CAIhC;QACe,cAAS,GAAT,SAAS,CAA4C;QACrD,aAAQ,GAAR,QAAQ,CAA4B;IACpD,CAAC;IAEJ,OAAO,CAAC,OAAe,EAAE,MAAc;QACrC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;YAClC,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,OAAe;QACpB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE;YAClC,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,SAAS,CAAC,OAAe;QACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,SAAS,CAAC;IAClE,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,MAAM,KAAK,SAAS,CAAC;IAC9B,CAAC;CACF"}