@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/security/ssrf-guard.js

@@ -0,0 +1,222 @@
+/**
+ * SSRF protection for the scanner endpoint.
+ *
+ * Validates URLs against an allowlist of public code hosting providers.
+ * Rejects private IP ranges, localhost, and link-local addresses.
+ * Prevents DNS rebinding by resolving hostnames before making requests.
+ *
+ * Canonical location: src/security/ssrf-guard.ts
+ * Re-exported from: packages/governance-server/src/ssrf-guard.ts
+ *
+ * @connexum/ai-governance
+ */
+import * as dns from 'node:dns/promises';
+import * as net from 'node:net';
+// ---------------------------------------------------------------------------
+// Allowlisted domains for scanner
+// ---------------------------------------------------------------------------
+const ALLOWED_HOSTS = new Set([
+    'github.com',
+    'gitlab.com',
+    'bitbucket.org',
+    'dev.azure.com',
+    'codeberg.org',
+    'sr.ht',
+    'raw.githubusercontent.com',
+    'api.github.com',
+    'gitlab.com',
+]);
+// ---------------------------------------------------------------------------
+// Private/reserved IP ranges
+// ---------------------------------------------------------------------------
+const PRIVATE_RANGES_V4 = [
+    { prefix: '10.', mask: 8 },
+    { prefix: '172.16.', mask: 12 },
+    { prefix: '172.17.', mask: 12 },
+    { prefix: '172.18.', mask: 12 },
+    { prefix: '172.19.', mask: 12 },
+    { prefix: '172.20.', mask: 12 },
+    { prefix: '172.21.', mask: 12 },
+    { prefix: '172.22.', mask: 12 },
+    { prefix: '172.23.', mask: 12 },
+    { prefix: '172.24.', mask: 12 },
+    { prefix: '172.25.', mask: 12 },
+    { prefix: '172.26.', mask: 12 },
+    { prefix: '172.27.', mask: 12 },
+    { prefix: '172.28.', mask: 12 },
+    { prefix: '172.29.', mask: 12 },
+    { prefix: '172.30.', mask: 12 },
+    { prefix: '172.31.', mask: 12 },
+    { prefix: '192.168.', mask: 16 },
+    { prefix: '127.', mask: 8 },
+    { prefix: '0.', mask: 8 },
+    { prefix: '169.254.', mask: 16 }, // link-local
+    { prefix: '100.64.', mask: 10 }, // CGNAT
+];
+function isPrivateIpV4(ip) {
+    for (const range of PRIVATE_RANGES_V4) {
+        if (ip.startsWith(range.prefix))
+            return true;
+    }
+    return false;
+}
+function isPrivateIpV6(ip) {
+    const lower = ip.toLowerCase();
+    if (lower === '::1')
+        return true; // loopback
+    if (lower.startsWith('fe80:'))
+        return true; // link-local
+    if (lower.startsWith('fc') || lower.startsWith('fd'))
+        return true; // unique local
+    if (lower === '::' || lower === '0:0:0:0:0:0:0:0')
+        return true; // unspecified
+    // IPv4-mapped IPv6
+    if (lower.startsWith('::ffff:')) {
+        const v4 = lower.slice(7);
+        return isPrivateIpV4(v4);
+    }
+    return false;
+}
+function isPrivateIp(ip) {
+    if (net.isIPv4(ip))
+        return isPrivateIpV4(ip);
+    if (net.isIPv6(ip))
+        return isPrivateIpV6(ip);
+    return true; // unknown format, reject
+}
+// ---------------------------------------------------------------------------
+// SSRF guard
+// ---------------------------------------------------------------------------
+export async function checkUrl(url, allowCustomHosts = false) {
+    // Parse URL
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return { safe: false, reason: 'Invalid URL format' };
+    }
+    // HTTPS only
+    if (parsed.protocol !== 'https:') {
+        return { safe: false, reason: 'Only HTTPS URLs are allowed' };
+    }
+    // No auth in URL
+    if (parsed.username || parsed.password) {
+        return { safe: false, reason: 'URLs with embedded credentials are not allowed' };
+    }
+    // No non-standard ports
+    if (parsed.port && parsed.port !== '443') {
+        return { safe: false, reason: 'Non-standard ports are not allowed' };
+    }
+    // No raw IP addresses
+    if (net.isIP(parsed.hostname)) {
+        return { safe: false, reason: 'Raw IP addresses are not allowed. Use domain names.' };
+    }
+    // Domain allowlist check (unless custom hosts enabled for enterprise)
+    if (!allowCustomHosts && !ALLOWED_HOSTS.has(parsed.hostname)) {
+        return {
+            safe: false,
+            reason: `Host '${parsed.hostname}' is not in the allowed list. Allowed: ${Array.from(ALLOWED_HOSTS).join(', ')}`,
+        };
+    }
+    // DNS resolution to prevent DNS rebinding
+    try {
+        const addresses = await dns.resolve4(parsed.hostname);
+        if (addresses.length === 0) {
+            return { safe: false, reason: 'DNS resolution returned no addresses' };
+        }
+        // Check ALL resolved IPs (not just the first)
+        for (const ip of addresses) {
+            if (isPrivateIp(ip)) {
+                return {
+                    safe: false,
+                    reason: `DNS resolved to private IP ${ip}. This may indicate DNS rebinding.`,
+                };
+            }
+        }
+        return { safe: true, resolvedIp: addresses[0] };
+    }
+    catch (err) {
+        // Also try IPv6
+        try {
+            const addresses6 = await dns.resolve6(parsed.hostname);
+            if (addresses6.length === 0) {
+                return { safe: false, reason: 'DNS resolution returned no addresses' };
+            }
+            for (const ip of addresses6) {
+                if (isPrivateIp(ip)) {
+                    return {
+                        safe: false,
+                        reason: `DNS resolved to private IPv6 ${ip}. This may indicate DNS rebinding.`,
+                    };
+                }
+            }
+            return { safe: true, resolvedIp: addresses6[0] };
+        }
+        catch {
+            return { safe: false, reason: `DNS resolution failed for ${parsed.hostname}: ${err.message}` };
+        }
+    }
+}
+/**
+ * Add a custom allowed host (for enterprise tier).
+ */
+export function addAllowedHost(host) {
+    ALLOWED_HOSTS.add(host);
+}
+/**
+ * Get the current allowed hosts list.
+ */
+export function getAllowedHosts() {
+    return Array.from(ALLOWED_HOSTS);
+}
+// ---------------------------------------------------------------------------
+// Session-scoped loopback allowlist (for OllamaAdapter)
+//
+// OllamaAdapter traffic goes to 127.0.0.1 (or ::1) by design. Rather than
+// globally loosening the SSRF guard, adapters register a session token that
+// marks exactly one loopback allowance. The token is invalidated on revoke.
+//
+// This is scoped: only the checkUrlWithSession path honours session tokens.
+// The existing checkUrl() path is NOT modified.
+// ---------------------------------------------------------------------------
+const LOOPBACK_SESSION_TOKENS = new Set();
+/**
+ * Register a session-scoped loopback allowance.
+ * Returns the token that must be passed to checkUrlWithSession.
+ * Call revokeLoopbackSession(token) when the adapter is torn down.
+ */
+export function registerLoopbackSession(token) {
+    LOOPBACK_SESSION_TOKENS.add(token);
+}
+/**
+ * Revoke a previously registered loopback session.
+ */
+export function revokeLoopbackSession(token) {
+    LOOPBACK_SESSION_TOKENS.delete(token);
+}
+/**
+ * Session-aware URL check. If the request is to a loopback address
+ * (127.0.0.1 or ::1) and sessionToken is a registered loopback session,
+ * the check is allowed. All other requests fall through to checkUrl().
+ *
+ * This is the entry point adapters should use when they need loopback access.
+ */
+export async function checkUrlWithSession(url, sessionToken) {
+    if (sessionToken && LOOPBACK_SESSION_TOKENS.has(sessionToken)) {
+        // Allow loopback URLs for registered sessions only
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return { safe: false, reason: 'Invalid URL format' };
+        }
+        const host = parsed.hostname;
+        if (host === '127.0.0.1' || host === '::1' || host === 'localhost') {
+            return { safe: true, resolvedIp: host };
+        }
+    }
+    return checkUrl(url);
+}
+//# sourceMappingURL=ssrf-guard.js.map

package/dist/esm/security/ssrf-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.js","sourceRoot":"","sources":["../../../src/security/ssrf-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,GAAG,MAAM,mBAAmB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,eAAe;IACf,cAAc;IACd,OAAO;IACP,2BAA2B;IAC3B,gBAAgB;IAChB,YAAY;CACb,CAAC,CAAC;AAEH,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,MAAM,iBAAiB,GAAG;IACxB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE;IAC1B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAC/B,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;IAChC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE;IAC3B,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE;IACzB,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,aAAa;IAC/C,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ;CAC1C,CAAC;AAEF,SAAS,aAAa,CAAC,EAAU;IAC/B,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACzD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC,CAAC,cAAc;IAC9E,mBAAmB;IACnB,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,EAAU;IAC7B,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC,CAAC,yBAAyB;AACxC,CAAC;AAYD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,gBAAgB,GAAG,KAAK;IAClE,YAAY;IACZ,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAED,aAAa;IACb,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAChE,CAAC;IAED,iBAAiB;IACjB,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;IACnF,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACvE,CAAC;IAED,sBAAsB;IACtB,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IACxF,CAAC;IAED,sEAAsE;IACtE,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,SAAS,MAAM,CAAC,QAAQ,0CAA0C,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACjH,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QACzE,CAAC;QAED,8CAA8C;QAC9C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpB,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,8BAA8B,EAAE,oCAAoC;iBAC7E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gBAAgB;QAChB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;YACzE,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;oBACpB,OAAO;wBACL,IAAI,EAAE,KAAK;wBACX,MAAM,EAAE,gCAAgC,EAAE,oCAAoC;qBAC/E,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5G,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,gDAAgD;AAChD,8EAA8E;AAE9E,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAW,EACX,YAAgC;IAEhC,IAAI,YAAY,IAAI,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,mDAAmD;QACnD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/esm/security/supply-chain.js

@@ -0,0 +1,283 @@
+/**
+ * SupplyChain -- Dependency and module integrity verification.
+ *
+ * Verifies npm dependencies, shared module hashes, and MCP server
+ * integrity at agent startup. Addresses OWASP ASI04 (Supply Chain).
+ *
+ * @connexum/ai-governance
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import { execFileSync } from 'child_process';
+export class SupplyChain {
+    config;
+    constructor(config) {
+        this.config = {
+            projectRoot: config.projectRoot,
+            sharedDir: config.sharedDir || path.join(config.projectRoot, 'shared'),
+            toolRegistryPath: config.toolRegistryPath || path.join(config.projectRoot, 'TOOL_REGISTRY.md'),
+            auditLogPath: config.auditLogPath || path.join(config.projectRoot, '.governance', 'audit', 'supply-chain.jsonl'),
+            skipNpmAudit: config.skipNpmAudit ?? false,
+        };
+    }
+    /**
+     * Run a full supply chain audit. Returns pass/fail with details.
+     */
+    audit() {
+        const failures = [];
+        const vulnerabilities = this.checkVulnerabilities();
+        if (vulnerabilities.critical > 0) {
+            failures.push(`${vulnerabilities.critical} critical vulnerabilities found`);
+        }
+        const lockfileIntegrity = this.checkLockfile();
+        if (!lockfileIntegrity.valid && lockfileIntegrity.exists) {
+            failures.push('Lockfile integrity check failed');
+        }
+        const moduleIntegrity = this.checkModuleIntegrity();
+        if (moduleIntegrity.failed > 0) {
+            failures.push(`${moduleIntegrity.failed} shared module(s) failed integrity check`);
+        }
+        const toolRegistry = this.checkToolRegistry();
+        if (toolRegistry.unapprovedDetected.length > 0) {
+            failures.push(`${toolRegistry.unapprovedDetected.length} unapproved tool(s) detected`);
+        }
+        const result = {
+            timestamp: new Date().toISOString(),
+            vulnerabilities,
+            lockfileIntegrity,
+            moduleIntegrity,
+            toolRegistry,
+            passed: failures.length === 0,
+            failures,
+        };
+        this.logAudit(result);
+        return result;
+    }
+    /**
+     * Run npm audit to check for known vulnerabilities.
+     */
+    checkVulnerabilities() {
+        if (this.config.skipNpmAudit) {
+            return { checked: false, critical: 0, high: 0, moderate: 0, low: 0, total: 0, details: 'Skipped' };
+        }
+        const packageJson = path.join(this.config.projectRoot, 'package.json');
+        if (!fs.existsSync(packageJson)) {
+            return { checked: false, critical: 0, high: 0, moderate: 0, low: 0, total: 0, details: 'No package.json' };
+        }
+        try {
+            const result = execFileSync('npm', ['audit', '--json'], {
+                cwd: this.config.projectRoot,
+                encoding: 'utf-8',
+                timeout: 30000,
+            });
+            const audit = JSON.parse(result);
+            const vuln = audit.metadata?.vulnerabilities || {};
+            return {
+                checked: true,
+                critical: vuln.critical || 0,
+                high: vuln.high || 0,
+                moderate: vuln.moderate || 0,
+                low: vuln.low || 0,
+                total: (vuln.critical || 0) + (vuln.high || 0) + (vuln.moderate || 0) + (vuln.low || 0),
+            };
+        }
+        catch (e) {
+            // npm audit returns non-zero when vulnerabilities exist
+            const err = e;
+            if (err.stdout) {
+                try {
+                    const audit = JSON.parse(err.stdout);
+                    const vuln = audit.metadata?.vulnerabilities || {};
+                    return {
+                        checked: true,
+                        critical: vuln.critical || 0,
+                        high: vuln.high || 0,
+                        moderate: vuln.moderate || 0,
+                        low: vuln.low || 0,
+                        total: (vuln.critical || 0) + (vuln.high || 0) + (vuln.moderate || 0) + (vuln.low || 0),
+                    };
+                }
+                catch {
+                    // fall through
+                }
+            }
+            return { checked: false, critical: 0, high: 0, moderate: 0, low: 0, total: 0, details: 'npm audit failed' };
+        }
+    }
+    /**
+     * Verify lockfile hasn't been tampered with.
+     */
+    checkLockfile() {
+        const lockfile = path.join(this.config.projectRoot, 'package-lock.json');
+        if (!fs.existsSync(lockfile)) {
+            return { exists: false, valid: true };
+        }
+        const content = fs.readFileSync(lockfile, 'utf-8');
+        const hash = crypto.createHash('sha256').update(content).digest('hex');
+        // Check against stored hash
+        const hashFile = path.join(this.config.projectRoot, '.governance', 'lockfile-hash.txt');
+        if (!fs.existsSync(hashFile)) {
+            // First run - store current hash as baseline
+            const dir = path.dirname(hashFile);
+            if (!fs.existsSync(dir))
+                fs.mkdirSync(dir, { recursive: true });
+            fs.writeFileSync(hashFile, hash);
+            return { exists: true, hash, valid: true };
+        }
+        const expectedHash = fs.readFileSync(hashFile, 'utf-8').trim();
+        return {
+            exists: true,
+            hash,
+            expectedHash,
+            valid: hash === expectedHash,
+        };
+    }
+    /**
+     * Verify shared module file hashes against manifest.
+     */
+    checkModuleIntegrity() {
+        const manifestPath = path.join(this.config.projectRoot, '.governance', 'module-manifest.json');
+        if (!fs.existsSync(manifestPath)) {
+            return { totalFiles: 0, verified: 0, failed: 0, mismatches: [] };
+        }
+        const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+        const mismatches = [];
+        let verified = 0;
+        for (const [relativePath, expectedHash] of Object.entries(manifest.files)) {
+            const fullPath = path.join(this.config.projectRoot, relativePath);
+            if (!fs.existsSync(fullPath)) {
+                mismatches.push({ file: relativePath, expected: expectedHash, actual: 'MISSING' });
+                continue;
+            }
+            const content = fs.readFileSync(fullPath, 'utf-8');
+            const actualHash = crypto.createHash('sha256').update(content).digest('hex');
+            if (actualHash === expectedHash) {
+                verified++;
+            }
+            else {
+                mismatches.push({ file: relativePath, expected: expectedHash, actual: actualHash });
+            }
+        }
+        return {
+            totalFiles: Object.keys(manifest.files).length,
+            verified,
+            failed: mismatches.length,
+            mismatches,
+        };
+    }
+    /**
+     * Check if any unapproved tools/MCP servers are in use.
+     */
+    checkToolRegistry() {
+        if (!fs.existsSync(this.config.toolRegistryPath)) {
+            return { exists: false, approvedTools: 0, unapprovedDetected: [] };
+        }
+        const content = fs.readFileSync(this.config.toolRegistryPath, 'utf-8');
+        // Parse approved tools from markdown table
+        const approvedTools = [];
+        const lines = content.split('\n');
+        for (const line of lines) {
+            const match = line.match(/^\|\s*`?([^|`]+)`?\s*\|.*\|\s*APPROVED\s*\|/i);
+            if (match) {
+                approvedTools.push(match[1].trim());
+            }
+        }
+        // Check settings.json for MCP servers in use
+        const unapproved = [];
+        const settingsPath = path.join(this.config.projectRoot, '.claude', 'settings.json');
+        if (fs.existsSync(settingsPath)) {
+            try {
+                const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf-8'));
+                const mcpServers = Object.keys(settings.mcpServers || {});
+                for (const server of mcpServers) {
+                    if (!approvedTools.includes(server)) {
+                        unapproved.push(server);
+                    }
+                }
+            }
+            catch {
+                // skip if settings can't be parsed
+            }
+        }
+        return {
+            exists: true,
+            approvedTools: approvedTools.length,
+            unapprovedDetected: unapproved,
+        };
+    }
+    /**
+     * Generate a module manifest from the current state of shared files.
+     */
+    generateManifest(agentName) {
+        const files = {};
+        const walkDir = (dir) => {
+            if (!fs.existsSync(dir))
+                return;
+            const entries = fs.readdirSync(dir, { withFileTypes: true });
+            for (const entry of entries) {
+                const full = path.join(dir, entry.name);
+                if (entry.isDirectory() && entry.name !== 'node_modules' && entry.name !== '.git') {
+                    walkDir(full);
+                }
+                else if (entry.isFile() && /\.(js|ts|sh|json|md)$/.test(entry.name)) {
+                    const content = fs.readFileSync(full, 'utf-8');
+                    const hash = crypto.createHash('sha256').update(content).digest('hex');
+                    const relative = path.relative(this.config.projectRoot, full);
+                    files[relative] = hash;
+                }
+            }
+        };
+        if (fs.existsSync(this.config.sharedDir)) {
+            walkDir(this.config.sharedDir);
+        }
+        const manifest = {
+            generatedAt: new Date().toISOString(),
+            generatedBy: agentName,
+            projectRoot: this.config.projectRoot,
+            files,
+        };
+        // Save manifest
+        const manifestPath = path.join(this.config.projectRoot, '.governance', 'module-manifest.json');
+        const dir = path.dirname(manifestPath);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
+        return manifest;
+    }
+    /**
+     * Update the lockfile hash baseline (after legitimate dependency changes).
+     */
+    updateLockfileBaseline() {
+        const lockfile = path.join(this.config.projectRoot, 'package-lock.json');
+        if (!fs.existsSync(lockfile))
+            return null;
+        const content = fs.readFileSync(lockfile, 'utf-8');
+        const hash = crypto.createHash('sha256').update(content).digest('hex');
+        const hashFile = path.join(this.config.projectRoot, '.governance', 'lockfile-hash.txt');
+        const dir = path.dirname(hashFile);
+        if (!fs.existsSync(dir))
+            fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(hashFile, hash);
+        return hash;
+    }
+    // --- Private helpers ---
+    logAudit(result) {
+        const logDir = path.dirname(this.config.auditLogPath);
+        if (!fs.existsSync(logDir)) {
+            fs.mkdirSync(logDir, { recursive: true });
+        }
+        const entry = {
+            timestamp: result.timestamp,
+            event: 'supply-chain:audit',
+            passed: result.passed,
+            failures: result.failures,
+            vulnTotal: result.vulnerabilities.total,
+            vulnCritical: result.vulnerabilities.critical,
+            modulesVerified: result.moduleIntegrity.verified,
+            modulesFailed: result.moduleIntegrity.failed,
+        };
+        fs.appendFileSync(this.config.auditLogPath, JSON.stringify(entry) + '\n');
+    }
+}
+//# sourceMappingURL=supply-chain.js.map

package/dist/esm/security/supply-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain.js","sourceRoot":"","sources":["../../../src/security/supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA8D7C,MAAM,OAAO,WAAW;IACd,MAAM,CAA8B;IAE5C,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC;YACtE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,kBAAkB,CAAC;YAC9F,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,CAAC;YAChH,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACpD,IAAI,eAAe,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,QAAQ,iCAAiC,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,KAAK,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACpD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,0CAA0C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,IAAI,YAAY,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,kBAAkB,CAAC,MAAM,8BAA8B,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAoB;YAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,eAAe;YACf,iBAAiB;YACjB,eAAe;YACf,YAAY;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC7B,QAAQ;SACT,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACrG,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7G,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACtD,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;gBAC5B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;YACnD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;gBAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;gBACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;gBAC5B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;gBAClB,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;aACxF,CAAC;QACJ,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,wDAAwD;YACxD,MAAM,GAAG,GAAG,CAAyC,CAAC;YACtD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACrC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,CAAC;oBACnD,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;wBAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;wBACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;wBAC5B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;wBAClB,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;qBACxF,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,eAAe;gBACjB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAC9G,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvE,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;QACxF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,6CAA6C;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,IAAI;YACJ,YAAY;YACZ,KAAK,EAAE,IAAI,KAAK,YAAY;SAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAC;QAE/F,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAmB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACpF,MAAM,UAAU,GAA8D,EAAE,CAAC;QACjF,IAAI,QAAQ,GAAG,CAAC,CAAC;QAEjB,KAAK,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAClE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACnF,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE7E,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,QAAQ,EAAE,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAED,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM;YAC9C,QAAQ;YACR,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAEvE,2CAA2C;QAC3C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACzE,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QACpF,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;gBACpE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBAC1D,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;oBAChC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;wBACpC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,aAAa,EAAE,aAAa,CAAC,MAAM;YACnC,kBAAkB,EAAE,UAAU;SAC/B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,KAAK,GAA2B,EAAE,CAAC;QAEzC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE;YAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YAChC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAClF,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChB,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtE,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;oBAC9D,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,QAAQ,GAAmB;YAC/B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW,EAAE,SAAS;YACtB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACpC,KAAK;SACN,CAAC;QAEF,gBAAgB;QAChB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAElE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;QACzE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0BAA0B;IAElB,QAAQ,CAAC,MAAuB;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,KAAK;YACvC,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ;YAC7C,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ;YAChD,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,MAAM;SAC7C,CAAC;QAEF,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5E,CAAC;CACF"}