@datasynx/agentic-ai-cartography 0.1.0

package/dist/index.js

@@ -0,0 +1,1161 @@
+// src/db.ts
+import Database from "better-sqlite3";
+import { mkdirSync } from "fs";
+import { dirname } from "path";
+var SCHEMA = `
+PRAGMA journal_mode = WAL;
+PRAGMA foreign_keys = ON;
+PRAGMA busy_timeout = 5000;
+
+CREATE TABLE IF NOT EXISTS sessions (
+  id TEXT PRIMARY KEY,
+  mode TEXT NOT NULL CHECK (mode IN ('discover','shadow')),
+  started_at TEXT NOT NULL,
+  completed_at TEXT,
+  config TEXT NOT NULL DEFAULT '{}'
+);
+
+CREATE TABLE IF NOT EXISTS nodes (
+  id TEXT NOT NULL,
+  session_id TEXT NOT NULL REFERENCES sessions(id),
+  type TEXT NOT NULL,
+  name TEXT NOT NULL,
+  discovered_via TEXT,
+  discovered_at TEXT NOT NULL,
+  path_id TEXT,
+  depth INTEGER DEFAULT 0,
+  confidence REAL DEFAULT 0.5,
+  metadata TEXT NOT NULL DEFAULT '{}',
+  tags TEXT NOT NULL DEFAULT '[]',
+  PRIMARY KEY (id, session_id)
+);
+
+CREATE TABLE IF NOT EXISTS edges (
+  id TEXT PRIMARY KEY,
+  session_id TEXT NOT NULL REFERENCES sessions(id),
+  source_id TEXT NOT NULL,
+  target_id TEXT NOT NULL,
+  relationship TEXT NOT NULL,
+  evidence TEXT,
+  confidence REAL DEFAULT 0.5,
+  discovered_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS activity_events (
+  id TEXT PRIMARY KEY,
+  session_id TEXT NOT NULL REFERENCES sessions(id),
+  task_id TEXT,
+  timestamp TEXT NOT NULL,
+  event_type TEXT NOT NULL,
+  process TEXT NOT NULL,
+  pid INTEGER NOT NULL,
+  target TEXT,
+  target_type TEXT,
+  port INTEGER,
+  duration_ms INTEGER
+);
+
+CREATE TABLE IF NOT EXISTS tasks (
+  id TEXT PRIMARY KEY,
+  session_id TEXT NOT NULL REFERENCES sessions(id),
+  description TEXT,
+  started_at TEXT NOT NULL,
+  completed_at TEXT,
+  steps TEXT NOT NULL DEFAULT '[]',
+  involved_services TEXT NOT NULL DEFAULT '[]',
+  status TEXT DEFAULT 'active' CHECK (status IN ('active','completed','cancelled')),
+  is_sop_candidate INTEGER DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS workflows (
+  id TEXT PRIMARY KEY,
+  session_id TEXT NOT NULL REFERENCES sessions(id),
+  name TEXT,
+  pattern TEXT NOT NULL,
+  task_ids TEXT NOT NULL DEFAULT '[]',
+  occurrences INTEGER DEFAULT 1,
+  first_seen TEXT NOT NULL,
+  last_seen TEXT NOT NULL,
+  avg_duration_ms INTEGER,
+  involved_services TEXT NOT NULL DEFAULT '[]'
+);
+
+CREATE TABLE IF NOT EXISTS sops (
+  id TEXT PRIMARY KEY,
+  workflow_id TEXT NOT NULL,
+  title TEXT NOT NULL,
+  description TEXT NOT NULL,
+  steps TEXT NOT NULL,
+  involved_systems TEXT NOT NULL DEFAULT '[]',
+  estimated_duration TEXT,
+  frequency TEXT,
+  generated_at TEXT NOT NULL,
+  confidence REAL DEFAULT 0.5
+);
+
+CREATE TABLE IF NOT EXISTS node_approvals (
+  pattern TEXT PRIMARY KEY,
+  action TEXT NOT NULL CHECK (action IN ('save','ignore','auto')),
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_nodes_session ON nodes(session_id);
+CREATE INDEX IF NOT EXISTS idx_edges_session ON edges(session_id);
+CREATE INDEX IF NOT EXISTS idx_events_session ON activity_events(session_id);
+CREATE INDEX IF NOT EXISTS idx_events_task ON activity_events(task_id);
+CREATE INDEX IF NOT EXISTS idx_tasks_session ON tasks(session_id);
+`;
+var CartographyDB = class {
+  db;
+  constructor(dbPath) {
+    mkdirSync(dirname(dbPath), { recursive: true });
+    this.db = new Database(dbPath);
+    this.db.pragma("journal_mode = WAL");
+    this.db.pragma("foreign_keys = ON");
+    this.db.pragma("busy_timeout = 5000");
+    this.migrate();
+  }
+  migrate() {
+    const version = this.db.pragma("user_version", { simple: true });
+    if (version === 0) {
+      this.db.exec(SCHEMA);
+      this.db.pragma("user_version = 1");
+    }
+  }
+  close() {
+    this.db.pragma("optimize");
+    this.db.close();
+  }
+  // ── Sessions ────────────────────────────
+  createSession(mode, config) {
+    const id = crypto.randomUUID();
+    this.db.prepare(
+      "INSERT INTO sessions (id, mode, started_at, config) VALUES (?, ?, ?, ?)"
+    ).run(id, mode, (/* @__PURE__ */ new Date()).toISOString(), JSON.stringify(config));
+    return id;
+  }
+  endSession(id) {
+    this.db.prepare("UPDATE sessions SET completed_at = ? WHERE id = ?").run((/* @__PURE__ */ new Date()).toISOString(), id);
+  }
+  getSession(id) {
+    const row = this.db.prepare("SELECT * FROM sessions WHERE id = ?").get(id);
+    return row ? this.mapSession(row) : void 0;
+  }
+  getLatestSession(mode) {
+    const row = mode ? this.db.prepare("SELECT * FROM sessions WHERE mode = ? ORDER BY rowid DESC LIMIT 1").get(mode) : this.db.prepare("SELECT * FROM sessions ORDER BY rowid DESC LIMIT 1").get();
+    return row ? this.mapSession(row) : void 0;
+  }
+  getSessions() {
+    const rows = this.db.prepare("SELECT * FROM sessions ORDER BY rowid DESC").all();
+    return rows.map((r) => this.mapSession(r));
+  }
+  mapSession(r) {
+    return {
+      id: r["id"],
+      mode: r["mode"],
+      startedAt: r["started_at"],
+      completedAt: r["completed_at"] ?? void 0,
+      config: r["config"]
+    };
+  }
+  // ── Nodes ───────────────────────────────
+  upsertNode(sessionId, node, depth = 0) {
+    this.db.prepare(`
+      INSERT OR REPLACE INTO nodes
+        (id, session_id, type, name, discovered_via, discovered_at, depth, confidence, metadata, tags)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      node.id,
+      sessionId,
+      node.type,
+      node.name,
+      node.discoveredVia,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      depth,
+      node.confidence,
+      JSON.stringify(node.metadata ?? {}),
+      JSON.stringify(node.tags ?? [])
+    );
+  }
+  getNodes(sessionId) {
+    const rows = this.db.prepare("SELECT * FROM nodes WHERE session_id = ?").all(sessionId);
+    return rows.map((r) => ({
+      id: r["id"],
+      sessionId: r["session_id"],
+      type: r["type"],
+      name: r["name"],
+      discoveredVia: r["discovered_via"],
+      discoveredAt: r["discovered_at"],
+      depth: r["depth"],
+      confidence: r["confidence"],
+      metadata: JSON.parse(r["metadata"]),
+      tags: JSON.parse(r["tags"]),
+      pathId: r["path_id"]
+    }));
+  }
+  // ── Edges ───────────────────────────────
+  insertEdge(sessionId, edge) {
+    const id = crypto.randomUUID();
+    this.db.prepare(`
+      INSERT OR IGNORE INTO edges
+        (id, session_id, source_id, target_id, relationship, evidence, confidence, discovered_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      id,
+      sessionId,
+      edge.sourceId,
+      edge.targetId,
+      edge.relationship,
+      edge.evidence,
+      edge.confidence,
+      (/* @__PURE__ */ new Date()).toISOString()
+    );
+  }
+  getEdges(sessionId) {
+    const rows = this.db.prepare("SELECT * FROM edges WHERE session_id = ?").all(sessionId);
+    return rows.map((r) => ({
+      id: r["id"],
+      sessionId: r["session_id"],
+      sourceId: r["source_id"],
+      targetId: r["target_id"],
+      relationship: r["relationship"],
+      evidence: r["evidence"],
+      confidence: r["confidence"],
+      discoveredAt: r["discovered_at"]
+    }));
+  }
+  // ── Events ──────────────────────────────
+  insertEvent(sessionId, event, taskId) {
+    const id = crypto.randomUUID();
+    this.db.prepare(`
+      INSERT INTO activity_events
+        (id, session_id, task_id, timestamp, event_type, process, pid, target, target_type, port)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      id,
+      sessionId,
+      taskId ?? null,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      event.eventType,
+      event.process,
+      event.pid,
+      event.target ?? null,
+      event.targetType ?? null,
+      event.port ?? null
+    );
+  }
+  getEvents(sessionId, since) {
+    const rows = since ? this.db.prepare("SELECT * FROM activity_events WHERE session_id = ? AND timestamp > ? ORDER BY timestamp").all(sessionId, since) : this.db.prepare("SELECT * FROM activity_events WHERE session_id = ? ORDER BY timestamp").all(sessionId);
+    return rows.map((r) => ({
+      id: r["id"],
+      sessionId: r["session_id"],
+      taskId: r["task_id"],
+      timestamp: r["timestamp"],
+      eventType: r["event_type"],
+      process: r["process"],
+      pid: r["pid"],
+      target: r["target"],
+      targetType: r["target_type"],
+      port: r["port"],
+      durationMs: r["duration_ms"]
+    }));
+  }
+  // ── Tasks ───────────────────────────────
+  startTask(sessionId, description) {
+    const id = crypto.randomUUID();
+    this.db.prepare(`
+      INSERT INTO tasks (id, session_id, description, started_at, steps, involved_services, status)
+      VALUES (?, ?, ?, ?, '[]', '[]', 'active')
+    `).run(id, sessionId, description ?? null, (/* @__PURE__ */ new Date()).toISOString());
+    return id;
+  }
+  endCurrentTask(sessionId) {
+    this.db.prepare(`
+      UPDATE tasks SET status = 'completed', completed_at = ?
+      WHERE session_id = ? AND status = 'active'
+    `).run((/* @__PURE__ */ new Date()).toISOString(), sessionId);
+  }
+  updateTaskDescription(sessionId, description) {
+    this.db.prepare(`
+      UPDATE tasks SET description = ?
+      WHERE session_id = ? AND status = 'active'
+    `).run(description, sessionId);
+  }
+  getActiveTask(sessionId) {
+    const row = this.db.prepare(
+      "SELECT * FROM tasks WHERE session_id = ? AND status = 'active' LIMIT 1"
+    ).get(sessionId);
+    return row ? this.mapTask(row) : void 0;
+  }
+  getTasks(sessionId) {
+    const rows = this.db.prepare("SELECT * FROM tasks WHERE session_id = ? ORDER BY started_at").all(sessionId);
+    return rows.map((r) => this.mapTask(r));
+  }
+  mapTask(r) {
+    return {
+      id: r["id"],
+      sessionId: r["session_id"],
+      description: r["description"],
+      startedAt: r["started_at"],
+      completedAt: r["completed_at"],
+      steps: r["steps"],
+      involvedServices: r["involved_services"],
+      status: r["status"],
+      isSOPCandidate: Boolean(r["is_sop_candidate"])
+    };
+  }
+  // ── Workflows ───────────────────────────
+  insertWorkflow(sessionId, data) {
+    const id = crypto.randomUUID();
+    this.db.prepare(`
+      INSERT INTO workflows
+        (id, session_id, name, pattern, task_ids, occurrences,
+         first_seen, last_seen, avg_duration_ms, involved_services)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      id,
+      sessionId,
+      data.name ?? null,
+      data.pattern,
+      data.taskIds,
+      data.occurrences,
+      data.firstSeen,
+      data.lastSeen,
+      data.avgDurationMs,
+      data.involvedServices
+    );
+  }
+  getWorkflows(sessionId) {
+    const rows = this.db.prepare("SELECT * FROM workflows WHERE session_id = ?").all(sessionId);
+    return rows.map((r) => ({
+      id: r["id"],
+      sessionId: r["session_id"],
+      name: r["name"],
+      pattern: r["pattern"],
+      taskIds: r["task_ids"],
+      occurrences: r["occurrences"],
+      firstSeen: r["first_seen"],
+      lastSeen: r["last_seen"],
+      avgDurationMs: r["avg_duration_ms"],
+      involvedServices: r["involved_services"]
+    }));
+  }
+  // ── SOPs ────────────────────────────────
+  insertSOP(sop) {
+    const id = crypto.randomUUID();
+    this.db.prepare(`
+      INSERT INTO sops
+        (id, workflow_id, title, description, steps, involved_systems,
+         estimated_duration, frequency, generated_at, confidence)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      id,
+      sop.workflowId,
+      sop.title,
+      sop.description,
+      JSON.stringify(sop.steps),
+      JSON.stringify(sop.involvedSystems),
+      sop.estimatedDuration,
+      sop.frequency,
+      (/* @__PURE__ */ new Date()).toISOString(),
+      sop.confidence
+    );
+  }
+  getSOPs(sessionId) {
+    const rows = this.db.prepare(`
+      SELECT s.* FROM sops s
+      JOIN workflows w ON s.workflow_id = w.id
+      WHERE w.session_id = ?
+    `).all(sessionId);
+    return rows.map((r) => ({
+      id: r["id"],
+      workflowId: r["workflow_id"],
+      title: r["title"],
+      description: r["description"],
+      steps: JSON.parse(r["steps"]),
+      involvedSystems: JSON.parse(r["involved_systems"]),
+      estimatedDuration: r["estimated_duration"],
+      frequency: r["frequency"],
+      confidence: r["confidence"]
+    }));
+  }
+  // ── Approvals ───────────────────────────
+  setApproval(pattern, action) {
+    this.db.prepare(`
+      INSERT OR REPLACE INTO node_approvals (pattern, action, created_at) VALUES (?, ?, ?)
+    `).run(pattern, action, (/* @__PURE__ */ new Date()).toISOString());
+  }
+  getApproval(pattern) {
+    const row = this.db.prepare("SELECT action FROM node_approvals WHERE pattern = ?").get(pattern);
+    return row?.action;
+  }
+  // ── Stats ───────────────────────────────
+  getStats(sessionId) {
+    const nodes = this.db.prepare("SELECT COUNT(*) as c FROM nodes WHERE session_id = ?").get(sessionId).c;
+    const edges = this.db.prepare("SELECT COUNT(*) as c FROM edges WHERE session_id = ?").get(sessionId).c;
+    const events = this.db.prepare("SELECT COUNT(*) as c FROM activity_events WHERE session_id = ?").get(sessionId).c;
+    const tasks = this.db.prepare("SELECT COUNT(*) as c FROM tasks WHERE session_id = ?").get(sessionId).c;
+    return { nodes, edges, events, tasks };
+  }
+};
+
+// src/tools.ts
+import { z as z2 } from "zod";
+
+// src/types.ts
+import { z } from "zod";
+var NODE_TYPES = [
+  "host",
+  "database_server",
+  "database",
+  "table",
+  "web_service",
+  "api_endpoint",
+  "cache_server",
+  "message_broker",
+  "queue",
+  "topic",
+  "container",
+  "pod",
+  "k8s_cluster",
+  "config_file",
+  "unknown"
+];
+var EDGE_RELATIONSHIPS = [
+  "connects_to",
+  "reads_from",
+  "writes_to",
+  "calls",
+  "contains",
+  "depends_on"
+];
+var EVENT_TYPES = [
+  "process_start",
+  "process_end",
+  "connection_open",
+  "connection_close",
+  "window_focus",
+  "tool_switch"
+];
+var NodeSchema = z.object({
+  id: z.string().describe('Format: "{type}:{host}:{port}" oder "{type}:{name}"'),
+  type: z.enum(NODE_TYPES),
+  name: z.string(),
+  discoveredVia: z.string(),
+  confidence: z.number().min(0).max(1).default(0.5),
+  metadata: z.record(z.unknown()).default({}),
+  tags: z.array(z.string()).default([])
+});
+var EdgeSchema = z.object({
+  sourceId: z.string(),
+  targetId: z.string(),
+  relationship: z.enum(EDGE_RELATIONSHIPS),
+  evidence: z.string(),
+  confidence: z.number().min(0).max(1).default(0.5)
+});
+var EventSchema = z.object({
+  eventType: z.enum(EVENT_TYPES),
+  process: z.string(),
+  pid: z.number(),
+  target: z.string().optional(),
+  targetType: z.enum(NODE_TYPES).optional(),
+  protocol: z.string().optional(),
+  port: z.number().optional()
+});
+var SOPStepSchema = z.object({
+  order: z.number(),
+  instruction: z.string(),
+  tool: z.string(),
+  target: z.string().optional(),
+  notes: z.string().optional()
+});
+var SOPSchema = z.object({
+  title: z.string(),
+  description: z.string(),
+  steps: z.array(SOPStepSchema),
+  involvedSystems: z.array(z.string()),
+  estimatedDuration: z.string(),
+  frequency: z.string(),
+  confidence: z.number().min(0).max(1)
+});
+var MIN_POLL_INTERVAL_MS = 15e3;
+function defaultConfig(overrides = {}) {
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "/tmp";
+  return {
+    mode: "discover",
+    maxDepth: 8,
+    maxTurns: 50,
+    entryPoints: ["localhost"],
+    agentModel: "claude-sonnet-4-5-20250929",
+    shadowMode: "daemon",
+    pollIntervalMs: 3e4,
+    inactivityTimeoutMs: 3e5,
+    promptTimeoutMs: 6e4,
+    trackWindowFocus: false,
+    autoSaveNodes: false,
+    enableNotifications: true,
+    shadowModel: "claude-haiku-4-5-20251001",
+    outputDir: "./cartography-output",
+    dbPath: `${home}/.cartography/cartography.db`,
+    socketPath: `${home}/.cartography/daemon.sock`,
+    pidFile: `${home}/.cartography/daemon.pid`,
+    verbose: false,
+    ...overrides
+  };
+}
+
+// src/tools.ts
+function stripSensitive(target) {
+  try {
+    const url = new URL(target.startsWith("http") ? target : `tcp://${target}`);
+    return `${url.hostname}${url.port ? ":" + url.port : ""}`;
+  } catch {
+    return target.replace(/\/.*$/, "").replace(/\?.*$/, "").replace(/@.*:/, ":");
+  }
+}
+async function createCartographyTools(db, sessionId) {
+  const sdk = await import("@anthropic-ai/claude-code");
+  const { tool, createSdkMcpServer } = sdk;
+  const tools = [
+    tool("save_node", "Infrastructure-Node speichern", {
+      id: z2.string(),
+      type: z2.enum(NODE_TYPES),
+      name: z2.string(),
+      discoveredVia: z2.string(),
+      confidence: z2.number().min(0).max(1),
+      metadata: z2.record(z2.unknown()).optional(),
+      tags: z2.array(z2.string()).optional()
+    }, async (args) => {
+      const node = {
+        id: stripSensitive(args["id"]),
+        type: args["type"],
+        name: args["name"],
+        discoveredVia: args["discoveredVia"],
+        confidence: args["confidence"],
+        metadata: args["metadata"] ?? {},
+        tags: args["tags"] ?? []
+      };
+      db.upsertNode(sessionId, node);
+      return { content: [{ type: "text", text: `\u2713 Node: ${node.id}` }] };
+    }),
+    tool("save_edge", "Verbindung zwischen zwei Nodes speichern", {
+      sourceId: z2.string(),
+      targetId: z2.string(),
+      relationship: z2.enum(EDGE_RELATIONSHIPS),
+      evidence: z2.string(),
+      confidence: z2.number().min(0).max(1)
+    }, async (args) => {
+      db.insertEdge(sessionId, {
+        sourceId: args["sourceId"],
+        targetId: args["targetId"],
+        relationship: args["relationship"],
+        evidence: args["evidence"],
+        confidence: args["confidence"]
+      });
+      return { content: [{ type: "text", text: `\u2713 ${args["sourceId"]}\u2192${args["targetId"]}` }] };
+    }),
+    tool("save_event", "Activity-Event (Prozess/Verbindung) speichern", {
+      eventType: z2.enum(EVENT_TYPES),
+      process: z2.string(),
+      pid: z2.number(),
+      target: z2.string().optional(),
+      targetType: z2.enum(NODE_TYPES).optional(),
+      port: z2.number().optional()
+    }, async (args) => {
+      db.insertEvent(sessionId, {
+        eventType: args["eventType"],
+        process: args["process"],
+        pid: args["pid"],
+        target: args["target"] ? stripSensitive(args["target"]) : void 0,
+        targetType: args["targetType"],
+        port: args["port"]
+      });
+      return { content: [{ type: "text", text: `\u2713 ${args["eventType"]}` }] };
+    }),
+    tool("get_catalog", "Aktuellen Katalog abrufen (Duplikat-Check)", {
+      includeEdges: z2.boolean().default(true)
+    }, async (args) => {
+      const nodes = db.getNodes(sessionId);
+      const edges = args["includeEdges"] ? db.getEdges(sessionId) : [];
+      return {
+        content: [{
+          type: "text",
+          text: JSON.stringify({
+            count: { nodes: nodes.length, edges: edges.length },
+            nodeIds: nodes.map((n) => n.id)
+          })
+        }]
+      };
+    }),
+    tool("manage_task", "Task starten, beenden oder beschreiben", {
+      action: z2.enum(["start", "end", "describe"]),
+      description: z2.string().optional()
+    }, async (args) => {
+      const action = args["action"];
+      if (action === "start") {
+        const id = db.startTask(sessionId, args["description"]);
+        return { content: [{ type: "text", text: `\u2713 Task gestartet: ${id}` }] };
+      }
+      if (action === "end") {
+        db.endCurrentTask(sessionId);
+        return { content: [{ type: "text", text: "\u2713 Task beendet" }] };
+      }
+      db.updateTaskDescription(sessionId, args["description"]);
+      return { content: [{ type: "text", text: "\u2713 Beschreibung aktualisiert" }] };
+    }),
+    tool("save_sop", "Standard Operating Procedure speichern", {
+      workflowId: z2.string(),
+      title: z2.string(),
+      description: z2.string(),
+      steps: z2.array(SOPStepSchema),
+      involvedSystems: z2.array(z2.string()),
+      estimatedDuration: z2.string(),
+      frequency: z2.string(),
+      confidence: z2.number().min(0).max(1)
+    }, async (args) => {
+      db.insertSOP({
+        workflowId: args["workflowId"],
+        title: args["title"],
+        description: args["description"],
+        steps: args["steps"],
+        involvedSystems: args["involvedSystems"],
+        estimatedDuration: args["estimatedDuration"],
+        frequency: args["frequency"],
+        confidence: args["confidence"]
+      });
+      return { content: [{ type: "text", text: `\u2713 SOP: ${args["title"]}` }] };
+    })
+  ];
+  return createSdkMcpServer({
+    name: "cartography",
+    version: "0.1.0",
+    tools
+  });
+}
+
+// src/safety.ts
+var BLOCKED_CMDS = /\b(rm|mv|cp|dd|mkfs|chmod|chown|chgrp|kill|killall|pkill|reboot|shutdown|poweroff|halt|systemctl\s+(start|stop|restart|enable|disable)|service\s+(start|stop|restart)|docker\s+(rm|rmi|stop|kill|exec|run|build|push)|kubectl\s+(delete|apply|edit|exec|run|create|patch)|apt|yum|dnf|pacman|pip\s+install|npm\s+(install|uninstall)|curl\s+.*-X\s*(POST|PUT|DELETE|PATCH)|wget\s+-O|tee\s)\b/i;
+var BLOCKED_REDIRECTS = />>|>[^>]/;
+var safetyHook = async (input) => {
+  if (!("tool_name" in input)) return {};
+  if (input.tool_name !== "Bash") return {};
+  const cmd = input.tool_input?.command ?? "";
+  if (BLOCKED_CMDS.test(cmd) || BLOCKED_REDIRECTS.test(cmd)) {
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: `BLOCKED: "${cmd}" \u2014 read-only policy`
+      }
+    };
+  }
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "allow"
+    }
+  };
+};
+
+// src/agent.ts
+async function runDiscovery(config, db, sessionId, onOutput) {
+  const { query } = await import("@anthropic-ai/claude-code");
+  const tools = await createCartographyTools(db, sessionId);
+  const systemPrompt = `Du bist ein Infrastruktur-Discovery-Agent.
+Kartographiere die gesamte Systemlandschaft.
+
+STRATEGIE:
+1. ss -tlnp + ps aux \u2192 \xDCberblick
+2. Jeden Service tiefer (Datenbanken\u2192Tabellen, APIs\u2192Endpoints, Queues\u2192Topics)
+3. save_node + save_edge f\xFCr alles. get_catalog \u2192 keine Duplikate.
+4. Config-Files folgen: .env (nur Host:Port!), docker-compose.yml, application.yml
+5. Backtrack wenn Spur ersch\xF6pft. Stop wenn alles explored.
+
+PORT-MAPPING: 5432=postgres, 3306=mysql, 27017=mongodb, 6379=redis,
+9092=kafka, 5672=rabbitmq, 80/443/8080/3000=web_service,
+9090=prometheus, 8500=consul, 8200=vault, 2379=etcd
+
+REGELN:
+- NUR read-only Commands (ss, ps, cat, head, curl -s, docker inspect, kubectl get)
+- Targets NUR Host:Port \u2014 KEINE URLs, Pfade, Credentials
+- Node IDs: "{type}:{host}:{port}" oder "{type}:{name}"
+- Confidence: 0.9 direkt beobachtet, 0.7 aus Config, 0.5 Vermutung
+- KEINE Credentials speichern
+
+Entrypoints: ${config.entryPoints.join(", ")}`;
+  for await (const msg of query({
+    prompt: systemPrompt,
+    options: {
+      model: config.agentModel,
+      maxTurns: config.maxTurns,
+      customSystemPrompt: systemPrompt,
+      mcpServers: { cartography: tools },
+      allowedTools: [
+        "Bash",
+        "mcp__cartograph__save_node",
+        "mcp__cartograph__save_edge",
+        "mcp__cartograph__get_catalog"
+      ],
+      hooks: {
+        PreToolUse: [{ matcher: "Bash", hooks: [safetyHook] }]
+      },
+      permissionMode: "bypassPermissions"
+    }
+  })) {
+    if (msg.type === "assistant" && onOutput) {
+      for (const block of msg.message.content) {
+        if (block.type === "text") {
+          onOutput(block.text);
+        }
+      }
+    }
+    if (msg.type === "result") return;
+  }
+}
+async function runShadowCycle(config, db, sessionId, prevSnapshot, currSnapshot, onOutput) {
+  const { query } = await import("@anthropic-ai/claude-code");
+  const tools = await createCartographyTools(db, sessionId);
+  const prompt = `Analysiere den Diff zwischen diesen beiden System-Snapshots.
+Finde:
+- Neue/geschlossene TCP-Verbindungen \u2192 save_event
+- Neue/beendete Prozesse \u2192 save_event
+- Bisher unbekannte Services \u2192 get_catalog pr\xFCfen, dann save_node
+- Task-Grenzen (Inaktivit\xE4t, Tool-Wechsel) \u2192 manage_task
+target = NUR Host:Port. Kurz und effizient.
+
+=== VORHER ===
+${prevSnapshot}
+
+=== JETZT ===
+${currSnapshot}`;
+  for await (const msg of query({
+    prompt,
+    options: {
+      model: config.shadowModel,
+      maxTurns: 5,
+      mcpServers: { cartography: tools },
+      allowedTools: [
+        "mcp__cartograph__save_event",
+        "mcp__cartograph__save_node",
+        "mcp__cartograph__save_edge",
+        "mcp__cartograph__get_catalog",
+        "mcp__cartograph__manage_task"
+      ],
+      permissionMode: "bypassPermissions"
+    }
+  })) {
+    if (onOutput) onOutput(msg);
+  }
+}
+async function generateSOPs(db, sessionId) {
+  const Anthropic = (await import("@anthropic-ai/sdk")).default;
+  const client = new Anthropic();
+  const tasks = db.getTasks(sessionId).filter((t) => t.status === "completed");
+  if (tasks.length === 0) return 0;
+  const clusters = clusterTasks(tasks);
+  let generated = 0;
+  for (const cluster of clusters) {
+    const workflowId = crypto.randomUUID();
+    const involved = JSON.parse(cluster[0]?.involvedServices ?? "[]");
+    const taskDescriptions = cluster.map((t, i) => `Task ${i + 1}: ${t.description ?? "Unnamed"}
+Steps: ${t.steps}`).join("\n\n");
+    const response = await client.messages.create({
+      model: "claude-sonnet-4-5-20250929",
+      max_tokens: 2048,
+      messages: [{
+        role: "user",
+        content: `Generiere eine SOP (Standard Operating Procedure) f\xFCr diesen wiederkehrenden Workflow.
+Antworte NUR mit validen JSON im Format:
+{
+  "title": "...",
+  "description": "...",
+  "steps": [{"order": 1, "instruction": "...", "tool": "...", "target": "...", "notes": "..."}],
+  "involvedSystems": ["..."],
+  "estimatedDuration": "~N Minuten",
+  "frequency": "Xmal t\xE4glich",
+  "confidence": 0.8
+}
+
+Tasks:
+${taskDescriptions}
+
+Beteiligte Services: ${involved.join(", ")}`
+      }]
+    });
+    const text = response.content[0]?.type === "text" ? response.content[0].text : "";
+    try {
+      const jsonMatch = text.match(/\{[\s\S]*\}/);
+      if (!jsonMatch) continue;
+      const parsed = JSON.parse(jsonMatch[0]);
+      db.insertSOP({ workflowId, ...parsed });
+      generated++;
+    } catch {
+    }
+  }
+  return generated;
+}
+function clusterTasks(tasks) {
+  const clusters = [];
+  const assigned = /* @__PURE__ */ new Set();
+  for (const task of tasks) {
+    if (assigned.has(task.id)) continue;
+    const cluster = [task];
+    assigned.add(task.id);
+    const taskServices = new Set(JSON.parse(task.involvedServices ?? "[]"));
+    for (const other of tasks) {
+      if (assigned.has(other.id)) continue;
+      const otherServices = new Set(JSON.parse(other.involvedServices ?? "[]"));
+      const overlap = [...taskServices].filter((s) => otherServices.has(s));
+      if (overlap.length > 0) {
+        cluster.push(other);
+        assigned.add(other.id);
+      }
+    }
+    clusters.push(cluster);
+  }
+  return clusters;
+}
+
+// src/exporter.ts
+import { mkdirSync as mkdirSync2, writeFileSync } from "fs";
+import { join } from "path";
+var MERMAID_ICONS = {
+  host: "\u{1F5A5}\uFE0F",
+  database_server: "\u{1F5C4}\uFE0F",
+  database: "\u{1F5C4}\uFE0F",
+  table: "\u{1F4CB}",
+  web_service: "\u{1F310}",
+  api_endpoint: "\u{1F50C}",
+  cache_server: "\u26A1",
+  message_broker: "\u{1F4E8}",
+  queue: "\u{1F4EC}",
+  topic: "\u{1F4E2}",
+  container: "\u{1F4E6}",
+  pod: "\u2638\uFE0F",
+  k8s_cluster: "\u2638\uFE0F",
+  config_file: "\u{1F4C4}",
+  unknown: "\u2753"
+};
+var EDGE_LABELS = {
+  connects_to: "",
+  reads_from: "reads",
+  writes_to: "writes",
+  calls: "calls",
+  contains: "contains",
+  depends_on: "depends"
+};
+function sanitize(id) {
+  return id.replace(/[^a-zA-Z0-9_]/g, "_");
+}
+function groupByParent(nodes) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    const group = node.id.split(":")[1] ?? node.type;
+    if (!groups.has(group)) groups.set(group, []);
+    groups.get(group).push(node);
+  }
+  return groups;
+}
+function generateTopologyMermaid(nodes, edges) {
+  const lines = ["graph TB"];
+  const groups = groupByParent(nodes);
+  for (const [group, groupNodes] of groups) {
+    if (groups.size > 1) {
+      lines.push(`    subgraph ${sanitize(group)}`);
+    }
+    for (const node of groupNodes) {
+      const icon = MERMAID_ICONS[node.type] ?? "\u2753";
+      lines.push(`    ${sanitize(node.id)}["${icon} ${node.name}"]`);
+    }
+    if (groups.size > 1) {
+      lines.push("    end");
+    }
+  }
+  for (const edge of edges) {
+    const label = EDGE_LABELS[edge.relationship] ?? "";
+    const arrow = label ? `-->|"${label}"|` : "-->";
+    lines.push(`    ${sanitize(edge.sourceId)} ${arrow} ${sanitize(edge.targetId)}`);
+  }
+  return lines.join("\n");
+}
+function generateDependencyMermaid(nodes, edges) {
+  const lines = ["graph LR"];
+  const depEdges = edges.filter(
+    (e) => ["calls", "reads_from", "writes_to", "depends_on"].includes(e.relationship)
+  );
+  const usedIds = /* @__PURE__ */ new Set();
+  for (const edge of depEdges) {
+    usedIds.add(edge.sourceId);
+    usedIds.add(edge.targetId);
+  }
+  const usedNodes = nodes.filter((n) => usedIds.has(n.id));
+  for (const node of usedNodes) {
+    const icon = MERMAID_ICONS[node.type] ?? "\u2753";
+    lines.push(`    ${sanitize(node.id)}["${icon} ${node.name}"]`);
+  }
+  for (const edge of depEdges) {
+    const label = EDGE_LABELS[edge.relationship] ?? "";
+    const arrow = label ? `-->|"${label}"|` : "-->";
+    lines.push(`    ${sanitize(edge.sourceId)} ${arrow} ${sanitize(edge.targetId)}`);
+  }
+  return lines.join("\n");
+}
+function generateWorkflowMermaid(sop) {
+  const lines = ["flowchart TD"];
+  for (const step of sop.steps) {
+    const nodeId = `S${step.order}`;
+    const label = `${step.order}. ${step.instruction.substring(0, 60)}`;
+    lines.push(`    ${nodeId}["${label}"]`);
+    if (step.order > 1) {
+      lines.push(`    S${step.order - 1} --> ${nodeId}`);
+    }
+  }
+  return lines.join("\n");
+}
+function exportBackstageYAML(nodes, edges, org) {
+  const owner = org ?? "unknown";
+  const docs = [];
+  for (const node of nodes) {
+    const isComponent = ["web_service", "container", "pod"].includes(node.type);
+    const isAPI = node.type === "api_endpoint";
+    const kind = isComponent ? "Component" : isAPI ? "API" : "Resource";
+    const deps = edges.filter((e) => e.sourceId === node.id).map((e) => `    - resource:default/${sanitize(e.targetId)}`);
+    const doc = [
+      `apiVersion: backstage.io/v1alpha1`,
+      `kind: ${kind}`,
+      `metadata:`,
+      `  name: ${sanitize(node.id)}`,
+      `  annotations:`,
+      `    cartography/discovered-at: "${node.discoveredAt}"`,
+      `    cartography/confidence: "${node.confidence}"`,
+      `spec:`,
+      `  type: ${node.type}`,
+      `  lifecycle: production`,
+      `  owner: ${owner}`,
+      ...deps.length > 0 ? ["  dependsOn:", ...deps] : []
+    ].join("\n");
+    docs.push(doc);
+  }
+  return docs.join("\n---\n");
+}
+function exportJSON(db, sessionId) {
+  const nodes = db.getNodes(sessionId);
+  const edges = db.getEdges(sessionId);
+  const events = db.getEvents(sessionId);
+  const tasks = db.getTasks(sessionId);
+  const sops = db.getSOPs(sessionId);
+  const stats = db.getStats(sessionId);
+  return JSON.stringify({
+    sessionId,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    stats,
+    nodes,
+    edges,
+    events,
+    tasks,
+    sops
+  }, null, 2);
+}
+function exportHTML(nodes, edges) {
+  const graphData = JSON.stringify({
+    nodes: nodes.map((n) => ({ id: n.id, name: n.name, type: n.type, confidence: n.confidence })),
+    links: edges.map((e) => ({ source: e.sourceId, target: e.targetId, relationship: e.relationship }))
+  });
+  return `<!DOCTYPE html>
+<html lang="de">
+<head>
+  <meta charset="UTF-8">
+  <title>Cartography \u2014 Topology</title>
+  <script src="https://d3js.org/d3.v7.min.js"></script>
+  <style>
+    body { margin: 0; background: #1a1a2e; color: #eee; font-family: monospace; }
+    svg { width: 100vw; height: 100vh; }
+    .node circle { stroke: #fff; stroke-width: 1.5px; }
+    .node text { font-size: 10px; fill: #eee; }
+    .link { stroke: #666; stroke-opacity: 0.6; }
+    #info { position: fixed; top: 10px; right: 10px; background: rgba(0,0,0,0.7);
+            padding: 10px; border-radius: 4px; font-size: 12px; }
+  </style>
+</head>
+<body>
+<div id="info">
+  <strong>Cartography</strong><br>
+  Nodes: ${nodes.length} | Edges: ${edges.length}<br>
+  <small>Drag to explore</small>
+</div>
+<svg></svg>
+<script>
+const data = ${graphData};
+
+const TYPE_COLORS = {
+  host: '#4a9eff', database_server: '#ff6b6b', database: '#ff8c42',
+  web_service: '#6bcb77', api_endpoint: '#4d96ff', cache_server: '#ffd93d',
+  message_broker: '#c77dff', queue: '#e0aaff', topic: '#9d4edd',
+  container: '#48cae4', pod: '#00b4d8', k8s_cluster: '#0077b6',
+  config_file: '#adb5bd', unknown: '#6c757d',
+};
+
+const svg = d3.select('svg');
+const width = window.innerWidth, height = window.innerHeight;
+const g = svg.append('g');
+
+svg.call(d3.zoom().on('zoom', e => g.attr('transform', e.transform)));
+
+const sim = d3.forceSimulation(data.nodes)
+  .force('link', d3.forceLink(data.links).id(d => d.id).distance(100))
+  .force('charge', d3.forceManyBody().strength(-200))
+  .force('center', d3.forceCenter(width / 2, height / 2));
+
+const link = g.append('g').selectAll('line')
+  .data(data.links).join('line').attr('class', 'link');
+
+const node = g.append('g').selectAll('g')
+  .data(data.nodes).join('g').attr('class', 'node')
+  .call(d3.drag()
+    .on('start', (e, d) => { if (!e.active) sim.alphaTarget(0.3).restart(); d.fx = d.x; d.fy = d.y; })
+    .on('drag', (e, d) => { d.fx = e.x; d.fy = e.y; })
+    .on('end', (e, d) => { if (!e.active) sim.alphaTarget(0); d.fx = null; d.fy = null; })
+  );
+
+node.append('circle').attr('r', 8).attr('fill', d => TYPE_COLORS[d.type] || '#aaa');
+node.append('text').attr('dx', 12).attr('dy', '.35em').text(d => d.name);
+node.append('title').text(d => \`\${d.type}: \${d.id}
+Confidence: \${d.confidence}\`);
+
+sim.on('tick', () => {
+  link.attr('x1', d => d.source.x).attr('y1', d => d.source.y)
+      .attr('x2', d => d.target.x).attr('y2', d => d.target.y);
+  node.attr('transform', d => \`translate(\${d.x},\${d.y})\`);
+});
+</script>
+</body>
+</html>`;
+}
+function exportSOPMarkdown(sop) {
+  const lines = [
+    `# ${sop.title}`,
+    "",
+    `**Beschreibung:** ${sop.description}`,
+    `**Systeme:** ${sop.involvedSystems.join(", ")}`,
+    `**Dauer:** ${sop.estimatedDuration}`,
+    `**H\xE4ufigkeit:** ${sop.frequency}`,
+    `**Confidence:** ${sop.confidence.toFixed(2)}`,
+    "",
+    "## Schritte",
+    ""
+  ];
+  for (const step of sop.steps) {
+    lines.push(`${step.order}. **${step.tool}**${step.target ? ` \u2192 \`${step.target}\`` : ""}`);
+    lines.push(`   ${step.instruction}`);
+    if (step.notes) lines.push(`   _${step.notes}_`);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function exportAll(db, sessionId, outputDir, formats = ["mermaid", "json", "yaml", "html", "sops"]) {
+  mkdirSync2(outputDir, { recursive: true });
+  mkdirSync2(join(outputDir, "sops"), { recursive: true });
+  mkdirSync2(join(outputDir, "workflows"), { recursive: true });
+  const nodes = db.getNodes(sessionId);
+  const edges = db.getEdges(sessionId);
+  if (formats.includes("mermaid")) {
+    writeFileSync(join(outputDir, "topology.mermaid"), generateTopologyMermaid(nodes, edges));
+    writeFileSync(join(outputDir, "dependencies.mermaid"), generateDependencyMermaid(nodes, edges));
+    process.stderr.write("\u2713 topology.mermaid, dependencies.mermaid\n");
+  }
+  if (formats.includes("json")) {
+    writeFileSync(join(outputDir, "catalog.json"), exportJSON(db, sessionId));
+    process.stderr.write("\u2713 catalog.json\n");
+  }
+  if (formats.includes("yaml")) {
+    writeFileSync(join(outputDir, "catalog-info.yaml"), exportBackstageYAML(nodes, edges));
+    process.stderr.write("\u2713 catalog-info.yaml\n");
+  }
+  if (formats.includes("html")) {
+    writeFileSync(join(outputDir, "topology.html"), exportHTML(nodes, edges));
+    process.stderr.write("\u2713 topology.html\n");
+  }
+  if (formats.includes("sops")) {
+    const sops = db.getSOPs(sessionId);
+    for (const sop of sops) {
+      const filename = sop.title.toLowerCase().replace(/[^a-z0-9]+/g, "-") + ".md";
+      writeFileSync(join(outputDir, "sops", filename), exportSOPMarkdown(sop));
+      const wfFilename = `workflow-${sop.workflowId.substring(0, 8)}.mermaid`;
+      writeFileSync(join(outputDir, "workflows", wfFilename), generateWorkflowMermaid(sop));
+    }
+    if (sops.length > 0) {
+      process.stderr.write(`\u2713 ${sops.length} SOPs + workflow diagrams
+`);
+    }
+  }
+}
+
+// src/preflight.ts
+import { execSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { join as join2 } from "path";
+function isOAuthLoggedIn() {
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "/tmp";
+  const credFile = join2(home, ".claude", ".credentials.json");
+  if (!existsSync(credFile)) return false;
+  try {
+    const creds = JSON.parse(readFileSync(credFile, "utf8"));
+    const oauth = creds["claudeAiOauth"];
+    return typeof oauth?.["accessToken"] === "string" && oauth["accessToken"].length > 0;
+  } catch {
+    return false;
+  }
+}
+function checkPrerequisites() {
+  try {
+    execSync("claude --version", { stdio: "pipe" });
+  } catch {
+    process.stderr.write(
+      "\n\u274C Claude CLI nicht gefunden.\n   Cartography braucht die Claude CLI als Runtime-Dependency.\n\n   Installieren:\n     npm install -g @anthropic-ai/claude-code\n     # oder\n     curl -fsSL https://claude.ai/install.sh | bash\n\n   Danach: claude login\n\n"
+    );
+    process.exitCode = 1;
+    throw new Error("Claude CLI not found");
+  }
+  const hasApiKey = Boolean(process.env.ANTHROPIC_API_KEY);
+  const hasOAuth = isOAuthLoggedIn();
+  if (!hasApiKey && !hasOAuth) {
+    process.stderr.write(
+      "\u26A0 Keine Authentifizierung gefunden. Bitte eine der folgenden Optionen:\n\n  Option A \u2014 claude.ai Subscription (empfohlen):\n    claude login\n\n  Option B \u2014 API Key:\n    export ANTHROPIC_API_KEY=sk-ant-...\n\n"
+    );
+  } else if (hasOAuth && !hasApiKey) {
+    process.stderr.write("\u2713 Eingeloggt via claude login (Subscription)\n");
+  }
+}
+function checkPollInterval(intervalMs) {
+  if (intervalMs < MIN_POLL_INTERVAL_MS) {
+    process.stderr.write(
+      `\u26A0 Minimum Shadow-Intervall: ${MIN_POLL_INTERVAL_MS / 1e3} Sekunden (Agent SDK Overhead)
+`
+    );
+    return MIN_POLL_INTERVAL_MS;
+  }
+  return intervalMs;
+}
+export {
+  CartographyDB,
+  MIN_POLL_INTERVAL_MS,
+  checkPollInterval,
+  checkPrerequisites,
+  createCartographyTools,
+  CartographyDB as default,
+  defaultConfig,
+  exportAll,
+  exportBackstageYAML,
+  exportHTML,
+  exportJSON,
+  exportSOPMarkdown,
+  generateDependencyMermaid,
+  generateSOPs,
+  generateTopologyMermaid,
+  generateWorkflowMermaid,
+  runDiscovery,
+  runShadowCycle,
+  safetyHook,
+  stripSensitive
+};
+//# sourceMappingURL=index.js.map