@llm-dev-ops/agentics-cli 1.4.32 → 1.4.35

package/dist/bundled-agents/policy-engine-agents/dist/observability/tracing.js

@@ -0,0 +1,219 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tracingService = exports.TracingService = void 0;
+exports.Trace = Trace;
+/**
+ * Distributed Tracing using OpenTelemetry
+ * Production-grade tracing for request flow visibility
+ */
+const sdk_trace_node_1 = require("@opentelemetry/sdk-trace-node");
+const resources_1 = require("@opentelemetry/resources");
+const semantic_conventions_1 = require("@opentelemetry/semantic-conventions");
+const sdk_trace_base_1 = require("@opentelemetry/sdk-trace-base");
+const exporter_jaeger_1 = require("@opentelemetry/exporter-jaeger");
+const instrumentation_1 = require("@opentelemetry/instrumentation");
+const instrumentation_http_1 = require("@opentelemetry/instrumentation-http");
+const instrumentation_express_1 = require("@opentelemetry/instrumentation-express");
+const instrumentation_pg_1 = require("@opentelemetry/instrumentation-pg");
+const instrumentation_redis_4_1 = require("@opentelemetry/instrumentation-redis-4");
+const api_1 = require("@opentelemetry/api");
+const config_1 = require("@utils/config");
+const logger_1 = __importDefault(require("@utils/logger"));
+class TracingService {
+    provider = null;
+    enabled;
+    constructor() {
+        this.enabled = config_1.config.observability.traceEnabled;
+    }
+    /**
+     * Initialize tracing
+     */
+    initialize() {
+        if (!this.enabled) {
+            logger_1.default.info('Tracing disabled');
+            return;
+        }
+        try {
+            const resource = new resources_1.Resource({
+                [semantic_conventions_1.SemanticResourceAttributes.SERVICE_NAME]: 'llm-policy-engine',
+                [semantic_conventions_1.SemanticResourceAttributes.SERVICE_VERSION]: '1.0.0',
+                [semantic_conventions_1.SemanticResourceAttributes.DEPLOYMENT_ENVIRONMENT]: config_1.config.nodeEnv,
+            });
+            this.provider = new sdk_trace_node_1.NodeTracerProvider({
+                resource,
+            });
+            const jaegerExporter = new exporter_jaeger_1.JaegerExporter({
+                endpoint: process.env.JAEGER_ENDPOINT || 'http://localhost:14268/api/traces',
+            });
+            this.provider.addSpanProcessor(new sdk_trace_base_1.BatchSpanProcessor(jaegerExporter));
+            this.provider.register();
+            (0, instrumentation_1.registerInstrumentations)({
+                instrumentations: [
+                    new instrumentation_http_1.HttpInstrumentation({
+                        requestHook: (span, request) => {
+                            const headers = request.headers;
+                            span.setAttribute('http.request.id', headers?.['x-request-id'] || '');
+                        },
+                    }),
+                    new instrumentation_express_1.ExpressInstrumentation(),
+                    new instrumentation_pg_1.PgInstrumentation({
+                        enhancedDatabaseReporting: true,
+                    }),
+                    new instrumentation_redis_4_1.RedisInstrumentation(),
+                ],
+            });
+            logger_1.default.info('Tracing initialized successfully');
+        }
+        catch (error) {
+            logger_1.default.error({ error }, 'Failed to initialize tracing');
+            this.enabled = false;
+        }
+    }
+    /**
+     * Create a new span
+     */
+    createSpan(name, attributes) {
+        if (!this.enabled) {
+            return null;
+        }
+        const tracer = api_1.trace.getTracer('llm-policy-engine');
+        const span = tracer.startSpan(name, {
+            attributes: attributes || {},
+        });
+        return span;
+    }
+    /**
+     * Start a span with context
+     */
+    startSpan(name, fn, attributes) {
+        if (!this.enabled) {
+            const mockSpan = {
+                end: () => { },
+                setStatus: () => { },
+                setAttribute: () => { },
+                addEvent: () => { },
+            };
+            return fn(mockSpan);
+        }
+        const tracer = api_1.trace.getTracer('llm-policy-engine');
+        return tracer.startActiveSpan(name, { attributes: attributes || {} }, async (span) => {
+            try {
+                const result = await fn(span);
+                span.setStatus({ code: api_1.SpanStatusCode.OK });
+                return result;
+            }
+            catch (error) {
+                span.setStatus({
+                    code: api_1.SpanStatusCode.ERROR,
+                    message: error instanceof Error ? error.message : String(error),
+                });
+                span.recordException(error);
+                throw error;
+            }
+            finally {
+                span.end();
+            }
+        });
+    }
+    /**
+     * Get current context
+     */
+    getCurrentContext() {
+        return api_1.context.active();
+    }
+    /**
+     * Wrap a function with tracing
+     */
+    wrap(name, fn, getAttributes) {
+        if (!this.enabled) {
+            return fn;
+        }
+        return (async (...args) => {
+            const attributes = getAttributes ? getAttributes(...args) : {};
+            return this.startSpan(name, () => fn(...args), attributes);
+        });
+    }
+    /**
+     * Add event to current span
+     */
+    addEvent(name, attributes) {
+        if (!this.enabled) {
+            return;
+        }
+        const span = api_1.trace.getActiveSpan();
+        if (span) {
+            span.addEvent(name, attributes);
+        }
+    }
+    /**
+     * Set attribute on current span
+     */
+    setAttribute(key, value) {
+        if (!this.enabled) {
+            return;
+        }
+        const span = api_1.trace.getActiveSpan();
+        if (span) {
+            span.setAttribute(key, value);
+        }
+    }
+    /**
+     * Set multiple attributes on current span
+     */
+    setAttributes(attributes) {
+        if (!this.enabled) {
+            return;
+        }
+        const span = api_1.trace.getActiveSpan();
+        if (span) {
+            Object.entries(attributes).forEach(([key, value]) => {
+                span.setAttribute(key, value);
+            });
+        }
+    }
+    /**
+     * Record exception in current span
+     */
+    recordException(error) {
+        if (!this.enabled) {
+            return;
+        }
+        const span = api_1.trace.getActiveSpan();
+        if (span) {
+            span.recordException(error);
+            span.setStatus({
+                code: api_1.SpanStatusCode.ERROR,
+                message: error.message,
+            });
+        }
+    }
+    /**
+     * Shutdown tracing
+     */
+    async shutdown() {
+        if (this.provider) {
+            await this.provider.shutdown();
+            logger_1.default.info('Tracing shutdown complete');
+        }
+    }
+}
+exports.TracingService = TracingService;
+exports.tracingService = new TracingService();
+/**
+ * Trace decorator for class methods
+ */
+function Trace(spanName, getAttributes) {
+    return function (target, propertyKey, descriptor) {
+        const originalMethod = descriptor.value;
+        const name = spanName || `${target.constructor.name}.${propertyKey}`;
+        descriptor.value = async function (...args) {
+            const attributes = getAttributes ? getAttributes(...args) : {};
+            return exports.tracingService.startSpan(name, () => originalMethod.apply(this, args), attributes);
+        };
+        return descriptor;
+    };
+}
+//# sourceMappingURL=tracing.js.map

package/dist/bundled-agents/policy-engine-agents/dist/observability/tracing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracing.js","sourceRoot":"","sources":["../../src/observability/tracing.ts"],"names":[],"mappings":";;;;;;AA0OA,sBAgBC;AA1PD;;;GAGG;AACH,kEAAmE;AACnE,wDAAoD;AACpD,8EAAiF;AACjF,kEAAmE;AACnE,oEAAgE;AAChE,oEAA0E;AAC1E,8EAA0E;AAC1E,oFAAgF;AAChF,0EAAsE;AACtE,oFAAuG;AACvG,4CAAmF;AACnF,0CAAuC;AACvC,2DAAmC;AAEnC,MAAa,cAAc;IACjB,QAAQ,GAA8B,IAAI,CAAC;IAC3C,OAAO,CAAU;IAEzB;QACE,IAAI,CAAC,OAAO,GAAG,eAAM,CAAC,aAAa,CAAC,YAAY,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,gBAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,oBAAQ,CAAC;gBAC5B,CAAC,iDAA0B,CAAC,YAAY,CAAC,EAAE,mBAAmB;gBAC9D,CAAC,iDAA0B,CAAC,eAAe,CAAC,EAAE,OAAO;gBACrD,CAAC,iDAA0B,CAAC,sBAAsB,CAAC,EAAE,eAAM,CAAC,OAAO;aACpE,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,GAAG,IAAI,mCAAkB,CAAC;gBACrC,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,cAAc,GAAG,IAAI,gCAAc,CAAC;gBACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,mCAAmC;aAC7E,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,mCAAkB,CAAC,cAAc,CAAQ,CAAC,CAAC;YAE9E,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAEzB,IAAA,0CAAwB,EAAC;gBACvB,gBAAgB,EAAE;oBAChB,IAAI,0CAAmB,CAAC;wBACtB,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;4BAC7B,MAAM,OAAO,GAAI,OAAe,CAAC,OAAO,CAAC;4BACzC,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;wBACxE,CAAC;qBACF,CAAC;oBACF,IAAI,gDAAsB,EAAE;oBAC5B,IAAI,sCAAiB,CAAC;wBACpB,yBAAyB,EAAE,IAAI;qBAChC,CAAC;oBACF,IAAI,8CAAqB,EAAE;iBAC5B;aACF,CAAC,CAAC;YAEH,gBAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gBAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,IAAY,EAAE,UAAgC;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,WAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE;YAClC,UAAU,EAAE,UAAU,IAAI,EAAE;SAC7B,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS,CACP,IAAY,EACZ,EAA8B,EAC9B,UAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG;gBACf,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;gBACb,SAAS,EAAE,GAAG,EAAE,GAAE,CAAC;gBACnB,YAAY,EAAE,GAAG,EAAE,GAAE,CAAC;gBACtB,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;aACZ,CAAC;YACT,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,WAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAEpD,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACnF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAc,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5C,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,oBAAc,CAAC,KAAK;oBAC1B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAChE,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,KAAc,CAAC,CAAC;gBACrC,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,aAAO,CAAC,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,IAAI,CACF,IAAY,EACZ,EAAK,EACL,aAA+D;QAE/D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC,KAAK,EAAE,GAAG,IAAmB,EAAE,EAAE;YACvC,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;QAC7D,CAAC,CAAM,CAAC;IACV,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,IAAY,EAAE,UAAgC;QACrD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,WAAK,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,GAAW,EAAE,KAAgC;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,WAAK,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,UAAqD;QACjE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,WAAK,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBAClD,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAY;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,WAAK,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,oBAAc,CAAC,KAAK;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC/B,gBAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;CACF;AAjND,wCAiNC;AAEY,QAAA,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;AAEnD;;GAEG;AACH,SAAgB,KAAK,CAAC,QAAiB,EAAE,aAAuD;IAC9F,OAAO,UACL,MAAW,EACX,WAAmB,EACnB,UAA8B;QAE9B,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC;QACxC,MAAM,IAAI,GAAG,QAAQ,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QAErE,UAAU,CAAC,KAAK,GAAG,KAAK,WAAW,GAAG,IAAW;YAC/C,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,sBAAc,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,CAAC;QAC5F,CAAC,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/bundled-agents/policy-engine-agents/dist/security/agentics-identity.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Agentics Identity Middleware
+ *
+ * CRITICAL: This service does NOT manage identity - it only ASSERTS identity
+ * from the Agentics platform. All authentication is delegated to:
+ * - Agentics CLI issued JWT tokens
+ * - GCP IAM service identity via Agentics runtime
+ *
+ * NO local login, NO credential storage, NO user management
+ */
+import { Request, Response, NextFunction } from 'express';
+/**
+ * Identity context extracted from Agentics authentication
+ */
+export interface AgenticsIdentity {
+    /** Unique subject identifier from Agentics platform */
+    subject: string;
+    /** Email associated with the identity */
+    email: string;
+    /** Identity type: user, service, or gcp-service */
+    type: 'user' | 'service' | 'gcp-service';
+    /** Scopes granted to this identity */
+    scopes: string[];
+    /** Organization ID in Agentics platform */
+    orgId?: string;
+    /** Project ID if scoped to a project */
+    projectId?: string;
+    /** Raw token for audit purposes (hashed) */
+    tokenHash: string;
+    /** Token expiration timestamp */
+    expiresAt: Date;
+    /** Token issued at timestamp */
+    issuedAt: Date;
+}
+export interface AuthenticatedRequest extends Request {
+    identity?: AgenticsIdentity;
+    correlationId?: string;
+}
+/**
+ * Main authentication middleware
+ * Accepts ONLY Agentics-issued identity tokens
+ */
+export declare const requireAgenticsIdentity: (req: AuthenticatedRequest, res: Response, next: NextFunction) => Promise<void>;
+/**
+ * Scope-based authorization middleware
+ * Must be used AFTER requireAgenticsIdentity
+ */
+export declare const requireScope: (...requiredScopes: string[]) => (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+/**
+ * Convenience middleware for read operations
+ */
+export declare const requireReadScope: (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+/**
+ * Convenience middleware for write operations
+ */
+export declare const requireWriteScope: (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+/**
+ * Convenience middleware for admin operations
+ */
+export declare const requireAdminScope: (req: AuthenticatedRequest, res: Response, next: NextFunction) => void;
+/**
+ * Extract actor identity for audit logging
+ */
+export declare function getActorIdentity(identity: AgenticsIdentity | undefined): string;
+/**
+ * Check if identity has approval authority for security/compliance policies
+ */
+export declare function hasApprovalAuthority(identity: AgenticsIdentity | undefined): boolean;
+//# sourceMappingURL=agentics-identity.d.ts.map

package/dist/bundled-agents/policy-engine-agents/dist/security/agentics-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentics-identity.d.ts","sourceRoot":"","sources":["../../src/security/agentics-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAgB1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC;IACzC,sCAAsC;IACtC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,SAAS,EAAE,IAAI,CAAC;IAChB,gCAAgC;IAChC,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwID;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,oBAAoB,EACzB,KAAK,QAAQ,EACb,MAAM,YAAY,KACjB,OAAO,CAAC,IAAI,CAiEd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,GAAG,gBAAgB,MAAM,EAAE,MAC9C,KAAK,oBAAoB,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAoCxE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,QAzCd,oBAAoB,OAAO,QAAQ,QAAQ,YAAY,KAAG,IAyCd,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,iBAAiB,QA9Cf,oBAAoB,OAAO,QAAQ,QAAQ,YAAY,KAAG,IA8CZ,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,iBAAiB,QAnDf,oBAAoB,OAAO,QAAQ,QAAQ,YAAY,KAAG,IAmDZ,CAAC;AAE9D;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,CAK/E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAMpF"}

package/dist/bundled-agents/policy-engine-agents/dist/security/agentics-identity.js

@@ -0,0 +1,280 @@
+"use strict";
+/**
+ * Agentics Identity Middleware
+ *
+ * CRITICAL: This service does NOT manage identity - it only ASSERTS identity
+ * from the Agentics platform. All authentication is delegated to:
+ * - Agentics CLI issued JWT tokens
+ * - GCP IAM service identity via Agentics runtime
+ *
+ * NO local login, NO credential storage, NO user management
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireAdminScope = exports.requireWriteScope = exports.requireReadScope = exports.requireScope = exports.requireAgenticsIdentity = void 0;
+exports.getActorIdentity = getActorIdentity;
+exports.hasApprovalAuthority = hasApprovalAuthority;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const errors_1 = require("@utils/errors");
+const logger_1 = __importDefault(require("@utils/logger"));
+const crypto_1 = __importDefault(require("crypto"));
+// Agentics platform JWT issuer
+const AGENTICS_ISSUER = process.env.AGENTICS_ISSUER || 'https://auth.agentics.dev';
+const AGENTICS_AUDIENCE = process.env.AGENTICS_AUDIENCE || 'policy-engine';
+// GCP service identity
+const GCP_IDENTITY_HEADER = 'x-gcp-identity-token';
+// Agentics public key for JWT verification (loaded from env or fetched)
+const AGENTICS_PUBLIC_KEY = process.env.AGENTICS_PUBLIC_KEY || '';
+/**
+ * Verify Agentics-issued JWT token
+ */
+async function verifyAgenticsToken(token) {
+    try {
+        // Decode without verification first to check issuer
+        const unverified = jsonwebtoken_1.default.decode(token, { complete: true });
+        if (!unverified || typeof unverified.payload === 'string') {
+            throw new errors_1.AuthenticationError('Invalid token format');
+        }
+        const payload = unverified.payload;
+        // Verify issuer is Agentics platform
+        if (payload.iss !== AGENTICS_ISSUER) {
+            throw new errors_1.AuthenticationError('Token not issued by Agentics platform');
+        }
+        // Verify audience includes this service
+        const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+        if (!audiences.includes(AGENTICS_AUDIENCE)) {
+            throw new errors_1.AuthenticationError('Token not intended for this service');
+        }
+        // Verify with public key if available
+        if (AGENTICS_PUBLIC_KEY) {
+            try {
+                jsonwebtoken_1.default.verify(token, AGENTICS_PUBLIC_KEY, {
+                    issuer: AGENTICS_ISSUER,
+                    audience: AGENTICS_AUDIENCE,
+                    algorithms: ['RS256', 'ES256'],
+                });
+            }
+            catch (verifyError) {
+                throw new errors_1.AuthenticationError('Token signature verification failed');
+            }
+        }
+        else {
+            // In production, signature verification is REQUIRED
+            // For development, we log a warning but continue
+            if (process.env.NODE_ENV === 'production') {
+                throw new errors_1.AuthenticationError('Token verification not configured');
+            }
+            logger_1.default.warn('AGENTICS_PUBLIC_KEY not set - signature verification skipped (dev only)');
+        }
+        // Check expiration
+        if (payload.exp && Date.now() >= payload.exp * 1000) {
+            throw new errors_1.AuthenticationError('Token has expired');
+        }
+        // Extract identity
+        return {
+            subject: payload.sub || '',
+            email: payload.email || `${payload.sub}@agentics.dev`,
+            type: payload.identity_type || 'user',
+            scopes: payload.scopes || payload.scope?.split(' ') || [],
+            orgId: payload.org_id,
+            projectId: payload.project_id,
+            tokenHash: crypto_1.default.createHash('sha256').update(token).digest('hex').substring(0, 16),
+            expiresAt: new Date((payload.exp || 0) * 1000),
+            issuedAt: new Date((payload.iat || 0) * 1000),
+        };
+    }
+    catch (error) {
+        if (error instanceof errors_1.AuthenticationError) {
+            throw error;
+        }
+        throw new errors_1.AuthenticationError(`Token verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+    }
+}
+/**
+ * Verify GCP service identity token
+ */
+async function verifyGCPIdentity(token) {
+    try {
+        // GCP identity tokens are Google-signed JWTs
+        const decoded = jsonwebtoken_1.default.decode(token, { complete: true });
+        if (!decoded || typeof decoded.payload === 'string') {
+            throw new errors_1.AuthenticationError('Invalid GCP identity token format');
+        }
+        const payload = decoded.payload;
+        // Verify it's from Google
+        if (!payload.iss?.includes('accounts.google.com')) {
+            throw new errors_1.AuthenticationError('Token not issued by Google');
+        }
+        // Check if it's from an authorized Agentics service
+        const authorizedServicePatterns = [
+            /.*@agentics-.*\.iam\.gserviceaccount\.com$/,
+            /.*@.*\.iam\.gserviceaccount\.com$/, // Allow all service accounts in dev
+        ];
+        const email = payload.email || '';
+        const isAuthorized = process.env.NODE_ENV === 'production'
+            ? authorizedServicePatterns[0].test(email)
+            : authorizedServicePatterns.some(p => p.test(email));
+        if (!isAuthorized) {
+            throw new errors_1.AuthenticationError('GCP service account not authorized');
+        }
+        return {
+            subject: payload.sub || email,
+            email,
+            type: 'gcp-service',
+            scopes: ['policy:read', 'policy:write'], // GCP service accounts get full access
+            orgId: payload.hd, // Google Workspace domain
+            tokenHash: crypto_1.default.createHash('sha256').update(token).digest('hex').substring(0, 16),
+            expiresAt: new Date((payload.exp || 0) * 1000),
+            issuedAt: new Date((payload.iat || 0) * 1000),
+        };
+    }
+    catch (error) {
+        if (error instanceof errors_1.AuthenticationError) {
+            throw error;
+        }
+        throw new errors_1.AuthenticationError('GCP identity verification failed');
+    }
+}
+/**
+ * Generate correlation ID for request tracing
+ */
+function generateCorrelationId(req) {
+    // Use existing correlation ID if provided, otherwise generate new one
+    const existing = req.headers['x-correlation-id'] || req.headers['x-request-id'];
+    if (existing && typeof existing === 'string') {
+        return existing;
+    }
+    return `pe-${Date.now()}-${crypto_1.default.randomBytes(4).toString('hex')}`;
+}
+/**
+ * Main authentication middleware
+ * Accepts ONLY Agentics-issued identity tokens
+ */
+const requireAgenticsIdentity = async (req, res, next) => {
+    const correlationId = generateCorrelationId(req);
+    req.correlationId = correlationId;
+    // Add correlation ID to response
+    res.setHeader('X-Correlation-ID', correlationId);
+    try {
+        const authHeader = req.headers.authorization;
+        const gcpIdentityToken = req.headers[GCP_IDENTITY_HEADER];
+        // Try Agentics JWT first
+        if (authHeader?.startsWith('Bearer ')) {
+            const token = authHeader.substring(7);
+            req.identity = await verifyAgenticsToken(token);
+            logger_1.default.info({
+                correlationId,
+                subject: req.identity.subject,
+                type: req.identity.type,
+                scopes: req.identity.scopes,
+                path: req.path,
+                method: req.method,
+            }, 'Agentics identity verified');
+            next();
+            return;
+        }
+        // Try GCP service identity
+        if (gcpIdentityToken) {
+            req.identity = await verifyGCPIdentity(gcpIdentityToken);
+            logger_1.default.info({
+                correlationId,
+                subject: req.identity.subject,
+                type: req.identity.type,
+                path: req.path,
+                method: req.method,
+            }, 'GCP service identity verified');
+            next();
+            return;
+        }
+        throw new errors_1.AuthenticationError('No valid Agentics identity provided');
+    }
+    catch (error) {
+        const message = error instanceof errors_1.AuthenticationError
+            ? error.message
+            : 'Authentication failed';
+        logger_1.default.warn({
+            correlationId,
+            error: message,
+            path: req.path,
+            method: req.method,
+            ip: req.ip,
+        }, 'Authentication rejected');
+        res.status(401).json({
+            error: 'AUTHENTICATION_REQUIRED',
+            message,
+            correlationId,
+        });
+    }
+};
+exports.requireAgenticsIdentity = requireAgenticsIdentity;
+/**
+ * Scope-based authorization middleware
+ * Must be used AFTER requireAgenticsIdentity
+ */
+const requireScope = (...requiredScopes) => {
+    return (req, res, next) => {
+        if (!req.identity) {
+            res.status(401).json({
+                error: 'AUTHENTICATION_REQUIRED',
+                message: 'Identity not established',
+                correlationId: req.correlationId,
+            });
+            return;
+        }
+        const hasAllScopes = requiredScopes.every(scope => req.identity.scopes.includes(scope) ||
+            req.identity.scopes.includes('*') ||
+            req.identity.scopes.includes('policy:*'));
+        if (!hasAllScopes) {
+            logger_1.default.warn({
+                correlationId: req.correlationId,
+                subject: req.identity.subject,
+                requiredScopes,
+                actualScopes: req.identity.scopes,
+                path: req.path,
+                method: req.method,
+            }, 'Authorization denied - insufficient scopes');
+            res.status(403).json({
+                error: 'INSUFFICIENT_SCOPE',
+                message: `Required scopes: ${requiredScopes.join(', ')}`,
+                correlationId: req.correlationId,
+            });
+            return;
+        }
+        next();
+    };
+};
+exports.requireScope = requireScope;
+/**
+ * Convenience middleware for read operations
+ */
+exports.requireReadScope = (0, exports.requireScope)('policy:read');
+/**
+ * Convenience middleware for write operations
+ */
+exports.requireWriteScope = (0, exports.requireScope)('policy:write');
+/**
+ * Convenience middleware for admin operations
+ */
+exports.requireAdminScope = (0, exports.requireScope)('policy:admin');
+/**
+ * Extract actor identity for audit logging
+ */
+function getActorIdentity(identity) {
+    if (!identity) {
+        return 'anonymous';
+    }
+    return `${identity.type}:${identity.subject}`;
+}
+/**
+ * Check if identity has approval authority for security/compliance policies
+ */
+function hasApprovalAuthority(identity) {
+    if (!identity)
+        return false;
+    return identity.scopes.includes('policy:approve') ||
+        identity.scopes.includes('policy:admin') ||
+        identity.scopes.includes('*');
+}
+//# sourceMappingURL=agentics-identity.js.map

package/dist/bundled-agents/policy-engine-agents/dist/security/agentics-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentics-identity.js","sourceRoot":"","sources":["../../src/security/agentics-identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;AA6TH,4CAKC;AAKD,oDAMC;AA1UD,gEAA+B;AAC/B,0CAAoD;AACpD,2DAAmC;AACnC,oDAA4B;AAE5B,+BAA+B;AAC/B,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,2BAA2B,CAAC;AACnF,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,eAAe,CAAC;AAE3E,uBAAuB;AACvB,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAEnD,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;AA+BlE;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,oDAAoD;QACpD,MAAM,UAAU,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAyB,CAAC;QAErD,qCAAqC;QACrC,IAAI,OAAO,CAAC,GAAG,KAAK,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;QAED,wCAAwC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,4BAAmB,CAAC,qCAAqC,CAAC,CAAC;QACvE,CAAC;QAED,sCAAsC;QACtC,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE;oBACrC,MAAM,EAAE,eAAe;oBACvB,QAAQ,EAAE,iBAAiB;oBAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,IAAI,4BAAmB,CAAC,qCAAqC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,iDAAiD;YACjD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC1C,MAAM,IAAI,4BAAmB,CAAC,mCAAmC,CAAC,CAAC;YACrE,CAAC;YACD,gBAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACzF,CAAC;QAED,mBAAmB;QACnB,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QAED,mBAAmB;QACnB,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,GAAG,eAAe;YACrD,IAAI,EAAE,OAAO,CAAC,aAAa,IAAI,MAAM;YACrC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACzD,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,SAAS,EAAE,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;YACnF,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;SAC9C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,4BAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,6CAA6C;QAC7C,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,4BAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAyB,CAAC;QAElD,0BAA0B;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,oDAAoD;QACpD,MAAM,yBAAyB,GAAG;YAChC,4CAA4C;YAC5C,mCAAmC,EAAE,oCAAoC;SAC1E,CAAC;QAEF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YACxD,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;QACtE,CAAC;QAED,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,KAAK;YAC7B,KAAK;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,uCAAuC;YAChF,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,0BAA0B;YAC7C,SAAS,EAAE,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;YACnF,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;SAC9C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,4BAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,GAAY;IACzC,sEAAsE;IACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAChF,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,gBAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,GAAyB,EACzB,GAAa,EACb,IAAkB,EACH,EAAE;IACjB,MAAM,aAAa,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACjD,GAAG,CAAC,aAAa,GAAG,aAAa,CAAC;IAElC,iCAAiC;IACjC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;IAEjD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAuB,CAAC;QAEhF,yBAAyB;QACzB,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,GAAG,CAAC,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAEhD,gBAAM,CAAC,IAAI,CAAC;gBACV,aAAa;gBACb,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACvB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,EAAE,4BAA4B,CAAC,CAAC;YAEjC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,gBAAgB,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YAEzD,gBAAM,CAAC,IAAI,CAAC;gBACV,aAAa;gBACb,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACvB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,EAAE,+BAA+B,CAAC,CAAC;YAEpC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,IAAI,4BAAmB,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,4BAAmB;YAClD,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,uBAAuB,CAAC;QAE5B,gBAAM,CAAC,IAAI,CAAC;YACV,aAAa;YACb,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,EAAE,yBAAyB,CAAC,CAAC;QAE9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,yBAAyB;YAChC,OAAO;YACP,aAAa;SACd,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AArEW,QAAA,uBAAuB,2BAqElC;AAEF;;;GAGG;AACI,MAAM,YAAY,GAAG,CAAC,GAAG,cAAwB,EAAE,EAAE;IAC1D,OAAO,CAAC,GAAyB,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC5E,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,0BAA0B;gBACnC,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAChD,GAAG,CAAC,QAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACpC,GAAG,CAAC,QAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAClC,GAAG,CAAC,QAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1C,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,gBAAM,CAAC,IAAI,CAAC;gBACV,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,cAAc;gBACd,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;gBACjC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,EAAE,4CAA4C,CAAC,CAAC;YAEjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,OAAO,EAAE,oBAAoB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACxD,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC,CAAC;AArCW,QAAA,YAAY,gBAqCvB;AAEF;;GAEG;AACU,QAAA,gBAAgB,GAAG,IAAA,oBAAY,EAAC,aAAa,CAAC,CAAC;AAE5D;;GAEG;AACU,QAAA,iBAAiB,GAAG,IAAA,oBAAY,EAAC,cAAc,CAAC,CAAC;AAE9D;;GAEG;AACU,QAAA,iBAAiB,GAAG,IAAA,oBAAY,EAAC,cAAc,CAAC,CAAC;AAE9D;;GAEG;AACH,SAAgB,gBAAgB,CAAC,QAAsC;IACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,QAAsC;IACzE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC1C,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QACxC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC"}