@ninelives/agent-governance-sdk 5.0.1

package/dist/encryption/x3dh.js

@@ -0,0 +1,238 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.X3DHKeyManager = void 0;
+exports.generateX25519KeyPair = generateX25519KeyPair;
+exports.ed25519ToX25519 = ed25519ToX25519;
+exports.kdf = kdf;
+/**
+ * X3DH (Extended Triple Diffie-Hellman) key agreement.
+ *
+ * Implements the Signal X3DH specification for establishing shared secrets
+ * between agents. Uses Ed25519 identity keys converted to X25519 for DH.
+ *
+ * Spec: docs/specs/AGENTMESH-WIRE-1.0.md Section 7
+ * Reference: https://signal.org/docs/specifications/x3dh/ (CC0)
+ */
+const ed25519_js_1 = require("@noble/curves/ed25519.js");
+const hkdf_js_1 = require("@noble/hashes/hkdf.js");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const node_crypto_1 = require("node:crypto");
+const randomBytes = (n) => {
+    const buf = new Uint8Array(n);
+    node_crypto_1.webcrypto.getRandomValues(buf);
+    return buf;
+};
+const X3DH_INFO = new TextEncoder().encode("AgentMesh_X3DH_v1");
+const KEY_LEN = 32;
+// Spec-compliant X3DH KDF inputs per Signal §2.2:
+//   IKM  = F (0xFF × 32) || concat(DH outputs)
+//   salt = 0x00 × 32   (HKDF salt is the empty/zero block, NOT the F prefix)
+//   info = "AgentMesh_X3DH_v1"
+// An earlier implementation passed F (0xFF × 32) as the HKDF *salt* while
+// feeding the bare DH concat as IKM. That derives a different key than the
+// spec, which silently broke interop with any spec-compliant peer — in
+// particular the AGT Python SDK, whose KDF was already corrected upstream in
+// agent-governance-python/.../encryption/x3dh.py (PR #1926). Until now the
+// TypeScript SDK was never aligned, so a Python initiator and a TypeScript
+// responder (or vice-versa) completed X3DH/KNOCK but then failed to decrypt
+// the first message with "invalid tag". Aligning the salt/IKM here restores
+// Python↔TypeScript cross-runtime parity.
+const F_PREFIX = new Uint8Array(32).fill(0xff);
+const ZERO_SALT = new Uint8Array(32);
+function generateX25519KeyPair() {
+    const privateKey = randomBytes(KEY_LEN);
+    const publicKey = ed25519_js_1.x25519.getPublicKey(privateKey);
+    return { privateKey, publicKey };
+}
+function ed25519ToX25519(ed25519Private, ed25519Public) {
+    if (ed25519Public.length !== 32) {
+        throw new Error("ed25519Public must be 32 bytes");
+    }
+    if (ed25519Private.length !== 32 && ed25519Private.length !== 64) {
+        throw new Error("ed25519Private must be 32 or 64 bytes");
+    }
+    const priv32 = ed25519Private.length === 64 ? ed25519Private.slice(0, 32) : ed25519Private;
+    // Ed25519 seed → SHA-512 → first 32 bytes → clamp per RFC 7748 §5
+    const h = (0, sha2_js_1.sha512)(priv32);
+    const privateKey = h.slice(0, 32);
+    privateKey[0] &= 248;
+    privateKey[31] &= 127;
+    privateKey[31] |= 64;
+    const publicKey = ed25519_js_1.x25519.getPublicKey(privateKey);
+    return { privateKey, publicKey };
+}
+/**
+ * X3DH key-derivation function.
+ *
+ * Computes `HKDF-SHA256(salt = 0x00 × 32, IKM = F ‖ dhConcat,
+ * info = "AgentMesh_X3DH_v1", L = 32)` where `F` is `0xFF × 32`, per the
+ * Signal X3DH spec (§2.2). Callers pass `dhConcat` (the concatenation of the
+ * DH outputs) as `ikm`; the F prefix is prepended here so every code path
+ * (initiator + responder) applies it exactly once.
+ *
+ * Exported so the test suite can pin the exact derived key against a
+ * cross-runtime known-answer vector shared with the AGT Python SDK, which
+ * guards against silent salt/IKM regressions that pass intra-runtime
+ * consistency checks but break Python↔TypeScript interop.
+ */
+function kdf(ikm) {
+    return (0, hkdf_js_1.hkdf)(sha2_js_1.sha256, concat(F_PREFIX, ikm), ZERO_SALT, X3DH_INFO, KEY_LEN);
+}
+function concat(...arrays) {
+    const total = arrays.reduce((sum, a) => sum + a.length, 0);
+    const result = new Uint8Array(total);
+    let offset = 0;
+    for (const a of arrays) {
+        result.set(a, offset);
+        offset += a.length;
+    }
+    return result;
+}
+class X3DHKeyManager {
+    identityKey;
+    ed25519Private;
+    ed25519Public;
+    signedPreKeyPair = null;
+    oneTimePreKeys = new Map();
+    nextSpkId = 0;
+    nextOtkId = 0;
+    constructor(ed25519Private, ed25519Public) {
+        this.ed25519Private = ed25519Private.length === 64 ? ed25519Private.slice(0, 32) : ed25519Private;
+        this.ed25519Public = ed25519Public;
+        this.identityKey = ed25519ToX25519(ed25519Private, ed25519Public);
+    }
+    /**
+     * Ed25519 public key used to sign pre-keys. Distinct from
+     * `identityKey.publicKey` (X25519). Peers MUST be given this key to
+     * verify the signature on the signed pre-key (`verifyBundle`).
+     */
+    get identityKeyEd() {
+        return this.ed25519Public;
+    }
+    /**
+     * Sign an arbitrary message with the Ed25519 identity private key.
+     *
+     * Used for registry registration proof-of-possession (the server
+     * verifies `Ed25519(public_key || proof_timestamp)` against
+     * `identityKeyEd`) and for the relay's `connect` frame Ed25519
+     * timestamp signature.
+     */
+    signMessage(message) {
+        return ed25519_js_1.ed25519.sign(message, this.ed25519Private);
+    }
+    generateSignedPreKey() {
+        const keyPair = generateX25519KeyPair();
+        const signature = ed25519_js_1.ed25519.sign(keyPair.publicKey, this.ed25519Private);
+        const keyId = this.nextSpkId++;
+        this.signedPreKeyPair = { keyPair, signature, keyId };
+        return { keyId, publicKey: keyPair.publicKey, signature };
+    }
+    generateOneTimePreKeys(count) {
+        const keys = [];
+        for (let i = 0; i < count; i++) {
+            const keyPair = generateX25519KeyPair();
+            const keyId = this.nextOtkId++;
+            this.oneTimePreKeys.set(keyId, keyPair);
+            keys.push({ keyId, publicKey: keyPair.publicKey });
+        }
+        return keys;
+    }
+    getPublicBundle(otkId) {
+        if (!this.signedPreKeyPair) {
+            throw new Error("No signed pre-key generated. Call generateSignedPreKey() first.");
+        }
+        const bundle = {
+            identityKey: this.identityKey.publicKey,
+            identityKeyEd: this.ed25519Public,
+            signedPreKey: this.signedPreKeyPair.keyPair.publicKey,
+            signedPreKeySignature: this.signedPreKeyPair.signature,
+            signedPreKeyId: this.signedPreKeyPair.keyId,
+        };
+        if (otkId !== undefined) {
+            const otk = this.oneTimePreKeys.get(otkId);
+            if (otk) {
+                bundle.oneTimePreKey = otk.publicKey;
+                bundle.oneTimePreKeyId = otkId;
+            }
+        }
+        return bundle;
+    }
+    initiate(peerBundle) {
+        verifyBundle(peerBundle);
+        const ephemeral = generateX25519KeyPair();
+        const dh1 = ed25519_js_1.x25519.getSharedSecret(this.identityKey.privateKey, peerBundle.signedPreKey);
+        const dh2 = ed25519_js_1.x25519.getSharedSecret(ephemeral.privateKey, peerBundle.identityKey);
+        const dh3 = ed25519_js_1.x25519.getSharedSecret(ephemeral.privateKey, peerBundle.signedPreKey);
+        let dhConcat = concat(dh1, dh2, dh3);
+        let usedOtkId;
+        if (peerBundle.oneTimePreKey) {
+            const dh4 = ed25519_js_1.x25519.getSharedSecret(ephemeral.privateKey, peerBundle.oneTimePreKey);
+            dhConcat = concat(dhConcat, dh4);
+            usedOtkId = peerBundle.oneTimePreKeyId;
+        }
+        const sharedSecret = kdf(dhConcat);
+        const ad = concat(this.identityKey.publicKey, peerBundle.identityKey);
+        return {
+            sharedSecret,
+            ephemeralPublicKey: ephemeral.publicKey,
+            usedOneTimeKeyId: usedOtkId,
+            associatedData: ad,
+        };
+    }
+    respond(peerIdentityKey, ephemeralPublicKey, usedOneTimeKeyId) {
+        if (!this.signedPreKeyPair) {
+            throw new Error("No signed pre-key available.");
+        }
+        const dh1 = ed25519_js_1.x25519.getSharedSecret(this.signedPreKeyPair.keyPair.privateKey, peerIdentityKey);
+        const dh2 = ed25519_js_1.x25519.getSharedSecret(this.identityKey.privateKey, ephemeralPublicKey);
+        const dh3 = ed25519_js_1.x25519.getSharedSecret(this.signedPreKeyPair.keyPair.privateKey, ephemeralPublicKey);
+        let dhConcat = concat(dh1, dh2, dh3);
+        if (usedOneTimeKeyId !== undefined) {
+            const otk = this.oneTimePreKeys.get(usedOneTimeKeyId);
+            if (!otk) {
+                throw new Error(`One-time pre-key ${usedOneTimeKeyId} not found or already consumed.`);
+            }
+            const dh4 = ed25519_js_1.x25519.getSharedSecret(otk.privateKey, ephemeralPublicKey);
+            dhConcat = concat(dhConcat, dh4);
+            this.oneTimePreKeys.delete(usedOneTimeKeyId);
+        }
+        const sharedSecret = kdf(dhConcat);
+        const ad = concat(peerIdentityKey, this.identityKey.publicKey);
+        return {
+            sharedSecret,
+            ephemeralPublicKey,
+            usedOneTimeKeyId,
+            associatedData: ad,
+        };
+    }
+    get signedPreKey() {
+        return this.signedPreKeyPair;
+    }
+}
+exports.X3DHKeyManager = X3DHKeyManager;
+function verifyBundle(bundle) {
+    if (!bundle.identityKeyEd || bundle.identityKeyEd.length !== 32) {
+        throw new Error("Missing or invalid Ed25519 identity key (identityKeyEd). " +
+            "Required for signed pre-key signature verification.");
+    }
+    if (bundle.signedPreKeySignature.length !== 64) {
+        throw new Error("Invalid signed pre-key signature length.");
+    }
+    if (bundle.signedPreKey.length !== 32) {
+        throw new Error("Invalid signed pre-key length.");
+    }
+    if (bundle.identityKey.length !== 32) {
+        throw new Error("Invalid identity key length.");
+    }
+    // Verify the signed pre-key signature using the Ed25519 identity key.
+    // This ensures the pre-key was actually generated by the bundle's owner
+    // and not injected by an attacker.
+    const valid = ed25519_js_1.ed25519.verify(bundle.signedPreKeySignature, bundle.signedPreKey, bundle.identityKeyEd);
+    if (!valid) {
+        throw new Error("Signed pre-key signature verification FAILED. " +
+            "The pre-key was not signed by the claimed identity key.");
+    }
+}
+//# sourceMappingURL=x3dh.js.map

package/dist/encryption/x3dh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"x3dh.js","sourceRoot":"","sources":["../../src/encryption/x3dh.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAgElC,sDAIC;AAED,0CAmBC;AAgBD,kBAEC;AAzGD;;;;;;;;GAQG;AAEH,yDAA2D;AAC3D,mDAA6C;AAC7C,mDAAuD;AACvD,6CAAwC;AAExC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAc,EAAE;IAC5C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,uBAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAChE,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,kDAAkD;AAClD,+CAA+C;AAC/C,6EAA6E;AAC7E,+BAA+B;AAC/B,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,0CAA0C;AAC1C,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAyBrC,SAAgB,qBAAqB;IACnC,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,mBAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,SAAgB,eAAe,CAC7B,cAA0B,EAC1B,aAAyB;IAEzB,IAAI,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IAC3F,kEAAkE;IAClE,MAAM,CAAC,GAAG,IAAA,gBAAM,EAAC,MAAM,CAAC,CAAC;IACzB,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,SAAS,GAAG,mBAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,GAAG,CAAC,GAAe;IACjC,OAAO,IAAA,cAAI,EAAC,gBAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,MAAoB;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAa,cAAc;IACT,WAAW,CAAgB;IAC1B,cAAc,CAAa;IAC3B,aAAa,CAAa;IACnC,gBAAgB,GAA4E,IAAI,CAAC;IACjG,cAAc,GAA+B,IAAI,GAAG,EAAE,CAAC;IACvD,SAAS,GAAG,CAAC,CAAC;IACd,SAAS,GAAG,CAAC,CAAC;IAEtB,YAAY,cAA0B,EAAE,aAAyB;QAC/D,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QAClG,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,OAAmB;QAC7B,OAAO,oBAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACpD,CAAC;IAED,oBAAoB;QAClB,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,oBAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,gBAAgB,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC;IAC5D,CAAC;IAED,sBAAsB,CAAC,KAAa;QAClC,MAAM,IAAI,GAAoD,EAAE,CAAC;QACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe,CAAC,KAAc;QAC5B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS;YACrD,qBAAqB,EAAE,IAAI,CAAC,gBAAgB,CAAC,SAAS;YACtD,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK;SAC5C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC;gBACrC,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;YACjC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,QAAQ,CAAC,UAAwB;QAC/B,YAAY,CAAC,UAAU,CAAC,CAAC;QAEzB,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAE1C,MAAM,GAAG,GAAG,mBAAM,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,mBAAM,CAAC,eAAe,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,mBAAM,CAAC,eAAe,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QAElF,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,SAA6B,CAAC;QAElC,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,mBAAM,CAAC,eAAe,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YACnF,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjC,SAAS,GAAG,UAAU,CAAC,eAAe,CAAC;QACzC,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAEtE,OAAO;YACL,YAAY;YACZ,kBAAkB,EAAE,SAAS,CAAC,SAAS;YACvC,gBAAgB,EAAE,SAAS;YAC3B,cAAc,EAAE,EAAE;SACnB,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAA2B,EAC3B,kBAA8B,EAC9B,gBAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,GAAG,GAAG,mBAAM,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,mBAAM,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,mBAAM,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAEjG,IAAI,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAErC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACtD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,oBAAoB,gBAAgB,iCAAiC,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,GAAG,GAAG,mBAAM,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YACvE,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAE/D,OAAO;YACL,YAAY;YACZ,kBAAkB;YAClB,gBAAgB;YAChB,cAAc,EAAE,EAAE;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAhJD,wCAgJC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,2DAA2D;YAC3D,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,KAAK,GAAG,oBAAO,CAAC,MAAM,CAC1B,MAAM,CAAC,qBAAqB,EAC5B,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,aAAa,CACrB,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gDAAgD;YAChD,yDAAyD,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/framework-adapter.d.ts

@@ -0,0 +1,63 @@
+import { AgentMeshClient } from './client';
+import { ExecutionTrace, GovernanceMetrics, TraceCapture, TraceSpanKind, TraceSpanStatus } from './metrics';
+import { GovernanceResult, TrustedSkillMetadataSource } from './types';
+export interface FrameworkInvocation {
+    name: string;
+    kind?: TraceSpanKind;
+    action?: string;
+    /** Optional diagnostic identity hint; if provided, it must match the bound client identity. */
+    agentId?: string;
+    input?: Record<string, unknown>;
+    attributes?: Record<string, unknown>;
+    trustedSkillMetadata?: TrustedSkillMetadataSource;
+}
+export interface FrameworkInvocationOutcome<TOutput = unknown> {
+    output?: TOutput;
+    error?: string;
+    status?: TraceSpanStatus;
+    costUsd?: number;
+}
+export interface FrameworkAdapterResult<TOutput = unknown> {
+    allowed: boolean;
+    reason: string;
+    action: string;
+    invocation: FrameworkInvocation;
+    governanceResult: GovernanceResult;
+    output?: TOutput;
+    error?: string;
+    trace: ExecutionTrace;
+}
+export interface GenericFrameworkAdapterOptions {
+    metrics?: GovernanceMetrics;
+    actionPrefix?: string;
+    actionResolver?: (invocation: FrameworkInvocation) => string;
+}
+export declare class FrameworkInvocationHandle<TOutput = unknown> {
+    private readonly invocation;
+    private readonly action;
+    readonly allowed: boolean;
+    readonly reason: string;
+    readonly governanceResult: GovernanceResult;
+    private readonly capture;
+    private readonly spanId;
+    private readonly metrics;
+    private finalized;
+    private finalResult?;
+    constructor(invocation: FrameworkInvocation, action: string, allowed: boolean, reason: string, governanceResult: GovernanceResult, capture: TraceCapture | undefined, spanId: string | undefined, metrics: GovernanceMetrics | undefined);
+    get traceId(): string | undefined;
+    toResult(): FrameworkAdapterResult<TOutput>;
+    complete(outcome?: FrameworkInvocationOutcome<TOutput>): FrameworkAdapterResult<TOutput>;
+    finalizeDenied(trace: ExecutionTrace): FrameworkAdapterResult<TOutput>;
+}
+export declare class GenericFrameworkAdapter {
+    private readonly client;
+    private readonly metrics?;
+    private readonly actionPrefix;
+    private readonly actionResolver?;
+    constructor(client: AgentMeshClient, options?: GenericFrameworkAdapterOptions);
+    beginInvocation<TOutput = unknown>(invocation: FrameworkInvocation): Promise<FrameworkInvocationHandle<TOutput>>;
+    run<TOutput>(invocation: FrameworkInvocation, handler: () => Promise<TOutput> | TOutput): Promise<FrameworkAdapterResult<TOutput>>;
+    private resolveAction;
+    private rejectIdentityMismatch;
+}
+//# sourceMappingURL=framework-adapter.d.ts.map

package/dist/framework-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-adapter.d.ts","sourceRoot":"","sources":["../src/framework-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,eAAe,EAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAEhB,0BAA0B,EAClC,MAAM,SAAS,CAAC;AAGjB,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;CACnD;AAED,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,OAAO;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,GAAG,OAAO;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,mBAAmB,CAAC;IAChC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,mBAAmB,KAAK,MAAM,CAAC;CAC9D;AAED,qBAAa,yBAAyB,CAAC,OAAO,GAAG,OAAO;IAKpD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAX1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAkC;gBAGnC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,EAAE,MAAM,EACtB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB,EAC1B,OAAO,EAAE,YAAY,GAAG,SAAS,EACjC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,iBAAiB,GAAG,SAAS;IAGzD,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAEhC;IAED,QAAQ,IAAI,sBAAsB,CAAC,OAAO,CAAC;IAQ3C,QAAQ,CAAC,OAAO,GAAE,0BAA0B,CAAC,OAAO,CAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC;IA2C5F,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC;CAYvE;AAED,qBAAa,uBAAuB;IAMhC,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAoB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA8C;gBAG3D,MAAM,EAAE,eAAe,EACxC,OAAO,GAAE,8BAAmC;IAOxC,eAAe,CAAC,OAAO,GAAG,OAAO,EACrC,UAAU,EAAE,mBAAmB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IA2ExC,GAAG,CAAC,OAAO,EACf,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,GACxC,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAiB3C,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,sBAAsB;CAmB/B"}

package/dist/framework-adapter.js

@@ -0,0 +1,253 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GenericFrameworkAdapter = exports.FrameworkInvocationHandle = void 0;
+const metrics_1 = require("./metrics");
+const crypto_1 = require("crypto");
+class FrameworkInvocationHandle {
+    invocation;
+    action;
+    allowed;
+    reason;
+    governanceResult;
+    capture;
+    spanId;
+    metrics;
+    finalized = false;
+    finalResult;
+    constructor(invocation, action, allowed, reason, governanceResult, capture, spanId, metrics) {
+        this.invocation = invocation;
+        this.action = action;
+        this.allowed = allowed;
+        this.reason = reason;
+        this.governanceResult = governanceResult;
+        this.capture = capture;
+        this.spanId = spanId;
+        this.metrics = metrics;
+    }
+    get traceId() {
+        return this.capture?.currentTraceId();
+    }
+    toResult() {
+        if (!this.finalized || !this.finalResult) {
+            throw new Error('Invocation has not been completed');
+        }
+        return this.finalResult;
+    }
+    complete(outcome = {}) {
+        if (this.finalized) {
+            throw new Error('Invocation already completed');
+        }
+        if (!this.capture || !this.spanId) {
+            throw new Error('Invocation was already finalized during preflight');
+        }
+        const status = outcome.status ?? (outcome.error ? 'error' : 'ok');
+        this.capture.finishSpan(this.spanId, status, normalizeOutput(outcome.output), outcome.error, outcome.costUsd ?? 0);
+        const durationMs = this.capture.getSpanDuration(this.spanId) ?? 0;
+        if (this.invocation.kind === 'tool_call' && durationMs > 0) {
+            this.metrics?.recordToolCall(this.invocation.name, durationMs);
+        }
+        const trace = this.capture.finish(outcome.output === undefined ? undefined : stringifyOutput(outcome.output), !outcome.error && status === 'ok');
+        this.metrics?.recordTrace(trace);
+        this.finalResult = {
+            allowed: this.allowed,
+            reason: this.reason,
+            action: this.action,
+            invocation: this.invocation,
+            governanceResult: this.governanceResult,
+            output: outcome.output,
+            error: outcome.error,
+            trace,
+        };
+        this.finalized = true;
+        return this.finalResult;
+    }
+    finalizeDenied(trace) {
+        this.finalResult = {
+            allowed: false,
+            reason: this.reason,
+            action: this.action,
+            invocation: this.invocation,
+            governanceResult: this.governanceResult,
+            trace,
+        };
+        this.finalized = true;
+        return this.finalResult;
+    }
+}
+exports.FrameworkInvocationHandle = FrameworkInvocationHandle;
+class GenericFrameworkAdapter {
+    client;
+    metrics;
+    actionPrefix;
+    actionResolver;
+    constructor(client, options = {}) {
+        this.client = client;
+        this.metrics = options.metrics;
+        this.actionPrefix = options.actionPrefix ?? 'framework';
+        this.actionResolver = options.actionResolver;
+    }
+    async beginInvocation(invocation) {
+        const action = this.resolveAction(invocation);
+        const canonicalAgentId = this.client.identity.did;
+        const assertedAgentId = invocation.agentId;
+        const normalizedInvocation = {
+            ...invocation,
+            agentId: canonicalAgentId,
+        };
+        const identityMismatchReason = assertedAgentId && assertedAgentId !== canonicalAgentId
+            ? `Caller-asserted agentId "${assertedAgentId}" does not match bound client identity "${canonicalAgentId}"`
+            : undefined;
+        const capture = new metrics_1.TraceCapture(canonicalAgentId, stringifyOutput(normalizedInvocation.input ?? {}));
+        const span = capture.startSpan(normalizedInvocation.name, normalizedInvocation.kind ?? 'internal', normalizedInvocation.input, undefined, {
+            ...(normalizedInvocation.attributes ?? {}),
+            ...(assertedAgentId ? { assertedAgentId } : {}),
+        });
+        const skillAuditMetadata = buildSkillAuditMetadata(normalizedInvocation.trustedSkillMetadata, normalizedInvocation.input);
+        const governanceResult = identityMismatchReason
+            ? this.rejectIdentityMismatch(action, canonicalAgentId, identityMismatchReason)
+            : await this.client.executeWithGovernance(action, normalizedInvocation.input ?? {}, skillAuditMetadata);
+        this.metrics?.recordPolicyDecision(governanceResult.decision, governanceResult.executionTime, {
+            action,
+            invocationKind: normalizedInvocation.kind ?? 'internal',
+        });
+        this.metrics?.recordTrustScore(canonicalAgentId, governanceResult.trustScore.overall);
+        this.metrics?.recordAuditEntry(this.client.audit.length);
+        const allowed = governanceResult.decision === 'allow';
+        const reason = identityMismatchReason ?? toReason(action, governanceResult);
+        const handle = new FrameworkInvocationHandle(normalizedInvocation, action, allowed, reason, governanceResult, capture, span.spanId, this.metrics);
+        if (!allowed) {
+            capture.finishSpan(span.spanId, 'error', undefined, reason);
+            const trace = capture.finish(undefined, false);
+            this.metrics?.recordTrace(trace);
+            handle.finalizeDenied(trace);
+        }
+        return handle;
+    }
+    async run(invocation, handler) {
+        const handle = await this.beginInvocation(invocation);
+        if (!handle.allowed) {
+            return handle.toResult();
+        }
+        try {
+            const output = await handler();
+            return handle.complete({ output });
+        }
+        catch (error) {
+            return handle.complete({
+                error: error instanceof Error ? error.message : 'Unknown framework handler error',
+                status: 'error',
+            });
+        }
+    }
+    resolveAction(invocation) {
+        if (invocation.action) {
+            return invocation.action;
+        }
+        if (this.actionResolver) {
+            return this.actionResolver(invocation);
+        }
+        return `${this.actionPrefix}.${invocation.kind ?? 'internal'}.${invocation.name}`;
+    }
+    rejectIdentityMismatch(action, agentId, reason) {
+        const auditEntry = this.client.audit.log({
+            agentId,
+            action,
+            decision: 'deny',
+        });
+        this.client.trust.recordFailure(agentId);
+        return {
+            decision: 'deny',
+            trustScore: this.client.trust.getTrustScore(agentId),
+            auditEntry,
+            executionTime: 0,
+            lifecycleState: this.client.lifecycle.state,
+        };
+    }
+}
+exports.GenericFrameworkAdapter = GenericFrameworkAdapter;
+function toReason(action, governanceResult) {
+    if (governanceResult.ringViolation) {
+        return governanceResult.ringViolation.message;
+    }
+    if (governanceResult.decision === 'review') {
+        return `Governance review required for action "${action}"`;
+    }
+    if (governanceResult.decision === 'deny') {
+        return `Governance denied action "${action}"`;
+    }
+    return `Governance allowed action "${action}"`;
+}
+function normalizeOutput(output) {
+    if (output === undefined) {
+        return undefined;
+    }
+    if (output !== null && typeof output === 'object' && !Array.isArray(output)) {
+        return output;
+    }
+    return {
+        value: output,
+    };
+}
+function stringifyOutput(output) {
+    try {
+        return JSON.stringify(output);
+    }
+    catch {
+        return String(output);
+    }
+}
+function hashContext(context) {
+    if (context === undefined || context === null) {
+        return undefined;
+    }
+    try {
+        const canonical = stableStringify(context);
+        return (0, crypto_1.createHash)('sha256')
+            .update(canonical, 'utf8')
+            .digest('hex');
+    }
+    catch {
+        // Fail-safe: non-canonical payloads should not produce hashes.
+        return undefined;
+    }
+}
+function stableStringify(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value)) {
+        return value.map(sortKeys);
+    }
+    if (value !== null &&
+        typeof value === 'object') {
+        return Object.keys(value)
+            .sort()
+            .reduce((acc, key) => {
+            acc[key] = sortKeys(value[key]);
+            return acc;
+        }, {});
+    }
+    return value;
+}
+function buildSkillAuditMetadata(trusted, contextBefore, contextAfter) {
+    const contextHashBefore = hashContext(contextBefore);
+    const contextHashAfter = hashContext(contextAfter);
+    if (!trusted?.skillName &&
+        !trusted?.skillOrigin &&
+        !contextHashBefore &&
+        !contextHashAfter) {
+        return undefined;
+    }
+    return {
+        skillName: trusted?.skillName,
+        skillOrigin: trusted?.skillOrigin,
+        provenanceSourceTrust: trusted?.skillName || trusted?.skillOrigin
+            ? 'trusted'
+            : undefined,
+        contextHashBefore,
+        contextHashAfter,
+    };
+}
+//# sourceMappingURL=framework-adapter.js.map

package/dist/framework-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-adapter.js","sourceRoot":"","sources":["../src/framework-adapter.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAGlC,uCAMmB;AAKnB,mCAAoC;AAqCpC,MAAa,yBAAyB;IAKjB;IACA;IACR;IACA;IACA;IACQ;IACA;IACA;IAXX,SAAS,GAAG,KAAK,CAAC;IAClB,WAAW,CAAmC;IAEtD,YACmB,UAA+B,EAC/B,MAAc,EACtB,OAAgB,EAChB,MAAc,EACd,gBAAkC,EAC1B,OAAiC,EACjC,MAA0B,EAC1B,OAAsC;QAPtC,eAAU,GAAV,UAAU,CAAqB;QAC/B,WAAM,GAAN,MAAM,CAAQ;QACtB,YAAO,GAAP,OAAO,CAAS;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,qBAAgB,GAAhB,gBAAgB,CAAkB;QAC1B,YAAO,GAAP,OAAO,CAA0B;QACjC,WAAM,GAAN,MAAM,CAAoB;QAC1B,YAAO,GAAP,OAAO,CAA+B;IACtD,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACxC,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,QAAQ,CAAC,UAA+C,EAAE;QACxD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,UAAU,CACrB,IAAI,CAAC,MAAM,EACX,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAC/B,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,OAAO,IAAI,CAAC,CACrB,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,WAAW,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAC/B,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,EAC1E,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,KAAK,IAAI,CAClC,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;QAEjC,IAAI,CAAC,WAAW,GAAG;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK;SACN,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,cAAc,CAAC,KAAqB;QAClC,IAAI,CAAC,WAAW,GAAG;YACjB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,KAAK;SACN,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAlFD,8DAkFC;AAED,MAAa,uBAAuB;IAMf;IALF,OAAO,CAAqB;IAC5B,YAAY,CAAS;IACrB,cAAc,CAA+C;IAE9E,YACmB,MAAuB,EACxC,UAA0C,EAAE;QAD3B,WAAM,GAAN,MAAM,CAAiB;QAGxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC;QACxD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,UAA+B;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClD,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC;QAC3C,MAAM,oBAAoB,GAAwB;YAChD,GAAG,UAAU;YACb,OAAO,EAAE,gBAAgB;SAC1B,CAAC;QACF,MAAM,sBAAsB,GAAG,eAAe,IAAI,eAAe,KAAK,gBAAgB;YACpF,CAAC,CAAC,4BAA4B,eAAe,2CAA2C,gBAAgB,GAAG;YAC3G,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,sBAAY,CAC9B,gBAAgB,EAChB,eAAe,CAAC,oBAAoB,CAAC,KAAK,IAAI,EAAE,CAAC,CAClD,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAC5B,oBAAoB,CAAC,IAAI,EACzB,oBAAoB,CAAC,IAAI,IAAI,UAAU,EACvC,oBAAoB,CAAC,KAAK,EAC1B,SAAS,EACT;YACE,GAAG,CAAC,oBAAoB,CAAC,UAAU,IAAI,EAAE,CAAC;YAC1C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CACF,CAAC;QACF,MAAM,kBAAkB,GAAG,uBAAuB,CAChD,oBAAoB,CAAC,oBAAoB,EACzC,oBAAoB,CAAC,KAAK,CAC3B,CAAC;QAEF,MAAM,gBAAgB,GAAG,sBAAsB;YAC7C,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,EAAE,sBAAsB,CAAC;YAC/E,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,CAAC,KAAK,IAAI,EAAE,EAAE,kBAAkB,CAAE,CAAC;QAC3G,IAAI,CAAC,OAAO,EAAE,oBAAoB,CAChC,gBAAgB,CAAC,QAAQ,EACzB,gBAAgB,CAAC,aAAa,EAC9B;YACE,MAAM;YACN,cAAc,EAAE,oBAAoB,CAAC,IAAI,IAAI,UAAU;SACxD,CACF,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAC5B,gBAAgB,EAChB,gBAAgB,CAAC,UAAU,CAAC,OAAO,CACpC,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,KAAK,OAAO,CAAC;QACtD,MAAM,MAAM,GAAG,sBAAsB,IAAI,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,yBAAyB,CAC1C,oBAAoB,EACpB,MAAM,EACN,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,OAAO,EACP,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CACb,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,UAAU,CAChB,IAAI,CAAC,MAAM,EACX,OAAO,EACP,SAAS,EACT,MAAM,CACP,CAAC;YACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CACP,UAA+B,EAC/B,OAAyC;QAEzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAU,UAAU,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC;gBACjF,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,UAA+B;QACnD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,UAAU,CAAC,MAAM,CAAC;QAC3B,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IAEO,sBAAsB,CAC5B,MAAc,EACd,OAAe,EACf,MAAc;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YACvC,OAAO;YACP,MAAM;YACN,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC;YACpD,UAAU;YACV,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK;SAC5C,CAAC;IACJ,CAAC;CACF;AA9ID,0DA8IC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,gBAAkC;IAClE,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC;IAChD,CAAC;IAED,IAAI,gBAAgB,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,0CAA0C,MAAM,GAAG,CAAC;IAC7D,CAAC;IAED,IAAI,gBAAgB,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzC,OAAO,6BAA6B,MAAM,GAAG,CAAC;IAChD,CAAC;IAED,OAAO,8BAA8B,MAAM,GAAG,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,EAAE,MAAM;KACd,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAE3C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;aACzB,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC;aACjD,IAAI,EAAE;aACN,MAAM,CAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAChB,KAAiC,CAAC,GAAG,CAAC,CACxC,CAAC;YACF,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC,CAAC;IACX,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAoC,EACpC,aAAuB,EACvB,YAAsB;IAEtB,MAAM,iBAAiB,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,gBAAgB,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAEnD,IACE,CAAC,OAAO,EAAE,SAAS;QACnB,CAAC,OAAO,EAAE,WAAW;QACrB,CAAC,iBAAiB;QAClB,CAAC,gBAAgB,EACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,WAAW,EAAE,OAAO,EAAE,WAAW;QACjC,qBAAqB,EACnB,OAAO,EAAE,SAAS,IAAI,OAAO,EAAE,WAAW;YACxC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS;QACf,iBAAiB;QACjB,gBAAgB;KACjB,CAAC;AACJ,CAAC"}