@ninelives/agent-governance-sdk 5.0.1

package/dist/oci-manifest.js

@@ -0,0 +1,182 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OciManifestAdapter = void 0;
+const crypto_1 = require("crypto");
+const AI_CARD_MEDIA_TYPE = 'application/vnd.ai-card.agent.v1+json';
+const POLICY_MEDIA_TYPE = 'application/vnd.agt.policy.v1+json';
+const OCI_MANIFEST_MEDIA_TYPE = 'application/vnd.oci.image.manifest.v2+json';
+const OCI_CONFIG_MEDIA_TYPE = 'application/vnd.oci.image.config.v1+json';
+/**
+ * Converts AGT agent manifests to/from OCI manifest format with AI Card
+ * compatibility. Enables registry-based discovery and verification of
+ * agent metadata.
+ */
+class OciManifestAdapter {
+    /**
+     * Convert an AGT agent identity to an AI Card.
+     */
+    identityToAICard(identity, extra) {
+        const card = {
+            name: identity.name ?? identity.did,
+            version: '1.0.0',
+            description: identity.description,
+            author: identity.organization ?? identity.sponsor,
+            capabilities: this.capabilitiesToAICard(identity.capabilities),
+            metadata: {
+                did: identity.did,
+                status: identity.status ?? 'active',
+                createdAt: identity.createdAt,
+                expiresAt: identity.expiresAt,
+                parentDid: identity.parentDid,
+                delegationDepth: identity.delegationDepth,
+            },
+            ...extra,
+        };
+        return card;
+    }
+    /**
+     * Convert an AI Card back to an AGT agent identity.
+     */
+    aiCardToIdentity(card, publicKey) {
+        const metadata = (card.metadata ?? {});
+        return {
+            did: metadata.did ?? `did:agent:${card.name}`,
+            publicKey,
+            capabilities: this.aiCardToCapabilities(card.capabilities),
+            name: card.name,
+            description: card.description,
+            organization: card.author,
+            status: metadata.status ?? 'active',
+            createdAt: metadata.createdAt,
+            expiresAt: metadata.expiresAt,
+            parentDid: metadata.parentDid,
+            delegationDepth: metadata.delegationDepth,
+        };
+    }
+    /**
+     * Package an agent identity and optional policy rules into an OCI manifest.
+     */
+    package(identity, policyRules, extra) {
+        const aiCard = this.identityToAICard(identity, extra);
+        const aiCardJson = JSON.stringify(aiCard, null, 2);
+        const aiCardDescriptor = this.createDescriptor(aiCardJson, AI_CARD_MEDIA_TYPE, {
+            'org.opencontainers.image.title': 'ai-card.json',
+        });
+        const layers = [
+            { descriptor: aiCardDescriptor, content: aiCardJson },
+        ];
+        if (policyRules && policyRules.length > 0) {
+            const policyJson = JSON.stringify({ rules: policyRules }, null, 2);
+            const policyDescriptor = this.createDescriptor(policyJson, POLICY_MEDIA_TYPE, {
+                'org.opencontainers.image.title': 'policy.json',
+            });
+            layers.push({ descriptor: policyDescriptor, content: policyJson });
+        }
+        const configContent = JSON.stringify({
+            created: new Date().toISOString(),
+            author: identity.organization ?? identity.sponsor ?? 'unknown',
+            agent: { did: identity.did, name: identity.name },
+        });
+        const configDescriptor = this.createDescriptor(configContent, OCI_CONFIG_MEDIA_TYPE);
+        const manifest = {
+            schemaVersion: 2,
+            mediaType: OCI_MANIFEST_MEDIA_TYPE,
+            config: configDescriptor,
+            layers: layers.map((l) => l.descriptor),
+            annotations: {
+                'org.opencontainers.image.title': identity.name ?? identity.did,
+                'org.opencontainers.image.description': identity.description ?? '',
+                'org.opencontainers.image.vendor': identity.organization ?? '',
+                'dev.ai-card.version': aiCard.version,
+                'dev.agt.did': identity.did,
+            },
+        };
+        return { manifest, aiCard, configBlob: configContent, layers };
+    }
+    /**
+     * Extract an AI Card from an OCI manifest's layers.
+     */
+    unpackAICard(layers) {
+        const aiCardLayer = layers.find((l) => l.descriptor.mediaType === AI_CARD_MEDIA_TYPE);
+        if (!aiCardLayer)
+            return null;
+        try {
+            return JSON.parse(aiCardLayer.content);
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Extract policy rules from an OCI manifest's layers.
+     */
+    unpackPolicies(layers) {
+        const policyLayer = layers.find((l) => l.descriptor.mediaType === POLICY_MEDIA_TYPE);
+        if (!policyLayer)
+            return [];
+        try {
+            const parsed = JSON.parse(policyLayer.content);
+            return parsed.rules ?? [];
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Verify the integrity of an OCI manifest by checking layer digests.
+     */
+    verifyManifest(manifest, layers, configContent) {
+        const errors = [];
+        if (manifest.schemaVersion !== 2) {
+            errors.push(`Unsupported schema version: ${manifest.schemaVersion}`);
+        }
+        // Verify config digest
+        if (configContent) {
+            const expectedDigest = this.sha256Digest(configContent);
+            if (manifest.config.digest !== expectedDigest) {
+                errors.push(`Config digest mismatch: expected ${expectedDigest}, got ${manifest.config.digest}`);
+            }
+        }
+        // Verify layer digests
+        for (const layer of layers) {
+            const expectedDigest = this.sha256Digest(layer.content);
+            if (layer.descriptor.digest !== expectedDigest) {
+                errors.push(`Layer digest mismatch for ${layer.descriptor.annotations?.['org.opencontainers.image.title'] ?? 'unknown'}: expected ${expectedDigest}, got ${layer.descriptor.digest}`);
+            }
+            const expectedSize = Buffer.byteLength(layer.content, 'utf-8');
+            if (layer.descriptor.size !== expectedSize) {
+                errors.push(`Layer size mismatch: expected ${expectedSize}, got ${layer.descriptor.size}`);
+            }
+        }
+        return { valid: errors.length === 0, errors };
+    }
+    // ── Internal helpers ──
+    createDescriptor(content, mediaType, annotations) {
+        return {
+            mediaType,
+            digest: this.sha256Digest(content),
+            size: Buffer.byteLength(content, 'utf-8'),
+            annotations,
+        };
+    }
+    sha256Digest(content) {
+        const hash = (0, crypto_1.createHash)('sha256').update(content, 'utf-8').digest('hex');
+        return `sha256:${hash}`;
+    }
+    capabilitiesToAICard(capabilities) {
+        return {
+            domains: capabilities,
+            input_modes: ['text'],
+            output_modes: ['text', 'json'],
+        };
+    }
+    aiCardToCapabilities(capabilities) {
+        if (!capabilities)
+            return [];
+        return capabilities.domains ?? [];
+    }
+}
+exports.OciManifestAdapter = OciManifestAdapter;
+//# sourceMappingURL=oci-manifest.js.map

package/dist/oci-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci-manifest.js","sourceRoot":"","sources":["../src/oci-manifest.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC,mCAAoC;AAYpC,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;AACnE,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAC/D,MAAM,uBAAuB,GAAG,4CAA4C,CAAC;AAC7E,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AAEzE;;;;GAIG;AACH,MAAa,kBAAkB;IAC7B;;OAEG;IACH,gBAAgB,CAAC,QAA2B,EAAE,KAAuB;QACnE,MAAM,IAAI,GAAW;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG;YACnC,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,MAAM,EAAE,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO;YACjD,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC9D,QAAQ,EAAE;gBACR,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ;gBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,eAAe,EAAE,QAAQ,CAAC,eAAe;aAC1C;YACD,GAAG,KAAK;SACT,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,IAAY,EAAE,SAAiB;QAC9C,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;QAClE,OAAO;YACL,GAAG,EAAG,QAAQ,CAAC,GAAc,IAAI,aAAa,IAAI,CAAC,IAAI,EAAE;YACzD,SAAS;YACT,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,MAAM,EAAG,QAAQ,CAAC,MAAsC,IAAI,QAAQ;YACpE,SAAS,EAAE,QAAQ,CAAC,SAA+B;YACnD,SAAS,EAAE,QAAQ,CAAC,SAA+B;YACnD,SAAS,EAAE,QAAQ,CAAC,SAA+B;YACnD,eAAe,EAAE,QAAQ,CAAC,eAAqC;SAChE,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,OAAO,CACL,QAA2B,EAC3B,WAA0B,EAC1B,KAAuB;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,kBAAkB,EAAE;YAC7E,gCAAgC,EAAE,cAAc;SACjD,CAAC,CAAC;QAEH,MAAM,MAAM,GAA0D;YACpE,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE;SACtD,CAAC;QAEF,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,EAAE;gBAC5E,gCAAgC,EAAE,aAAa;aAChD,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;YACnC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,IAAI,SAAS;YAC9D,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;QAErF,MAAM,QAAQ,GAAgB;YAC5B,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,uBAAuB;YAClC,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;YACvC,WAAW,EAAE;gBACX,gCAAgC,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG;gBAC/D,sCAAsC,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;gBAClE,iCAAiC,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;gBAC9D,qBAAqB,EAAE,MAAM,CAAC,OAAO;gBACrC,aAAa,EAAE,QAAQ,CAAC,GAAG;aAC5B;SACF,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAA6D;QACxE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;QACtF,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAW,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAA6D;QAC1E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,KAAK,iBAAiB,CAAC,CAAC;QACrF,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAA4B,CAAC;YAC1E,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,QAAqB,EACrB,MAA6D,EAC7D,aAAsB;QAEtB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,+BAA+B,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,uBAAuB;QACvB,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,oCAAoC,cAAc,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CACT,6BAA6B,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,gCAAgC,CAAC,IAAI,SAAS,cAAc,cAAc,SAAS,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CACzK,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CACT,iCAAiC,YAAY,SAAS,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,yBAAyB;IAEjB,gBAAgB,CACtB,OAAe,EACf,SAAiB,EACjB,WAAoC;QAEpC,OAAO;YACL,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAClC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;YACzC,WAAW;SACZ,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,OAAe;QAClC,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,OAAO,UAAU,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,oBAAoB,CAAC,YAAsB;QACjD,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,CAAC,MAAM,CAAC;YACrB,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;SAC/B,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,YAAiC;QAC5D,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;CACF;AAtMD,gDAsMC"}

package/dist/policy-backends/cedar.d.ts

@@ -0,0 +1,15 @@
+import { BackendDecision, ExternalPolicyBackend } from '../types';
+interface CedarBackendConfig {
+    endpoint: string;
+    fetchImpl?: typeof fetch;
+}
+export declare class CedarBackend implements ExternalPolicyBackend {
+    readonly name = "cedar";
+    private readonly endpoint;
+    private readonly fetchImpl;
+    constructor(config: CedarBackendConfig);
+    evaluateAction(action: string, context: Record<string, unknown>): Promise<BackendDecision>;
+    evaluatePolicy(agentDid: string, context: Record<string, unknown>): Promise<BackendDecision>;
+}
+export {};
+//# sourceMappingURL=cedar.d.ts.map

package/dist/policy-backends/cedar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedar.d.ts","sourceRoot":"","sources":["../../src/policy-backends/cedar.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AA4ClE,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,YAAa,YAAW,qBAAqB;IACxD,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,MAAM,EAAE,kBAAkB;IAShC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IA+BhG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;CAM7F"}

package/dist/policy-backends/cedar.js

@@ -0,0 +1,88 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CedarBackend = void 0;
+/** Hostnames and IP prefixes that must never be used as Cedar endpoints. */
+const SSRF_BLOCKLIST = [
+    '169.254.169.254', // AWS/Azure IMDS
+    '169.254.170.2', // ECS task metadata
+    '168.63.129.16', // Azure Wire Server
+    'metadata.google.internal',
+    'metadata.google',
+    '100.100.100.200', // Alibaba Cloud IMDS
+    'fd00::', // IPv6 unique-local prefix
+    '::1', // IPv6 loopback
+];
+const SSRF_PRIVATE_RANGES = [
+    /^127\./, // IPv4 loopback
+    /^10\./, // RFC 1918
+    /^172\.(1[6-9]|2\d|3[01])\./,
+    /^192\.168\./, // RFC 1918
+    /^0\./, // "this" network
+];
+function isBlockedEndpoint(endpoint) {
+    let hostname;
+    try {
+        const url = new URL(endpoint);
+        hostname = url.hostname.replace(/^\[|\]$/g, '');
+        if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+            return true;
+        }
+    }
+    catch {
+        return true;
+    }
+    const lower = hostname.toLowerCase();
+    if (lower === 'localhost' || SSRF_BLOCKLIST.some(b => lower === b || lower.endsWith('.' + b))) {
+        return true;
+    }
+    if (SSRF_PRIVATE_RANGES.some(re => re.test(hostname))) {
+        return true;
+    }
+    return false;
+}
+class CedarBackend {
+    name = 'cedar';
+    endpoint;
+    fetchImpl;
+    constructor(config) {
+        const cleaned = config.endpoint.replace(/\/$/, '');
+        if (isBlockedEndpoint(cleaned)) {
+            throw new Error('Cedar endpoint blocked: URL points to a reserved or private address');
+        }
+        this.endpoint = cleaned;
+        this.fetchImpl = config.fetchImpl ?? fetch;
+    }
+    async evaluateAction(action, context) {
+        const response = await this.fetchImpl(this.endpoint, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({
+                action,
+                entities: context,
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`Cedar backend request failed with status ${response.status}`);
+        }
+        const body = await response.json();
+        if (body.decision === 'allow' || body.decision === 'deny' || body.decision === 'review') {
+            return body.decision;
+        }
+        if (typeof body.allow === 'boolean') {
+            return body.allow ? 'allow' : 'deny';
+        }
+        throw new Error('Cedar backend returned an unsupported result shape');
+    }
+    evaluatePolicy(agentDid, context) {
+        return this.evaluateAction('policy.evaluate', {
+            ...context,
+            principal: agentDid,
+        });
+    }
+}
+exports.CedarBackend = CedarBackend;
+//# sourceMappingURL=cedar.js.map

package/dist/policy-backends/cedar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedar.js","sourceRoot":"","sources":["../../src/policy-backends/cedar.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAIlC,4EAA4E;AAC5E,MAAM,cAAc,GAAG;IACrB,iBAAiB,EAAK,iBAAiB;IACvC,eAAe,EAAO,oBAAoB;IAC1C,eAAe,EAAO,oBAAoB;IAC1C,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB,EAAK,qBAAqB;IAC3C,QAAQ,EAAc,2BAA2B;IACjD,KAAK,EAAiB,gBAAgB;CACvC,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAc,gBAAgB;IACtC,OAAO,EAAe,WAAW;IACjC,4BAA4B;IAC5B,aAAa,EAAS,WAAW;IACjC,MAAM,EAAgB,iBAAiB;CACxC,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,MAAa,YAAY;IACd,IAAI,GAAG,OAAO,CAAC;IACP,QAAQ,CAAS;IACjB,SAAS,CAAe;IAEzC,YAAY,MAA0B;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,OAAgC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM;gBACN,QAAQ,EAAE,OAAO;aAClB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAG/B,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC,QAAQ,CAAC;QACvB,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,cAAc,CAAC,QAAgB,EAAE,OAAgC;QAC/D,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE;YAC5C,GAAG,OAAO;YACV,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC;CACF;AAnDD,oCAmDC"}

package/dist/policy-backends/opa.d.ts

@@ -0,0 +1,17 @@
+import { BackendDecision, ExternalPolicyBackend } from '../types';
+interface OPABackendConfig {
+    endpoint: string;
+    policyPath?: string;
+    fetchImpl?: typeof fetch;
+}
+export declare class OPABackend implements ExternalPolicyBackend {
+    readonly name = "opa";
+    private readonly endpoint;
+    private readonly policyPath;
+    private readonly fetchImpl;
+    constructor(config: OPABackendConfig);
+    evaluateAction(action: string, context: Record<string, unknown>): Promise<BackendDecision>;
+    evaluatePolicy(agentDid: string, context: Record<string, unknown>): Promise<BackendDecision>;
+}
+export {};
+//# sourceMappingURL=opa.d.ts.map

package/dist/policy-backends/opa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa.d.ts","sourceRoot":"","sources":["../../src/policy-backends/opa.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAElE,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAwBD,qBAAa,UAAW,YAAW,qBAAqB;IACtD,QAAQ,CAAC,IAAI,SAAS;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,MAAM,EAAE,gBAAgB;IAO9B,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAsChG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;CAM7F"}

package/dist/policy-backends/opa.js

@@ -0,0 +1,74 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPABackend = void 0;
+const BLOCKED_HOSTS = new Set([
+    '169.254.169.254',
+    'metadata.google.internal',
+]);
+function validateOpaUrl(endpoint) {
+    let parsed;
+    try {
+        parsed = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`Invalid OPA endpoint URL: ${endpoint}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Unsupported OPA URL scheme '${parsed.protocol}': only http and https are allowed`);
+    }
+    if (BLOCKED_HOSTS.has(parsed.hostname)) {
+        throw new Error(`OPA URL host '${parsed.hostname}' is blocked to prevent SSRF`);
+    }
+}
+class OPABackend {
+    name = 'opa';
+    endpoint;
+    policyPath;
+    fetchImpl;
+    constructor(config) {
+        validateOpaUrl(config.endpoint);
+        this.endpoint = config.endpoint.replace(/\/$/, '');
+        this.policyPath = config.policyPath ?? 'agentmesh/allow';
+        this.fetchImpl = config.fetchImpl ?? fetch;
+    }
+    async evaluateAction(action, context) {
+        const response = await this.fetchImpl(`${this.endpoint}/v1/data/${this.policyPath}`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({
+                input: {
+                    ...context,
+                    action,
+                },
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`OPA backend request failed with status ${response.status}`);
+        }
+        const body = await response.json();
+        if (typeof body.result === 'boolean') {
+            return body.result ? 'allow' : 'deny';
+        }
+        if (body.result && typeof body.result === 'object') {
+            if (typeof body.result.allow === 'boolean') {
+                return body.result.allow ? 'allow' : 'deny';
+            }
+            if (body.result.decision === 'allow' || body.result.decision === 'deny' || body.result.decision === 'review') {
+                return body.result.decision;
+            }
+        }
+        throw new Error('OPA backend returned an unsupported result shape');
+    }
+    evaluatePolicy(agentDid, context) {
+        return this.evaluateAction('policy.evaluate', {
+            ...context,
+            agentDid,
+        });
+    }
+}
+exports.OPABackend = OPABackend;
+//# sourceMappingURL=opa.js.map

package/dist/policy-backends/opa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa.js","sourceRoot":"","sources":["../../src/policy-backends/opa.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAUlC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,iBAAiB;IACjB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,QAAQ,oCAAoC,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,QAAQ,8BAA8B,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,MAAa,UAAU;IACZ,IAAI,GAAG,KAAK,CAAC;IACL,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,SAAS,CAAe;IAEzC,YAAY,MAAwB;QAClC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,iBAAiB,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,OAAgC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,YAAY,IAAI,CAAC,UAAU,EAAE,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE;oBACL,GAAG,OAAO;oBACV,MAAM;iBACP;aACF,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAE/B,CAAC;QACF,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACxC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnD,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9C,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7G,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,cAAc,CAAC,QAAgB,EAAE,OAAgC;QAC/D,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE;YAC5C,GAAG,OAAO;YACV,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;CACF;AAzDD,gCAyDC"}

package/dist/policy.d.ts

@@ -0,0 +1,77 @@
+import { PolicyRule, Policy, PolicyDecisionResult, CandidateDecision, ExternalPolicyBackend, PolicyBackendEvaluationResult, ResolutionResult, ConflictResolutionStrategy, LegacyPolicyDecision } from './types';
+export type PolicyDecision = LegacyPolicyDecision;
+/**
+ * Resolves conflicts between competing policy candidate decisions.
+ */
+export declare class PolicyConflictResolver {
+    readonly strategy: ConflictResolutionStrategy;
+    constructor(strategy: ConflictResolutionStrategy);
+    resolve(candidates: CandidateDecision[]): ResolutionResult;
+    private denyOverrides;
+    private allowOverrides;
+    private priorityFirstMatch;
+    private mostSpecificWins;
+}
+/**
+ * Declarative policy engine with full parity to the Python/NET SDK.
+ *
+ * Features:
+ * - Rich policy document model with apiVersion, scope, default_action
+ * - Expression-based condition evaluation (equality, comparison, in, and/or)
+ * - Configurable conflict resolution (deny-overrides, allow-overrides, priority-first-match, most-specific-wins)
+ * - Rate limiting support
+ * - Approval workflows
+ * - Backward-compatible with v0.1 flat rules
+ */
+export declare class PolicyEngine {
+    private _policies;
+    private _rateLimits;
+    private _resolver;
+    private _backends;
+    /** Legacy flat rules for backward compatibility. */
+    private _legacyRules;
+    constructor(rules?: PolicyRule[], conflictStrategy?: ConflictResolutionStrategy);
+    /** Load a Policy document into the engine. */
+    loadPolicy(policy: Policy): void;
+    /** Parse and load a YAML string as a Policy document. */
+    loadYaml(yamlContent: string): Policy;
+    /** Parse and load a JSON string as a Policy document. */
+    loadJson(jsonContent: string): Policy;
+    /** Get a loaded policy by name. */
+    getPolicy(name: string): Policy | undefined;
+    /** List all loaded policy names. */
+    listPolicies(): string[];
+    /** Remove a policy by name. Returns true if found and removed. */
+    removePolicy(name: string): boolean;
+    /** Clear all loaded policies. */
+    clearPolicies(): void;
+    registerBackend(backend: ExternalPolicyBackend): void;
+    listBackends(): string[];
+    clearBackends(): void;
+    /**
+     * Evaluate all applicable policies for an agent action.
+     * Returns a rich PolicyDecisionResult with matched rule, timing, etc.
+     */
+    evaluatePolicy(agentDid: string, context: Record<string, unknown>): PolicyDecisionResult;
+    evaluateWithBackends(action: string, context?: Record<string, unknown>): Promise<PolicyBackendEvaluationResult>;
+    evaluatePolicyWithBackends(agentDid: string, context: Record<string, unknown>): Promise<PolicyBackendEvaluationResult>;
+    /** Load policy rules from a YAML file (legacy flat format). */
+    loadFromYAML(yamlPath: string): Promise<void>;
+    /**
+     * Evaluate using legacy flat rules (v0.1 compatible).
+     * First match wins; default is 'deny'.
+     */
+    evaluate(action: string, context?: Record<string, unknown>): PolicyDecision;
+    /** Append a legacy flat rule. */
+    addRule(rule: PolicyRule): void;
+    /** Return a snapshot of legacy flat rules. */
+    getRules(): readonly PolicyRule[];
+    private matchAction;
+    private matchLegacyConditions;
+    private findRule;
+    private isRateLimited;
+    private incrementRateLimit;
+    private runActionBackend;
+    private runPolicyBackend;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,MAAM,EAEN,oBAAoB,EACpB,iBAAiB,EAGjB,qBAAqB,EACrB,6BAA6B,EAC7B,gBAAgB,EAChB,0BAA0B,EAE1B,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAGjB,MAAM,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAmBlD;;GAEG;AACH,qBAAa,sBAAsB;IACrB,QAAQ,CAAC,QAAQ,EAAE,0BAA0B;gBAApC,QAAQ,EAAE,0BAA0B;IAEzD,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB;IAqC1D,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,cAAc;IAmBtB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,gBAAgB;CAezB;AAoND;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,SAAS,CAAkC;IACnD,OAAO,CAAC,WAAW,CAA0C;IAC7D,OAAO,CAAC,SAAS,CAAyB;IAC1C,OAAO,CAAC,SAAS,CAA+B;IAEhD,oDAAoD;IACpD,OAAO,CAAC,YAAY,CAAoB;gBAE5B,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,gBAAgB,CAAC,EAAE,0BAA0B;IAW/E,8CAA8C;IAC9C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIhC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IASrC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAOrC,mCAAmC;IACnC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI3C,oCAAoC;IACpC,YAAY,IAAI,MAAM,EAAE;IAIxB,kEAAkE;IAClE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAInC,iCAAiC;IACjC,aAAa,IAAI,IAAI;IAKrB,eAAe,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIrD,YAAY,IAAI,MAAM,EAAE;IAIxB,aAAa,IAAI,IAAI;IAIrB;;;OAGG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,oBAAoB;IAwGlF,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACpC,OAAO,CAAC,6BAA6B,CAAC;IA0BnC,0BAA0B,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,6BAA6B,CAAC;IAgDzC,+DAA+D;IACzD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnD;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,cAAc;IAsB/E,iCAAiC;IACjC,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAI/B,8CAA8C;IAC9C,QAAQ,IAAI,SAAS,UAAU,EAAE;IAMjC,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,qBAAqB;IAY7B,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,kBAAkB;YAWZ,gBAAgB;YAyBhB,gBAAgB;CAwB/B"}