@ninelives/agent-governance-sdk 5.0.1

package/dist/credential-vault.js

@@ -0,0 +1,567 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+/**
+ * Credential vault, scoping, and injection for agent tool calls.
+ *
+ * TypeScript port of the Python `agent_os.credential_vault` primitive
+ * (issue #2481, PR #2534). Tracking issue: #2535.
+ *
+ * Design goals (identical to the Python reference):
+ *
+ * 1. **Value boundary** — agents never receive resolved secret values. They
+ *    reference credentials by opaque handle names; only the injector ever
+ *    holds the resolved value, and only long enough to render a payload.
+ * 2. **Authority boundary** — every resolution is gated by a per-agent
+ *    {@link CredentialProfile} that binds an *action capability* (not just
+ *    an agent identity) to a specific credential handle.
+ * 3. **Policy-first** — placeholder substitution happens *after* the
+ *    workflow policy callback returns `allow=true`.
+ * 4. **Deterministic deny** — denied resolutions emit the same opaque
+ *    {@link DenyReceipt} regardless of whether the handle is missing,
+ *    bound to a different agent, or denied by policy.
+ * 5. **Untrusted server metadata** — only placeholders whose names appear
+ *    in the caller-supplied `allowedHandles` set are eligible for
+ *    substitution. Anything else is treated as injection.
+ * 6. **Rotation without rebinding** — credential values rotate in place;
+ *    the handle name is stable so prompts, MCP descriptions, and saved
+ *    plans never need to change.
+ *
+ * Encrypted-at-rest persistence uses AES-256-GCM (`@noble/ciphers`) with
+ * a 12-byte random nonce prefixed to the ciphertext. If no persistence
+ * path is configured the vault is memory-only.
+ *
+ * Wire-format note: this SDK uses AES-256-GCM; the Python SDK uses Fernet.
+ * A cross-language interop spec is tracked in issue #2535 and the two
+ * formats are not currently interchangeable.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialInjector = exports.CredentialVault = exports.DenyReceipt = exports.CredentialProfile = exports.CredentialHandle = exports.CredentialError = exports.DENY_REASON = exports.PLACEHOLDER_RE = void 0;
+exports.auditDigest = auditDigest;
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const aes_js_1 = require("@noble/ciphers/aes.js");
+const hmac_js_1 = require("@noble/hashes/hmac.js");
+const sha2_js_1 = require("@noble/hashes/sha2.js");
+const utils_js_1 = require("@noble/hashes/utils.js");
+// ---------------------------------------------------------------------------
+// Public constants
+// ---------------------------------------------------------------------------
+/** Regex matching the credential placeholder syntax `{{cred:NAME}}`. */
+exports.PLACEHOLDER_RE = /\{\{\s*cred:([A-Za-z0-9_.\-]{1,128})\s*\}\}/g;
+/** Stable string returned in audit/deny records when a request is refused. */
+exports.DENY_REASON = 'credential_denied';
+/** AES-GCM key length (bytes). */
+const KEY_LENGTH = 32;
+/** AES-GCM nonce length (bytes). */
+const NONCE_LENGTH = 12;
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+class CredentialError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CredentialError';
+    }
+}
+exports.CredentialError = CredentialError;
+/**
+ * Opaque handle an agent may reference. Holding a handle does **not** grant
+ * access to the underlying value; resolution requires the vault, the
+ * agent's DID, and an action capability binding.
+ */
+class CredentialHandle {
+    name;
+    constructor(name) {
+        this.name = name;
+    }
+    /** Return the `{{cred:NAME}}` placeholder for this handle. */
+    placeholder() {
+        return `{{cred:${this.name}}}`;
+    }
+    toString() {
+        return `<CredentialHandle ${this.name}>`;
+    }
+}
+exports.CredentialHandle = CredentialHandle;
+/**
+ * Per-agent capability binding.
+ *
+ * A profile maps action capabilities (e.g. `github:read_issues`,
+ * `github:push_code`) to the credential handle name that may be used to
+ * fulfil that capability. Two capabilities that share an underlying
+ * credential are still modelled as separate bindings so revoking one does
+ * not implicitly revoke the other.
+ */
+class CredentialProfile {
+    agentDid;
+    _bindings;
+    constructor(agentDid, bindings) {
+        if (!agentDid) {
+            throw new TypeError('agentDid must be a non-empty string');
+        }
+        this.agentDid = agentDid;
+        const entries = bindings instanceof Map ? [...bindings.entries()] : Object.entries(bindings);
+        this._bindings = new Map(entries);
+    }
+    /** Return the handle name bound to `actionClass`, or undefined. */
+    capabilityFor(actionClass) {
+        return this._bindings.get(actionClass);
+    }
+    /** Snapshot of bindings (read-only). */
+    get bindings() {
+        return this._bindings;
+    }
+}
+exports.CredentialProfile = CredentialProfile;
+/** Deterministic deny output returned in place of a rendered payload. */
+class DenyReceipt {
+    reason;
+    actionClass;
+    targetService;
+    constructor(opts = {}) {
+        this.reason = opts.reason ?? exports.DENY_REASON;
+        this.actionClass = opts.actionClass ?? '';
+        this.targetService = opts.targetService ?? '';
+    }
+    toJSON() {
+        return {
+            reason: this.reason,
+            actionClass: this.actionClass,
+            targetService: this.targetService,
+        };
+    }
+    equals(other) {
+        return (this.reason === other.reason &&
+            this.actionClass === other.actionClass &&
+            this.targetService === other.targetService);
+    }
+}
+exports.DenyReceipt = DenyReceipt;
+// ---------------------------------------------------------------------------
+// Vault
+// ---------------------------------------------------------------------------
+const NAME_RE = /^[A-Za-z0-9_.\-]{1,128}$/;
+/**
+ * Encrypted-at-rest credential store and scoped resolver.
+ *
+ * Exposes two surfaces:
+ *
+ * - **Admin** (`put`, `rotate`, `delete`, `listHandles`, `registerProfile`)
+ *   — for operators provisioning credentials.
+ * - **Resolver** (`checkAccess`, `_resolveInternal`) — for the injector.
+ *   Agents are never expected to call these directly.
+ */
+class CredentialVault {
+    records = new Map();
+    profiles = new Map();
+    _audit = [];
+    persistPath;
+    key;
+    loaded = false;
+    constructor(options = {}) {
+        this.persistPath = options.persistPath ?? null;
+        this.key = options.encryptionKey ?? null;
+        if (this.persistPath !== null) {
+            if (this.key === null) {
+                throw new TypeError('encryptionKey is required when persistPath is set');
+            }
+            if (this.key.length !== KEY_LENGTH) {
+                throw new TypeError(`encryptionKey must be exactly ${KEY_LENGTH} bytes`);
+            }
+        }
+    }
+    /** Generate a fresh AES-256-GCM key (32 random bytes). */
+    static generateKey() {
+        return (0, utils_js_1.randomBytes)(KEY_LENGTH);
+    }
+    /** Load persisted records from disk. Idempotent. */
+    async load() {
+        if (this.loaded || this.persistPath === null) {
+            this.loaded = true;
+            return;
+        }
+        try {
+            const buf = await node_fs_1.promises.readFile(this.persistPath);
+            if (buf.length === 0) {
+                this.loaded = true;
+                return;
+            }
+            const decoded = this.decrypt(new Uint8Array(buf));
+            const payload = JSON.parse(new TextDecoder().decode(decoded));
+            for (const r of payload.records ?? []) {
+                this.records.set(r.name, r);
+            }
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT') {
+                throw err;
+            }
+        }
+        this.loaded = true;
+    }
+    // -- Admin surface ------------------------------------------------------
+    async put(name, value, credType = 'secret') {
+        if (!NAME_RE.test(name)) {
+            throw new TypeError('Credential name must match [A-Za-z0-9_.-]{1,128}');
+        }
+        await this.load();
+        const existing = this.records.get(name);
+        const now = Date.now() / 1000;
+        const record = {
+            name,
+            value,
+            credType,
+            version: existing ? existing.version + 1 : 1,
+            createdAt: existing ? existing.createdAt : now,
+            rotatedAt: existing ? now : null,
+        };
+        this.records.set(name, record);
+        await this.flush();
+        return new CredentialHandle(name);
+    }
+    async rotate(name, newValue) {
+        await this.load();
+        const old = this.records.get(name);
+        if (!old) {
+            throw new CredentialError(`unknown credential: ${name}`);
+        }
+        const updated = {
+            ...old,
+            value: newValue,
+            version: old.version + 1,
+            rotatedAt: Date.now() / 1000,
+        };
+        this.records.set(name, updated);
+        await this.flush();
+        return new CredentialHandle(name);
+    }
+    async delete(name) {
+        await this.load();
+        const present = this.records.delete(name);
+        if (present) {
+            await this.flush();
+        }
+        return present;
+    }
+    async listHandles() {
+        await this.load();
+        return [...this.records.keys()].sort();
+    }
+    async getMetadata(name) {
+        await this.load();
+        const r = this.records.get(name);
+        if (!r)
+            return null;
+        const { value: _ignored, ...meta } = r;
+        return meta;
+    }
+    registerProfile(profile) {
+        this.profiles.set(profile.agentDid, profile);
+    }
+    revokeProfile(agentDid) {
+        return this.profiles.delete(agentDid);
+    }
+    // -- Resolver surface ---------------------------------------------------
+    /** True iff `agentDid` may use `handleName` for `actionClass`. */
+    checkAccess(agentDid, handleName, actionClass) {
+        const profile = this.profiles.get(agentDid);
+        if (!profile)
+            return false;
+        const bound = profile.capabilityFor(actionClass);
+        if (bound === undefined || bound !== handleName)
+            return false;
+        return this.records.has(handleName);
+    }
+    /**
+     * Internal: resolve a credential value and emit an audit event.
+     * Returns `[value, event]`; on deny `value` is null.
+     *
+     * Callers must ensure `value` never crosses the agent trust boundary.
+     * Use {@link CredentialInjector} rather than calling this directly.
+     */
+    _resolveInternal(agentDid, handleName, actionClass, targetService, policyVersion) {
+        const allowed = this.checkAccess(agentDid, handleName, actionClass);
+        if (allowed) {
+            const value = this.records.get(handleName).value;
+            const event = {
+                timestamp: Date.now() / 1000,
+                agentDid,
+                handleName,
+                targetService,
+                actionClass,
+                decision: 'allow',
+                policyVersion,
+                reason: '',
+            };
+            this._audit.push(event);
+            return [value, event];
+        }
+        const event = {
+            timestamp: Date.now() / 1000,
+            agentDid,
+            handleName,
+            targetService,
+            actionClass,
+            decision: 'deny',
+            policyVersion,
+            reason: exports.DENY_REASON,
+        };
+        this._audit.push(event);
+        return [null, event];
+    }
+    /** Immutable snapshot of audit events. */
+    auditLog() {
+        return [...this._audit];
+    }
+    clearAudit() {
+        this._audit.length = 0;
+    }
+    // Internal helper for the injector to append an audit event when a
+    // request is rejected before any vault read happens (out-of-scope
+    // placeholder or policy deny).
+    _recordReject(event) {
+        this._audit.push(event);
+    }
+    // -- Persistence --------------------------------------------------------
+    async flush() {
+        if (this.persistPath === null || this.key === null)
+            return;
+        const payload = JSON.stringify({ records: [...this.records.values()] });
+        const ciphertext = this.encrypt((0, utils_js_1.utf8ToBytes)(payload));
+        const tmp = `${this.persistPath}.tmp`;
+        await node_fs_1.promises.mkdir(path.dirname(this.persistPath) || '.', { recursive: true });
+        await node_fs_1.promises.writeFile(tmp, ciphertext);
+        await node_fs_1.promises.rename(tmp, this.persistPath);
+    }
+    encrypt(plaintext) {
+        if (this.key === null)
+            throw new CredentialError('no encryption key');
+        const nonce = (0, utils_js_1.randomBytes)(NONCE_LENGTH);
+        const ct = (0, aes_js_1.gcm)(this.key, nonce).encrypt(plaintext);
+        const out = new Uint8Array(NONCE_LENGTH + ct.length);
+        out.set(nonce, 0);
+        out.set(ct, NONCE_LENGTH);
+        return out;
+    }
+    decrypt(blob) {
+        if (this.key === null)
+            throw new CredentialError('no encryption key');
+        if (blob.length < NONCE_LENGTH) {
+            throw new CredentialError('persisted vault is corrupt (too short)');
+        }
+        const nonce = blob.slice(0, NONCE_LENGTH);
+        const ct = blob.slice(NONCE_LENGTH);
+        return (0, aes_js_1.gcm)(this.key, nonce).decrypt(ct);
+    }
+}
+exports.CredentialVault = CredentialVault;
+/**
+ * Render `{{cred:NAME}}` placeholders into HTTP, MCP, and env payloads.
+ *
+ * The injector is the *only* component that ever holds resolved credential
+ * values, and only long enough to render an outbound payload.
+ *
+ * For every injection call:
+ *
+ * - `allowedHandles` is the workflow-policy allowlist of handle names
+ *   eligible for substitution on this call. A placeholder whose name is
+ *   not in this set causes the entire call to be denied — this is the
+ *   "MCP server metadata is untrusted" boundary.
+ * - `policyCheck` is invoked *before* any value is read from the vault.
+ * - On any deny, `payload` is a {@link DenyReceipt} (deterministic shape).
+ */
+class CredentialInjector {
+    vault;
+    constructor(vault) {
+        this.vault = vault;
+    }
+    async injectHeaders(agentDid, headers, opts) {
+        return this._inject(agentDid, { ...headers }, opts);
+    }
+    async injectToolArgs(agentDid, args, opts) {
+        return this._inject(agentDid, args, opts);
+    }
+    async injectEnv(agentDid, env, opts) {
+        return this._inject(agentDid, { ...env }, opts);
+    }
+    async _inject(agentDid, payload, opts) {
+        const allowlist = new Set(opts.allowedHandles);
+        const requested = collectPlaceholders(payload);
+        const policyVersion = opts.policyVersion ?? 'v0';
+        // 1. Reject anything outside the workflow-supplied allowlist.
+        const outside = [...requested].filter(n => !allowlist.has(n));
+        if (outside.length > 0) {
+            const event = {
+                timestamp: Date.now() / 1000,
+                agentDid,
+                handleName: outside[0],
+                targetService: opts.targetService,
+                actionClass: opts.actionClass,
+                decision: 'deny',
+                policyVersion,
+                reason: exports.DENY_REASON,
+            };
+            this.vault._recordReject(event);
+            const receipt = new DenyReceipt({
+                actionClass: opts.actionClass,
+                targetService: opts.targetService,
+            });
+            return { allowed: false, payload: receipt, denyReceipt: receipt, auditEvents: [event] };
+        }
+        // 2. Run policy *before* any vault read.
+        if (opts.policyCheck) {
+            const ctx = {
+                agentDid,
+                actionClass: opts.actionClass,
+                targetService: opts.targetService,
+                requestedHandles: [...requested].sort(),
+                policyVersion,
+            };
+            const outcome = await opts.policyCheck(ctx);
+            if (!outcome.allow) {
+                const event = {
+                    timestamp: Date.now() / 1000,
+                    agentDid,
+                    handleName: [...requested][0] ?? '',
+                    targetService: opts.targetService,
+                    actionClass: opts.actionClass,
+                    decision: 'deny',
+                    policyVersion,
+                    reason: exports.DENY_REASON,
+                };
+                this.vault._recordReject(event);
+                const receipt = new DenyReceipt({
+                    actionClass: opts.actionClass,
+                    targetService: opts.targetService,
+                });
+                return { allowed: false, payload: receipt, denyReceipt: receipt, auditEvents: [event] };
+            }
+        }
+        // 3. Resolve. Any single deny aborts the whole call.
+        const resolved = new Map();
+        const events = [];
+        for (const name of requested) {
+            const [value, ev] = this.vault._resolveInternal(agentDid, name, opts.actionClass, opts.targetService, policyVersion);
+            events.push(ev);
+            if (value === null) {
+                const receipt = new DenyReceipt({
+                    actionClass: opts.actionClass,
+                    targetService: opts.targetService,
+                });
+                return { allowed: false, payload: receipt, denyReceipt: receipt, auditEvents: events };
+            }
+            resolved.set(name, value);
+        }
+        const rendered = substitute(payload, resolved);
+        return { allowed: true, payload: rendered, denyReceipt: null, auditEvents: events };
+    }
+}
+exports.CredentialInjector = CredentialInjector;
+// ---------------------------------------------------------------------------
+// Placeholder helpers
+// ---------------------------------------------------------------------------
+function collectPlaceholders(payload) {
+    const out = new Set();
+    walk(payload, s => {
+        exports.PLACEHOLDER_RE.lastIndex = 0;
+        let m;
+        while ((m = exports.PLACEHOLDER_RE.exec(s)) !== null) {
+            out.add(m[1]);
+        }
+    });
+    return out;
+}
+function substitute(payload, resolved) {
+    return mapStrings(payload, s => s.replace(exports.PLACEHOLDER_RE, (match, name) => resolved.get(name) ?? match));
+}
+function walk(payload, visit) {
+    if (typeof payload === 'string') {
+        visit(payload);
+    }
+    else if (Array.isArray(payload)) {
+        for (const item of payload)
+            walk(item, visit);
+    }
+    else if (payload && typeof payload === 'object') {
+        for (const [k, v] of Object.entries(payload)) {
+            visit(k);
+            walk(v, visit);
+        }
+    }
+}
+function mapStrings(payload, fn) {
+    if (typeof payload === 'string')
+        return fn(payload);
+    if (Array.isArray(payload))
+        return payload.map(v => mapStrings(v, fn));
+    if (payload && typeof payload === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(payload)) {
+            out[fn(k)] = mapStrings(v, fn);
+        }
+        return out;
+    }
+    return payload;
+}
+// ---------------------------------------------------------------------------
+// Audit-log integrity helper
+// ---------------------------------------------------------------------------
+/**
+ * Stable HMAC-SHA256 digest of an audit-event sequence.
+ *
+ * The digest covers handle names and decisions but never resolved
+ * credential values (the vault never stores them in events).
+ */
+function auditDigest(events, key) {
+    const h = hmac_js_1.hmac.create(sha2_js_1.sha256, key);
+    for (const ev of events) {
+        const json = JSON.stringify({
+            timestamp: ev.timestamp,
+            agentDid: ev.agentDid,
+            handleName: ev.handleName,
+            targetService: ev.targetService,
+            actionClass: ev.actionClass,
+            decision: ev.decision,
+            policyVersion: ev.policyVersion,
+            reason: ev.reason,
+        });
+        h.update((0, utils_js_1.utf8ToBytes)(json));
+        h.update(new Uint8Array([0x1f]));
+    }
+    return (0, utils_js_1.bytesToHex)(h.digest());
+}
+//# sourceMappingURL=credential-vault.js.map

package/dist/credential-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-vault.js","sourceRoot":"","sources":["../src/credential-vault.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAomBH,kCAiBC;AAnnBD,qCAAyC;AACzC,gDAAkC;AAElC,kDAA4C;AAC5C,mDAA6C;AAC7C,mDAA+C;AAC/C,qDAA8E;AAE9E,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,wEAAwE;AAC3D,QAAA,cAAc,GAAG,8CAA8C,CAAC;AAE7E,8EAA8E;AACjE,QAAA,WAAW,GAAG,mBAAmB,CAAC;AAK/C,kCAAkC;AAClC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,oCAAoC;AACpC,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAeD;;;;GAIG;AACH,MAAa,gBAAgB;IAClB,IAAI,CAAS;IACtB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,8DAA8D;IAC9D,WAAW;QACT,OAAO,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC;IACjC,CAAC;IACD,QAAQ;QACN,OAAO,qBAAqB,IAAI,CAAC,IAAI,GAAG,CAAC;IAC3C,CAAC;CACF;AAZD,4CAYC;AAED;;;;;;;;GAQG;AACH,MAAa,iBAAiB;IACnB,QAAQ,CAAS;IACT,SAAS,CAA8B;IAExD,YAAY,QAAgB,EAAE,QAAsD;QAClF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,MAAM,OAAO,GAAG,QAAQ,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7F,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,mEAAmE;IACnE,aAAa,CAAC,WAAmB;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,wCAAwC;IACxC,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;CACF;AAtBD,8CAsBC;AAaD,yEAAyE;AACzE,MAAa,WAAW;IACb,MAAM,CAAS;IACf,WAAW,CAAS;IACpB,aAAa,CAAS;IAC/B,YAAY,OAA0E,EAAE;QACtF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAW,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,MAAM;QACJ,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,KAAkB;QACvB,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC5B,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YACtC,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAC3C,CAAC;IACJ,CAAC;CACF;AAvBD,kCAuBC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAS3C;;;;;;;;;GASG;AACH,MAAa,eAAe;IACT,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC9C,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IAChD,MAAM,GAAsB,EAAE,CAAC;IAC/B,WAAW,CAAgB;IAC3B,GAAG,CAAoB;IAChC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,UAAkC,EAAE;QAC9C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAC/C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC;QAEzC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CAAC,iCAAiC,UAAU,QAAQ,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,CAAC,WAAW;QAChB,OAAO,IAAA,sBAAW,EAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAChD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAE3D,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,QAAQ,GAAG,QAAQ;QACxD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC9B,MAAM,MAAM,GAAqB;YAC/B,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5C,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;YAC9C,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SACjC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QACzC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,eAAe,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,OAAO,GAAqB;YAChC,GAAG,GAAG;YACN,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;SAC7B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,eAAe,CAAC,OAA0B;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,0EAA0E;IAE1E,kEAAkE;IAClE,WAAW,CAAC,QAAgB,EAAE,UAAkB,EAAE,WAAmB;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CACd,QAAgB,EAChB,UAAkB,EAClB,WAAmB,EACnB,aAAqB,EACrB,aAAqB;QAErB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,KAAK,CAAC;YAClD,MAAM,KAAK,GAAoB;gBAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;gBAC5B,QAAQ;gBACR,UAAU;gBACV,aAAa;gBACb,WAAW;gBACX,QAAQ,EAAE,OAAO;gBACjB,aAAa;gBACb,MAAM,EAAE,EAAE;aACX,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,KAAK,GAAoB;YAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YAC5B,QAAQ;YACR,UAAU;YACV,aAAa;YACb,WAAW;YACX,QAAQ,EAAE,MAAM;YAChB,aAAa;YACb,MAAM,EAAE,mBAAW;SACpB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,UAAU;QACR,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,+BAA+B;IAC/B,aAAa,CAAC,KAAsB;QAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,0EAA0E;IAElE,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAA,sBAAW,EAAC,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,MAAM,CAAC;QACtC,MAAM,kBAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,kBAAE,CAAC,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACpC,MAAM,kBAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAEO,OAAO,CAAC,SAAqB;QACnC,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,IAAA,sBAAW,EAAC,YAAY,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAA,YAAG,EAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,YAAY,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClB,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC1B,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,OAAO,CAAC,IAAgB;QAC9B,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpC,OAAO,IAAA,YAAG,EAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAjOD,0CAiOC;AAoCD;;;;;;;;;;;;;;GAcG;AACH,MAAa,kBAAkB;IACA;IAA7B,YAA6B,KAAsB;QAAtB,UAAK,GAAL,KAAK,CAAiB;IAAG,CAAC;IAEvD,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,OAA+B,EAC/B,IAAsB;QAEtB,OAAO,IAAI,CAAC,OAAO,CAAyB,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,IAAO,EACP,IAAsB;QAEtB,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,GAA2B,EAC3B,IAAsB;QAEtB,OAAO,IAAI,CAAC,OAAO,CAAyB,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,QAAgB,EAChB,OAAU,EACV,IAAsB;QAEtB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;QAEjD,8DAA8D;QAC9D,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAoB;gBAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;gBAC5B,QAAQ;gBACR,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;gBACtB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,QAAQ,EAAE,MAAM;gBAChB,aAAa;gBACb,MAAM,EAAE,mBAAW;aACpB,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;gBAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,GAAG,GAAqB;gBAC5B,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,gBAAgB,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE;gBACvC,aAAa;aACd,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAoB;oBAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;oBAC5B,QAAQ;oBACR,UAAU,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;oBACnC,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,QAAQ,EAAE,MAAM;oBAChB,aAAa;oBACb,MAAM,EAAE,mBAAW;iBACpB,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;oBAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAC7C,QAAQ,EACR,IAAI,EACJ,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,aAAa,EAClB,aAAa,CACd,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;oBAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;YACzF,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAM,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtF,CAAC;CACF;AAhHD,gDAgHC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE;QAChB,sBAAc,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,sBAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,QAAqC;IACzE,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAC7B,CAAC,CAAC,OAAO,CAAC,sBAAc,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAgB,EAAE,KAA0B;IACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,CAAC;YACT,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,EAAyB;IAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,MAAkC,EAAE,GAAe;IAC7E,MAAM,CAAC,GAAG,cAAI,CAAC,MAAM,CAAC,gBAAM,EAAE,GAAG,CAAC,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;QACH,CAAC,CAAC,MAAM,CAAC,IAAA,sBAAW,EAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAA,qBAAU,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/dist/discovery.d.ts

@@ -0,0 +1,80 @@
+export type DetectionBasis = 'config_file' | 'container_reference' | 'source_pattern' | 'manual';
+export type DiscoveryStatus = 'registered' | 'unregistered' | 'shadow' | 'unknown';
+export type DiscoveryRiskLevel = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export interface DiscoveryEvidence {
+    scanner: string;
+    basis: DetectionBasis;
+    source: string;
+    detail: string;
+    rawData: Record<string, unknown>;
+    confidence: number;
+    timestamp: string;
+}
+export interface DiscoveredAgent {
+    fingerprint: string;
+    name: string;
+    agentType: string;
+    description: string;
+    did?: string;
+    owner?: string;
+    status: DiscoveryStatus;
+    evidence: DiscoveryEvidence[];
+    confidence: number;
+    mergeKeys: Record<string, string>;
+    firstSeenAt: string;
+    lastSeenAt: string;
+    tags: Record<string, string>;
+}
+export interface DiscoveryRiskAssessment {
+    level: DiscoveryRiskLevel;
+    score: number;
+    factors: string[];
+    assessedAt: string;
+}
+export interface ShadowAgentRecord {
+    agent: DiscoveredAgent;
+    risk: DiscoveryRiskAssessment;
+    recommendedActions: string[];
+}
+export interface RegisteredAgentRecord {
+    did?: string;
+    name?: string;
+    fingerprint?: string;
+    configPath?: string;
+    owner?: string;
+}
+export interface ShadowDiscoveryOptions {
+    paths: string[];
+    registry?: RegisteredAgentRecord[];
+    maxDepth?: number;
+    includeSourcePatterns?: boolean;
+    maxFileReadBytes?: number;
+}
+export interface DiscoveryScanResult {
+    agents: DiscoveredAgent[];
+    shadowAgents: ShadowAgentRecord[];
+    errors: string[];
+    startedAt: string;
+    completedAt: string;
+    scannedTargets: number;
+    agentCount: number;
+}
+export declare class ShadowDiscovery {
+    private readonly registeredAgents;
+    constructor(registeredAgents?: RegisteredAgentRecord[]);
+    scan(options: ShadowDiscoveryOptions): DiscoveryScanResult;
+    reconcile(agents: DiscoveredAgent[], registry?: RegisteredAgentRecord[]): ShadowAgentRecord[];
+    private walkDirectory;
+    private scanConfigFile;
+    private scanContainerFile;
+    private scanSourceFile;
+    private addObservation;
+    private scoreRisk;
+    private riskLevelForScore;
+    private recommendActions;
+    private matchRegisteredAgent;
+    private readTextSafely;
+    private computeFingerprint;
+    private normalizePath;
+}
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,qBAAqB,GAAG,gBAAgB,GAAG,QAAQ,CAAC;AACjG,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AACnF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEjF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,IAAI,EAAE,uBAAuB,CAAC;IAC9B,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAmED,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAAhB,gBAAgB,GAAE,qBAAqB,EAAO;IAE3E,IAAI,CAAC,OAAO,EAAE,sBAAsB,GAAG,mBAAmB;IAsC1D,SAAS,CACP,MAAM,EAAE,eAAe,EAAE,EACzB,QAAQ,GAAE,qBAAqB,EAA0B,GACxD,iBAAiB,EAAE;IAwBtB,OAAO,CAAC,aAAa;IAsDrB,OAAO,CAAC,cAAc;IA+BtB,OAAO,CAAC,iBAAiB;IAgDzB,OAAO,CAAC,cAAc;IAgDtB,OAAO,CAAC,cAAc;IA4CtB,OAAO,CAAC,SAAS;IAoDjB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,oBAAoB;IA4B5B,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,kBAAkB;IAS1B,OAAO,CAAC,aAAa;CAGtB"}