@ninelives/agent-governance-sdk 5.0.1

package/dist/discovery.js

@@ -0,0 +1,404 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShadowDiscovery = void 0;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+const CONFIG_PATTERNS = [
+    { glob: 'agentmesh.yaml', type: 'agt', confidence: 0.95 },
+    { glob: 'agentmesh.yml', type: 'agt', confidence: 0.95 },
+    { glob: '.agentmesh/config.yaml', type: 'agt', confidence: 0.95 },
+    { glob: 'agent-governance.yaml', type: 'agt', confidence: 0.9 },
+    { glob: 'crewai.yaml', type: 'crewai', confidence: 0.9 },
+    { glob: 'crewai.yml', type: 'crewai', confidence: 0.9 },
+    { glob: 'mcp.json', type: 'mcp-server', confidence: 0.85 },
+    { glob: 'mcp-config.json', type: 'mcp-server', confidence: 0.85 },
+    { glob: '.mcp/config.json', type: 'mcp-server', confidence: 0.85 },
+    { glob: 'claude_desktop_config.json', type: 'mcp-server', confidence: 0.8 },
+    { glob: '.copilot-setup-steps.yml', type: 'copilot-agent', confidence: 0.8 },
+    { glob: 'copilot-setup-steps.yml', type: 'copilot-agent', confidence: 0.8 },
+];
+const DOCKER_AGENT_PATTERNS = [
+    { pattern: /langchain|langgraph/i, type: 'langchain', confidence: 0.7 },
+    { pattern: /crewai/i, type: 'crewai', confidence: 0.7 },
+    { pattern: /autogen/i, type: 'autogen', confidence: 0.7 },
+    { pattern: /agentmesh|agent\.governance/i, type: 'agt', confidence: 0.72 },
+    { pattern: /mcp[_-]server/i, type: 'mcp-server', confidence: 0.72 },
+    { pattern: /semantic[_-]kernel/i, type: 'semantic-kernel', confidence: 0.7 },
+];
+const SOURCE_AGENT_PATTERNS = [
+    { pattern: /langchain|langgraph/i, type: 'langchain', confidence: 0.65 },
+    { pattern: /crewai/i, type: 'crewai', confidence: 0.65 },
+    { pattern: /autogen|openai-agents/i, type: 'openai-agents', confidence: 0.65 },
+    { pattern: /agentmesh|agent[-_]governance/i, type: 'agt', confidence: 0.7 },
+    { pattern: /mcp[_-]server|model context protocol/i, type: 'mcp-server', confidence: 0.7 },
+    { pattern: /semantic[_-]kernel/i, type: 'semantic-kernel', confidence: 0.65 },
+];
+const SKIP_DIRS = new Set([
+    '.git',
+    'node_modules',
+    '__pycache__',
+    '.venv',
+    'venv',
+    '.tox',
+    '.mypy_cache',
+    '.pytest_cache',
+    'dist',
+    'build',
+    '.eggs',
+    'coverage',
+]);
+const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.py', '.mjs', '.cjs']);
+const HIGH_RISK_TYPES = new Set(['autogen', 'crewai', 'langchain', 'openai-agents']);
+const MEDIUM_RISK_TYPES = new Set(['mcp-server', 'semantic-kernel', 'copilot-agent']);
+const DEFAULT_MAX_FILE_READ_BYTES = 64 * 1024;
+class ShadowDiscovery {
+    registeredAgents;
+    constructor(registeredAgents = []) {
+        this.registeredAgents = registeredAgents;
+    }
+    scan(options) {
+        const startedAt = new Date().toISOString();
+        const errors = [];
+        const agents = new Map();
+        const maxDepth = options.maxDepth ?? 10;
+        const includeSourcePatterns = options.includeSourcePatterns ?? true;
+        const maxFileReadBytes = options.maxFileReadBytes ?? DEFAULT_MAX_FILE_READ_BYTES;
+        for (const scanPath of options.paths) {
+            const rootPath = path_1.default.resolve(scanPath);
+            try {
+                if (!(0, fs_1.statSync)(rootPath).isDirectory()) {
+                    errors.push(`Not a directory: ${scanPath}`);
+                    continue;
+                }
+            }
+            catch {
+                errors.push(`Not a directory: ${scanPath}`);
+                continue;
+            }
+            this.walkDirectory(rootPath, rootPath, maxDepth, includeSourcePatterns, maxFileReadBytes, agents, errors);
+        }
+        const registry = options.registry ?? this.registeredAgents;
+        const discoveredAgents = Array.from(agents.values());
+        const shadowAgents = this.reconcile(discoveredAgents, registry);
+        return {
+            agents: discoveredAgents.sort((left, right) => right.confidence - left.confidence),
+            shadowAgents,
+            errors,
+            startedAt,
+            completedAt: new Date().toISOString(),
+            scannedTargets: options.paths.length,
+            agentCount: discoveredAgents.length,
+        };
+    }
+    reconcile(agents, registry = this.registeredAgents) {
+        const shadows = [];
+        for (const agent of agents) {
+            const registered = this.matchRegisteredAgent(agent, registry);
+            if (registered) {
+                agent.status = 'registered';
+                agent.owner ??= registered.owner;
+                agent.did ??= registered.did;
+                continue;
+            }
+            agent.status = 'shadow';
+            const risk = this.scoreRisk(agent);
+            shadows.push({
+                agent,
+                risk,
+                recommendedActions: this.recommendActions(agent, risk),
+            });
+        }
+        return shadows.sort((left, right) => right.risk.score - left.risk.score);
+    }
+    walkDirectory(rootPath, currentPath, maxDepth, includeSourcePatterns, maxFileReadBytes, agents, errors) {
+        const relativeDepth = path_1.default.relative(rootPath, currentPath);
+        const depth = relativeDepth ? relativeDepth.split(path_1.default.sep).length : 0;
+        if (depth > maxDepth) {
+            return;
+        }
+        let entries;
+        try {
+            entries = (0, fs_1.readdirSync)(currentPath, { withFileTypes: true });
+        }
+        catch (error) {
+            errors.push(`Unable to read ${currentPath}: ${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        for (const entry of entries) {
+            // Skip symlinks entirely. `Dirent.isDirectory()` and `isFile()`
+            // describe the directory entry itself (not the symlink target), so
+            // the directory recursion below is already safe, but the downstream
+            // `readFileSync` calls in `scanConfigFile` / `scanContainerFile` /
+            // `scanSourceFile` follow symlinks. A symlink named (e.g.)
+            // `agentmesh.yaml` pointing at `/etc/passwd` would be opened and
+            // read; a symlink loop or a symlink to a large file would inflate the
+            // discovery cost without bound.
+            if (entry.isSymbolicLink()) {
+                continue;
+            }
+            const fullPath = path_1.default.join(currentPath, entry.name);
+            if (entry.isDirectory()) {
+                if (!SKIP_DIRS.has(entry.name)) {
+                    this.walkDirectory(rootPath, fullPath, maxDepth, includeSourcePatterns, maxFileReadBytes, agents, errors);
+                }
+                continue;
+            }
+            const relativePath = this.normalizePath(path_1.default.relative(rootPath, fullPath));
+            this.scanConfigFile(rootPath, fullPath, relativePath, entry.name, agents);
+            this.scanContainerFile(rootPath, fullPath, relativePath, entry.name, maxFileReadBytes, agents);
+            if (includeSourcePatterns) {
+                this.scanSourceFile(rootPath, fullPath, relativePath, entry.name, maxFileReadBytes, agents);
+            }
+        }
+    }
+    scanConfigFile(rootPath, fullPath, relativePath, fileName, agents) {
+        for (const config of CONFIG_PATTERNS) {
+            if (fileName === config.glob || relativePath.endsWith(config.glob)) {
+                const mergeKeys = { configPath: this.normalizePath(fullPath) };
+                this.addObservation(agents, {
+                    mergeKeys,
+                    name: `${config.type} agent at ${relativePath}`,
+                    agentType: config.type,
+                    description: `Configuration artifact found at ${relativePath}`,
+                    rootPath,
+                    tagKey: 'configFile',
+                    tagValue: relativePath,
+                    evidence: {
+                        scanner: 'config',
+                        basis: 'config_file',
+                        source: this.normalizePath(fullPath),
+                        detail: `Agent config file: ${fileName}`,
+                        rawData: { path: this.normalizePath(fullPath), type: config.type },
+                        confidence: config.confidence,
+                    },
+                });
+            }
+        }
+    }
+    scanContainerFile(rootPath, fullPath, relativePath, fileName, maxFileReadBytes, agents) {
+        if (!['Dockerfile', 'docker-compose.yml', 'docker-compose.yaml'].includes(fileName)) {
+            return;
+        }
+        const content = this.readTextSafely(fullPath, maxFileReadBytes);
+        if (!content) {
+            return;
+        }
+        for (const descriptor of DOCKER_AGENT_PATTERNS) {
+            const match = descriptor.pattern.exec(content);
+            if (!match) {
+                continue;
+            }
+            const mergeKeys = {
+                dockerPath: this.normalizePath(fullPath),
+                pattern: descriptor.type,
+            };
+            this.addObservation(agents, {
+                mergeKeys,
+                name: `Containerized ${descriptor.type} agent at ${relativePath}`,
+                agentType: descriptor.type,
+                description: `Container artifact references ${descriptor.type}`,
+                rootPath,
+                tagKey: 'dockerFile',
+                tagValue: relativePath,
+                evidence: {
+                    scanner: 'config',
+                    basis: 'container_reference',
+                    source: this.normalizePath(fullPath),
+                    detail: `Container file references ${match[0]}`,
+                    rawData: { file: this.normalizePath(fullPath), match: match[0] },
+                    confidence: descriptor.confidence,
+                },
+            });
+            break;
+        }
+    }
+    scanSourceFile(rootPath, fullPath, relativePath, fileName, maxFileReadBytes, agents) {
+        if (!SOURCE_EXTENSIONS.has(path_1.default.extname(fileName).toLowerCase())) {
+            return;
+        }
+        const content = this.readTextSafely(fullPath, maxFileReadBytes);
+        if (!content) {
+            return;
+        }
+        for (const descriptor of SOURCE_AGENT_PATTERNS) {
+            const match = descriptor.pattern.exec(content);
+            if (!match) {
+                continue;
+            }
+            const mergeKeys = {
+                sourcePath: this.normalizePath(fullPath),
+                pattern: descriptor.type,
+            };
+            this.addObservation(agents, {
+                mergeKeys,
+                name: `${descriptor.type} source integration at ${relativePath}`,
+                agentType: descriptor.type,
+                description: `Source pattern suggests a ${descriptor.type} agent integration`,
+                rootPath,
+                tagKey: 'sourceFile',
+                tagValue: relativePath,
+                evidence: {
+                    scanner: 'config',
+                    basis: 'source_pattern',
+                    source: this.normalizePath(fullPath),
+                    detail: `Source pattern match: ${match[0]}`,
+                    rawData: { file: this.normalizePath(fullPath), match: match[0] },
+                    confidence: descriptor.confidence,
+                },
+            });
+            break;
+        }
+    }
+    addObservation(agents, observation) {
+        const fingerprint = this.computeFingerprint(observation.mergeKeys);
+        const timestamp = new Date().toISOString();
+        const evidence = { ...observation.evidence, timestamp };
+        const existing = agents.get(fingerprint);
+        if (existing) {
+            existing.evidence.push(evidence);
+            existing.confidence = Math.max(existing.confidence, evidence.confidence);
+            existing.lastSeenAt = timestamp;
+            existing.tags[observation.tagKey] = observation.tagValue;
+            return;
+        }
+        agents.set(fingerprint, {
+            fingerprint,
+            name: observation.name,
+            agentType: observation.agentType,
+            description: observation.description,
+            status: 'unknown',
+            evidence: [evidence],
+            confidence: evidence.confidence,
+            mergeKeys: observation.mergeKeys,
+            firstSeenAt: timestamp,
+            lastSeenAt: timestamp,
+            tags: {
+                root: this.normalizePath(observation.rootPath),
+                [observation.tagKey]: observation.tagValue,
+            },
+        });
+    }
+    scoreRisk(agent) {
+        const factors = [];
+        let score = 0;
+        if (!agent.did) {
+            score += 30;
+            factors.push('No cryptographic identity (DID/SPIFFE)');
+        }
+        if (!agent.owner) {
+            score += 20;
+            factors.push('No assigned owner');
+        }
+        if (agent.status === 'shadow' || agent.status === 'unregistered') {
+            score += 20;
+            factors.push(`Agent status: ${agent.status}`);
+        }
+        if (HIGH_RISK_TYPES.has(agent.agentType)) {
+            score += 15;
+            factors.push(`High-risk agent type: ${agent.agentType}`);
+        }
+        else if (MEDIUM_RISK_TYPES.has(agent.agentType)) {
+            score += 10;
+            factors.push(`Medium-risk agent type: ${agent.agentType}`);
+        }
+        const daysSinceFirstSeen = Math.floor((Date.now() - new Date(agent.firstSeenAt).getTime()) / (24 * 60 * 60 * 1000));
+        if (daysSinceFirstSeen > 30) {
+            score += 10;
+            factors.push(`Ungoverned for ${daysSinceFirstSeen} days`);
+        }
+        else if (daysSinceFirstSeen > 7) {
+            score += 5;
+            factors.push(`Ungoverned for ${daysSinceFirstSeen} days`);
+        }
+        if (agent.confidence < 0.5) {
+            score -= 10;
+            factors.push('Low detection confidence');
+        }
+        const clampedScore = Math.max(0, Math.min(100, score));
+        return {
+            level: this.riskLevelForScore(clampedScore),
+            score: clampedScore,
+            factors,
+            assessedAt: new Date().toISOString(),
+        };
+    }
+    riskLevelForScore(score) {
+        if (score >= 75)
+            return 'critical';
+        if (score >= 50)
+            return 'high';
+        if (score >= 25)
+            return 'medium';
+        if (score >= 10)
+            return 'low';
+        return 'info';
+    }
+    recommendActions(agent, risk) {
+        const actions = [];
+        if (agent.confidence >= 0.8) {
+            actions.push('Register this agent with AgentMesh to establish governance identity.');
+        }
+        else {
+            actions.push('Investigate this artifact to confirm it is an active AI agent deployment.');
+        }
+        if (!agent.owner) {
+            actions.push('Assign an owner responsible for the agent lifecycle and policy posture.');
+        }
+        if (agent.agentType === 'mcp-server') {
+            actions.push('Run the MCP security scanner against this server definition before allowing production use.');
+        }
+        if (risk.level === 'critical' || risk.level === 'high') {
+            actions.push('Apply deny-by-default policy, execution ring limits, and kill-switch coverage before activation.');
+        }
+        else {
+            actions.push('Review capabilities and apply least-privilege policies before onboarding.');
+        }
+        return actions;
+    }
+    matchRegisteredAgent(agent, registry) {
+        return registry.find((registered) => {
+            if (agent.did && registered.did === agent.did) {
+                return true;
+            }
+            if (registered.fingerprint && registered.fingerprint === agent.fingerprint) {
+                return true;
+            }
+            if (registered.configPath) {
+                const registeredPath = this.normalizePath(path_1.default.resolve(registered.configPath));
+                if (Object.values(agent.mergeKeys).some((value) => this.normalizePath(value) === registeredPath)) {
+                    return true;
+                }
+            }
+            if (registered.name && agent.name.toLowerCase().includes(registered.name.toLowerCase())) {
+                return true;
+            }
+            return false;
+        });
+    }
+    readTextSafely(filePath, maxFileReadBytes) {
+        try {
+            return (0, fs_1.readFileSync)(filePath).subarray(0, maxFileReadBytes).toString('utf-8');
+        }
+        catch {
+            return undefined;
+        }
+    }
+    computeFingerprint(mergeKeys) {
+        const canonical = Object.entries(mergeKeys)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, value]) => `${key}=${this.normalizePath(value)}`)
+            .join('|');
+        return (0, crypto_1.createHash)('sha256').update(canonical).digest('hex').slice(0, 16);
+    }
+    normalizePath(value) {
+        return value.replace(/\\/g, '/');
+    }
+}
+exports.ShadowDiscovery = ShadowDiscovery;
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;;;;AAElC,mCAAoC;AACpC,2BAAyD;AACzD,gDAAwB;AAmFxB,MAAM,eAAe,GAAoB;IACvC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IACzD,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IACxD,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IACjE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;IAC/D,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE;IACxD,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE;IACvD,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE;IAC1D,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE;IACjE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE;IAClE,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE;IAC3E,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE;IAC5E,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,EAAE;CAC5E,CAAC;AAEF,MAAM,qBAAqB,GAAqB;IAC9C,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE;IACvE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE;IACvD,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE;IACzD,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;IAC1E,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE;IACnE,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE;CAC7E,CAAC;AAEF,MAAM,qBAAqB,GAAqB;IAC9C,EAAE,OAAO,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE;IACxE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;IACxD,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE;IAC9E,EAAE,OAAO,EAAE,gCAAgC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE;IAC3E,EAAE,OAAO,EAAE,uCAAuC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE;IACzF,EAAE,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE;CAC9E,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,cAAc;IACd,aAAa;IACb,OAAO;IACP,MAAM;IACN,MAAM;IACN,aAAa;IACb,eAAe;IACf,MAAM;IACN,OAAO;IACP,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;AACrF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC;AACtF,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,MAAa,eAAe;IACG;IAA7B,YAA6B,mBAA4C,EAAE;QAA9C,qBAAgB,GAAhB,gBAAgB,CAA8B;IAAG,CAAC;IAE/E,IAAI,CAAC,OAA+B;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QACxC,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,IAAI,CAAC;QACpE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,2BAA2B,CAAC;QAEjF,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,CAAC,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;oBAC5C,SAAS;gBACX,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,oBAAoB,QAAQ,EAAE,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5G,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC3D,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAEhE,OAAO;YACL,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAClF,YAAY;YACZ,MAAM;YACN,SAAS;YACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YACpC,UAAU,EAAE,gBAAgB,CAAC,MAAM;SACpC,CAAC;IACJ,CAAC;IAED,SAAS,CACP,MAAyB,EACzB,WAAoC,IAAI,CAAC,gBAAgB;QAEzD,MAAM,OAAO,GAAwB,EAAE,CAAC;QAExC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC9D,IAAI,UAAU,EAAE,CAAC;gBACf,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC;gBAC5B,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,CAAC;gBACjC,KAAK,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC;gBAC7B,SAAS;YACX,CAAC;YAED,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK;gBACL,IAAI;gBACJ,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IAEO,aAAa,CACnB,QAAgB,EAChB,WAAmB,EACnB,QAAgB,EAChB,qBAA8B,EAC9B,gBAAwB,EACxB,MAAoC,EACpC,MAAgB;QAEhB,MAAM,aAAa,GAAG,cAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,cAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,IAAA,gBAAW,EAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,kBAAkB,WAAW,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,gEAAgE;YAChE,mEAAmE;YACnE,oEAAoE;YACpE,mEAAmE;YACnE,2DAA2D;YAC3D,iEAAiE;YACjE,sEAAsE;YACtE,gCAAgC;YAChC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC5G,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,cAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC3E,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAE/F,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;IACH,CAAC;IAEO,cAAc,CACpB,QAAgB,EAChB,QAAgB,EAChB,YAAoB,EACpB,QAAgB,EAChB,MAAoC;QAEpC,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,QAAQ,KAAK,MAAM,CAAC,IAAI,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnE,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;oBAC1B,SAAS;oBACT,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,aAAa,YAAY,EAAE;oBAC/C,SAAS,EAAE,MAAM,CAAC,IAAI;oBACtB,WAAW,EAAE,mCAAmC,YAAY,EAAE;oBAC9D,QAAQ;oBACR,MAAM,EAAE,YAAY;oBACpB,QAAQ,EAAE,YAAY;oBACtB,QAAQ,EAAE;wBACR,OAAO,EAAE,QAAQ;wBACjB,KAAK,EAAE,aAAa;wBACpB,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;wBACpC,MAAM,EAAE,sBAAsB,QAAQ,EAAE;wBACxC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;wBAClE,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,iBAAiB,CACvB,QAAgB,EAChB,QAAgB,EAChB,YAAoB,EACpB,QAAgB,EAChB,gBAAwB,EACxB,MAAoC;QAEpC,IAAI,CAAC,CAAC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpF,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,qBAAqB,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG;gBAChB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;gBACxC,OAAO,EAAE,UAAU,CAAC,IAAI;aACzB,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;gBAC1B,SAAS;gBACT,IAAI,EAAE,iBAAiB,UAAU,CAAC,IAAI,aAAa,YAAY,EAAE;gBACjE,SAAS,EAAE,UAAU,CAAC,IAAI;gBAC1B,WAAW,EAAE,iCAAiC,UAAU,CAAC,IAAI,EAAE;gBAC/D,QAAQ;gBACR,MAAM,EAAE,YAAY;gBACpB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE;oBACR,OAAO,EAAE,QAAQ;oBACjB,KAAK,EAAE,qBAAqB;oBAC5B,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;oBACpC,MAAM,EAAE,6BAA6B,KAAK,CAAC,CAAC,CAAC,EAAE;oBAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;oBAChE,UAAU,EAAE,UAAU,CAAC,UAAU;iBAClC;aACF,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IAEO,cAAc,CACpB,QAAgB,EAChB,QAAgB,EAChB,YAAoB,EACpB,QAAgB,EAChB,gBAAwB,EACxB,MAAoC;QAEpC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,qBAAqB,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAAG;gBAChB,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;gBACxC,OAAO,EAAE,UAAU,CAAC,IAAI;aACzB,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE;gBAC1B,SAAS;gBACT,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,0BAA0B,YAAY,EAAE;gBAChE,SAAS,EAAE,UAAU,CAAC,IAAI;gBAC1B,WAAW,EAAE,6BAA6B,UAAU,CAAC,IAAI,oBAAoB;gBAC7E,QAAQ;gBACR,MAAM,EAAE,YAAY;gBACpB,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE;oBACR,OAAO,EAAE,QAAQ;oBACjB,KAAK,EAAE,gBAAgB;oBACvB,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;oBACpC,MAAM,EAAE,yBAAyB,KAAK,CAAC,CAAC,CAAC,EAAE;oBAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE;oBAChE,UAAU,EAAE,UAAU,CAAC,UAAU;iBAClC;aACF,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;IAEO,cAAc,CACpB,MAAoC,EACpC,WASC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAsB,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEzC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACzE,QAAQ,CAAC,UAAU,GAAG,SAAS,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;YACtB,WAAW;YACX,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC,QAAQ,CAAC;YACpB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,WAAW,EAAE,SAAS;YACtB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC;gBAC9C,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,QAAQ;aAC3C;SACF,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,KAAsB;QACtC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACf,KAAK,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,KAAK,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACjE,KAAK,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,KAAK,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,KAAK,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,2BAA2B,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CACnC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAC7E,CAAC;QACF,IAAI,kBAAkB,GAAG,EAAE,EAAE,CAAC;YAC5B,KAAK,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,kBAAkB,kBAAkB,OAAO,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;YAClC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,kBAAkB,kBAAkB,OAAO,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAC3B,KAAK,IAAI,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACvD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;YAC3C,KAAK,EAAE,YAAY;YACnB,OAAO;YACP,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,KAAa;QACrC,IAAI,KAAK,IAAI,EAAE;YAAE,OAAO,UAAU,CAAC;QACnC,IAAI,KAAK,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC;QAC/B,IAAI,KAAK,IAAI,EAAE;YAAE,OAAO,QAAQ,CAAC;QACjC,IAAI,KAAK,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,KAAsB,EAAE,IAA6B;QAC5E,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;QAC9G,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QACnH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,oBAAoB,CAC1B,KAAsB,EACtB,QAAiC;QAEjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;YAClC,IAAI,KAAK,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC3E,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC/E,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC,EAAE,CAAC;oBACjG,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAED,IAAI,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACxF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,QAAgB,EAAE,gBAAwB;QAC/D,IAAI,CAAC;YACH,OAAO,IAAA,iBAAY,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,SAAiC;QAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;aACxC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;aAC5D,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;CACF;AA3aD,0CA2aC"}

package/dist/encryption/channel.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SecureChannel — high-level E2E encrypted agent-to-agent messaging.
+ *
+ * Spec: docs/specs/AGENTMESH-WIRE-1.0.md Section 9
+ */
+import { EncryptedMessage } from "./ratchet";
+import { X3DHKeyManager, PreKeyBundle } from "./x3dh";
+export interface ChannelEstablishment {
+    initiatorIdentityKey: Uint8Array;
+    ephemeralPublicKey: Uint8Array;
+    usedOneTimeKeyId?: number;
+}
+export declare class SecureChannel {
+    private ratchet;
+    private associatedData;
+    private closed;
+    private msgCount;
+    readonly localIdentityKey: Uint8Array;
+    readonly remoteIdentityKey: Uint8Array;
+    private constructor();
+    static createSender(keyManager: X3DHKeyManager, peerBundle: PreKeyBundle, associatedData?: Uint8Array): [SecureChannel, ChannelEstablishment];
+    static createReceiver(keyManager: X3DHKeyManager, establishment: ChannelEstablishment, associatedData?: Uint8Array): SecureChannel;
+    send(plaintext: Uint8Array): EncryptedMessage;
+    receive(message: EncryptedMessage): Uint8Array;
+    close(): void;
+    get isClosed(): boolean;
+    get messageCount(): number;
+}
+//# sourceMappingURL=channel.d.ts.map

package/dist/encryption/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../src/encryption/channel.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,OAAO,EAAiB,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtD,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,EAAE,UAAU,CAAC;IACjC,kBAAkB,EAAE,UAAU,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAK;IACrB,SAAgB,gBAAgB,EAAE,UAAU,CAAC;IAC7C,SAAgB,iBAAiB,EAAE,UAAU,CAAC;IAE9C,OAAO;IAYP,MAAM,CAAC,YAAY,CACjB,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,YAAY,EACxB,cAAc,GAAE,UAA6B,GAC5C,CAAC,aAAa,EAAE,oBAAoB,CAAC;IA2BxC,MAAM,CAAC,cAAc,CACnB,UAAU,EAAE,cAAc,EAC1B,aAAa,EAAE,oBAAoB,EACnC,cAAc,GAAE,UAA6B,GAC5C,aAAa;IA4BhB,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,gBAAgB;IAO7C,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU;IAO9C,KAAK,IAAI,IAAI;IAIb,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,IAAI,YAAY,IAAI,MAAM,CAEzB;CACF"}

package/dist/encryption/channel.js

@@ -0,0 +1,78 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureChannel = void 0;
+/**
+ * SecureChannel — high-level E2E encrypted agent-to-agent messaging.
+ *
+ * Spec: docs/specs/AGENTMESH-WIRE-1.0.md Section 9
+ */
+const ratchet_1 = require("./ratchet");
+class SecureChannel {
+    ratchet;
+    associatedData;
+    closed = false;
+    msgCount = 0;
+    localIdentityKey;
+    remoteIdentityKey;
+    constructor(ratchet, associatedData, localIK, remoteIK) {
+        this.ratchet = ratchet;
+        this.associatedData = associatedData;
+        this.localIdentityKey = localIK;
+        this.remoteIdentityKey = remoteIK;
+    }
+    static createSender(keyManager, peerBundle, associatedData = new Uint8Array()) {
+        const x3dhResult = keyManager.initiate(peerBundle);
+        const ratchet = ratchet_1.DoubleRatchet.initSender(x3dhResult.sharedSecret, peerBundle.signedPreKey);
+        const ad = new Uint8Array(associatedData.length + x3dhResult.associatedData.length);
+        ad.set(associatedData, 0);
+        ad.set(x3dhResult.associatedData, associatedData.length);
+        const establishment = {
+            initiatorIdentityKey: keyManager.identityKey.publicKey,
+            ephemeralPublicKey: x3dhResult.ephemeralPublicKey,
+            usedOneTimeKeyId: x3dhResult.usedOneTimeKeyId,
+        };
+        const channel = new SecureChannel(ratchet, ad, keyManager.identityKey.publicKey, peerBundle.identityKey);
+        return [channel, establishment];
+    }
+    static createReceiver(keyManager, establishment, associatedData = new Uint8Array()) {
+        if (!keyManager.signedPreKey) {
+            throw new Error("Responder must have a signed pre-key.");
+        }
+        const x3dhResult = keyManager.respond(establishment.initiatorIdentityKey, establishment.ephemeralPublicKey, establishment.usedOneTimeKeyId);
+        const ratchet = ratchet_1.DoubleRatchet.initReceiver(x3dhResult.sharedSecret, {
+            privateKey: keyManager.signedPreKey.keyPair.privateKey,
+            publicKey: keyManager.signedPreKey.keyPair.publicKey,
+        });
+        const ad = new Uint8Array(associatedData.length + x3dhResult.associatedData.length);
+        ad.set(associatedData, 0);
+        ad.set(x3dhResult.associatedData, associatedData.length);
+        return new SecureChannel(ratchet, ad, keyManager.identityKey.publicKey, establishment.initiatorIdentityKey);
+    }
+    send(plaintext) {
+        if (this.closed)
+            throw new Error("Channel is closed.");
+        const msg = this.ratchet.encrypt(plaintext, this.associatedData);
+        this.msgCount++;
+        return msg;
+    }
+    receive(message) {
+        if (this.closed)
+            throw new Error("Channel is closed.");
+        const pt = this.ratchet.decrypt(message, this.associatedData);
+        this.msgCount++;
+        return pt;
+    }
+    close() {
+        this.closed = true;
+    }
+    get isClosed() {
+        return this.closed;
+    }
+    get messageCount() {
+        return this.msgCount;
+    }
+}
+exports.SecureChannel = SecureChannel;
+//# sourceMappingURL=channel.js.map

package/dist/encryption/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../../src/encryption/channel.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC;;;;GAIG;AAEH,uCAA4D;AAS5D,MAAa,aAAa;IAChB,OAAO,CAAgB;IACvB,cAAc,CAAa;IAC3B,MAAM,GAAG,KAAK,CAAC;IACf,QAAQ,GAAG,CAAC,CAAC;IACL,gBAAgB,CAAa;IAC7B,iBAAiB,CAAa;IAE9C,YACE,OAAsB,EACtB,cAA0B,EAC1B,OAAmB,EACnB,QAAoB;QAEpB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC;QAChC,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,UAA0B,EAC1B,UAAwB,EACxB,iBAA6B,IAAI,UAAU,EAAE;QAE7C,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,uBAAa,CAAC,UAAU,CACtC,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,YAAY,CACxB,CAAC;QAEF,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACpF,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAC1B,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEzD,MAAM,aAAa,GAAyB;YAC1C,oBAAoB,EAAE,UAAU,CAAC,WAAW,CAAC,SAAS;YACtD,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;YACjD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;SAC9C,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,aAAa,CAC/B,OAAO,EACP,EAAE,EACF,UAAU,CAAC,WAAW,CAAC,SAAS,EAChC,UAAU,CAAC,WAAW,CACvB,CAAC;QACF,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,UAA0B,EAC1B,aAAmC,EACnC,iBAA6B,IAAI,UAAU,EAAE;QAE7C,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CACnC,aAAa,CAAC,oBAAoB,EAClC,aAAa,CAAC,kBAAkB,EAChC,aAAa,CAAC,gBAAgB,CAC/B,CAAC;QAEF,MAAM,OAAO,GAAG,uBAAa,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,EAAE;YAClE,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU;YACtD,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS;SACrD,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACpF,EAAE,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QAC1B,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAEzD,OAAO,IAAI,aAAa,CACtB,OAAO,EACP,EAAE,EACF,UAAU,CAAC,WAAW,CAAC,SAAS,EAChC,aAAa,CAAC,oBAAoB,CACnC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,SAAqB;QACxB,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,CAAC,OAAyB;QAC/B,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACvD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AA5GD,sCA4GC"}

package/dist/encryption/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * E2E encryption primitives for agent-to-agent secure messaging.
+ */
+export { X3DHKeyManager, generateX25519KeyPair, ed25519ToX25519, type X25519KeyPair, type PreKeyBundle, type X3DHResult, } from "./x3dh";
+export { DoubleRatchet, type MessageHeader, type EncryptedMessage, type RatchetState, } from "./ratchet";
+export { SecureChannel, type ChannelEstablishment, } from "./channel";
+export { MeshClient, type MeshClientOptions, type MeshSession, type WebSocketFactory, } from "./mesh-client";
+export { RegistryClient, RegistryError, ed25519AuthSigner, type RegistryClientOptions, type AgentRecord, type DiscoverResult, } from "./registry-client";
+//# sourceMappingURL=index.d.ts.map

package/dist/encryption/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/encryption/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,GAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,aAAa,EACb,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC"}

package/dist/encryption/index.js

@@ -0,0 +1,23 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ed25519AuthSigner = exports.RegistryError = exports.RegistryClient = exports.MeshClient = exports.SecureChannel = exports.DoubleRatchet = exports.ed25519ToX25519 = exports.generateX25519KeyPair = exports.X3DHKeyManager = void 0;
+/**
+ * E2E encryption primitives for agent-to-agent secure messaging.
+ */
+var x3dh_1 = require("./x3dh");
+Object.defineProperty(exports, "X3DHKeyManager", { enumerable: true, get: function () { return x3dh_1.X3DHKeyManager; } });
+Object.defineProperty(exports, "generateX25519KeyPair", { enumerable: true, get: function () { return x3dh_1.generateX25519KeyPair; } });
+Object.defineProperty(exports, "ed25519ToX25519", { enumerable: true, get: function () { return x3dh_1.ed25519ToX25519; } });
+var ratchet_1 = require("./ratchet");
+Object.defineProperty(exports, "DoubleRatchet", { enumerable: true, get: function () { return ratchet_1.DoubleRatchet; } });
+var channel_1 = require("./channel");
+Object.defineProperty(exports, "SecureChannel", { enumerable: true, get: function () { return channel_1.SecureChannel; } });
+var mesh_client_1 = require("./mesh-client");
+Object.defineProperty(exports, "MeshClient", { enumerable: true, get: function () { return mesh_client_1.MeshClient; } });
+var registry_client_1 = require("./registry-client");
+Object.defineProperty(exports, "RegistryClient", { enumerable: true, get: function () { return registry_client_1.RegistryClient; } });
+Object.defineProperty(exports, "RegistryError", { enumerable: true, get: function () { return registry_client_1.RegistryError; } });
+Object.defineProperty(exports, "ed25519AuthSigner", { enumerable: true, get: function () { return registry_client_1.ed25519AuthSigner; } });
+//# sourceMappingURL=index.js.map

package/dist/encryption/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/encryption/index.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC;;GAEG;AAEH,+BAOgB;AANd,sGAAA,cAAc,OAAA;AACd,6GAAA,qBAAqB,OAAA;AACrB,uGAAA,eAAe,OAAA;AAMjB,qCAKmB;AAJjB,wGAAA,aAAa,OAAA;AAMf,qCAGmB;AAFjB,wGAAA,aAAa,OAAA;AAIf,6CAKuB;AAJrB,yGAAA,UAAU,OAAA;AAMZ,qDAO2B;AANzB,iHAAA,cAAc,OAAA;AACd,gHAAA,aAAa,OAAA;AACb,oHAAA,iBAAiB,OAAA"}