@policystrata/agent-trust-gateway 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Raintree Technology
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,88 @@
+# PolicyStrata Agent Trust Gateway
+
+Customer-hosted runtime gateway for governed-data agents. The gateway evaluates redacted runtime
+events locally with `policystrata/runtime`, blocks deny/quarantine/approval-required decisions in
+enforce mode, and uploads only decision envelopes to the PolicyStrata control plane by default.
+It is an application-side enforcement and telemetry helper, not a replacement for `policystrata
+scan`, `policystrata doctor`, application authorization, or database controls.
+
+```bash
+npm install @policystrata/agent-trust-gateway
+```
+
+```bash
+agent-trust-gateway serve --manifest runtime-manifest.json --port 8787 \
+  --api-url https://policystrata.example
+```
+
+Loopback bindings are intended for same-host sidecars. If you bind beyond
+loopback, set `POLICYSTRATA_GATEWAY_TOKEN` or pass `--gateway-token`; callers
+must send `authorization: Bearer <token>` to `/v1/decide`.
+
+POST one event or `{ "events": [...] }` to `/v1/decide`:
+
+```bash
+curl -s http://127.0.0.1:8787/v1/decide \
+  -H 'content-type: application/json' \
+  --data @runtime-event.json
+```
+
+The same evaluator is available in-process:
+
+```ts
+import { decideRuntimeEvent } from "@policystrata/agent-trust-gateway";
+
+const result = decideRuntimeEvent(runtimeManifest, runtimeEvent);
+if (!result.ok) {
+  throw new Error(result.decisions.map((decision) => decision.reason).join("; "));
+}
+```
+
+## Runtime Modes
+
+Use `enforce` for production gates that should fail closed on deny, quarantine, or approval-required
+decisions. Use `shadow` to observe decisions without blocking the caller. For tenant, PII, SQL,
+egress, and tool controls, production examples should default to fail-closed behavior and rely on
+explicit approvals or allowlists for exceptions.
+
+The evaluator supports:
+
+- auth-context required fields
+- retrieval tenant and entitlement checks
+- SQL tenant predicate detection, query-risk classification, and row-limit checks
+- RLS drift events through the `database_rule` layer
+- runtime kill-switch deny behavior
+- memory tenant isolation
+- egress destination allowlists, approval requirements, and destination classes
+- data-class deny/redaction policies
+
+See `docs/runtime-controls.md` for PII, MCP schema, browser action, code execution, human approval,
+and kill-switch event examples.
+See `docs/gateway-deployment-examples.md` for generic Docker, Terraform, and Helm deployment
+sketches that avoid hosted-app assumptions.
+
+## Upload Boundary
+
+`payload` is stripped before upload unless `includePayload` or `--include-payload` is set.
+Fixture-only `expectedDecision` metadata is always stripped before upload. Keep raw prompts, rows,
+documents, tool payloads, connector payloads, and test expectations local; send hashes, witness
+refs, policy refs, redaction classes, query risk, and the runtime decision envelope to the control
+plane.
+
+Uploads fail closed by default if the redacted envelope still contains sensitive field names or
+common secret/PII value patterns in summaries, refs, or other metadata. Use
+`allowBoundaryViolations` only for local negative tests.
+
+Uploads send `x-clearance-organization-id` and the legacy
+`x-assurance-organization-id` header while hosted control planes migrate. Uploads also support an
+idempotency key and enforce a 1 MB default upload-body limit before opening the network request.
+
+## Deployment Guidance
+
+Keep the gateway close to the application or agent runtime. For production:
+
+- bind to loopback or require a gateway token for non-loopback bindings;
+- terminate TLS and rate-limit requests at the platform edge, service mesh, or reverse proxy;
+- keep request bodies small and metadata-only;
+- default tenant, PII, SQL, egress, and tool controls to fail closed;
+- use `shadow` mode only while validating policy coverage before an enforcement rollout.

package/dist/src/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/src/cli.js

@@ -0,0 +1,140 @@
+#!/usr/bin/env node
+import { readFile, writeFile } from "node:fs/promises";
+import { decideRuntimePayload, startAgentTrustGateway, } from "./index.js";
+async function main(argv) {
+    const command = argv[0];
+    const flags = parseFlags(argv.slice(1));
+    if (!command || flags.help === true || flags.h === true) {
+        printHelp();
+        return command ? 0 : 2;
+    }
+    if (command === "decide") {
+        const manifest = await readJson(requiredString(flags, "manifest"));
+        const eventPayload = await readJson(requiredString(flags, "event"));
+        const mode = modeFlag(flags);
+        const result = decideRuntimePayload(manifest, eventPayload, mode);
+        const body = `${JSON.stringify(result, null, 2)}\n`;
+        const out = optionalString(flags, "out");
+        if (out) {
+            await writeFile(out, body, "utf8");
+        }
+        else {
+            process.stdout.write(body);
+        }
+        return result.ok || mode === "shadow" ? 0 : 1;
+    }
+    if (command === "serve") {
+        const manifest = await readJson(requiredString(flags, "manifest"));
+        const upload = uploadOptions(flags);
+        const gateway = await startAgentTrustGateway({
+            manifest,
+            host: optionalString(flags, "host"),
+            port: numberFlag(flags, "port") ?? 8787,
+            mode: modeFlag(flags),
+            upload,
+            gatewayToken: optionalString(flags, "gateway-token") ?? process.env.POLICYSTRATA_GATEWAY_TOKEN,
+            failOnUploadError: flags["fail-on-upload-error"] === true,
+        });
+        process.stderr.write(`PolicyStrata Agent Trust Gateway listening at ${gateway.url}\n`);
+        await waitForShutdown(gateway.close);
+        return 0;
+    }
+    throw new Error(`unknown command: ${command}`);
+}
+function parseFlags(argv) {
+    const flags = {};
+    for (let index = 0; index < argv.length; index += 1) {
+        const item = argv[index];
+        if (!item.startsWith("--")) {
+            throw new Error(`unexpected argument: ${item}`);
+        }
+        const key = item.slice(2);
+        const next = argv[index + 1];
+        if (!next || next.startsWith("--")) {
+            flags[key] = true;
+            continue;
+        }
+        flags[key] = next;
+        index += 1;
+    }
+    return flags;
+}
+function uploadOptions(flags) {
+    const apiUrl = optionalString(flags, "api-url");
+    if (!apiUrl)
+        return undefined;
+    return {
+        apiUrl,
+        token: optionalString(flags, "token") ?? process.env.POLICYSTRATA_CONTROL_PLANE_TOKEN,
+        organizationId: optionalString(flags, "organization-id"),
+        includePayload: flags["include-payload"] === true,
+    };
+}
+function modeFlag(flags) {
+    if (flags.shadow === true)
+        return "shadow";
+    const raw = optionalString(flags, "mode");
+    if (raw === "shadow" || raw === "enforce")
+        return raw;
+    if (raw) {
+        throw new Error("--mode must be shadow or enforce");
+    }
+    return "enforce";
+}
+function numberFlag(flags, key) {
+    const raw = optionalString(flags, key);
+    if (!raw)
+        return undefined;
+    const parsed = Number(raw);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new Error(`--${key} must be a non-negative integer`);
+    }
+    return parsed;
+}
+function requiredString(flags, key) {
+    const value = optionalString(flags, key);
+    if (!value) {
+        throw new Error(`missing --${key}`);
+    }
+    return value;
+}
+function optionalString(flags, key) {
+    const value = flags[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+async function readJson(path) {
+    return JSON.parse(await readFile(path, "utf8"));
+}
+function waitForShutdown(close) {
+    return new Promise((resolve, reject) => {
+        const stop = () => {
+            close().then(resolve, reject);
+        };
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+    });
+}
+function printHelp() {
+    process.stdout.write(`PolicyStrata Agent Trust Gateway
+
+Usage:
+  agent-trust-gateway decide --manifest manifest.json --event event.json [--out decisions.json] [--mode enforce|shadow]
+  agent-trust-gateway serve --manifest manifest.json [--host 127.0.0.1] [--port 8787] [--api-url http://localhost:3000]
+
+Options:
+  --shadow                    Alias for --mode shadow.
+  --api-url                   PolicyStrata control-plane base URL for redacted event uploads.
+  --token                     Control-plane bearer token. Defaults to POLICYSTRATA_CONTROL_PLANE_TOKEN.
+  --organization-id           Optional organization header for the control plane.
+  --include-payload           Upload event payloads instead of stripping them. Off by default.
+  --gateway-token             Bearer token required by /v1/decide. Defaults to POLICYSTRATA_GATEWAY_TOKEN.
+  --fail-on-upload-error      Return 502 when the control-plane upload fails.
+`);
+}
+main(process.argv.slice(2)).then((code) => {
+    process.exitCode = code;
+}, (error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/src/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GAGvB,MAAM,YAAY,CAAC;AAKpB,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,SAAS,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAA8B,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAChG,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAU,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACpD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAA8B,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;YAC3C,QAAQ;YACR,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;YACnC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI;YACvC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC;YACrB,MAAM;YACN,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B;YAC9F,iBAAiB,EAAE,KAAK,CAAC,sBAAsB,CAAC,KAAK,IAAI;SAC1D,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACvF,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAClB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QAClB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAY;IACjC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO;QACL,MAAM;QACN,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,gCAAgC;QACrF,cAAc,EAAE,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC;QACxD,cAAc,EAAE,KAAK,CAAC,iBAAiB,CAAC,KAAK,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAY;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,KAAY,EAAE,GAAW;IAC3C,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,KAAK,GAAG,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAY,EAAE,GAAW;IAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAY,EAAE,GAAW;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,IAAY;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,KAA0B;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,KAAK,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;CActB,CAAC,CAAC;AACH,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE;IACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CACF,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,85 @@
+import { type IncomingMessage, type Server, type ServerResponse } from "node:http";
+import { type PolicyStrataRuntimeEventDecision, type PolicyStrataRuntimeEventEvaluation, type PolicyStrataRuntimeEventInput, type PolicyStrataRuntimeManifest } from "policystrata/runtime";
+export declare const POLICYSTRATA_GATEWAY_VERSION = "0.1.1";
+export type AgentTrustGatewayMode = "shadow" | "enforce";
+export interface RuntimeEventBatchPayload {
+    events: readonly PolicyStrataRuntimeEventInput[];
+}
+export type NativeIntegrationProvider = "github" | "vercel" | "datadog" | "snowflake" | "slack" | "jira" | "aws" | "gcp" | "azure";
+export interface NativeIntegrationEvidenceInput {
+    provider: NativeIntegrationProvider;
+    project: string;
+    connectionId: string;
+    eventType?: string;
+    observedAt?: string;
+    decision?: PolicyStrataRuntimeEventDecision["action"];
+    summary?: string;
+    evidenceRefs?: readonly string[];
+    payload?: Record<string, unknown>;
+}
+export type RuntimeEventPayload = PolicyStrataRuntimeEventInput | RuntimeEventBatchPayload;
+export type RuntimeEventWithDecision = PolicyStrataRuntimeEventInput & {
+    decision: PolicyStrataRuntimeEventDecision;
+};
+export interface GatewayDecisionResult {
+    ok: boolean;
+    mode: AgentTrustGatewayMode;
+    events: RuntimeEventWithDecision[];
+    decisions: PolicyStrataRuntimeEventEvaluation[];
+}
+export interface RuntimeEventUploadOptions {
+    apiUrl: string;
+    token?: string;
+    organizationId?: string;
+    path?: string;
+    idempotencyKey?: string;
+    maxBodyBytes?: number;
+    includePayload?: boolean;
+    allowBoundaryViolations?: boolean;
+    fetch?: typeof fetch;
+}
+export interface RuntimeEventUploadResult {
+    ok: boolean;
+    status: number;
+    body: unknown;
+}
+export interface AgentTrustGatewayOptions {
+    manifest: PolicyStrataRuntimeManifest;
+    mode?: AgentTrustGatewayMode;
+    upload?: RuntimeEventUploadOptions;
+    gatewayToken?: string;
+    failOnUploadError?: boolean;
+    maxBodyBytes?: number;
+}
+export interface StartedAgentTrustGateway {
+    server: Server;
+    url: string;
+    close(): Promise<void>;
+}
+export interface MetadataBoundaryFinding {
+    path: string;
+    reason: string;
+    severity: "high" | "critical";
+}
+export declare class PolicyStrataGatewayBlockedError extends Error {
+    readonly result: GatewayDecisionResult;
+    constructor(result: GatewayDecisionResult);
+}
+export declare function nativeIntegrationRuntimeEvent(input: NativeIntegrationEvidenceInput): PolicyStrataRuntimeEventInput;
+export declare function decideRuntimeEvent(manifest: PolicyStrataRuntimeManifest, event: PolicyStrataRuntimeEventInput, mode?: AgentTrustGatewayMode): GatewayDecisionResult;
+export declare function decideRuntimeEvents(manifest: PolicyStrataRuntimeManifest, events: readonly PolicyStrataRuntimeEventInput[], mode?: AgentTrustGatewayMode): GatewayDecisionResult;
+export declare function decideRuntimePayload(manifest: PolicyStrataRuntimeManifest, payload: unknown, mode?: AgentTrustGatewayMode): GatewayDecisionResult;
+export declare function guardRuntimePayload(manifest: PolicyStrataRuntimeManifest, payload: unknown, mode?: AgentTrustGatewayMode): Promise<GatewayDecisionResult>;
+export declare function runtimeEventsFromPayload(payload: unknown): PolicyStrataRuntimeEventInput[];
+export declare function redactRuntimeEventForUpload(event: RuntimeEventWithDecision): RuntimeEventWithDecision;
+export declare function scanMetadataBoundary(payload: unknown): MetadataBoundaryFinding[];
+export declare function assertMetadataBoundary(payload: unknown): void;
+export declare function uploadRuntimeEvents(options: RuntimeEventUploadOptions & {
+    events: readonly RuntimeEventWithDecision[];
+}): Promise<RuntimeEventUploadResult>;
+export declare function createAgentTrustGatewayHandler(options: AgentTrustGatewayOptions): (request: IncomingMessage, response: ServerResponse) => void;
+export declare function createAgentTrustGatewayServer(options: AgentTrustGatewayOptions): Server;
+export declare function startAgentTrustGateway(options: AgentTrustGatewayOptions & {
+    host?: string;
+    port?: number;
+}): Promise<StartedAgentTrustGateway>;

package/dist/src/index.js

@@ -0,0 +1,410 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { evaluateRuntimeEvent, evaluateRuntimeEvents, } from "policystrata/runtime";
+export const POLICYSTRATA_GATEWAY_VERSION = "0.1.1";
+export class PolicyStrataGatewayBlockedError extends Error {
+    result;
+    constructor(result) {
+        super(result.decisions.map((decision) => decision.reason).join("; ") || "runtime policy blocked event");
+        this.name = "PolicyStrataGatewayBlockedError";
+        this.result = result;
+    }
+}
+export function nativeIntegrationRuntimeEvent(input) {
+    const eventType = input.eventType ?? defaultIntegrationEventType(input.provider);
+    const evidenceRefs = input.evidenceRefs ?? [`integration://${input.provider}/${input.connectionId}`];
+    const payload = {
+        storageMode: "metadata_only",
+        provider: input.provider,
+        connectionId: input.connectionId,
+        ...(input.payload ?? {}),
+    };
+    return {
+        schemaVersion: "0.2.0",
+        eventId: `integration-${input.provider}-${input.connectionId}-${sha256Json(payload).slice(0, 16)}`,
+        project: input.project,
+        observedAt: input.observedAt ?? new Date().toISOString(),
+        agent: {
+            key: `${input.provider}-integration`,
+            name: `${input.provider} integration`,
+            kind: "integration",
+        },
+        layer: defaultIntegrationLayer(input.provider),
+        operation: eventType,
+        summary: input.summary ?? `${input.provider} evidence synchronized for ${input.project}`,
+        decision: {
+            action: input.decision ?? defaultIntegrationDecision(input.provider),
+            reason: `${input.provider} provider evidence`,
+            control: {
+                id: `${input.provider}.native_integration`,
+                mode: "release_gate",
+                objective: "Use native provider evidence in Clearance gates",
+            },
+        },
+        provider: input.provider,
+        integrationConnectionId: input.connectionId,
+        externalRefs: evidenceRefs.map((ref) => ({
+            provider: input.provider,
+            ref,
+            kind: "evidence",
+            connectionId: input.connectionId,
+        })),
+        artifactRefs: [...evidenceRefs],
+        payloadHash: sha256Json(payload),
+    };
+}
+export function decideRuntimeEvent(manifest, event, mode = "enforce") {
+    const decision = evaluateRuntimeEvent(manifest, event);
+    return decisionResult([decision], mode);
+}
+export function decideRuntimeEvents(manifest, events, mode = "enforce") {
+    return decisionResult(evaluateRuntimeEvents(manifest, events), mode);
+}
+export function decideRuntimePayload(manifest, payload, mode = "enforce") {
+    return decideRuntimeEvents(manifest, runtimeEventsFromPayload(payload), mode);
+}
+export async function guardRuntimePayload(manifest, payload, mode = "enforce") {
+    const result = decideRuntimePayload(manifest, payload, mode);
+    if (mode === "enforce" && !result.ok) {
+        throw new PolicyStrataGatewayBlockedError(result);
+    }
+    return result;
+}
+export function runtimeEventsFromPayload(payload) {
+    if (Array.isArray(payload)) {
+        return payload.map(assertRuntimeEvent);
+    }
+    const record = recordValue(payload);
+    if (Array.isArray(record.events)) {
+        return record.events.map(assertRuntimeEvent);
+    }
+    return [assertRuntimeEvent(payload)];
+}
+export function redactRuntimeEventForUpload(event) {
+    const { expectedDecision: _expectedDecision, expected_decision: _expectedDecisionSnake, payload: _payload, ...redacted } = event;
+    return redacted;
+}
+export function scanMetadataBoundary(payload) {
+    const findings = [];
+    for (const [path, value] of walkPayload(payload)) {
+        const key = path.split(".").at(-1) ?? path;
+        if (SENSITIVE_KEY_PATTERN.test(key)) {
+            findings.push({
+                path,
+                reason: `sensitive field name: ${key}`,
+                severity: "critical",
+            });
+        }
+        if (typeof value === "string") {
+            for (const [pattern, label] of SECRET_VALUE_PATTERNS) {
+                if (pattern.test(value)) {
+                    findings.push({
+                        path,
+                        reason: `possible ${label}`,
+                        severity: "critical",
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+export function assertMetadataBoundary(payload) {
+    const findings = scanMetadataBoundary(payload);
+    if (findings.length > 0) {
+        const first = findings[0];
+        throw new Error(`metadata-only boundary violation at ${first.path}: ${first.reason}`);
+    }
+}
+function runtimeEventForUpload(event, includePayload) {
+    const { expectedDecision: _expectedDecision, ...withoutExpectation } = event;
+    if (includePayload)
+        return withoutExpectation;
+    return redactRuntimeEventForUpload(event);
+}
+export async function uploadRuntimeEvents(options) {
+    const client = options.fetch ?? fetch;
+    const events = options.events.map((event) => runtimeEventForUpload(event, options.includePayload === true));
+    const uploadBody = JSON.stringify({
+        gateway: {
+            name: "@policystrata/agent-trust-gateway",
+            version: POLICYSTRATA_GATEWAY_VERSION,
+        },
+        events,
+    });
+    const maxBodyBytes = options.maxBodyBytes ?? 1_000_000;
+    if (Buffer.byteLength(uploadBody, "utf8") > maxBodyBytes) {
+        throw new Error(`runtime event upload payload is too large: exceeds ${maxBodyBytes} bytes`);
+    }
+    if (options.allowBoundaryViolations !== true) {
+        assertMetadataBoundary({ events });
+    }
+    const response = await client(runtimeEventsEndpoint(options), {
+        method: "POST",
+        headers: uploadHeaders(options),
+        body: uploadBody,
+    });
+    const body = await responseBody(response);
+    return {
+        ok: response.ok,
+        status: response.status,
+        body,
+    };
+}
+export function createAgentTrustGatewayHandler(options) {
+    const mode = options.mode ?? "enforce";
+    const maxBodyBytes = options.maxBodyBytes ?? 1_000_000;
+    const gatewayToken = resolveGatewayToken(options.gatewayToken);
+    return (request, response) => {
+        void handleRequest(request, response, options, mode, maxBodyBytes, gatewayToken);
+    };
+}
+export function createAgentTrustGatewayServer(options) {
+    return createServer(createAgentTrustGatewayHandler(options));
+}
+export async function startAgentTrustGateway(options) {
+    const server = createAgentTrustGatewayServer(options);
+    const host = options.host ?? "127.0.0.1";
+    const port = options.port ?? 8787;
+    if (!isLoopbackHost(host) && !resolveGatewayToken(options.gatewayToken)) {
+        throw new Error("POLICYSTRATA_GATEWAY_TOKEN or --gateway-token is required when binding beyond loopback");
+    }
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    return {
+        server,
+        url: `http://${address.address}:${address.port}`,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => (error ? reject(error) : resolve()));
+        }),
+    };
+}
+async function handleRequest(request, response, options, mode, maxBodyBytes, gatewayToken) {
+    try {
+        const url = new URL(request.url ?? "/", "http://localhost");
+        if (request.method === "GET" && url.pathname === "/healthz") {
+            sendJson(response, 200, { ok: true, service: "policystrata-agent-trust-gateway" });
+            return;
+        }
+        if (request.method !== "POST" || url.pathname !== "/v1/decide") {
+            sendJson(response, 404, { ok: false, error: "not_found" });
+            return;
+        }
+        if (gatewayToken && !isAuthorizedGatewayRequest(request, gatewayToken)) {
+            sendJson(response, 401, { ok: false, error: "unauthorized" });
+            return;
+        }
+        const payload = await readJsonBody(request, maxBodyBytes);
+        const result = decideRuntimePayload(options.manifest, payload, mode);
+        let upload;
+        if (options.upload) {
+            upload = await uploadRuntimeEvents({ ...options.upload, events: result.events });
+        }
+        const uploadFailed = Boolean(upload && !upload.ok && options.failOnUploadError);
+        const status = uploadFailed ? 502 : !result.ok && mode === "enforce" ? 403 : 200;
+        sendJson(response, status, {
+            ...result,
+            upload: upload ? { ok: upload.ok, status: upload.status, body: upload.body } : undefined,
+        });
+    }
+    catch (error) {
+        sendJson(response, 400, {
+            ok: false,
+            error: error instanceof Error ? error.message : "invalid runtime gateway request",
+        });
+    }
+}
+function decisionResult(decisions, mode) {
+    return {
+        ok: decisions.every((decision) => decision.allowed),
+        mode,
+        events: decisions.map((decision) => decision.event),
+        decisions: [...decisions],
+    };
+}
+function assertRuntimeEvent(value) {
+    const event = recordValue(value);
+    for (const key of ["schemaVersion", "eventId", "project", "observedAt", "agent", "layer", "operation", "summary"]) {
+        if (event[key] === undefined) {
+            throw new Error(`runtime event is missing ${key}`);
+        }
+    }
+    return event;
+}
+function runtimeEventsEndpoint(options) {
+    return new URL(options.path ?? "/api/v1/runtime-events", options.apiUrl).toString();
+}
+function uploadHeaders(options) {
+    const headers = {
+        "content-type": "application/json",
+    };
+    if (options.token) {
+        headers.authorization = `Bearer ${options.token}`;
+    }
+    if (options.organizationId) {
+        headers["x-clearance-organization-id"] = options.organizationId;
+        headers["x-assurance-organization-id"] = options.organizationId;
+    }
+    if (options.idempotencyKey) {
+        headers["idempotency-key"] = options.idempotencyKey;
+    }
+    return headers;
+}
+function resolveGatewayToken(explicitToken) {
+    return explicitToken || process.env.POLICYSTRATA_GATEWAY_TOKEN;
+}
+function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return (normalized === "localhost" ||
+        normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized === "[::1]");
+}
+function isAuthorizedGatewayRequest(request, gatewayToken) {
+    const authorization = request.headers.authorization ?? "";
+    const credential = authorization.toLowerCase().startsWith("bearer ")
+        ? authorization.slice(7).trim()
+        : "";
+    if (!credential)
+        return false;
+    const left = Buffer.from(credential);
+    const right = Buffer.from(gatewayToken);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+async function responseBody(response) {
+    const text = await response.text();
+    if (!text)
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+async function readJsonBody(request, maxBodyBytes) {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.byteLength;
+        if (total > maxBodyBytes) {
+            throw new Error("runtime gateway request body is too large");
+        }
+        chunks.push(buffer);
+    }
+    const raw = Buffer.concat(chunks).toString("utf8");
+    if (!raw.trim()) {
+        throw new Error("runtime gateway request body is empty");
+    }
+    return JSON.parse(raw);
+}
+function sendJson(response, status, payload) {
+    response.writeHead(status, { "content-type": "application/json" });
+    response.end(`${JSON.stringify(payload)}\n`);
+}
+function recordValue(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+const SENSITIVE_KEY_PATTERN = /(?:^|[_\-.])(api[_\-.]?key|authorization|bearer|cookie|credential|customer[_\-.]?rows|doc[_\-.]?text|documents?|full[_\-.]?trace|input[_\-.]?schema|output[_\-.]?schema|password|passwd|private[_\-.]?schema|prompt|raw[_\-.]?docs?|raw[_\-.]?documents?|raw[_\-.]?payload|raw[_\-.]?prompt|rows|sampled[_\-.]?rows|secret|source[_\-.]?credentials|token|tool[_\-.]?(?:input|output|payload|request|response))(?:$|[_\-.])/i;
+const SECRET_VALUE_PATTERNS = [
+    [/\bBearer\s+[A-Za-z0-9._~+/=-]{8,}\b/i, "bearer token"],
+    [/\b(?:api[_-]?key|password|passwd|secret|token)\s*[:=]\s*[^\s,;]+/i, "secret assignment"],
+    [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/, "JWT"],
+    [/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i, "email address"],
+    [/\b(?:\d[ -]*?){13,19}\b/, "possible payment card"],
+    [/\bsk-[A-Za-z0-9_-]{16,}\b/, "API key"],
+    [/\bgh[pousr]_[A-Za-z0-9_]{20,}\b/, "API key"],
+    [/\bAKIA[0-9A-Z]{16}\b/, "API key"],
+    [/https?:\/\/[^\s?#]+[^\s]*[?&](?:api[_-]?key|token|secret|password)=[^&\s]+/i, "secret in URL"],
+];
+function* walkPayload(value, prefix = "$") {
+    yield [prefix, value];
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index += 1) {
+            yield* walkPayload(value[index], `${prefix}[${index}]`);
+        }
+        return;
+    }
+    if (!value || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        yield* walkPayload(child, `${prefix}.${key}`);
+    }
+}
+function defaultIntegrationEventType(provider) {
+    switch (provider) {
+        case "github":
+            return "github.check_gate";
+        case "vercel":
+            return "vercel.deployment_gate";
+        case "datadog":
+            return "datadog.monitor_signal";
+        case "snowflake":
+            return "snowflake.data_policy_signal";
+        case "slack":
+            return "slack.approval_channel";
+        case "jira":
+            return "jira.workflow_gate";
+        case "aws":
+            return "aws.control_plane_signal";
+        case "gcp":
+            return "gcp.control_plane_signal";
+        case "azure":
+            return "azure.control_plane_signal";
+        default:
+            return exhaustiveProvider(provider);
+    }
+}
+function defaultIntegrationLayer(provider) {
+    switch (provider) {
+        case "snowflake":
+            return "sql";
+        case "aws":
+        case "gcp":
+        case "azure":
+        case "vercel":
+            return "egress";
+        case "datadog":
+        case "github":
+        case "slack":
+        case "jira":
+            return "trace";
+        default:
+            return exhaustiveProvider(provider);
+    }
+}
+function defaultIntegrationDecision(provider) {
+    switch (provider) {
+        case "github":
+        case "vercel":
+            return "allow";
+        case "datadog":
+        case "snowflake":
+        case "slack":
+        case "jira":
+        case "aws":
+        case "gcp":
+        case "azure":
+            return "require_approval";
+        default:
+            return exhaustiveProvider(provider);
+    }
+}
+function sha256Json(value) {
+    return createHash("sha256")
+        .update(JSON.stringify(value, Object.keys(recordValue(value)).sort()))
+        .digest("hex");
+}
+function exhaustiveProvider(provider) {
+    throw new Error(`Unsupported native integration provider: ${provider}`);
+}
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAKtB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAmFpD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,MAAM,CAAwB;IAEvC,YAAY,MAA6B;QACvC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,8BAA8B,CAAC,CAAC;QACxG,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAqC;IAErC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjF,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,iBAAiB,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG;QACd,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;KACzB,CAAC;IACF,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,OAAO,EAAE,eAAe,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAClG,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxD,KAAK,EAAE;YACL,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,cAAc;YACpC,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,cAAc;YACrC,IAAI,EAAE,aAAa;SACpB;QACD,KAAK,EAAE,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9C,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,GAAG,KAAK,CAAC,QAAQ,8BAA8B,KAAK,CAAC,OAAO,EAAE;QACxF,QAAQ,EAAE;YACR,MAAM,EAAE,KAAK,CAAC,QAAQ,IAAI,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC;YACpE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,oBAAoB;YAC7C,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,qBAAqB;gBAC1C,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,iDAAiD;aAC7D;SACF;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,uBAAuB,EAAE,KAAK,CAAC,YAAY;QAC3C,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG;YACH,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC;QAC/B,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC;KACA,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAqC,EACrC,KAAoC,EACpC,OAA8B,SAAS;IAEvC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,cAAc,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAqC,EACrC,MAAgD,EAChD,OAA8B,SAAS;IAEvC,OAAO,cAAc,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAqC,EACrC,OAAgB,EAChB,OAA8B,SAAS;IAEvC,OAAO,mBAAmB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAqC,EACrC,OAAgB,EAChB,OAA8B,SAAS;IAEvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAA+B;IACzE,MAAM,EACJ,gBAAgB,EAAE,iBAAiB,EACnC,iBAAiB,EAAE,sBAAsB,EACzC,OAAO,EAAE,QAAQ,EACjB,GAAG,QAAQ,EACZ,GAAG,KAAK,CAAC;IACV,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC3C,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,MAAM,EAAE,yBAAyB,GAAG,EAAE;gBACtC,QAAQ,EAAE,UAAU;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,qBAAqB,EAAE,CAAC;gBACrD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI;wBACJ,MAAM,EAAE,YAAY,KAAK,EAAE;wBAC3B,QAAQ,EAAE,UAAU;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAA+B,EAC/B,cAAuB;IAEvB,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,GAAG,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAC7E,IAAI,cAAc;QAAE,OAAO,kBAAkB,CAAC;IAC9C,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoF;IAEpF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,OAAO,EAAE;YACP,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,4BAA4B;SACtC;QACD,MAAM;KACP,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC;IACvD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sDAAsD,YAAY,QAAQ,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;QAC7C,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC;QAC/B,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC;IACvD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE/D,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3B,KAAK,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAiC;IAC7E,OAAO,YAAY,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAoE;IAEpE,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAClC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IAChD,OAAO;QACL,MAAM;QACN,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE;QAChD,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAwB,EACxB,QAAwB,EACxB,OAAiC,EACjC,IAA2B,EAC3B,YAAoB,EACpB,YAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC/D,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,YAAY,IAAI,CAAC,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrE,IAAI,MAA4C,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE;YACzB,GAAG,MAAM;YACT,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;SACzF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YACtB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC;SAClF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,SAAwD,EACxD,IAA2B;IAE3B,OAAO;QACL,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;QACnD,IAAI;QACJ,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnD,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QAClH,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,KAAiD,CAAC;AAC3D,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAkC;IAC/D,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,wBAAwB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,OAAkC;IACvD,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QAChE,OAAO,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,aAAiC;IAC5D,OAAO,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;AACjE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,OAAO,CACL,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,OAAO,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAwB,EAAE,YAAoB;IAChF,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAClE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/B,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAwB,EAAE,YAAoB;IACxE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC;QAC3B,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,OAAgB;IAC1E,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,qBAAqB,GACzB,8ZAA8Z,CAAC;AAEja,MAAM,qBAAqB,GAAgC;IACzD,CAAC,sCAAsC,EAAE,cAAc,CAAC;IACxD,CAAC,mEAAmE,EAAE,mBAAmB,CAAC;IAC1F,CAAC,uDAAuD,EAAE,KAAK,CAAC;IAChE,CAAC,4CAA4C,EAAE,eAAe,CAAC;IAC/D,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;IACpD,CAAC,2BAA2B,EAAE,SAAS,CAAC;IACxC,CAAC,iCAAiC,EAAE,SAAS,CAAC;IAC9C,CAAC,sBAAsB,EAAE,SAAS,CAAC;IACnC,CAAC,6EAA6E,EAAE,eAAe,CAAC;CACjG,CAAC;AAEF,QAAQ,CAAC,CAAC,WAAW,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IAChD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,IAAI,KAAK,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAmC;IACtE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,mBAAmB,CAAC;QAC7B,KAAK,QAAQ;YACX,OAAO,wBAAwB,CAAC;QAClC,KAAK,SAAS;YACZ,OAAO,wBAAwB,CAAC;QAClC,KAAK,WAAW;YACd,OAAO,8BAA8B,CAAC;QACxC,KAAK,OAAO;YACV,OAAO,wBAAwB,CAAC;QAClC,KAAK,MAAM;YACT,OAAO,oBAAoB,CAAC;QAC9B,KAAK,KAAK;YACR,OAAO,0BAA0B,CAAC;QACpC,KAAK,KAAK;YACR,OAAO,0BAA0B,CAAC;QACpC,KAAK,OAAO;YACV,OAAO,4BAA4B,CAAC;QACtC;YACE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAmC;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,KAAK,CAAC;QACf,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,CAAC;QACX,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAmC;IACrE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC;QACjB,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,CAAC;QACX,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC;QAC5B;YACE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SACrE,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAe;IACzC,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;AAC1E,CAAC"}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@policystrata/agent-trust-gateway",
+  "version": "0.1.1",
+  "description": "Customer-hosted runtime gateway for PolicyStrata governed-data agents",
+  "type": "module",
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
+  "bin": {
+    "agent-trust-gateway": "dist/src/cli.js"
+  },
+  "license": "MIT",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/raintree-technology/policystrata.git",
+    "directory": "packages/gateway"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "keywords": [
+    "llm",
+    "data-agents",
+    "runtime-security",
+    "agent-governance",
+    "policystrata"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    }
+  },
+  "files": [
+    "dist/src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "bun run --cwd ../node build && tsc -p tsconfig.json",
+    "test": "bun run build && node --test dist/test/*.test.js",
+    "prepack": "bun run build"
+  },
+  "engines": {
+    "node": "24.x"
+  },
+  "dependencies": {
+    "policystrata": "^0.1.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.0.0"
+  }
+}