@sernixa/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Sernixa Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,186 @@
+# @sernixa/sdk
+
+TypeScript SDK for Sernixa — governed tool and agent execution with MCP
+call-gate support.
+
+## What This Does
+
+The SDK gates local JavaScript/TypeScript function execution through Sernixa's
+approval oracle. Your code runs **only after** Sernixa returns an approved-style
+decision (`approved`, `auto_approved`, or `executed`).
+
+This is **not** a native MCP JSON-RPC server or transport. Sernixa exposes a
+governed HTTP call gate for host/router-controlled MCP dispatch. Native MCP
+transport is not shipped yet.
+
+## Install
+
+> **Not yet published to npm.** Use the monorepo workspace package until the
+> first npm release.
+
+From the repository root:
+
+```bash
+npm install
+npm -w packages/sdk run build
+```
+
+After npm publication (when available):
+
+```bash
+npm install @sernixa/sdk
+```
+
+## Quick Start
+
+```ts
+import { Client } from "@sernixa/sdk";
+
+const client = new Client({
+  baseUrl: "http://localhost:8000",
+  apiKey: process.env.SERNIXA_API_KEY,
+});
+
+const readFile = client.intercept(
+  async (path: string) => `contents for ${path}`,
+  {
+    intentId: "mcp-read-file",
+    riskLevel: "LOW",
+    operationClass: "read",
+    dataSensitivity: "internal",
+    systemsTouched: ["workspace"],
+  }
+);
+
+const result = await readFile("/workspace/report.md");
+```
+
+## MCP Call Gate
+
+Use `mcpCallGate()` to request approval for an MCP-style tool call through
+Sernixa's governed HTTP call gate:
+
+```ts
+const response = await client.mcpCallGate({
+  mcpToolsetId: "workspace-mcp",
+  toolName: "read_file",
+  intentId: "read-workspace-file",
+  arguments: { path: "/workspace/report.md" },
+  riskLevel: "LOW",
+  operationClass: "read",
+  dataSensitivity: "internal",
+});
+
+if (response.status === "accepted" || response.status === "auto_approved") {
+  // Dispatch the actual MCP tool call from the caller-owned host
+}
+```
+
+> **Important:** `dispatch_mode` is always `caller_owned_after_allowed`. Sernixa
+> does not execute upstream MCP servers — it governs whether the call should
+> proceed.
+
+## Gateway Wrapper
+
+```ts
+import { SernixaGateway } from "@sernixa/sdk";
+
+const gateway = new SernixaGateway({
+  apiKey: process.env.SERNIXA_API_KEY,
+  mcpProfile: "prod-tools",
+  enforceEbpf: true,
+});
+
+const result = await gateway.run(
+  () => agent.run({ input: "Summarize customer risk" }),
+  {
+    intentId: "agent-risk-summary",
+    riskLevel: "MEDIUM",
+    operationClass: "agent_run",
+    dataSensitivity: "internal",
+  }
+);
+```
+
+`enforceEbpf=true` does **not** start an eBPF collector. It checks `/ready` and
+requires Flight Recorder runtime support outside `local_demo`.
+
+## Delegation
+
+```ts
+import { Client } from "@sernixa/sdk";
+
+const client = new Client();
+
+const token = await client.createDelegationToken({
+  delegatorAgentId: "orchestrator",
+  delegateeAgentId: "worker",
+  scope: {
+    max_risk_level: "low",
+    allowed_operation_classes: ["read"],
+  },
+});
+
+const governed = client.interceptWithDelegation(
+  async () => "worker result",
+  {
+    intentId: "delegated-read",
+    riskLevel: "LOW",
+    operationClass: "read",
+    dataSensitivity: "internal",
+    systemsTouched: ["workspace"],
+  },
+  {
+    agentId: "worker",
+    delegationTokenId: token.token_id as string,
+    signingSecret: process.env.SERNIXA_REQUEST_SIGNING_SECRET!,
+  }
+);
+
+const result = await governed();
+```
+
+## Error Handling
+
+```ts
+import {
+  SernixaBlockedError,
+  SernixaRejectedError,
+  SernixaTimeoutError,
+  SernixaSignatureError,
+  SernixaDelegationScopeError,
+} from "@sernixa/sdk";
+
+try {
+  await governed();
+} catch (error) {
+  if (error instanceof SernixaBlockedError) {
+    console.error("Policy blocked:", error.reason);
+  } else if (error instanceof SernixaRejectedError) {
+    console.error("Reviewer rejected:", error.reason);
+  } else if (error instanceof SernixaDelegationScopeError) {
+    console.error("Delegation scope error:", error.reason);
+  } else if (error instanceof SernixaSignatureError) {
+    console.error("Signature error:", error.reason);
+  } else if (error instanceof SernixaTimeoutError) {
+    console.error("Approval pending:", error.approvalId);
+  }
+}
+```
+
+## Environment Variables
+
+| Variable                           | Default              | Description                            |
+| ---------------------------------- | -------------------- | -------------------------------------- |
+| `SERNIXA_BASE_URL`                 | `http://localhost:8000` | Sernixa API base URL                |
+| `SERNIXA_API_KEY`                  | (empty)              | Bearer token                           |
+| `SERNIXA_POLL_INTERVAL_SECONDS`    | `2`                  | Seconds between approval polls         |
+| `SERNIXA_POLL_TIMEOUT_SECONDS`     | `600`                | Max seconds to wait for approval       |
+| `SERNIXA_TIMEOUT_MS`               | `10000`              | Per-request HTTP timeout               |
+| `SERNIXA_MAX_RETRIES`              | `2`                  | Retries for 429/5xx/network errors     |
+| `SERNIXA_CAPTURE_ARGUMENTS`        | `false`              | Submit function argument values        |
+| `SERNIXA_REQUEST_SIGNING_KEY_ID`   | `local-request-key-v1` | Key ID for delegation signing       |
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,204 @@
+export declare const VERSION = "0.1.0";
+export type RiskLevel = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' | 'low' | 'medium' | 'high' | 'critical';
+export type DecisionStatus = 'pending' | 'pending_review' | 'approved' | 'auto_approved' | 'executed' | 'rejected' | 'blocked' | 'expired' | 'failed';
+export type RuntimeMode = 'local_demo' | 'production_like' | string;
+export type FetchLike = (input: string | URL, init?: RequestInit) => Promise<Response>;
+export type ActionMetadata = Record<string, unknown>;
+export type InterceptOptions = {
+    intentId: string;
+    riskLevel: RiskLevel;
+    operationClass: string;
+    dataSensitivity: string;
+    systemsTouched: string[];
+    metadata?: ActionMetadata;
+    actionId?: string;
+};
+export type ClientOptions = {
+    baseUrl?: string;
+    apiKey?: string;
+    pollIntervalSeconds?: number;
+    pollTimeoutSeconds?: number;
+    timeoutMs?: number;
+    maxRetries?: number;
+    fetch?: FetchLike;
+};
+export type GatewayOptions = ClientOptions & {
+    mcpProfile?: string;
+    enforceEbpf?: boolean;
+    client?: Client;
+};
+export type GatewayRunOptions = Partial<InterceptOptions> & {
+    mcpProfile?: string;
+};
+export type DelegationContext = {
+    agentId: string;
+    delegationTokenId: string;
+    signingSecret: string;
+    delegationChainId?: string;
+    runtimeId?: string;
+    runtimeIdentity?: string;
+    serviceIdentity?: string;
+    workloadIdentity?: string;
+    keyId?: string;
+};
+export type DelegationTokenRequest = {
+    delegatorAgentId: string;
+    delegateeAgentId: string;
+    scope: Record<string, unknown>;
+    parentTokenId?: string;
+    toolSubset?: string[];
+    rootHumanSessionId?: string;
+    expiresInSeconds?: number;
+    reason?: string;
+};
+export type McpCallGateRequest = {
+    mcpToolsetId: string;
+    toolName: string;
+    serverName?: string;
+    arguments?: Record<string, unknown>;
+    intentId: string;
+    actionId?: string;
+    agentId?: string;
+    riskLevel?: RiskLevel;
+    operationClass?: string;
+    dataSensitivity?: string;
+    resourceHints?: string[];
+    metadata?: Record<string, unknown>;
+};
+export type McpCallGateResponse = {
+    status: string;
+    action_id: string;
+    intent_id: string;
+    approval_id?: string;
+    reason: string;
+    dispatch_mode: string;
+    native_mcp_transport: boolean;
+    next_step: string;
+};
+export type ReadinessCheck = {
+    status?: string;
+    enabled?: boolean;
+    error?: string;
+    [key: string]: unknown;
+};
+export type ReadinessResponse = {
+    status: string;
+    runtime_mode?: string;
+    serving_mode?: string;
+    checks?: {
+        configuration?: {
+            status?: string;
+            snapshot?: Record<string, unknown>;
+            [key: string]: unknown;
+        };
+        flight_recorder?: ReadinessCheck;
+        mcp_gateway?: {
+            enabled: boolean;
+            published_profiles: number;
+            transport: string;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+};
+export declare const APPROVED_STATUSES: readonly ["approved", "auto_approved", "executed"];
+export declare const TERMINAL_STATUSES: readonly ["approved", "auto_approved", "executed", "rejected", "blocked", "expired", "failed"];
+export declare function isApprovedStatus(status: string | undefined | null): boolean;
+export declare function isTerminalStatus(status: string | undefined | null): boolean;
+export declare class SernixaError extends Error {
+    readonly statusCode?: number;
+    readonly approvalId?: string;
+    readonly reason?: string;
+    readonly evidence?: unknown;
+    constructor(message: string, options?: {
+        statusCode?: number;
+        approvalId?: string;
+        reason?: string;
+        evidence?: unknown;
+        cause?: unknown;
+    });
+}
+export declare class SernixaConfigurationError extends SernixaError {
+}
+export declare class SernixaValidationError extends SernixaError {
+}
+export declare class SernixaApiError extends SernixaError {
+}
+export declare class SernixaRateLimitError extends SernixaError {
+}
+export declare class SernixaBlockedError extends SernixaError {
+}
+export declare class SernixaRejectedError extends SernixaError {
+}
+export declare class SernixaExpiredError extends SernixaError {
+}
+export declare class SernixaTimeoutError extends SernixaError {
+}
+export declare class SernixaSignatureError extends SernixaError {
+}
+export declare class SernixaDelegationScopeError extends SernixaError {
+}
+export declare class SernixaReplayError extends SernixaError {
+}
+export declare function actionMetadata(options: {
+    riskLevel: RiskLevel;
+    operationClass: string;
+    dataSensitivity: string;
+    systemsTouched: string[];
+    [key: string]: unknown;
+}): ActionMetadata;
+export declare function safeSerialize(value: unknown, seen?: WeakSet<object>): unknown;
+export declare function generateIdempotencyKey(intentId: string, fnName: string, args: unknown[], kwargs: Record<string, unknown>): string;
+export declare function canonicalJson(value: unknown): string;
+export declare function computeBodyHash(payload: {
+    intentId: string;
+    actionId: string;
+    metadata: Record<string, unknown>;
+}): string;
+export declare function signDelegatedRequest(payload: Record<string, unknown>, signingSecret: string): string;
+export declare function buildDelegationSignaturePayload(options: {
+    intentId: string;
+    actionId: string;
+    metadata: Record<string, unknown>;
+    agentId: string;
+    runtimeId?: string;
+    runtimeIdentity?: string;
+    serviceIdentity?: string;
+    workloadIdentity?: string;
+    delegationTokenId: string;
+    delegationChainId?: string;
+    timestamp: number;
+    nonce: string;
+    bodyHash: string;
+    keyId: string;
+    algorithm?: string;
+}): Record<string, unknown>;
+export declare class Client {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+    readonly pollIntervalSeconds: number;
+    readonly pollTimeoutSeconds: number;
+    readonly timeoutMs: number;
+    readonly maxRetries: number;
+    private readonly fetchImpl;
+    constructor(options?: ClientOptions);
+    intercept<TArgs extends unknown[], TResult>(fn: (...args: TArgs) => TResult | Promise<TResult>, options: InterceptOptions): (...args: TArgs) => Promise<TResult>;
+    execute<TArgs extends unknown[], TResult>(fn: (...args: TArgs) => TResult | Promise<TResult>, options: InterceptOptions, ...args: TArgs): Promise<TResult>;
+    readiness(): Promise<ReadinessResponse>;
+    createDelegationToken(request: DelegationTokenRequest): Promise<Record<string, unknown>>;
+    mcpCallGate(request: McpCallGateRequest): Promise<McpCallGateResponse>;
+    private buildActionPayload;
+    interceptWithDelegation<TArgs extends unknown[], TResult>(fn: (...args: TArgs) => TResult | Promise<TResult>, options: InterceptOptions, delegation: DelegationContext): (...args: TArgs) => Promise<TResult>;
+    private submitAndWait;
+    private pollApproval;
+    private request;
+}
+export declare class SernixaGateway {
+    readonly client: Client;
+    readonly mcpProfile?: string;
+    readonly enforceEbpf: boolean;
+    constructor(options?: GatewayOptions);
+    run<TResult>(fn: () => TResult | Promise<TResult>, options?: GatewayRunOptions): Promise<TResult>;
+}
+export declare function validateRuntimeEvidence(readiness: Record<string, unknown>): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,OAAO,UAAU,CAAA;AAM9B,MAAM,MAAM,SAAS,GACjB,KAAK,GACL,QAAQ,GACR,MAAM,GACN,UAAU,GACV,KAAK,GACL,QAAQ,GACR,MAAM,GACN,UAAU,CAAA;AAEd,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,gBAAgB,GAChB,UAAU,GACV,eAAe,GACf,UAAU,GACV,UAAU,GACV,SAAS,GACT,SAAS,GACT,QAAQ,CAAA;AAEZ,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,iBAAiB,GAAG,MAAM,CAAA;AAEnE,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEtF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEpD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAMD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAMD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAMD,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE;QACP,aAAa,CAAC,EAAE;YACd,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SACvB,CAAA;QACD,eAAe,CAAC,EAAE,cAAc,CAAA;QAChC,WAAW,CAAC,EAAE;YACZ,OAAO,EAAE,OAAO,CAAA;YAChB,kBAAkB,EAAE,MAAM,CAAA;YAC1B,SAAS,EAAE,MAAM,CAAA;SAClB,CAAA;QACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KACvB,CAAA;IACD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,CAAA;AAMD,eAAO,MAAM,iBAAiB,oDAAqD,CAAA;AACnF,eAAO,MAAM,iBAAiB,gGAQpB,CAAA;AAWV,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAE3E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAE3E;AAMD,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;gBAGzB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,QAAQ,CAAC,EAAE,OAAO,CAAA;QAClB,KAAK,CAAC,EAAE,OAAO,CAAA;KACX;CAST;AAED,qBAAa,yBAA0B,SAAQ,YAAY;CAAG;AAC9D,qBAAa,sBAAuB,SAAQ,YAAY;CAAG;AAC3D,qBAAa,eAAgB,SAAQ,YAAY;CAAG;AACpD,qBAAa,qBAAsB,SAAQ,YAAY;CAAG;AAC1D,qBAAa,mBAAoB,SAAQ,YAAY;CAAG;AACxD,qBAAa,oBAAqB,SAAQ,YAAY;CAAG;AACzD,qBAAa,mBAAoB,SAAQ,YAAY;CAAG;AACxD,qBAAa,mBAAoB,SAAQ,YAAY;CAAG;AACxD,qBAAa,qBAAsB,SAAQ,YAAY;CAAG;AAC1D,qBAAa,2BAA4B,SAAQ,YAAY;CAAG;AAChE,qBAAa,kBAAmB,SAAQ,YAAY;CAAG;AAMvD,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,SAAS,EAAE,SAAS,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,GAAG,cAAc,CASjB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,kBAAwB,GAAG,OAAO,CAwCnF;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAWR;AAMD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGpD;AAUD,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC,GAAG,MAAM,CAUT;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,aAAa,EAAE,MAAM,GACpB,MAAM,CAIR;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoB1B;AA4LD,qBAAa,MAAM;IACjB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAW;gBAEzB,OAAO,GAAE,aAAkB;IAoCvC,SAAS,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,OAAO,EACxC,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAClD,OAAO,EAAE,gBAAgB,GACxB,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC;IAQjC,OAAO,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,OAAO,EAC5C,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAClD,OAAO,EAAE,gBAAgB,EACzB,GAAG,IAAI,EAAE,KAAK,GACb,OAAO,CAAC,OAAO,CAAC;IAIb,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAYvC,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAwBxF,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAmD5E,OAAO,CAAC,kBAAkB;IAsF1B,uBAAuB,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,OAAO,EACtD,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAClD,OAAO,EAAE,gBAAgB,EACzB,UAAU,EAAE,iBAAiB,GAC5B,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC;YAQzB,aAAa;YAuCb,YAAY;YAmDZ,OAAO;CA2CtB;AAMD,qBAAa,cAAc;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;gBAEjB,OAAO,GAAE,cAAmB;IAMlC,GAAG,CAAC,OAAO,EACf,EAAE,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EACpC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC;CAqBpB;AAMD,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAwBhF"}

package/dist/index.js

@@ -0,0 +1,680 @@
+import { createHash, createHmac, randomBytes } from 'node:crypto';
+export const VERSION = '0.1.0';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+export const APPROVED_STATUSES = ['approved', 'auto_approved', 'executed'];
+export const TERMINAL_STATUSES = [
+    'approved',
+    'auto_approved',
+    'executed',
+    'rejected',
+    'blocked',
+    'expired',
+    'failed',
+];
+const TRANSIENT_STATUS_CODES = new Set([429, 500, 502, 503, 504]);
+const VALID_RISK_LEVELS = new Set(['low', 'medium', 'high', 'critical']);
+const DELEGATED_REQUEST_SCHEMA_VERSION = 'sernixa.delegated_request.v1';
+const DELEGATED_REQUEST_ALGORITHM = 'HMAC-SHA256';
+// ---------------------------------------------------------------------------
+// Status helpers
+// ---------------------------------------------------------------------------
+export function isApprovedStatus(status) {
+    return APPROVED_STATUSES.includes(status);
+}
+export function isTerminalStatus(status) {
+    return TERMINAL_STATUSES.includes(status);
+}
+// ---------------------------------------------------------------------------
+// Error hierarchy
+// ---------------------------------------------------------------------------
+export class SernixaError extends Error {
+    statusCode;
+    approvalId;
+    reason;
+    evidence;
+    constructor(message, options = {}) {
+        super(message, { cause: options.cause });
+        this.name = new.target.name;
+        this.statusCode = options.statusCode;
+        this.approvalId = options.approvalId;
+        this.reason = options.reason;
+        this.evidence = options.evidence;
+    }
+}
+export class SernixaConfigurationError extends SernixaError {
+}
+export class SernixaValidationError extends SernixaError {
+}
+export class SernixaApiError extends SernixaError {
+}
+export class SernixaRateLimitError extends SernixaError {
+}
+export class SernixaBlockedError extends SernixaError {
+}
+export class SernixaRejectedError extends SernixaError {
+}
+export class SernixaExpiredError extends SernixaError {
+}
+export class SernixaTimeoutError extends SernixaError {
+}
+export class SernixaSignatureError extends SernixaError {
+}
+export class SernixaDelegationScopeError extends SernixaError {
+}
+export class SernixaReplayError extends SernixaError {
+}
+// ---------------------------------------------------------------------------
+// Serialization / metadata helpers
+// ---------------------------------------------------------------------------
+export function actionMetadata(options) {
+    const { riskLevel, operationClass, dataSensitivity, systemsTouched, ...extra } = options;
+    return {
+        risk_level: riskLevel,
+        operation_class: operationClass,
+        data_sensitivity: dataSensitivity,
+        systems_touched: systemsTouched,
+        ...extra,
+    };
+}
+export function safeSerialize(value, seen = new WeakSet()) {
+    if (value === null ||
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean') {
+        return value;
+    }
+    if (typeof value === 'bigint') {
+        return value.toString();
+    }
+    if (typeof value === 'undefined' || typeof value === 'function' || typeof value === 'symbol') {
+        return `<non-serializable: ${typeof value}>`;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => safeSerialize(item, seen));
+    }
+    if (typeof value === 'object') {
+        if (seen.has(value)) {
+            return '<non-serializable: circular>';
+        }
+        seen.add(value);
+        if (value instanceof Date) {
+            return value.toISOString();
+        }
+        const output = {};
+        for (const [key, item] of Object.entries(value)) {
+            output[key] = safeSerialize(item, seen);
+        }
+        return output;
+    }
+    return String(value).slice(0, 200);
+}
+export function generateIdempotencyKey(intentId, fnName, args, kwargs) {
+    return createHash('sha256')
+        .update(JSON.stringify({
+        intent_id: intentId,
+        fn: fnName,
+        args: safeSerialize(args),
+        kwargs: safeSerialize(kwargs),
+    }))
+        .digest('hex');
+}
+// ---------------------------------------------------------------------------
+// Delegation signing helpers
+// ---------------------------------------------------------------------------
+export function canonicalJson(value) {
+    return JSON.stringify(value, Object.keys(value).sort(), undefined)
+        .replace(/\s/g, '');
+}
+function canonicalJsonSorted(value) {
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) {
+        sorted[key] = value[key];
+    }
+    return JSON.stringify(sorted);
+}
+export function computeBodyHash(payload) {
+    return createHash('sha256')
+        .update(canonicalJsonSorted({
+        intent_id: payload.intentId,
+        action_id: payload.actionId,
+        metadata: payload.metadata,
+    }))
+        .digest('hex');
+}
+export function signDelegatedRequest(payload, signingSecret) {
+    return createHmac('sha256', signingSecret)
+        .update(canonicalJsonSorted(payload))
+        .digest('hex');
+}
+export function buildDelegationSignaturePayload(options) {
+    return {
+        schema_version: DELEGATED_REQUEST_SCHEMA_VERSION,
+        intent_id: options.intentId,
+        action_id: options.actionId,
+        agent_id: options.agentId,
+        runtime_id: options.runtimeId ?? null,
+        runtime_identity: options.runtimeIdentity ?? null,
+        service_identity: options.serviceIdentity ?? null,
+        workload_identity: options.workloadIdentity ?? null,
+        delegation_token_id: options.delegationTokenId,
+        delegation_chain_id: options.delegationChainId ?? null,
+        timestamp: options.timestamp,
+        nonce: options.nonce,
+        operation_class: options.metadata.operation_class ?? null,
+        data_sensitivity: options.metadata.data_sensitivity ?? null,
+        body_hash: options.bodyHash,
+        key_id: options.keyId,
+        algorithm: options.algorithm ?? DELEGATED_REQUEST_ALGORITHM,
+    };
+}
+function validateActionOptions(options) {
+    if (!options.intentId.trim()) {
+        throw new SernixaValidationError('intentId must be a non-empty string.');
+    }
+    if (options.intentId.length > 128) {
+        throw new SernixaValidationError('intentId must be 128 characters or fewer.');
+    }
+    if (!VALID_RISK_LEVELS.has(String(options.riskLevel).toLowerCase())) {
+        throw new SernixaValidationError('riskLevel must be one of: low, medium, high, critical.');
+    }
+    if (!options.operationClass.trim()) {
+        throw new SernixaValidationError('operationClass must be a non-empty string.');
+    }
+    if (!options.dataSensitivity.trim()) {
+        throw new SernixaValidationError('dataSensitivity must be a non-empty string.');
+    }
+    if (!Array.isArray(options.systemsTouched) || options.systemsTouched.length === 0) {
+        throw new SernixaValidationError('systemsTouched must be a non-empty string array.');
+    }
+    if (!options.systemsTouched.every((item) => typeof item === 'string' && item.trim())) {
+        throw new SernixaValidationError('systemsTouched must contain only non-empty strings.');
+    }
+    JSON.stringify(safeMetadata(options.metadata ?? {}));
+}
+function safeMetadata(metadata) {
+    const output = {};
+    for (const [key, value] of Object.entries(metadata)) {
+        output[key] = safeSerialize(value);
+    }
+    return output;
+}
+function positiveNumber(value, name, allowZero) {
+    if (!Number.isFinite(value) || value < 0 || (!allowZero && value === 0)) {
+        throw new SernixaConfigurationError(`${name} must be ${allowZero ? 'zero or greater' : 'greater than zero'}.`);
+    }
+    return value;
+}
+function envNumber(name, fallback) {
+    const raw = process.env[name];
+    if (!raw) {
+        return fallback;
+    }
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed)) {
+        throw new SernixaConfigurationError(`${name} must be a number.`);
+    }
+    return parsed;
+}
+function envBool(name, fallback) {
+    const raw = process.env[name];
+    if (!raw) {
+        return fallback;
+    }
+    return ['1', 'true', 'yes', 'on'].includes(raw.toLowerCase());
+}
+async function responseJsonObject(response) {
+    let data;
+    try {
+        data = await response.json();
+    }
+    catch (error) {
+        throw new SernixaApiError('Sernixa API returned a non-JSON response.', {
+            statusCode: response.status,
+            cause: error,
+        });
+    }
+    if (!data || typeof data !== 'object' || Array.isArray(data)) {
+        throw new SernixaApiError('Sernixa API returned an unexpected JSON payload.', {
+            statusCode: response.status,
+            evidence: data,
+        });
+    }
+    return data;
+}
+async function responseText(response) {
+    try {
+        return (await response.text()).slice(0, 1000);
+    }
+    catch {
+        return '';
+    }
+}
+async function throwBlocked(response) {
+    const data = await responseJsonObject(response);
+    const detail = objectField(data, 'detail');
+    const status = stringField(detail, 'status') ?? '';
+    const reason = stringField(detail, 'reason') ?? stringField(data, 'reason') ?? 'blocked';
+    if (['invalid_signature', 'invalid_nonce'].includes(status)) {
+        throw new SernixaSignatureError(`Signature verification failed: ${reason}`, {
+            statusCode: response.status,
+            reason: status,
+            evidence: Object.keys(detail).length ? detail : data,
+        });
+    }
+    if (['replayed_nonce', 'stale_timestamp'].includes(status)) {
+        throw new SernixaReplayError(`Replay protection triggered: ${reason}`, {
+            statusCode: response.status,
+            reason: status,
+            evidence: Object.keys(detail).length ? detail : data,
+        });
+    }
+    if ([
+        'out_of_scope',
+        'mismatched_delegatee',
+        'unknown_agent',
+        'expired_token',
+        'revoked_token',
+        'invalid_chain',
+    ].includes(status)) {
+        throw new SernixaDelegationScopeError(`Action out of delegation scope: ${reason}`, {
+            statusCode: response.status,
+            reason: status,
+            evidence: Object.keys(detail).length ? detail : data,
+        });
+    }
+    throw new SernixaBlockedError(`Action blocked: ${reason}`, {
+        statusCode: response.status,
+        reason,
+        evidence: Object.keys(detail).length ? detail : data,
+    });
+}
+function objectField(value, key) {
+    const field = value[key];
+    return field && typeof field === 'object' && !Array.isArray(field)
+        ? field
+        : {};
+}
+function stringField(value, key) {
+    return typeof value[key] === 'string' ? value[key] : undefined;
+}
+function booleanField(value, key) {
+    return typeof value[key] === 'boolean' ? value[key] : undefined;
+}
+function isAbortError(error) {
+    return error instanceof Error && error.name === 'AbortError';
+}
+async function sleep(ms) {
+    if (ms <= 0) {
+        return;
+    }
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+// ---------------------------------------------------------------------------
+// Client
+// ---------------------------------------------------------------------------
+export class Client {
+    baseUrl;
+    apiKey;
+    pollIntervalSeconds;
+    pollTimeoutSeconds;
+    timeoutMs;
+    maxRetries;
+    fetchImpl;
+    constructor(options = {}) {
+        this.baseUrl = (options.baseUrl ?? process.env.SERNIXA_BASE_URL ?? 'http://localhost:8000').replace(/\/+$/, '');
+        if (!this.baseUrl.startsWith('http://') && !this.baseUrl.startsWith('https://')) {
+            throw new SernixaConfigurationError('SERNIXA_BASE_URL must start with http:// or https://.');
+        }
+        this.apiKey = options.apiKey ?? process.env.SERNIXA_API_KEY ?? '';
+        this.pollIntervalSeconds = positiveNumber(options.pollIntervalSeconds ?? envNumber('SERNIXA_POLL_INTERVAL_SECONDS', 2), 'pollIntervalSeconds', true);
+        this.pollTimeoutSeconds = positiveNumber(options.pollTimeoutSeconds ?? envNumber('SERNIXA_POLL_TIMEOUT_SECONDS', 600), 'pollTimeoutSeconds', true);
+        this.timeoutMs = positiveNumber(options.timeoutMs ?? envNumber('SERNIXA_TIMEOUT_MS', envNumber('SERNIXA_TIMEOUT_SECONDS', 10) * 1000), 'timeoutMs', false);
+        this.maxRetries = positiveNumber(options.maxRetries ?? envNumber('SERNIXA_MAX_RETRIES', 2), 'maxRetries', true);
+        this.fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+        if (!this.fetchImpl) {
+            throw new SernixaConfigurationError('A fetch implementation is required in this Node runtime.');
+        }
+    }
+    intercept(fn, options) {
+        return async (...args) => {
+            const payload = this.buildActionPayload(fn, options, args);
+            await this.submitAndWait(payload);
+            return await fn(...args);
+        };
+    }
+    async execute(fn, options, ...args) {
+        return await this.intercept(fn, options)(...args);
+    }
+    async readiness() {
+        const response = await this.request('GET', '/ready');
+        const data = await responseJsonObject(response);
+        if (response.status >= 400 && !Object.hasOwn(data, 'checks')) {
+            throw new SernixaApiError('Sernixa readiness check failed.', {
+                statusCode: response.status,
+                evidence: data,
+            });
+        }
+        return data;
+    }
+    async createDelegationToken(request) {
+        const payload = {
+            delegator_agent_id: request.delegatorAgentId,
+            delegatee_agent_id: request.delegateeAgentId,
+            scope: request.scope,
+            parent_token_id: request.parentTokenId ?? null,
+            tool_subset: request.toolSubset ?? null,
+            root_human_session_id: request.rootHumanSessionId ?? null,
+            expires_in_seconds: request.expiresInSeconds ?? 3600,
+            reason: request.reason ?? null,
+        };
+        const response = await this.request('POST', '/api/delegations', {
+            body: JSON.stringify(payload),
+        });
+        if (response.status >= 400) {
+            throw new SernixaApiError('Failed to create delegation token.', {
+                statusCode: response.status,
+                evidence: await responseText(response),
+            });
+        }
+        return responseJsonObject(response);
+    }
+    async mcpCallGate(request) {
+        const payload = {
+            mcp_toolset_id: request.mcpToolsetId,
+            tool_name: request.toolName,
+            server_name: request.serverName ?? null,
+            arguments: request.arguments ?? {},
+            intent_id: request.intentId,
+            action_id: request.actionId ?? null,
+            agent_id: request.agentId ?? null,
+            risk_level: request.riskLevel ?? 'medium',
+            operation_class: request.operationClass ?? 'tool_call',
+            data_sensitivity: request.dataSensitivity ?? 'internal',
+            resource_hints: request.resourceHints ?? [],
+            metadata: request.metadata ?? {},
+        };
+        const response = await this.request('POST', '/api/mcp/tools/call', {
+            body: JSON.stringify(payload),
+        });
+        if (response.status === 401 || response.status === 403) {
+            await throwBlocked(response);
+        }
+        if (response.status >= 400) {
+            throw new SernixaApiError('MCP call gate request failed.', {
+                statusCode: response.status,
+                evidence: await responseText(response),
+            });
+        }
+        const data = await responseJsonObject(response);
+        // 202 means pending review — return it as-is with approval_id
+        return {
+            status: typeof data.status === 'string' ? data.status : 'accepted',
+            action_id: typeof data.action_id === 'string' ? data.action_id : '',
+            intent_id: typeof data.intent_id === 'string' ? data.intent_id : request.intentId,
+            approval_id: typeof data.approval_id === 'string' ? data.approval_id : undefined,
+            reason: typeof data.reason === 'string' ? data.reason : '',
+            dispatch_mode: typeof data.dispatch_mode === 'string'
+                ? data.dispatch_mode
+                : 'caller_owned_after_allowed',
+            native_mcp_transport: data.native_mcp_transport === true,
+            next_step: typeof data.next_step === 'string'
+                ? data.next_step
+                : 'Dispatch the MCP tool call from the caller-owned host only after this gate allows it.',
+        };
+    }
+    buildActionPayload(fn, options, args, delegation) {
+        validateActionOptions(options);
+        const captureArguments = envBool('SERNIXA_CAPTURE_ARGUMENTS', false);
+        const fnName = fn.name || 'anonymous';
+        const idempotencyKey = generateIdempotencyKey(options.intentId, fnName, captureArguments ? args : [`${args.length} positional argument(s)`], {});
+        const metadata = actionMetadata({
+            riskLevel: options.riskLevel,
+            operationClass: options.operationClass,
+            dataSensitivity: options.dataSensitivity,
+            systemsTouched: options.systemsTouched,
+            function: fnName,
+            arguments_captured: captureArguments,
+            args_count: args.length,
+            idempotency_key: idempotencyKey,
+            ...safeMetadata(options.metadata ?? {}),
+        });
+        if (captureArguments) {
+            metadata.args = safeSerialize(args);
+        }
+        const payload = {
+            intent_id: options.intentId,
+            action_id: options.actionId ?? fnName.replaceAll('_', '-'),
+            metadata,
+        };
+        // Delegation envelope
+        const ctx = delegation;
+        if (ctx) {
+            payload.agent_id = ctx.agentId;
+            payload.delegation_token_id = ctx.delegationTokenId;
+            payload.delegation_chain_id = ctx.delegationChainId ?? null;
+            payload.runtime_id = ctx.runtimeId ?? null;
+            payload.runtime_identity = ctx.runtimeIdentity ?? null;
+            payload.service_identity = ctx.serviceIdentity ?? null;
+            payload.workload_identity = ctx.workloadIdentity ?? null;
+            const timestamp = Math.floor(Date.now() / 1000);
+            const nonce = randomBytes(16).toString('hex');
+            const keyId = ctx.keyId ?? process.env.SERNIXA_REQUEST_SIGNING_KEY_ID ?? 'local-request-key-v1';
+            payload.timestamp = timestamp;
+            payload.nonce = nonce;
+            payload.key_id = keyId;
+            payload.algorithm = DELEGATED_REQUEST_ALGORITHM;
+            const bodyHash = computeBodyHash({
+                intentId: payload.intent_id,
+                actionId: payload.action_id,
+                metadata: payload.metadata,
+            });
+            payload.body_hash = bodyHash;
+            const sigPayload = buildDelegationSignaturePayload({
+                intentId: payload.intent_id,
+                actionId: payload.action_id,
+                metadata: payload.metadata,
+                agentId: ctx.agentId,
+                runtimeId: ctx.runtimeId,
+                runtimeIdentity: ctx.runtimeIdentity,
+                serviceIdentity: ctx.serviceIdentity,
+                workloadIdentity: ctx.workloadIdentity,
+                delegationTokenId: ctx.delegationTokenId,
+                delegationChainId: ctx.delegationChainId,
+                timestamp,
+                nonce,
+                bodyHash,
+                keyId,
+            });
+            payload.signature = signDelegatedRequest(sigPayload, ctx.signingSecret);
+        }
+        return payload;
+    }
+    interceptWithDelegation(fn, options, delegation) {
+        return async (...args) => {
+            const payload = this.buildActionPayload(fn, options, args, delegation);
+            await this.submitAndWait(payload);
+            return await fn(...args);
+        };
+    }
+    async submitAndWait(payload) {
+        const response = await this.request('POST', '/api/actions/execute', {
+            body: JSON.stringify(payload),
+        });
+        if (response.status === 202) {
+            const decision = await responseJsonObject(response);
+            const approvalId = stringField(decision, 'approval_id');
+            if (!approvalId) {
+                throw new SernixaApiError('Received pending_review response without approval_id.', {
+                    statusCode: 202,
+                    evidence: decision,
+                });
+            }
+            await this.pollApproval(approvalId);
+            return;
+        }
+        if (response.status === 401 || response.status === 403) {
+            await throwBlocked(response);
+        }
+        if (response.status >= 400) {
+            throw new SernixaApiError('Failed to submit Sernixa action.', {
+                statusCode: response.status,
+                evidence: await responseText(response),
+            });
+        }
+        const decision = await responseJsonObject(response);
+        const status = typeof decision.status === 'string' ? decision.status : 'accepted';
+        if (status === 'blocked') {
+            throw new SernixaBlockedError('Action blocked by Sernixa.', {
+                reason: stringField(decision, 'reason'),
+                evidence: decision,
+            });
+        }
+    }
+    async pollApproval(approvalId) {
+        const startedAt = Date.now();
+        while (Date.now() - startedAt <= this.pollTimeoutSeconds * 1000) {
+            await sleep(this.pollIntervalSeconds * 1000);
+            const response = await this.request('GET', `/api/approvals/${encodeURIComponent(approvalId)}`);
+            if (response.status >= 400) {
+                throw new SernixaApiError('Failed to poll Sernixa approval status.', {
+                    statusCode: response.status,
+                    approvalId,
+                    evidence: await responseText(response),
+                });
+            }
+            const decision = await responseJsonObject(response);
+            const status = typeof decision.status === 'string' ? decision.status : undefined;
+            if (isApprovedStatus(status)) {
+                return;
+            }
+            if (status === 'rejected') {
+                throw new SernixaRejectedError('Action rejected by reviewer.', {
+                    approvalId,
+                    reason: stringField(decision, 'decision_reason') ?? stringField(decision, 'reason'),
+                    evidence: decision,
+                });
+            }
+            if (status === 'blocked') {
+                throw new SernixaBlockedError('Action blocked during review.', {
+                    approvalId,
+                    reason: stringField(decision, 'decision_reason') ?? stringField(decision, 'reason'),
+                    evidence: decision,
+                });
+            }
+            if (status === 'expired') {
+                throw new SernixaExpiredError('Action expired before approval.', {
+                    approvalId,
+                    evidence: decision,
+                });
+            }
+            if (status === 'failed') {
+                throw new SernixaError('Action failed after approval processing.', {
+                    approvalId,
+                    evidence: decision,
+                });
+            }
+        }
+        throw new SernixaTimeoutError(`Polling timed out after ${this.pollTimeoutSeconds} seconds.`, { approvalId });
+    }
+    async request(method, path, init = {}) {
+        let lastError;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt += 1) {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+            try {
+                const response = await this.fetchImpl(new URL(path, `${this.baseUrl}/`), {
+                    ...init,
+                    method,
+                    headers: {
+                        ...(this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {}),
+                        ...(init.body ? { 'Content-Type': 'application/json' } : {}),
+                        ...init.headers,
+                    },
+                    signal: controller.signal,
+                });
+                clearTimeout(timeout);
+                if (!TRANSIENT_STATUS_CODES.has(response.status) || attempt >= this.maxRetries) {
+                    if (response.status === 429 && attempt >= this.maxRetries) {
+                        throw new SernixaRateLimitError('Sernixa API rate limit persisted after retries.', {
+                            statusCode: 429,
+                            evidence: await responseText(response),
+                        });
+                    }
+                    return response;
+                }
+            }
+            catch (error) {
+                clearTimeout(timeout);
+                lastError = error;
+                if (error instanceof SernixaError) {
+                    throw error;
+                }
+                if (attempt >= this.maxRetries) {
+                    if (isAbortError(error)) {
+                        throw new SernixaTimeoutError('Sernixa API request timed out.', { cause: error });
+                    }
+                    throw new SernixaApiError('Sernixa API request failed.', { cause: error });
+                }
+            }
+            await sleep(Math.min(2000, 250 * 2 ** attempt));
+        }
+        throw new SernixaApiError('Sernixa API request failed.', { cause: lastError });
+    }
+}
+// ---------------------------------------------------------------------------
+// Gateway
+// ---------------------------------------------------------------------------
+export class SernixaGateway {
+    client;
+    mcpProfile;
+    enforceEbpf;
+    constructor(options = {}) {
+        this.client = options.client ?? new Client(options);
+        this.mcpProfile = options.mcpProfile;
+        this.enforceEbpf = options.enforceEbpf ?? false;
+    }
+    async run(fn, options = {}) {
+        if (this.enforceEbpf) {
+            validateRuntimeEvidence(await this.client.readiness());
+        }
+        const profile = options.mcpProfile ?? this.mcpProfile ?? 'default';
+        return await this.client.execute(fn, {
+            intentId: options.intentId ?? 'agent-run',
+            actionId: options.actionId ?? `gateway:${profile}`,
+            riskLevel: options.riskLevel ?? 'MEDIUM',
+            operationClass: options.operationClass ?? 'agent_run',
+            dataSensitivity: options.dataSensitivity ?? 'internal',
+            systemsTouched: options.systemsTouched ?? ['mcp'],
+            metadata: {
+                ...options.metadata,
+                sernixa_gateway: true,
+                mcp_profile: profile,
+                enforce_ebpf: this.enforceEbpf,
+                runtime_evidence_required: this.enforceEbpf ? 'flight_recorder' : 'not_required',
+            },
+        });
+    }
+}
+// ---------------------------------------------------------------------------
+// Runtime evidence validation
+// ---------------------------------------------------------------------------
+export function validateRuntimeEvidence(readiness) {
+    const checks = objectField(readiness, 'checks');
+    const configuration = objectField(checks, 'configuration');
+    const snapshot = objectField(configuration, 'snapshot');
+    const flight = objectField(checks, 'flight_recorder');
+    const snapshotFlight = objectField(snapshot, 'flight_recorder');
+    const runtimeMode = stringField(readiness, 'runtime_mode') ?? stringField(snapshot, 'runtime_mode');
+    const enabled = booleanField(flight, 'enabled') === true || booleanField(snapshotFlight, 'enabled') === true;
+    if (enabled) {
+        return;
+    }
+    if (runtimeMode === 'local_demo') {
+        console.warn('enforceEbpf=true requested in local_demo without Flight Recorder runtime enabled; execution is not production proof.');
+        return;
+    }
+    throw new SernixaConfigurationError('enforceEbpf=true requires Flight Recorder runtime support. The Sernixa /ready response did not report an enabled flight_recorder check.', { evidence: readiness });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEjE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAA;AAwJ9B,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,CAAU,CAAA;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,UAAU;IACV,eAAe;IACf,UAAU;IACV,UAAU;IACV,SAAS;IACT,SAAS;IACT,QAAQ;CACA,CAAA;AAEV,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;AACxE,MAAM,gCAAgC,GAAG,8BAA8B,CAAA;AACvE,MAAM,2BAA2B,GAAG,aAAa,CAAA;AAEjD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAAC,MAAiC;IAChE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,MAA4C,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAiC;IAChE,OAAO,iBAAiB,CAAC,QAAQ,CAAC,MAA4C,CAAC,CAAA;AACjF,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,MAAM,CAAS;IACf,QAAQ,CAAU;IAE3B,YACE,OAAe,EACf,UAMI,EAAE;QAEN,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAA;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IAClC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,YAAY;CAAG;AAC9D,MAAM,OAAO,sBAAuB,SAAQ,YAAY;CAAG;AAC3D,MAAM,OAAO,eAAgB,SAAQ,YAAY;CAAG;AACpD,MAAM,OAAO,qBAAsB,SAAQ,YAAY;CAAG;AAC1D,MAAM,OAAO,mBAAoB,SAAQ,YAAY;CAAG;AACxD,MAAM,OAAO,oBAAqB,SAAQ,YAAY;CAAG;AACzD,MAAM,OAAO,mBAAoB,SAAQ,YAAY;CAAG;AACxD,MAAM,OAAO,mBAAoB,SAAQ,YAAY;CAAG;AACxD,MAAM,OAAO,qBAAsB,SAAQ,YAAY;CAAG;AAC1D,MAAM,OAAO,2BAA4B,SAAQ,YAAY;CAAG;AAChE,MAAM,OAAO,kBAAmB,SAAQ,YAAY;CAAG;AAEvD,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,MAAM,UAAU,cAAc,CAAC,OAM9B;IACC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,CAAA;IACxF,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,cAAc;QAC/B,gBAAgB,EAAE,eAAe;QACjC,eAAe,EAAE,cAAc;QAC/B,GAAG,KAAK;KACT,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAO,IAAI,OAAO,EAAU;IACxE,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,EAC1B,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAA;IACzB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7F,OAAO,sBAAsB,OAAO,KAAK,GAAG,CAAA;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,8BAA8B,CAAA;QACvC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAEf,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,MAAc,EACd,IAAe,EACf,MAA+B;IAE/B,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,QAAQ;QACnB,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;QACzB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;KAC9B,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC;SACzE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA8B;IACzD,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAI/B;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,mBAAmB,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAgC,EAChC,aAAqB;IAErB,OAAO,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;SACvC,MAAM,CAAC,mBAAmB,CAAC,OAAkC,CAAC,CAAC;SAC/D,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAgB/C;IACC,OAAO;QACL,cAAc,EAAE,gCAAgC;QAChD,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,QAAQ,EAAE,OAAO,CAAC,OAAO;QACzB,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;QACrC,gBAAgB,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;QACjD,gBAAgB,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;QACjD,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QACnD,mBAAmB,EAAE,OAAO,CAAC,iBAAiB;QAC9C,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;QACtD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,eAAe,EAAG,OAAO,CAAC,QAAoC,CAAC,eAAe,IAAI,IAAI;QACtF,gBAAgB,EAAG,OAAO,CAAC,QAAoC,CAAC,gBAAgB,IAAI,IAAI;QACxF,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,MAAM,EAAE,OAAO,CAAC,KAAK;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,2BAA2B;KAC5D,CAAA;AACH,CAAC;AAyBD,SAAS,qBAAqB,CAAC,OAAyB;IACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAAC,2CAA2C,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,sBAAsB,CAAC,wDAAwD,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,sBAAsB,CAAC,4CAA4C,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,sBAAsB,CAAC,6CAA6C,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,sBAAsB,CAAC,kDAAkD,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,sBAAsB,CAAC,qDAAqD,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,QAAwB;IAC5C,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY,EAAE,SAAkB;IACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,yBAAyB,CACjC,GAAG,IAAI,YAAY,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAC1E,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,yBAAyB,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,QAAiB;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IAClD,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE;YACrE,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,KAAK,EAAE,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,eAAe,CAAC,kDAAkD,EAAE;YAC5E,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAA+B,CAAA;AACxC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAA;IAExF,IAAI,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,MAAM,EAAE,EAAE;YAC1E,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SACrD,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,MAAM,EAAE,EAAE;YACrE,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SACrD,CAAC,CAAA;IACJ,CAAC;IACD,IACE;QACE,cAAc;QACd,sBAAsB;QACtB,eAAe;QACf,eAAe;QACf,eAAe;QACf,eAAe;KAChB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAClB,CAAC;QACD,MAAM,IAAI,2BAA2B,CAAC,mCAAmC,MAAM,EAAE,EAAE;YACjF,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;SACrD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,MAAM,EAAE,EAAE;QACzD,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;KACrD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,GAAW;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IACxB,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAA;AACR,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,GAAW;IAC9D,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,GAAW;IAC/D,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAA;AAC9D,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,EAAU;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,OAAM;IACR,CAAC;IACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,OAAO,MAAM;IACR,OAAO,CAAQ;IACf,MAAM,CAAQ;IACd,mBAAmB,CAAQ;IAC3B,kBAAkB,CAAQ;IAC1B,SAAS,CAAQ;IACjB,UAAU,CAAQ;IAEV,SAAS,CAAW;IAErC,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,CAAC,OAAO,CACjG,MAAM,EACN,EAAE,CACH,CAAA;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,yBAAyB,CAAC,uDAAuD,CAAC,CAAA;QAC9F,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;QACjE,IAAI,CAAC,mBAAmB,GAAG,cAAc,CACvC,OAAO,CAAC,mBAAmB,IAAI,SAAS,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAC5E,qBAAqB,EACrB,IAAI,CACL,CAAA;QACD,IAAI,CAAC,kBAAkB,GAAG,cAAc,CACtC,OAAO,CAAC,kBAAkB,IAAI,SAAS,CAAC,8BAA8B,EAAE,GAAG,CAAC,EAC5E,oBAAoB,EACpB,IAAI,CACL,CAAA;QACD,IAAI,CAAC,SAAS,GAAG,cAAc,CAC7B,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,oBAAoB,EAAE,SAAS,CAAC,yBAAyB,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,EACrG,WAAW,EACX,KAAK,CACN,CAAA;QACD,IAAI,CAAC,UAAU,GAAG,cAAc,CAC9B,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,qBAAqB,EAAE,CAAC,CAAC,EACzD,YAAY,EACZ,IAAI,CACL,CAAA;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QACpE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAyB,CAAC,0DAA0D,CAAC,CAAA;QACjG,CAAC;IACH,CAAC;IAED,SAAS,CACP,EAAkD,EAClD,OAAyB;QAEzB,OAAO,KAAK,EAAE,GAAG,IAAW,EAAoB,EAAE;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1D,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;YACjC,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,EAAkD,EAClD,OAAyB,EACzB,GAAG,IAAW;QAEd,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,eAAe,CAAC,iCAAiC,EAAE;gBAC3D,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAyB,CAAA;IAClC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAA+B;QACzD,MAAM,OAAO,GAAG;YACd,kBAAkB,EAAE,OAAO,CAAC,gBAAgB;YAC5C,kBAAkB,EAAE,OAAO,CAAC,gBAAgB;YAC5C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,eAAe,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;YAC9C,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;YACvC,qBAAqB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;YACzD,kBAAkB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;YACpD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;SAC/B,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE;YAC9D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE;gBAC9D,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,QAAQ,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC;aACvC,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAA2B;QAC3C,MAAM,OAAO,GAAG;YACd,cAAc,EAAE,OAAO,CAAC,YAAY;YACpC,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;YAClC,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;YACnC,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YACjC,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ;YACzC,eAAe,EAAE,OAAO,CAAC,cAAc,IAAI,WAAW;YACtD,gBAAgB,EAAE,OAAO,CAAC,eAAe,IAAI,UAAU;YACvD,cAAc,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;YAC3C,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;SACjC,CAAA;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAA;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC9B,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE;gBACzD,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,QAAQ,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC;aACvC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAE/C,8DAA8D;QAC9D,OAAO;YACL,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;YAClE,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;YACnE,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ;YACjF,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAChF,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC1D,aAAa,EACX,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;gBACpC,CAAC,CAAC,IAAI,CAAC,aAAa;gBACpB,CAAC,CAAC,4BAA4B;YAClC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI;YACxD,SAAS,EACP,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAChC,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,uFAAuF;SAC9F,CAAA;IACH,CAAC;IAEO,kBAAkB,CACxB,EAAkD,EAClD,OAAyB,EACzB,IAAW,EACX,UAA8B;QAE9B,qBAAqB,CAAC,OAAO,CAAC,CAAA;QAC9B,MAAM,gBAAgB,GAAG,OAAO,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAA;QACpE,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,WAAW,CAAA;QACrC,MAAM,cAAc,GAAG,sBAAsB,CAC3C,OAAO,CAAC,QAAQ,EAChB,MAAM,EACN,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,yBAAyB,CAAC,EACnE,EAAE,CACH,CAAA;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,QAAQ,EAAE,MAAM;YAChB,kBAAkB,EAAE,gBAAgB;YACpC,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,eAAe,EAAE,cAAc;YAC/B,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;SACxC,CAAC,CAAA;QAEF,IAAI,gBAAgB,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,OAAO,GAAkB;YAC7B,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;YAC1D,QAAQ;SACT,CAAA;QAED,sBAAsB;QACtB,MAAM,GAAG,GAAG,UAAU,CAAA;QACtB,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAA;YAC9B,OAAO,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,CAAA;YACnD,OAAO,CAAC,mBAAmB,GAAG,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAA;YAC3D,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAA;YAC1C,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAA;YACtD,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,CAAA;YACtD,OAAO,CAAC,iBAAiB,GAAG,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAA;YAExD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;YAC/C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,sBAAsB,CAAA;YAE/F,OAAO,CAAC,SAAS,GAAG,SAAS,CAAA;YAC7B,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;YACrB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAA;YACtB,OAAO,CAAC,SAAS,GAAG,2BAA2B,CAAA;YAE/C,MAAM,QAAQ,GAAG,eAAe,CAAC;gBAC/B,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,QAAQ,EAAE,OAAO,CAAC,QAAmC;aACtD,CAAC,CAAA;YACF,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAA;YAE5B,MAAM,UAAU,GAAG,+BAA+B,CAAC;gBACjD,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,QAAQ,EAAE,OAAO,CAAC,QAAmC;gBACrD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,SAAS;gBACT,KAAK;gBACL,QAAQ;gBACR,KAAK;aACN,CAAC,CAAA;YACF,OAAO,CAAC,SAAS,GAAG,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAA;QACzE,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,uBAAuB,CACrB,EAAkD,EAClD,OAAyB,EACzB,UAA6B;QAE7B,OAAO,KAAK,EAAE,GAAG,IAAW,EAAoB,EAAE;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;YACtE,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;YACjC,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAsB;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,sBAAsB,EAAE;YAClE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAA;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACnD,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;YACvD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,eAAe,CAAC,uDAAuD,EAAE;oBACjF,UAAU,EAAE,GAAG;oBACf,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;QAC9B,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE;gBAC5D,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,QAAQ,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC;aACvC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;QACjF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,EAAE;gBAC1D,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBACvC,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,CAAC;YAChE,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;YAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;YAC9F,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE;oBACnE,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,UAAU;oBACV,QAAQ,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC;iBACvC,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YAChF,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,OAAM;YACR,CAAC;YACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,oBAAoB,CAAC,8BAA8B,EAAE;oBAC7D,UAAU;oBACV,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;oBACnF,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,EAAE;oBAC7D,UAAU;oBACV,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;oBACnF,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,EAAE;oBAC/D,UAAU;oBACV,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,CAAC,0CAA0C,EAAE;oBACjE,UAAU;oBACV,QAAQ,EAAE,QAAQ;iBACnB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,IAAI,CAAC,kBAAkB,WAAW,EAC7D,EAAE,UAAU,EAAE,CACf,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,OAAoB,EAAE;QACxE,IAAI,SAAkB,CAAA;QACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;YACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YACpE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE;oBACvE,GAAG,IAAI;oBACP,MAAM;oBACN,OAAO,EAAE;wBACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAClE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC5D,GAAG,IAAI,CAAC,OAAO;qBAChB;oBACD,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAA;gBACF,YAAY,CAAC,OAAO,CAAC,CAAA;gBACrB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;wBAC1D,MAAM,IAAI,qBAAqB,CAAC,iDAAiD,EAAE;4BACjF,UAAU,EAAE,GAAG;4BACf,QAAQ,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC;yBACvC,CAAC,CAAA;oBACJ,CAAC;oBACD,OAAO,QAAQ,CAAA;gBACjB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,OAAO,CAAC,CAAA;gBACrB,SAAS,GAAG,KAAK,CAAA;gBACjB,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBAC/B,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;wBACxB,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;oBACnF,CAAC;oBACD,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC5E,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAA;QACjD,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAChF,CAAC;CACF;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,OAAO,cAAc;IAChB,MAAM,CAAQ;IACd,UAAU,CAAS;IACnB,WAAW,CAAS;IAE7B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;QACnD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,GAAG,CACP,EAAoC,EACpC,UAA6B,EAAE;QAE/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,uBAAuB,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;QACxD,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,SAAS,CAAA;QAClE,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW;YACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,OAAO,EAAE;YAClD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ;YACxC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,WAAW;YACrD,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,UAAU;YACtD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC;YACjD,QAAQ,EAAE;gBACR,GAAG,OAAO,CAAC,QAAQ;gBACnB,eAAe,EAAE,IAAI;gBACrB,WAAW,EAAE,OAAO;gBACpB,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,yBAAyB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc;aACjF;SACF,CAAC,CAAA;IACJ,CAAC;CACF;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,UAAU,uBAAuB,CAAC,SAAkC;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC/C,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IACrD,MAAM,cAAc,GAAG,WAAW,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAA;IAC/D,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IACnG,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI,YAAY,CAAC,cAAc,EAAE,SAAS,CAAC,KAAK,IAAI,CAAA;IAE5G,IAAI,OAAO,EAAE,CAAC;QACZ,OAAM;IACR,CAAC;IAED,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CACV,sHAAsH,CACvH,CAAA;QACD,OAAM;IACR,CAAC;IAED,MAAM,IAAI,yBAAyB,CACjC,yIAAyI,EACzI,EAAE,QAAQ,EAAE,SAAS,EAAE,CACxB,CAAA;AACH,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@sernixa/sdk",
+  "version": "0.1.0",
+  "description": "Sernixa TypeScript SDK — governed tool and agent execution with MCP call-gate support",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "npm run build && node --test test/*.test.mjs"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "license": "MIT",
+  "author": "Sernixa Team",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/abhishekdhull63/Sernixa.ai-Web.git",
+    "directory": "packages/sdk"
+  },
+  "keywords": [
+    "sernixa",
+    "mcp",
+    "governance",
+    "agent",
+    "ai-safety",
+    "sdk",
+    "tool-governance"
+  ]
+}