@tenova/swt3-ai 0.3.4 → 0.3.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +77 -2
- package/dist/adapters/anthropic.d.ts +32 -0
- package/dist/adapters/anthropic.d.ts.map +1 -0
- package/dist/adapters/anthropic.js +299 -0
- package/dist/adapters/anthropic.js.map +1 -0
- package/dist/adapters/bedrock.d.ts +33 -0
- package/dist/adapters/bedrock.d.ts.map +1 -0
- package/dist/adapters/bedrock.js +267 -0
- package/dist/adapters/bedrock.js.map +1 -0
- package/dist/adapters/openai.d.ts +19 -0
- package/dist/adapters/openai.d.ts.map +1 -0
- package/dist/adapters/openai.js +288 -0
- package/dist/adapters/openai.js.map +1 -0
- package/dist/adapters/vercel-ai.d.ts +64 -0
- package/dist/adapters/vercel-ai.d.ts.map +1 -0
- package/dist/adapters/vercel-ai.js +68 -0
- package/dist/adapters/vercel-ai.js.map +1 -0
- package/dist/buffer.d.ts +42 -0
- package/dist/buffer.d.ts.map +1 -0
- package/dist/buffer.js +161 -0
- package/dist/buffer.js.map +1 -0
- package/dist/clearing.d.ts +29 -0
- package/dist/clearing.d.ts.map +1 -0
- package/dist/clearing.js +308 -0
- package/dist/clearing.js.map +1 -0
- package/dist/demo.d.ts +11 -0
- package/dist/demo.d.ts.map +1 -0
- package/dist/demo.js +238 -0
- package/dist/demo.js.map +1 -0
- package/dist/fingerprint.d.ts +29 -0
- package/dist/fingerprint.d.ts.map +1 -0
- package/dist/fingerprint.js +57 -0
- package/dist/fingerprint.js.map +1 -0
- package/dist/handoff.d.ts +17 -0
- package/dist/handoff.d.ts.map +1 -0
- package/dist/handoff.js +82 -0
- package/dist/handoff.js.map +1 -0
- package/dist/index.d.ts +22 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +20 -0
- package/dist/index.js.map +1 -0
- package/dist/signing.d.ts +20 -0
- package/dist/signing.d.ts.map +1 -0
- package/dist/signing.js +28 -0
- package/dist/signing.js.map +1 -0
- package/dist/types.d.ts +98 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +17 -0
- package/dist/types.js.map +1 -0
- package/dist/witness.d.ts +142 -0
- package/dist/witness.d.ts.map +1 -0
- package/dist/witness.js +345 -0
- package/dist/witness.js.map +1 -0
- package/package.json +1 -1
package/dist/types.d.ts
ADDED
|
@@ -0,0 +1,98 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SWT3 AI Witness SDK — Type definitions.
|
|
3
|
+
*/
|
|
4
|
+
export interface WitnessConfig {
|
|
5
|
+
endpoint: string;
|
|
6
|
+
apiKey: string;
|
|
7
|
+
tenantId: string;
|
|
8
|
+
clearingLevel: 0 | 1 | 2 | 3;
|
|
9
|
+
bufferSize: number;
|
|
10
|
+
flushInterval: number;
|
|
11
|
+
timeout: number;
|
|
12
|
+
maxRetries: number;
|
|
13
|
+
latencyThresholdMs: number;
|
|
14
|
+
guardrailsRequired: number;
|
|
15
|
+
guardrailNames: string[];
|
|
16
|
+
procedures?: string[];
|
|
17
|
+
factorHandoff?: "file";
|
|
18
|
+
factorHandoffPath?: string;
|
|
19
|
+
agentId?: string;
|
|
20
|
+
signingKey?: string;
|
|
21
|
+
cycleId?: string;
|
|
22
|
+
policyVersion?: string;
|
|
23
|
+
}
|
|
24
|
+
export interface WitnessPayload {
|
|
25
|
+
procedure_id: string;
|
|
26
|
+
factor_a: number;
|
|
27
|
+
factor_b: number;
|
|
28
|
+
factor_c: number;
|
|
29
|
+
clearing_level: number;
|
|
30
|
+
anchor_fingerprint: string;
|
|
31
|
+
anchor_epoch: number;
|
|
32
|
+
fingerprint_timestamp_ms: number;
|
|
33
|
+
ai_model_id?: string;
|
|
34
|
+
ai_prompt_hash?: string;
|
|
35
|
+
ai_response_hash?: string;
|
|
36
|
+
ai_system_prompt_hash?: string;
|
|
37
|
+
ai_latency_ms?: number;
|
|
38
|
+
ai_input_tokens?: number;
|
|
39
|
+
ai_output_tokens?: number;
|
|
40
|
+
ai_context?: {
|
|
41
|
+
provider?: string;
|
|
42
|
+
guardrails?: string[];
|
|
43
|
+
system_fingerprint?: string;
|
|
44
|
+
tool_name?: string;
|
|
45
|
+
tool_call_id?: string;
|
|
46
|
+
access_target?: string;
|
|
47
|
+
access_scope?: string;
|
|
48
|
+
access_granted?: boolean;
|
|
49
|
+
cycle_id?: string;
|
|
50
|
+
};
|
|
51
|
+
agent_id?: string;
|
|
52
|
+
cycle_id?: string;
|
|
53
|
+
payload_signature?: string;
|
|
54
|
+
policy_version_hash?: string;
|
|
55
|
+
}
|
|
56
|
+
export interface WitnessReceipt {
|
|
57
|
+
procedure_id: string;
|
|
58
|
+
verdict: "PASS" | "FAIL" | string;
|
|
59
|
+
swt3_anchor: string;
|
|
60
|
+
clearing_level: number;
|
|
61
|
+
witnessed_at: string;
|
|
62
|
+
verification_url: string;
|
|
63
|
+
ok: boolean;
|
|
64
|
+
error?: string;
|
|
65
|
+
}
|
|
66
|
+
export interface BatchResponse {
|
|
67
|
+
ok: boolean;
|
|
68
|
+
tenant_id: string;
|
|
69
|
+
total: number;
|
|
70
|
+
accepted: number;
|
|
71
|
+
rejected: number;
|
|
72
|
+
receipts: WitnessReceipt[];
|
|
73
|
+
}
|
|
74
|
+
export interface InferenceRecord {
|
|
75
|
+
modelId: string;
|
|
76
|
+
modelHash: string;
|
|
77
|
+
promptHash: string;
|
|
78
|
+
responseHash: string;
|
|
79
|
+
latencyMs: number;
|
|
80
|
+
inputTokens?: number;
|
|
81
|
+
outputTokens?: number;
|
|
82
|
+
guardrailsActive: number;
|
|
83
|
+
guardrailsRequired: number;
|
|
84
|
+
guardrailPassed: boolean;
|
|
85
|
+
hasRefusal: boolean;
|
|
86
|
+
provider: string;
|
|
87
|
+
systemFingerprint?: string;
|
|
88
|
+
systemPromptHash?: string;
|
|
89
|
+
guardrailNames: string[];
|
|
90
|
+
toolName?: string;
|
|
91
|
+
toolCallId?: string;
|
|
92
|
+
accessTarget?: string;
|
|
93
|
+
accessGranted?: boolean;
|
|
94
|
+
accessScope?: string;
|
|
95
|
+
}
|
|
96
|
+
/** Valid AI procedure IDs from SWT3 Spec v1.2.0 */
|
|
97
|
+
export declare const AI_PROCEDURES: Set<string>;
|
|
98
|
+
//# sourceMappingURL=types.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB,EAAE,MAAM,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mDAAmD;AACnD,eAAO,MAAM,aAAa,aAWxB,CAAC"}
|
package/dist/types.js
ADDED
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SWT3 AI Witness SDK — Type definitions.
|
|
3
|
+
*/
|
|
4
|
+
/** Valid AI procedure IDs from SWT3 Spec v1.2.0 */
|
|
5
|
+
export const AI_PROCEDURES = new Set([
|
|
6
|
+
"AI-INF.1", "AI-INF.2", "AI-INF.3",
|
|
7
|
+
"AI-MDL.1", "AI-MDL.2", "AI-MDL.3",
|
|
8
|
+
"AI-GRD.1", "AI-GRD.2", "AI-GRD.3",
|
|
9
|
+
"AI-FAIR.1", "AI-FAIR.2",
|
|
10
|
+
"AI-DATA.1", "AI-DATA.2",
|
|
11
|
+
"AI-HITL.1", "AI-HITL.2",
|
|
12
|
+
"AI-EXPL.1", "AI-EXPL.2",
|
|
13
|
+
"AI-TOOL.1",
|
|
14
|
+
"AI-ID.1",
|
|
15
|
+
"AI-ACC.1",
|
|
16
|
+
]);
|
|
17
|
+
//# sourceMappingURL=types.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAmGH,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IACnC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW;IACX,SAAS;IACT,UAAU;CACX,CAAC,CAAC"}
|
|
@@ -0,0 +1,142 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SWT3 AI Witness SDK — Core Witness class.
|
|
3
|
+
*
|
|
4
|
+
* Usage:
|
|
5
|
+
* import { Witness } from "@tenova/swt3-ai";
|
|
6
|
+
* import OpenAI from "openai";
|
|
7
|
+
*
|
|
8
|
+
* const witness = new Witness({
|
|
9
|
+
* endpoint: "https://sovereign.tenova.io",
|
|
10
|
+
* apiKey: "axm_live_...",
|
|
11
|
+
* tenantId: "YOUR_TENANT_ID",
|
|
12
|
+
* });
|
|
13
|
+
*
|
|
14
|
+
* const client = witness.wrap(new OpenAI()) as OpenAI;
|
|
15
|
+
* const response = await client.chat.completions.create({ ... });
|
|
16
|
+
*
|
|
17
|
+
* // Graceful shutdown
|
|
18
|
+
* await witness.flush();
|
|
19
|
+
*
|
|
20
|
+
* Copyright (c) 2026 Tenable Nova LLC. Apache 2.0. Patent pending.
|
|
21
|
+
*/
|
|
22
|
+
import { type VercelOnFinishOptions } from "./adapters/vercel-ai.js";
|
|
23
|
+
import type { WitnessReceipt, InferenceRecord } from "./types.js";
|
|
24
|
+
export interface WitnessOptions {
|
|
25
|
+
endpoint: string;
|
|
26
|
+
apiKey: string;
|
|
27
|
+
tenantId: string;
|
|
28
|
+
clearingLevel?: 0 | 1 | 2 | 3;
|
|
29
|
+
bufferSize?: number;
|
|
30
|
+
flushInterval?: number;
|
|
31
|
+
timeout?: number;
|
|
32
|
+
maxRetries?: number;
|
|
33
|
+
latencyThresholdMs?: number;
|
|
34
|
+
guardrailsRequired?: number;
|
|
35
|
+
guardrailNames?: string[];
|
|
36
|
+
procedures?: string[];
|
|
37
|
+
factorHandoff?: "file";
|
|
38
|
+
factorHandoffPath?: string;
|
|
39
|
+
agentId?: string;
|
|
40
|
+
signingKey?: string;
|
|
41
|
+
cycleId?: string;
|
|
42
|
+
strict?: boolean;
|
|
43
|
+
policyVersion?: string;
|
|
44
|
+
}
|
|
45
|
+
/**
|
|
46
|
+
* Raised when strict (gatekeeper) mode blocks an inference due to
|
|
47
|
+
* insufficient guardrails. The inference never reaches the AI model.
|
|
48
|
+
*/
|
|
49
|
+
export declare class GatekeeperError extends Error {
|
|
50
|
+
readonly required: number;
|
|
51
|
+
readonly active: number;
|
|
52
|
+
readonly missingNames: string[];
|
|
53
|
+
constructor(required: number, active: number, missingNames?: string[]);
|
|
54
|
+
}
|
|
55
|
+
export declare class Witness {
|
|
56
|
+
private config;
|
|
57
|
+
private buffer;
|
|
58
|
+
private handoffWarned;
|
|
59
|
+
private _strict;
|
|
60
|
+
constructor(options: WitnessOptions);
|
|
61
|
+
/**
|
|
62
|
+
* Wrap an AI client with transparent witnessing.
|
|
63
|
+
*
|
|
64
|
+
* Supported: OpenAI, Anthropic
|
|
65
|
+
* Returns a proxy that behaves identically to the original client.
|
|
66
|
+
*
|
|
67
|
+
* Usage:
|
|
68
|
+
* const client = witness.wrap(new OpenAI()) as OpenAI;
|
|
69
|
+
* const client = witness.wrap(new Anthropic()) as Anthropic;
|
|
70
|
+
*/
|
|
71
|
+
wrap(client: unknown): unknown;
|
|
72
|
+
/** Whether strict (gatekeeper) mode is enabled. Used by adapters. */
|
|
73
|
+
get strict(): boolean;
|
|
74
|
+
/**
|
|
75
|
+
* Pre-call guardrail gate (strict mode only).
|
|
76
|
+
*
|
|
77
|
+
* Evaluates whether configured guardrail requirements are met BEFORE
|
|
78
|
+
* the inference call reaches the AI model. If requirements are not met,
|
|
79
|
+
* throws `GatekeeperError` and mints an AI-GRD.3 anchor recording
|
|
80
|
+
* the rejection. The rejection is evidence — it is enqueued for flush.
|
|
81
|
+
*
|
|
82
|
+
* This method is SYNCHRONOUS — evaluates local config only, no network.
|
|
83
|
+
*
|
|
84
|
+
* @throws {GatekeeperError} if guardrail requirements are not met
|
|
85
|
+
*/
|
|
86
|
+
gateCheck(_messages?: unknown, _model?: string): void;
|
|
87
|
+
/**
|
|
88
|
+
* Wrap a function as a witnessed tool call (AI-TOOL.1).
|
|
89
|
+
*
|
|
90
|
+
* Usage:
|
|
91
|
+
* const search = witness.wrapTool(searchDatabase, "search_db");
|
|
92
|
+
* const result = await search("SELECT ...");
|
|
93
|
+
*
|
|
94
|
+
* Each call mints an AI-TOOL.1 anchor with:
|
|
95
|
+
* factor_a = 1 (tool was called)
|
|
96
|
+
* factor_b = latency_ms
|
|
97
|
+
* factor_c = 1 if succeeded, 0 if exception raised
|
|
98
|
+
*/
|
|
99
|
+
wrapTool<T extends (...args: any[]) => any>(fn: T, toolName?: string): T;
|
|
100
|
+
/**
|
|
101
|
+
* Wrap a function as a witnessed access attempt (AI-ACC.1).
|
|
102
|
+
*
|
|
103
|
+
* Usage:
|
|
104
|
+
* const queryDb = witness.wrapAccess(dbQuery, "prod-database", "read-only analytics");
|
|
105
|
+
* const result = await queryDb("SELECT ...");
|
|
106
|
+
*
|
|
107
|
+
* Each call mints an AI-ACC.1 anchor with:
|
|
108
|
+
* factor_a = 1 (access attempt occurred)
|
|
109
|
+
* factor_b = 1 if within declared scope (or no scope set), 0 if out of scope
|
|
110
|
+
* factor_c = 1 if access granted, 0 if denied/failed
|
|
111
|
+
*/
|
|
112
|
+
wrapAccess<T extends (...args: any[]) => any>(fn: T, resourceName?: string, scope?: string): T;
|
|
113
|
+
/**
|
|
114
|
+
* Record a witnessed inference. Extracts factors, applies clearing,
|
|
115
|
+
* and enqueues payloads for background flush.
|
|
116
|
+
*
|
|
117
|
+
* If factorHandoff is configured, factors are written to the handoff
|
|
118
|
+
* destination BEFORE clearing proceeds. If the handoff fails, the
|
|
119
|
+
* payload is NOT transmitted.
|
|
120
|
+
*/
|
|
121
|
+
record(inference: InferenceRecord): void;
|
|
122
|
+
/**
|
|
123
|
+
* Create a Vercel AI SDK `onFinish` callback for streamText / generateText.
|
|
124
|
+
*
|
|
125
|
+
* Usage:
|
|
126
|
+
* const result = await streamText({
|
|
127
|
+
* model: openai("gpt-4o"),
|
|
128
|
+
* prompt: myPrompt,
|
|
129
|
+
* onFinish: witness.vercelOnFinish({ promptText: myPrompt }),
|
|
130
|
+
* });
|
|
131
|
+
*/
|
|
132
|
+
vercelOnFinish(options?: VercelOnFinishOptions): (result: unknown) => void;
|
|
133
|
+
/** Force-flush all buffered payloads. */
|
|
134
|
+
flush(): Promise<WitnessReceipt[]>;
|
|
135
|
+
/** Stop the witness and flush remaining payloads. */
|
|
136
|
+
stop(): Promise<WitnessReceipt[]>;
|
|
137
|
+
/** Number of payloads waiting. */
|
|
138
|
+
get pending(): number;
|
|
139
|
+
/** All receipts from completed flushes. */
|
|
140
|
+
get receipts(): WitnessReceipt[];
|
|
141
|
+
}
|
|
142
|
+
//# sourceMappingURL=witness.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"witness.d.ts","sourceRoot":"","sources":["../src/witness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH,OAAO,EAAwB,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,KAAK,EAAiC,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;gBAEpB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAE,MAAM,EAAO;CAS1E;AAED,qBAAa,OAAO;IAClB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,OAAO,CAAU;gBAEb,OAAO,EAAE,cAAc;IAqCnC;;;;;;;;;OASG;IACH,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO;IAyB9B,qEAAqE;IACrE,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IA2BrD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC;IAiExE;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC1C,EAAE,EAAE,CAAC,EACL,YAAY,CAAC,EAAE,MAAM,EACrB,KAAK,CAAC,EAAE,MAAM,GACb,CAAC;IAiEJ;;;;;;;OAOG;IACH,MAAM,CAAC,SAAS,EAAE,eAAe,GAAG,IAAI;IA0CxC;;;;;;;;;OASG;IACH,cAAc,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;IAI1E,yCAAyC;IACnC,KAAK,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAIxC,qDAAqD;IAC/C,IAAI,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAIvC,kCAAkC;IAClC,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,2CAA2C;IAC3C,IAAI,QAAQ,IAAI,cAAc,EAAE,CAE/B;CACF"}
|
package/dist/witness.js
ADDED
|
@@ -0,0 +1,345 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* SWT3 AI Witness SDK — Core Witness class.
|
|
3
|
+
*
|
|
4
|
+
* Usage:
|
|
5
|
+
* import { Witness } from "@tenova/swt3-ai";
|
|
6
|
+
* import OpenAI from "openai";
|
|
7
|
+
*
|
|
8
|
+
* const witness = new Witness({
|
|
9
|
+
* endpoint: "https://sovereign.tenova.io",
|
|
10
|
+
* apiKey: "axm_live_...",
|
|
11
|
+
* tenantId: "YOUR_TENANT_ID",
|
|
12
|
+
* });
|
|
13
|
+
*
|
|
14
|
+
* const client = witness.wrap(new OpenAI()) as OpenAI;
|
|
15
|
+
* const response = await client.chat.completions.create({ ... });
|
|
16
|
+
*
|
|
17
|
+
* // Graceful shutdown
|
|
18
|
+
* await witness.flush();
|
|
19
|
+
*
|
|
20
|
+
* Copyright (c) 2026 Tenable Nova LLC. Apache 2.0. Patent pending.
|
|
21
|
+
*/
|
|
22
|
+
import { randomUUID } from "node:crypto";
|
|
23
|
+
import { sha256Truncated } from "./fingerprint.js";
|
|
24
|
+
import { extractPayloads, extractGatekeeperPayload } from "./clearing.js";
|
|
25
|
+
import { WitnessBuffer } from "./buffer.js";
|
|
26
|
+
import { writeHandoffFiles } from "./handoff.js";
|
|
27
|
+
import { wrapOpenAI } from "./adapters/openai.js";
|
|
28
|
+
import { wrapAnthropic } from "./adapters/anthropic.js";
|
|
29
|
+
import { wrapBedrock } from "./adapters/bedrock.js";
|
|
30
|
+
import { createVercelOnFinish } from "./adapters/vercel-ai.js";
|
|
31
|
+
/**
|
|
32
|
+
* Raised when strict (gatekeeper) mode blocks an inference due to
|
|
33
|
+
* insufficient guardrails. The inference never reaches the AI model.
|
|
34
|
+
*/
|
|
35
|
+
export class GatekeeperError extends Error {
|
|
36
|
+
required;
|
|
37
|
+
active;
|
|
38
|
+
missingNames;
|
|
39
|
+
constructor(required, active, missingNames = []) {
|
|
40
|
+
const msg = `Gatekeeper blocked: ${active} guardrails active, ${required} required` +
|
|
41
|
+
(missingNames.length ? `. Missing: ${missingNames.join(", ")}` : "");
|
|
42
|
+
super(msg);
|
|
43
|
+
this.name = "GatekeeperError";
|
|
44
|
+
this.required = required;
|
|
45
|
+
this.active = active;
|
|
46
|
+
this.missingNames = missingNames;
|
|
47
|
+
}
|
|
48
|
+
}
|
|
49
|
+
export class Witness {
|
|
50
|
+
config;
|
|
51
|
+
buffer;
|
|
52
|
+
handoffWarned = false;
|
|
53
|
+
_strict;
|
|
54
|
+
constructor(options) {
|
|
55
|
+
if (!options.endpoint)
|
|
56
|
+
throw new Error("endpoint is required");
|
|
57
|
+
if (!options.apiKey)
|
|
58
|
+
throw new Error("apiKey is required");
|
|
59
|
+
if (!options.apiKey.startsWith("axm_"))
|
|
60
|
+
throw new Error("apiKey must start with 'axm_'");
|
|
61
|
+
if (!options.tenantId)
|
|
62
|
+
throw new Error("tenantId is required");
|
|
63
|
+
if (options.factorHandoff && options.factorHandoff !== "file") {
|
|
64
|
+
throw new Error("factorHandoff must be 'file' (other methods planned for v0.4.0)");
|
|
65
|
+
}
|
|
66
|
+
if (options.factorHandoff === "file" && !options.factorHandoffPath) {
|
|
67
|
+
throw new Error("factorHandoffPath is required when factorHandoff is 'file'");
|
|
68
|
+
}
|
|
69
|
+
this.config = {
|
|
70
|
+
endpoint: options.endpoint.replace(/\/+$/, ""),
|
|
71
|
+
apiKey: options.apiKey,
|
|
72
|
+
tenantId: options.tenantId,
|
|
73
|
+
clearingLevel: options.clearingLevel ?? 1,
|
|
74
|
+
bufferSize: options.bufferSize ?? 10,
|
|
75
|
+
flushInterval: options.flushInterval ?? 5.0,
|
|
76
|
+
timeout: options.timeout ?? 10000,
|
|
77
|
+
maxRetries: options.maxRetries ?? 3,
|
|
78
|
+
latencyThresholdMs: options.latencyThresholdMs ?? 30000,
|
|
79
|
+
guardrailsRequired: options.guardrailsRequired ?? 0,
|
|
80
|
+
guardrailNames: options.guardrailNames ?? [],
|
|
81
|
+
procedures: options.procedures,
|
|
82
|
+
factorHandoff: options.factorHandoff,
|
|
83
|
+
factorHandoffPath: options.factorHandoffPath,
|
|
84
|
+
agentId: options.agentId,
|
|
85
|
+
signingKey: options.signingKey,
|
|
86
|
+
cycleId: options.cycleId,
|
|
87
|
+
policyVersion: options.policyVersion,
|
|
88
|
+
};
|
|
89
|
+
this._strict = options.strict ?? false;
|
|
90
|
+
this.buffer = new WitnessBuffer(this.config);
|
|
91
|
+
}
|
|
92
|
+
/**
|
|
93
|
+
* Wrap an AI client with transparent witnessing.
|
|
94
|
+
*
|
|
95
|
+
* Supported: OpenAI, Anthropic
|
|
96
|
+
* Returns a proxy that behaves identically to the original client.
|
|
97
|
+
*
|
|
98
|
+
* Usage:
|
|
99
|
+
* const client = witness.wrap(new OpenAI()) as OpenAI;
|
|
100
|
+
* const client = witness.wrap(new Anthropic()) as Anthropic;
|
|
101
|
+
*/
|
|
102
|
+
wrap(client) {
|
|
103
|
+
const proto = Object.getPrototypeOf(client);
|
|
104
|
+
const name = proto?.constructor?.name ?? "";
|
|
105
|
+
const obj = client;
|
|
106
|
+
// OpenAI: has client.chat.completions
|
|
107
|
+
if (name === "OpenAI" || obj?.chat) {
|
|
108
|
+
return wrapOpenAI(client, this);
|
|
109
|
+
}
|
|
110
|
+
// Anthropic: has client.messages
|
|
111
|
+
if (name === "Anthropic" || (obj?.messages && !obj?.chat)) {
|
|
112
|
+
return wrapAnthropic(client, this);
|
|
113
|
+
}
|
|
114
|
+
// AWS Bedrock: has client.send and client.config
|
|
115
|
+
if (name === "BedrockRuntimeClient" || (obj?.send && obj?.config)) {
|
|
116
|
+
return wrapBedrock(client, this);
|
|
117
|
+
}
|
|
118
|
+
throw new TypeError(`Unsupported client: ${name || "unknown"}. Supported: OpenAI, Anthropic, BedrockRuntimeClient.`);
|
|
119
|
+
}
|
|
120
|
+
/** Whether strict (gatekeeper) mode is enabled. Used by adapters. */
|
|
121
|
+
get strict() {
|
|
122
|
+
return this._strict;
|
|
123
|
+
}
|
|
124
|
+
/**
|
|
125
|
+
* Pre-call guardrail gate (strict mode only).
|
|
126
|
+
*
|
|
127
|
+
* Evaluates whether configured guardrail requirements are met BEFORE
|
|
128
|
+
* the inference call reaches the AI model. If requirements are not met,
|
|
129
|
+
* throws `GatekeeperError` and mints an AI-GRD.3 anchor recording
|
|
130
|
+
* the rejection. The rejection is evidence — it is enqueued for flush.
|
|
131
|
+
*
|
|
132
|
+
* This method is SYNCHRONOUS — evaluates local config only, no network.
|
|
133
|
+
*
|
|
134
|
+
* @throws {GatekeeperError} if guardrail requirements are not met
|
|
135
|
+
*/
|
|
136
|
+
gateCheck(_messages, _model) {
|
|
137
|
+
const required = this.config.guardrailsRequired;
|
|
138
|
+
const active = this.config.guardrailNames.length;
|
|
139
|
+
const gatePassed = active >= required;
|
|
140
|
+
// Mint AI-GRD.3 anchor regardless of outcome — rejection is evidence
|
|
141
|
+
const policyHash = this.config.policyVersion
|
|
142
|
+
? sha256Truncated(this.config.policyVersion, 12)
|
|
143
|
+
: undefined;
|
|
144
|
+
const payload = extractGatekeeperPayload(this.config.tenantId, required, active, gatePassed, this.config.clearingLevel, this.config.agentId, this.config.signingKey, this.config.cycleId, policyHash);
|
|
145
|
+
this.buffer.enqueueMany([payload]);
|
|
146
|
+
if (!gatePassed) {
|
|
147
|
+
throw new GatekeeperError(required, active);
|
|
148
|
+
}
|
|
149
|
+
}
|
|
150
|
+
/**
|
|
151
|
+
* Wrap a function as a witnessed tool call (AI-TOOL.1).
|
|
152
|
+
*
|
|
153
|
+
* Usage:
|
|
154
|
+
* const search = witness.wrapTool(searchDatabase, "search_db");
|
|
155
|
+
* const result = await search("SELECT ...");
|
|
156
|
+
*
|
|
157
|
+
* Each call mints an AI-TOOL.1 anchor with:
|
|
158
|
+
* factor_a = 1 (tool was called)
|
|
159
|
+
* factor_b = latency_ms
|
|
160
|
+
* factor_c = 1 if succeeded, 0 if exception raised
|
|
161
|
+
*/
|
|
162
|
+
wrapTool(fn, toolName) {
|
|
163
|
+
const name = toolName ?? fn.name ?? "anonymous";
|
|
164
|
+
const self = this;
|
|
165
|
+
const wrapper = function (...args) {
|
|
166
|
+
const callId = randomUUID().replace(/-/g, "").slice(0, 12);
|
|
167
|
+
const start = performance.now();
|
|
168
|
+
let succeeded = true;
|
|
169
|
+
let result;
|
|
170
|
+
const finish = () => {
|
|
171
|
+
const elapsedMs = Math.round(performance.now() - start);
|
|
172
|
+
const inputHash = sha256Truncated(JSON.stringify(args));
|
|
173
|
+
const outputHash = sha256Truncated(succeeded ? JSON.stringify(result) : "ERROR");
|
|
174
|
+
const record = {
|
|
175
|
+
modelId: name,
|
|
176
|
+
modelHash: sha256Truncated(name),
|
|
177
|
+
promptHash: inputHash,
|
|
178
|
+
responseHash: outputHash,
|
|
179
|
+
latencyMs: elapsedMs,
|
|
180
|
+
guardrailsActive: 0,
|
|
181
|
+
guardrailsRequired: 0,
|
|
182
|
+
guardrailPassed: true,
|
|
183
|
+
hasRefusal: !succeeded,
|
|
184
|
+
provider: "tool",
|
|
185
|
+
guardrailNames: [],
|
|
186
|
+
toolName: name,
|
|
187
|
+
toolCallId: callId,
|
|
188
|
+
};
|
|
189
|
+
self.record(record);
|
|
190
|
+
};
|
|
191
|
+
try {
|
|
192
|
+
result = fn.apply(this, args);
|
|
193
|
+
}
|
|
194
|
+
catch (err) {
|
|
195
|
+
succeeded = false;
|
|
196
|
+
finish();
|
|
197
|
+
throw err;
|
|
198
|
+
}
|
|
199
|
+
// Handle async functions (Promise detection)
|
|
200
|
+
if (result && typeof result.then === "function") {
|
|
201
|
+
return result.then((v) => {
|
|
202
|
+
result = v;
|
|
203
|
+
finish();
|
|
204
|
+
return v;
|
|
205
|
+
}, (err) => {
|
|
206
|
+
succeeded = false;
|
|
207
|
+
finish();
|
|
208
|
+
throw err;
|
|
209
|
+
});
|
|
210
|
+
}
|
|
211
|
+
finish();
|
|
212
|
+
return result;
|
|
213
|
+
};
|
|
214
|
+
return wrapper;
|
|
215
|
+
}
|
|
216
|
+
/**
|
|
217
|
+
* Wrap a function as a witnessed access attempt (AI-ACC.1).
|
|
218
|
+
*
|
|
219
|
+
* Usage:
|
|
220
|
+
* const queryDb = witness.wrapAccess(dbQuery, "prod-database", "read-only analytics");
|
|
221
|
+
* const result = await queryDb("SELECT ...");
|
|
222
|
+
*
|
|
223
|
+
* Each call mints an AI-ACC.1 anchor with:
|
|
224
|
+
* factor_a = 1 (access attempt occurred)
|
|
225
|
+
* factor_b = 1 if within declared scope (or no scope set), 0 if out of scope
|
|
226
|
+
* factor_c = 1 if access granted, 0 if denied/failed
|
|
227
|
+
*/
|
|
228
|
+
wrapAccess(fn, resourceName, scope) {
|
|
229
|
+
const name = resourceName ?? fn.name ?? "unknown-resource";
|
|
230
|
+
const self = this;
|
|
231
|
+
const wrapper = function (...args) {
|
|
232
|
+
const start = performance.now();
|
|
233
|
+
let granted = true;
|
|
234
|
+
let result;
|
|
235
|
+
const finish = () => {
|
|
236
|
+
const elapsedMs = Math.round(performance.now() - start);
|
|
237
|
+
const inputHash = sha256Truncated(JSON.stringify(args));
|
|
238
|
+
const outputHash = sha256Truncated(granted ? JSON.stringify(result) : "ACCESS_DENIED");
|
|
239
|
+
const record = {
|
|
240
|
+
modelId: name,
|
|
241
|
+
modelHash: sha256Truncated(name),
|
|
242
|
+
promptHash: inputHash,
|
|
243
|
+
responseHash: outputHash,
|
|
244
|
+
latencyMs: elapsedMs,
|
|
245
|
+
guardrailsActive: 0,
|
|
246
|
+
guardrailsRequired: 0,
|
|
247
|
+
guardrailPassed: true,
|
|
248
|
+
hasRefusal: !granted,
|
|
249
|
+
provider: "access",
|
|
250
|
+
guardrailNames: [],
|
|
251
|
+
accessTarget: name,
|
|
252
|
+
accessGranted: granted,
|
|
253
|
+
accessScope: scope,
|
|
254
|
+
};
|
|
255
|
+
self.record(record);
|
|
256
|
+
};
|
|
257
|
+
try {
|
|
258
|
+
result = fn.apply(this, args);
|
|
259
|
+
}
|
|
260
|
+
catch (err) {
|
|
261
|
+
granted = false;
|
|
262
|
+
finish();
|
|
263
|
+
throw err;
|
|
264
|
+
}
|
|
265
|
+
// Handle async functions (Promise detection)
|
|
266
|
+
if (result && typeof result.then === "function") {
|
|
267
|
+
return result.then((v) => {
|
|
268
|
+
result = v;
|
|
269
|
+
finish();
|
|
270
|
+
return v;
|
|
271
|
+
}, (err) => {
|
|
272
|
+
granted = false;
|
|
273
|
+
finish();
|
|
274
|
+
throw err;
|
|
275
|
+
});
|
|
276
|
+
}
|
|
277
|
+
finish();
|
|
278
|
+
return result;
|
|
279
|
+
};
|
|
280
|
+
return wrapper;
|
|
281
|
+
}
|
|
282
|
+
/**
|
|
283
|
+
* Record a witnessed inference. Extracts factors, applies clearing,
|
|
284
|
+
* and enqueues payloads for background flush.
|
|
285
|
+
*
|
|
286
|
+
* If factorHandoff is configured, factors are written to the handoff
|
|
287
|
+
* destination BEFORE clearing proceeds. If the handoff fails, the
|
|
288
|
+
* payload is NOT transmitted.
|
|
289
|
+
*/
|
|
290
|
+
record(inference) {
|
|
291
|
+
// Merge guardrail config
|
|
292
|
+
if (this.config.guardrailNames.length > 0 && inference.guardrailNames.length === 0) {
|
|
293
|
+
inference.guardrailNames = this.config.guardrailNames;
|
|
294
|
+
inference.guardrailsActive = this.config.guardrailNames.length;
|
|
295
|
+
inference.guardrailsRequired = this.config.guardrailsRequired;
|
|
296
|
+
}
|
|
297
|
+
const policyHash = this.config.policyVersion
|
|
298
|
+
? sha256Truncated(this.config.policyVersion, 12)
|
|
299
|
+
: undefined;
|
|
300
|
+
const payloads = extractPayloads(inference, this.config.tenantId, this.config.clearingLevel, this.config.latencyThresholdMs, this.config.guardrailsRequired, this.config.procedures, this.config.agentId, this.config.signingKey, this.config.cycleId, policyHash);
|
|
301
|
+
// Factor handoff: write full (uncleared) data to custody destination
|
|
302
|
+
// BEFORE enqueuing the cleared payload for transmission.
|
|
303
|
+
// If this fails, we do NOT proceed.
|
|
304
|
+
if (this.config.factorHandoff === "file" && this.config.factorHandoffPath) {
|
|
305
|
+
writeHandoffFiles(payloads, inference, this.config.tenantId, this.config.factorHandoffPath);
|
|
306
|
+
if (!this.handoffWarned) {
|
|
307
|
+
this.handoffWarned = true;
|
|
308
|
+
console.info(`\n [SWT3] ${payloads.length} anchors saved locally to ${this.config.factorHandoffPath}` +
|
|
309
|
+
`\n [SWT3] \u26a0 Local anchors won\u2019t survive a compliance audit.` +
|
|
310
|
+
`\n [SWT3] Connect to Axiom Engine \u2192 https://sovereign.tenova.io/signup?ref=sdk (free)\n`);
|
|
311
|
+
}
|
|
312
|
+
}
|
|
313
|
+
this.buffer.enqueueMany(payloads);
|
|
314
|
+
}
|
|
315
|
+
/**
|
|
316
|
+
* Create a Vercel AI SDK `onFinish` callback for streamText / generateText.
|
|
317
|
+
*
|
|
318
|
+
* Usage:
|
|
319
|
+
* const result = await streamText({
|
|
320
|
+
* model: openai("gpt-4o"),
|
|
321
|
+
* prompt: myPrompt,
|
|
322
|
+
* onFinish: witness.vercelOnFinish({ promptText: myPrompt }),
|
|
323
|
+
* });
|
|
324
|
+
*/
|
|
325
|
+
vercelOnFinish(options) {
|
|
326
|
+
return createVercelOnFinish(this, options);
|
|
327
|
+
}
|
|
328
|
+
/** Force-flush all buffered payloads. */
|
|
329
|
+
async flush() {
|
|
330
|
+
return this.buffer.flush();
|
|
331
|
+
}
|
|
332
|
+
/** Stop the witness and flush remaining payloads. */
|
|
333
|
+
async stop() {
|
|
334
|
+
return this.buffer.stop();
|
|
335
|
+
}
|
|
336
|
+
/** Number of payloads waiting. */
|
|
337
|
+
get pending() {
|
|
338
|
+
return this.buffer.pending;
|
|
339
|
+
}
|
|
340
|
+
/** All receipts from completed flushes. */
|
|
341
|
+
get receipts() {
|
|
342
|
+
return this.buffer.receipts;
|
|
343
|
+
}
|
|
344
|
+
}
|
|
345
|
+
//# sourceMappingURL=witness.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"witness.js","sourceRoot":"","sources":["../src/witness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAA8B,MAAM,yBAAyB,CAAC;AAyB3F;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,QAAQ,CAAS;IACjB,MAAM,CAAS;IACf,YAAY,CAAW;IAEhC,YAAY,QAAgB,EAAE,MAAc,EAAE,eAAyB,EAAE;QACvE,MAAM,GAAG,GAAG,uBAAuB,MAAM,uBAAuB,QAAQ,WAAW;YACjF,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,KAAK,CAAC,GAAG,CAAC,CAAC;QACX,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,OAAO;IACV,MAAM,CAAgB;IACtB,MAAM,CAAgB;IACtB,aAAa,GAAG,KAAK,CAAC;IACtB,OAAO,CAAU;IAEzB,YAAY,OAAuB;QACjC,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,CAAC;YACzC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;YACpC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,GAAG;YAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;YACjC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC;YACnC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,KAAK;YACvD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,CAAC;YACnD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC;QAEF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;;OASG;IACH,IAAI,CAAC,MAAe;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAiC,CAAC;QAE9C,sCAAsC;QACtC,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;YACnC,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,iDAAiD;QACjD,IAAI,IAAI,KAAK,sBAAsB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAK,GAA+B,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/F,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,SAAS,CACjB,uBAAuB,IAAI,IAAI,SAAS,uDAAuD,CAChG,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,SAAmB,EAAE,MAAe;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,QAAQ,CAAC;QAEtC,qEAAqE;QACrE,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;YAC1C,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,wBAAwB,CACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,QAAQ,EACR,MAAM,EACN,UAAU,EACV,IAAI,CAAC,MAAM,CAAC,aAAa,EACzB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,UAAU,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAEnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAoC,EAAK,EAAE,QAAiB;QAClE,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC,IAAI,IAAI,WAAW,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC;QAElB,MAAM,OAAO,GAAG,UAAqB,GAAG,IAAW;YACjD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,SAAS,GAAG,IAAI,CAAC;YACrB,IAAI,MAAW,CAAC;YAEhB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAEjF,MAAM,MAAM,GAAoB;oBAC9B,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC;oBAChC,UAAU,EAAE,SAAS;oBACrB,YAAY,EAAE,UAAU;oBACxB,SAAS,EAAE,SAAS;oBACpB,gBAAgB,EAAE,CAAC;oBACnB,kBAAkB,EAAE,CAAC;oBACrB,eAAe,EAAE,IAAI;oBACrB,UAAU,EAAE,CAAC,SAAS;oBACtB,QAAQ,EAAE,MAAM;oBAChB,cAAc,EAAE,EAAE;oBAClB,QAAQ,EAAE,IAAI;oBACd,UAAU,EAAE,MAAM;iBACnB,CAAC;gBAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,KAAK,CAAC;gBAClB,MAAM,EAAE,CAAC;gBACT,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,6CAA6C;YAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChD,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAM,EAAE,EAAE;oBACT,MAAM,GAAG,CAAC,CAAC;oBACX,MAAM,EAAE,CAAC;oBACT,OAAO,CAAC,CAAC;gBACX,CAAC,EACD,CAAC,GAAQ,EAAE,EAAE;oBACX,SAAS,GAAG,KAAK,CAAC;oBAClB,MAAM,EAAE,CAAC;oBACT,MAAM,GAAG,CAAC;gBACZ,CAAC,CACF,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,OAAO,OAAuB,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,UAAU,CACR,EAAK,EACL,YAAqB,EACrB,KAAc;QAEd,MAAM,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC,IAAI,IAAI,kBAAkB,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC;QAElB,MAAM,OAAO,GAAG,UAAqB,GAAG,IAAW;YACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,MAAW,CAAC;YAEhB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAEvF,MAAM,MAAM,GAAoB;oBAC9B,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC;oBAChC,UAAU,EAAE,SAAS;oBACrB,YAAY,EAAE,UAAU;oBACxB,SAAS,EAAE,SAAS;oBACpB,gBAAgB,EAAE,CAAC;oBACnB,kBAAkB,EAAE,CAAC;oBACrB,eAAe,EAAE,IAAI;oBACrB,UAAU,EAAE,CAAC,OAAO;oBACpB,QAAQ,EAAE,QAAQ;oBAClB,cAAc,EAAE,EAAE;oBAClB,YAAY,EAAE,IAAI;oBAClB,aAAa,EAAE,OAAO;oBACtB,WAAW,EAAE,KAAK;iBACnB,CAAC;gBAEF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM,EAAE,CAAC;gBACT,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,6CAA6C;YAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChD,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAM,EAAE,EAAE;oBACT,MAAM,GAAG,CAAC,CAAC;oBACX,MAAM,EAAE,CAAC;oBACT,OAAO,CAAC,CAAC;gBACX,CAAC,EACD,CAAC,GAAQ,EAAE,EAAE;oBACX,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM,EAAE,CAAC;oBACT,MAAM,GAAG,CAAC;gBACZ,CAAC,CACF,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,OAAO,OAAuB,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,SAA0B;QAC/B,yBAAyB;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnF,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;YACtD,SAAS,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;YAC/D,SAAS,CAAC,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAChE,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa;YAC1C,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,QAAQ,GAAG,eAAe,CAC9B,SAAS,EACT,IAAI,CAAC,MAAM,CAAC,QAAQ,EACpB,IAAI,CAAC,MAAM,CAAC,aAAa,EACzB,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,OAAO,EACnB,UAAU,CACX,CAAC;QAEF,qEAAqE;QACrE,yDAAyD;QACzD,oCAAoC;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC1E,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC5F,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,OAAO,CAAC,IAAI,CACV,cAAc,QAAQ,CAAC,MAAM,6BAA6B,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE;oBACzF,wEAAwE;oBACxE,+FAA+F,CAChG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;;OASG;IACH,cAAc,CAAC,OAA+B;QAC5C,OAAO,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAA8B,CAAC;IAC1E,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,kCAAkC;IAClC,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,2CAA2C;IAC3C,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9B,CAAC;CACF"}
|