@vorionsys/platform-core 0.1.0

package/dist/semantic-governance/index.js

@@ -0,0 +1,141 @@
+/**
+ * Semantic Governance Module - Layer 5
+ *
+ * Comprehensive semantic governance for AI agents, addressing the "confused deputy"
+ * problem where authenticated agents can be manipulated via prompt injection.
+ *
+ * This module provides:
+ *
+ * 1. **Instruction Integrity** - Validates system prompts against approved hashes
+ *    and templates to prevent unauthorized instructions.
+ *
+ * 2. **Output Schema Binding** - Constrains agent output to approved schemas
+ *    and scans for prohibited patterns (PII, credentials, etc.).
+ *
+ * 3. **Inference Scope Controls** - Limits what agents can derive from data
+ *    beyond simple data access (e.g., relationship inference, predictions).
+ *
+ * 4. **Context Authentication** - Validates external context sources (RAG, MCP)
+ *    and scans for injection patterns in data plane content.
+ *
+ * 5. **Dual-Channel Authorization** - Separates control plane (trusted instructions)
+ *    from data plane (processed content) to prevent indirect injection.
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   SemanticGovernanceService,
+ *   createSemanticGovernanceService,
+ *   SemanticCredentialManager,
+ *   InferenceLevel,
+ *   TrustTier,
+ * } from './semantic-governance';
+ *
+ * // Create a credential for an agent
+ * const credentialManager = new SemanticCredentialManager();
+ * const credential = credentialManager.createCredential(
+ *   'did:car:a3i:vorion:banquet-advisor',
+ *   'a3i.vorion.banquet-advisor:FHC-L3@1.2.0',
+ *   {
+ *     inferenceScope: {
+ *       globalLevel: InferenceLevel.ENTITY,
+ *       piiInference: { allowed: false, handling: 'redact' },
+ *     },
+ *     contextAuthentication: {
+ *       required: true,
+ *       minTrustTier: TrustTier.T2_PROVISIONAL,
+ *     },
+ *   }
+ * );
+ *
+ * // Create the service
+ * const service = createSemanticGovernanceService(credential);
+ *
+ * // Validate an interaction
+ * const result = await service.validateInteraction({
+ *   id: 'interaction-123',
+ *   agent: { did: 'did:car:...', carId: 'a3i.vorion...', trustTier: TrustTier.T3_MONITORED, domains: ['F', 'H'] },
+ *   message: { source: 'user-direct-input', content: 'Plan a banquet', authenticated: true, timestamp: new Date() },
+ * });
+ *
+ * if (!result.valid) {
+ *   console.error('Validation failed:', result.reason);
+ * }
+ * ```
+ *
+ * @packageDocumentation
+ * @module @vorion/semantic-governance
+ */
+export { 
+// Enums
+TrustTier, InferenceLevel, 
+// Constants
+INFERENCE_LEVEL_NAMES, 
+// Default configurations
+DEFAULT_INSTRUCTION_INTEGRITY, DEFAULT_OUTPUT_BINDING, DEFAULT_INFERENCE_SCOPE, DEFAULT_CONTEXT_AUTHENTICATION, DEFAULT_DUAL_CHANNEL, 
+// Zod schemas
+DomainCodeSchema, TrustTierSchema, InferenceLevelSchema, InstructionTemplateSchema, InstructionSourceSchema, InstructionIntegritySchema, InstructionValidationResultSchema, TemplateMatchResultSchema, OutputSchemaSchema, ProhibitedPatternSchema, OutputBindingSchema, PatternScanResultSchema, OutputValidationResultSchema, SanitizedOutputSchema, InferenceOperationTypeSchema, InferenceOperationSchema, DomainInferenceOverrideSchema, DerivedKnowledgeHandlingSchema, PIIInferenceConfigSchema, InferenceScopeSchema, DerivedKnowledgeSchema, InferenceValidationResultSchema, HandlingResultSchema, PIICheckResultSchema, ContentIntegritySchema, ContextAuthenticationRequirementsSchema, TrustProfileSchema, ProviderValidationResultSchema, ContentValidationResultSchema, InjectionScanResultSchema, ContextValidationResultSchema, MessageChannelSchema, DualChannelConfigSchema, MessageClassificationSchema, EnforcementResultSchema, SemanticGovernanceCredentialSchema, SemanticGovernanceConfigSchema, AgentIdentitySchema, ActionRequestSchema, ActionRecordSchema, AgentInteractionSchema, PreActionResultSchema, PostActionResultSchema, SemanticValidationResultSchema, } from './types.js';
+// =============================================================================
+// INSTRUCTION VALIDATOR
+// =============================================================================
+export { InstructionValidator, InstructionValidationError, createDefaultInstructionValidator, detectInjectionPatterns, COMMON_INJECTION_PATTERNS, } from './instruction-validator.js';
+// =============================================================================
+// OUTPUT VALIDATOR
+// =============================================================================
+export { OutputValidator, OutputValidationError, createDefaultOutputValidator, BUILT_IN_PROHIBITED_PATTERNS, } from './output-validator.js';
+// =============================================================================
+// INFERENCE VALIDATOR
+// =============================================================================
+export { InferenceValidator, InferenceScopeError, createDefaultInferenceValidator, createRestrictiveInferenceValidator, OPERATION_LEVEL_REQUIREMENTS, } from './inference-validator.js';
+// =============================================================================
+// CONTEXT VALIDATOR
+// =============================================================================
+export { ContextValidator, ContextValidationError, createDefaultContextValidator, createStrictContextValidator, INJECTION_PATTERNS, } from './context-validator.js';
+// =============================================================================
+// DUAL CHANNEL ENFORCER
+// =============================================================================
+export { DualChannelEnforcer, DualChannelError, createDefaultDualChannelEnforcer, createStrictDualChannelEnforcer, createPermissiveDualChannelEnforcer, DEFAULT_CONTROL_PLANE_SOURCES, DEFAULT_DATA_PLANE_SOURCES, } from './dual-channel.js';
+// =============================================================================
+// CREDENTIAL MANAGER
+// =============================================================================
+export { SemanticCredentialManager, CredentialError, getCredentialManager, resetCredentialManager, } from './credential-manager.js';
+// =============================================================================
+// SERVICE
+// =============================================================================
+export { SemanticGovernanceService, SemanticGovernanceError, createSemanticGovernanceService, getSemanticGovernanceMetrics, getSemanticGovernanceMetricsContentType, } from './service.js';
+// =============================================================================
+// INTEGRATION
+// =============================================================================
+export { SemanticGovernanceIntegration, createSemanticGovernanceIntegration, getSemanticGovernanceIntegration, resetSemanticGovernanceIntegration, getIntegrationMetrics, getIntegrationMetricsContentType, DEFAULT_INTEGRATION_CONFIG, } from './integration.js';
+// =============================================================================
+// CONVENIENCE EXPORTS
+// =============================================================================
+/**
+ * Quick-start function to create a fully configured semantic governance system
+ *
+ * @param agentId - Agent identifier (DID)
+ * @param carId - Categorical Agentic Registry ID
+ * @param config - Optional configuration overrides
+ * @returns Object containing service, credential manager, and credential
+ *
+ * @example
+ * ```typescript
+ * const { service, credential } = createSemanticGovernance(
+ *   'did:car:a3i:vorion:my-agent',
+ *   'a3i.vorion.my-agent:BD-L2@1.0.0',
+ *   {
+ *     inferenceScope: { globalLevel: InferenceLevel.STATISTICAL },
+ *     dualChannel: { enforced: true, dataPlaneTreatment: 'block' },
+ *   }
+ * );
+ * ```
+ */
+export function createSemanticGovernance(agentId, carId, config) {
+    const credentialManager = new SemanticCredentialManager();
+    const credential = credentialManager.createCredential(agentId, carId, config || {});
+    const service = createSemanticGovernanceService(credential);
+    return { service, credentialManager, credential };
+}
+import { SemanticCredentialManager } from './credential-manager.js';
+import { createSemanticGovernanceService } from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/semantic-governance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/semantic-governance/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAoEH,OAAO;AACL,QAAQ;AACR,SAAS,EACT,cAAc;AAEd,YAAY;AACZ,qBAAqB;AAErB,yBAAyB;AACzB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB;AAEpB,cAAc;AACd,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,iCAAiC,EACjC,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,6BAA6B,EAC7B,8BAA8B,EAC9B,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,+BAA+B,EAC/B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,uCAAuC,EACvC,kBAAkB,EAClB,8BAA8B,EAC9B,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,oBAAoB,EACpB,uBAAuB,EACvB,2BAA2B,EAC3B,uBAAuB,EACvB,kCAAkC,EAClC,8BAA8B,EAC9B,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AAEpB,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,iCAAiC,EACjC,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,+BAA+B,EAC/B,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,6BAA6B,EAC7B,4BAA4B,EAC5B,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gCAAgC,EAChC,+BAA+B,EAC/B,mCAAmC,EACnC,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AAEjC,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,uCAAuC,GACxC,MAAM,cAAc,CAAC;AAEtB,gFAAgF;AAChF,cAAc;AACd,gFAAgF;AAEhF,OAAO,EACL,6BAA6B,EAC7B,mCAAmC,EACnC,gCAAgC,EAChC,kCAAkC,EAClC,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,GAM3B,MAAM,kBAAkB,CAAC;AAE1B,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,KAAa,EACb,MAAiC;IAMjC,MAAM,iBAAiB,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAC1D,MAAM,UAAU,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;IAE5D,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC;AAID,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAA6B,+BAA+B,EAAE,MAAM,cAAc,CAAC"}

package/dist/semantic-governance/inference-validator.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Inference Validator - Inference Scope Enforcement
+ *
+ * Controls what an agent can derive from accessed data.
+ * OAuth scopes control DATA ACCESS; Inference Scope controls what can be DERIVED.
+ *
+ * Features:
+ * - Global inference level limits
+ * - Domain-specific overrides
+ * - Derived knowledge retention policies
+ * - PII inference controls
+ *
+ * @packageDocumentation
+ * @module @vorion/semantic-governance/inference-validator
+ */
+import { VorionError } from '../common/errors.js';
+import { InferenceLevel, type InferenceScope, type InferenceOperation, type InferenceOperationType, type DomainCode, type DerivedKnowledge, type InferenceValidationResult, type HandlingResult, type PIICheckResult } from './types.js';
+/**
+ * Error thrown when inference validation fails
+ */
+export declare class InferenceScopeError extends VorionError {
+    code: string;
+    statusCode: number;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Mapping of inference operation types to required levels
+ */
+export declare const OPERATION_LEVEL_REQUIREMENTS: Record<InferenceOperationType, InferenceLevel>;
+/**
+ * Inference Validator
+ *
+ * Validates inference operations against the configured inference scope rules.
+ */
+export declare class InferenceValidator {
+    private readonly config;
+    private readonly domainLevelCache;
+    /**
+     * Create a new InferenceValidator
+     *
+     * @param config - Inference scope configuration
+     */
+    constructor(config: InferenceScope);
+    /**
+     * Check if an inference operation is allowed
+     *
+     * @param operation - The inference operation to validate
+     * @returns Validation result
+     */
+    validateInference(operation: InferenceOperation): InferenceValidationResult;
+    /**
+     * Get the effective inference level for a domain
+     *
+     * @param domain - Domain code
+     * @returns Effective inference level
+     */
+    getEffectiveLevel(domain: DomainCode): InferenceLevel;
+    /**
+     * Handle derived knowledge according to policy
+     *
+     * @param knowledge - The derived knowledge to handle
+     * @returns Handling result
+     */
+    handleDerivedKnowledge(knowledge: DerivedKnowledge): HandlingResult;
+    /**
+     * Check data for PII inference
+     *
+     * @param data - Data to check
+     * @returns PII check result
+     */
+    checkPIIInference(data: unknown): PIICheckResult;
+    /**
+     * Get the required inference level for an operation type
+     *
+     * @param operationType - The operation type
+     * @returns Required inference level
+     */
+    getRequiredLevel(operationType: InferenceOperationType): InferenceLevel;
+    /**
+     * Check if a recipient is allowed to receive derived knowledge
+     *
+     * @param recipientId - Recipient identifier (DID or URL)
+     * @returns Whether the recipient is allowed
+     */
+    isRecipientAllowed(recipientId: string): boolean;
+    /**
+     * Validate a batch of inference operations
+     *
+     * @param operations - Array of operations to validate
+     * @returns Array of validation results
+     */
+    validateBatch(operations: InferenceOperation[]): InferenceValidationResult[];
+    /**
+     * Check if any operations in a batch would fail
+     *
+     * @param operations - Array of operations to check
+     * @returns True if all operations are allowed
+     */
+    allOperationsAllowed(operations: InferenceOperation[]): boolean;
+}
+/**
+ * Create an InferenceValidator with default configuration
+ *
+ * @param globalLevel - Global inference level limit
+ * @returns InferenceValidator with secure defaults
+ */
+export declare function createDefaultInferenceValidator(globalLevel?: InferenceLevel): InferenceValidator;
+/**
+ * Create a restrictive InferenceValidator for sensitive operations
+ *
+ * @returns InferenceValidator with minimal inference allowed
+ */
+export declare function createRestrictiveInferenceValidator(): InferenceValidator;
+//# sourceMappingURL=inference-validator.d.ts.map

package/dist/semantic-governance/inference-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inference-validator.d.ts","sourceRoot":"","sources":["../../src/semantic-governance/inference-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,cAAc,EAEd,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,YAAY,CAAC;AAIpB;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;IACzC,IAAI,SAA2B;IAC/B,UAAU,SAAO;gBAEd,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,sBAAsB,EAAE,cAAc,CAWvF,CAAC;AAeF;;;;GAIG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkC;IAEnE;;;;OAIG;gBACS,MAAM,EAAE,cAAc;IAoBlC;;;;;OAKG;IACH,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,GAAG,yBAAyB;IAkE3E;;;;;OAKG;IACH,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc;IAYrD;;;;;OAKG;IACH,sBAAsB,CAAC,SAAS,EAAE,gBAAgB,GAAG,cAAc;IAqEnE;;;;;OAKG;IACH,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc;IAiEhD;;;;;OAKG;IACH,gBAAgB,CAAC,aAAa,EAAE,sBAAsB,GAAG,cAAc;IAIvE;;;;;OAKG;IACH,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;IAkBhD;;;;;OAKG;IACH,aAAa,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,yBAAyB,EAAE;IAI5E;;;;;OAKG;IACH,oBAAoB,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,OAAO;CAGhE;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,WAAW,GAAE,cAAsC,GAAG,kBAAkB,CAcvH;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,IAAI,kBAAkB,CAiBxE"}

package/dist/semantic-governance/inference-validator.js

@@ -0,0 +1,390 @@
+/**
+ * Inference Validator - Inference Scope Enforcement
+ *
+ * Controls what an agent can derive from accessed data.
+ * OAuth scopes control DATA ACCESS; Inference Scope controls what can be DERIVED.
+ *
+ * Features:
+ * - Global inference level limits
+ * - Domain-specific overrides
+ * - Derived knowledge retention policies
+ * - PII inference controls
+ *
+ * @packageDocumentation
+ * @module @vorion/semantic-governance/inference-validator
+ */
+import { createHash } from 'crypto';
+import { createLogger } from '../common/logger.js';
+import { VorionError } from '../common/errors.js';
+import { InferenceLevel, INFERENCE_LEVEL_NAMES, } from './types.js';
+const logger = createLogger({ component: 'inference-validator' });
+/**
+ * Error thrown when inference validation fails
+ */
+export class InferenceScopeError extends VorionError {
+    code = 'INFERENCE_SCOPE_ERROR';
+    statusCode = 403;
+    constructor(message, details) {
+        super(message, details);
+        this.name = 'InferenceScopeError';
+    }
+}
+/**
+ * Mapping of inference operation types to required levels
+ */
+export const OPERATION_LEVEL_REQUIREMENTS = {
+    aggregate: InferenceLevel.STATISTICAL,
+    count: InferenceLevel.STATISTICAL,
+    average: InferenceLevel.STATISTICAL,
+    'entity-extraction': InferenceLevel.ENTITY,
+    'relationship-inference': InferenceLevel.RELATIONAL,
+    'pattern-prediction': InferenceLevel.PREDICTIVE,
+    'sentiment-analysis': InferenceLevel.ENTITY,
+    classification: InferenceLevel.ENTITY,
+    summarization: InferenceLevel.ENTITY,
+    custom: InferenceLevel.UNRESTRICTED,
+};
+/**
+ * Common PII patterns for detection
+ */
+const PII_PATTERNS = [
+    { type: 'email', pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/gi },
+    { type: 'ssn', pattern: /\b\d{3}-\d{2}-\d{4}\b/g },
+    { type: 'phone', pattern: /\b(?:\+1[-.]?)?\(?[2-9][0-9]{2}\)?[-.]?[2-9][0-9]{2}[-.]?[0-9]{4}\b/g },
+    { type: 'credit_card', pattern: /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13})\b/g },
+    { type: 'dob', pattern: /\b(?:0?[1-9]|1[0-2])[-/](?:0?[1-9]|[12]\d|3[01])[-/](?:19|20)\d{2}\b/g },
+    { type: 'address', pattern: /\b\d+\s+[\w\s]+(?:street|st|avenue|ave|road|rd|drive|dr|lane|ln|way|boulevard|blvd)\b/gi },
+    { type: 'name', pattern: /\b(?:Mr|Mrs|Ms|Dr|Prof)\.?\s+[A-Z][a-z]+\s+[A-Z][a-z]+\b/g },
+];
+/**
+ * Inference Validator
+ *
+ * Validates inference operations against the configured inference scope rules.
+ */
+export class InferenceValidator {
+    config;
+    domainLevelCache;
+    /**
+     * Create a new InferenceValidator
+     *
+     * @param config - Inference scope configuration
+     */
+    constructor(config) {
+        this.config = config;
+        this.domainLevelCache = new Map();
+        // Pre-compute effective levels for all domains
+        for (const override of config.domainOverrides) {
+            this.domainLevelCache.set(override.domain, override.level);
+        }
+        logger.debug({
+            globalLevel: INFERENCE_LEVEL_NAMES[config.globalLevel],
+            domainOverrides: config.domainOverrides.length,
+            piiAllowed: config.piiInference.allowed,
+            retention: config.derivedKnowledgeHandling.retention,
+        }, 'InferenceValidator initialized');
+    }
+    /**
+     * Check if an inference operation is allowed
+     *
+     * @param operation - The inference operation to validate
+     * @returns Validation result
+     */
+    validateInference(operation) {
+        const startTime = Date.now();
+        try {
+            // Determine required level for this operation
+            const requiredLevel = operation.type === 'custom' && operation.customLevel !== undefined
+                ? operation.customLevel
+                : OPERATION_LEVEL_REQUIREMENTS[operation.type];
+            // Check global level first
+            if (requiredLevel > this.config.globalLevel) {
+                logger.warn({
+                    operation: operation.type,
+                    requiredLevel: INFERENCE_LEVEL_NAMES[requiredLevel],
+                    globalLevel: INFERENCE_LEVEL_NAMES[this.config.globalLevel],
+                }, 'Inference operation exceeds global level');
+                return {
+                    valid: false,
+                    reason: `Inference operation '${operation.type}' requires level ${INFERENCE_LEVEL_NAMES[requiredLevel]}, but global level is ${INFERENCE_LEVEL_NAMES[this.config.globalLevel]}`,
+                    requiredLevel,
+                    agentLevel: this.config.globalLevel,
+                };
+            }
+            // Check domain-specific restrictions
+            for (const domain of operation.sourceDomains) {
+                const domainLevel = this.getEffectiveLevel(domain);
+                if (requiredLevel > domainLevel) {
+                    logger.warn({
+                        operation: operation.type,
+                        domain,
+                        requiredLevel: INFERENCE_LEVEL_NAMES[requiredLevel],
+                        domainLevel: INFERENCE_LEVEL_NAMES[domainLevel],
+                    }, 'Inference operation exceeds domain level');
+                    return {
+                        valid: false,
+                        reason: `Domain '${domain}' restricts inference to level ${INFERENCE_LEVEL_NAMES[domainLevel]}`,
+                        requiredLevel,
+                        agentLevel: domainLevel,
+                        restrictedDomain: domain,
+                    };
+                }
+            }
+            logger.debug({
+                operation: operation.type,
+                sourceDomains: operation.sourceDomains,
+            }, 'Inference operation allowed');
+            return { valid: true };
+        }
+        finally {
+            const duration = Date.now() - startTime;
+            logger.debug({ durationMs: duration }, 'Inference validation completed');
+        }
+    }
+    /**
+     * Get the effective inference level for a domain
+     *
+     * @param domain - Domain code
+     * @returns Effective inference level
+     */
+    getEffectiveLevel(domain) {
+        // Check domain-specific override
+        const override = this.domainLevelCache.get(domain);
+        if (override !== undefined) {
+            // Domain override can only be more restrictive than global
+            return Math.min(override, this.config.globalLevel);
+        }
+        // Fall back to global level
+        return this.config.globalLevel;
+    }
+    /**
+     * Handle derived knowledge according to policy
+     *
+     * @param knowledge - The derived knowledge to handle
+     * @returns Handling result
+     */
+    handleDerivedKnowledge(knowledge) {
+        const { derivedKnowledgeHandling } = this.config;
+        // Check retention policy
+        if (derivedKnowledgeHandling.retention === 'none') {
+            logger.debug({ knowledgeId: knowledge.id }, 'Derived knowledge discarded (retention: none)');
+            return {
+                action: 'discarded',
+                reason: 'Retention policy is set to none',
+            };
+        }
+        // Check if cross-context sharing is attempted
+        // This would need additional context about the current session
+        // For now, we just log and allow based on the flag
+        if (!derivedKnowledgeHandling.crossContextSharing) {
+            logger.debug({ knowledgeId: knowledge.id }, 'Cross-context sharing disabled');
+        }
+        // Check PII in derived knowledge
+        const piiResult = this.checkPIIInference(knowledge.content);
+        if (piiResult.containsPII && !this.config.piiInference.allowed) {
+            if (this.config.piiInference.handling === 'block') {
+                return {
+                    action: 'discarded',
+                    reason: 'Derived knowledge contains PII and PII inference is not allowed',
+                };
+            }
+            else if (this.config.piiInference.handling === 'redact') {
+                const redactedKnowledge = {
+                    ...knowledge,
+                    content: piiResult.modifiedData,
+                };
+                return {
+                    action: 'redacted',
+                    reason: 'PII redacted from derived knowledge',
+                    modifiedKnowledge: redactedKnowledge,
+                };
+            }
+            else if (this.config.piiInference.handling === 'hash') {
+                const hashedKnowledge = {
+                    ...knowledge,
+                    content: piiResult.modifiedData,
+                };
+                return {
+                    action: 'redacted',
+                    reason: 'PII hashed in derived knowledge',
+                    modifiedKnowledge: hashedKnowledge,
+                };
+            }
+        }
+        // Store based on retention policy
+        if (derivedKnowledgeHandling.retention === 'session') {
+            return {
+                action: 'stored',
+                reason: 'Derived knowledge stored for session duration',
+            };
+        }
+        else if (derivedKnowledgeHandling.retention === 'persistent') {
+            return {
+                action: 'stored',
+                reason: 'Derived knowledge stored persistently',
+            };
+        }
+        return {
+            action: 'stored',
+            reason: 'Derived knowledge stored according to policy',
+        };
+    }
+    /**
+     * Check data for PII inference
+     *
+     * @param data - Data to check
+     * @returns PII check result
+     */
+    checkPIIInference(data) {
+        const content = typeof data === 'string' ? data : JSON.stringify(data);
+        const detectedTypes = [];
+        let modifiedContent = content;
+        // Check all PII patterns
+        for (const { type, pattern } of PII_PATTERNS) {
+            const matches = content.match(pattern);
+            if (matches && matches.length > 0) {
+                detectedTypes.push(type);
+                // Apply handling based on config
+                if (this.config.piiInference.handling === 'redact') {
+                    modifiedContent = modifiedContent.replace(pattern, `[REDACTED_${type.toUpperCase()}]`);
+                }
+                else if (this.config.piiInference.handling === 'hash') {
+                    modifiedContent = modifiedContent.replace(pattern, (match) => {
+                        const hash = createHash('sha256').update(match).digest('hex').substring(0, 16);
+                        return `[HASH_${hash}]`;
+                    });
+                }
+            }
+        }
+        const containsPII = detectedTypes.length > 0;
+        // Determine action taken
+        let action;
+        if (!containsPII) {
+            action = 'allowed';
+        }
+        else if (this.config.piiInference.allowed) {
+            action = 'allowed';
+        }
+        else if (this.config.piiInference.handling === 'block') {
+            action = 'blocked';
+        }
+        else if (this.config.piiInference.handling === 'redact') {
+            action = 'redacted';
+        }
+        else {
+            action = 'hashed';
+        }
+        // Parse modified content back if it was JSON
+        let modifiedData;
+        try {
+            modifiedData = JSON.parse(modifiedContent);
+        }
+        catch {
+            modifiedData = modifiedContent;
+        }
+        if (containsPII) {
+            logger.debug({
+                piiTypes: detectedTypes,
+                action,
+            }, 'PII detected in data');
+        }
+        return {
+            containsPII,
+            piiTypes: detectedTypes,
+            action,
+            modifiedData: action !== 'allowed' ? modifiedData : undefined,
+        };
+    }
+    /**
+     * Get the required inference level for an operation type
+     *
+     * @param operationType - The operation type
+     * @returns Required inference level
+     */
+    getRequiredLevel(operationType) {
+        return OPERATION_LEVEL_REQUIREMENTS[operationType];
+    }
+    /**
+     * Check if a recipient is allowed to receive derived knowledge
+     *
+     * @param recipientId - Recipient identifier (DID or URL)
+     * @returns Whether the recipient is allowed
+     */
+    isRecipientAllowed(recipientId) {
+        const { allowedRecipients } = this.config.derivedKnowledgeHandling;
+        // Empty list means no restrictions (or no sharing allowed)
+        if (allowedRecipients.length === 0) {
+            return false;
+        }
+        // Check for exact match or wildcard patterns
+        return allowedRecipients.some((allowed) => {
+            if (allowed.includes('*')) {
+                const regex = new RegExp('^' + allowed.replace(/\*/g, '.*') + '$');
+                return regex.test(recipientId);
+            }
+            return allowed === recipientId;
+        });
+    }
+    /**
+     * Validate a batch of inference operations
+     *
+     * @param operations - Array of operations to validate
+     * @returns Array of validation results
+     */
+    validateBatch(operations) {
+        return operations.map((op) => this.validateInference(op));
+    }
+    /**
+     * Check if any operations in a batch would fail
+     *
+     * @param operations - Array of operations to check
+     * @returns True if all operations are allowed
+     */
+    allOperationsAllowed(operations) {
+        return operations.every((op) => this.validateInference(op).valid);
+    }
+}
+/**
+ * Create an InferenceValidator with default configuration
+ *
+ * @param globalLevel - Global inference level limit
+ * @returns InferenceValidator with secure defaults
+ */
+export function createDefaultInferenceValidator(globalLevel = InferenceLevel.ENTITY) {
+    return new InferenceValidator({
+        globalLevel,
+        domainOverrides: [],
+        derivedKnowledgeHandling: {
+            retention: 'session',
+            allowedRecipients: [],
+            crossContextSharing: false,
+        },
+        piiInference: {
+            allowed: false,
+            handling: 'redact',
+        },
+    });
+}
+/**
+ * Create a restrictive InferenceValidator for sensitive operations
+ *
+ * @returns InferenceValidator with minimal inference allowed
+ */
+export function createRestrictiveInferenceValidator() {
+    return new InferenceValidator({
+        globalLevel: InferenceLevel.STATISTICAL,
+        domainOverrides: [
+            { domain: 'F', level: InferenceLevel.NONE, reason: 'Financial data: no inference allowed' },
+            { domain: 'S', level: InferenceLevel.NONE, reason: 'Security data: no inference allowed' },
+        ],
+        derivedKnowledgeHandling: {
+            retention: 'none',
+            allowedRecipients: [],
+            crossContextSharing: false,
+        },
+        piiInference: {
+            allowed: false,
+            handling: 'block',
+        },
+    });
+}
+//# sourceMappingURL=inference-validator.js.map

package/dist/semantic-governance/inference-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inference-validator.js","sourceRoot":"","sources":["../../src/semantic-governance/inference-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,cAAc,EACd,qBAAqB,GAStB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAElE;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IACzC,IAAI,GAAG,uBAAuB,CAAC;IAC/B,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAmD;IAC1F,SAAS,EAAE,cAAc,CAAC,WAAW;IACrC,KAAK,EAAE,cAAc,CAAC,WAAW;IACjC,OAAO,EAAE,cAAc,CAAC,WAAW;IACnC,mBAAmB,EAAE,cAAc,CAAC,MAAM;IAC1C,wBAAwB,EAAE,cAAc,CAAC,UAAU;IACnD,oBAAoB,EAAE,cAAc,CAAC,UAAU;IAC/C,oBAAoB,EAAE,cAAc,CAAC,MAAM;IAC3C,cAAc,EAAE,cAAc,CAAC,MAAM;IACrC,aAAa,EAAE,cAAc,CAAC,MAAM;IACpC,MAAM,EAAE,cAAc,CAAC,YAAY;CACpC,CAAC;AAEF;;GAEG;AACH,MAAM,YAAY,GAA6C;IAC7D,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IACnF,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAClD,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,sEAAsE,EAAE;IAClG,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,iEAAiE,EAAE;IACnG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,uEAAuE,EAAE;IACjG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,yFAAyF,EAAE;IACvH,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2DAA2D,EAAE;CACvF,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAiB;IACvB,gBAAgB,CAAkC;IAEnE;;;;OAIG;IACH,YAAY,MAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAC;QAElC,+CAA+C;QAC/C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC9C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,KAAK,CACV;YACE,WAAW,EAAE,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC;YACtD,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,MAAM;YAC9C,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;YACvC,SAAS,EAAE,MAAM,CAAC,wBAAwB,CAAC,SAAS;SACrD,EACD,gCAAgC,CACjC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,SAA6B;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,8CAA8C;YAC9C,MAAM,aAAa,GACjB,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS;gBAChE,CAAC,CAAC,SAAS,CAAC,WAAW;gBACvB,CAAC,CAAC,4BAA4B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAEnD,2BAA2B;YAC3B,IAAI,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CACT;oBACE,SAAS,EAAE,SAAS,CAAC,IAAI;oBACzB,aAAa,EAAE,qBAAqB,CAAC,aAAa,CAAC;oBACnD,WAAW,EAAE,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;iBAC5D,EACD,0CAA0C,CAC3C,CAAC;gBACF,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,wBAAwB,SAAS,CAAC,IAAI,oBAAoB,qBAAqB,CAAC,aAAa,CAAC,yBAAyB,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;oBAC/K,aAAa;oBACb,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;iBACpC,CAAC;YACJ,CAAC;YAED,qCAAqC;YACrC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;gBAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACnD,IAAI,aAAa,GAAG,WAAW,EAAE,CAAC;oBAChC,MAAM,CAAC,IAAI,CACT;wBACE,SAAS,EAAE,SAAS,CAAC,IAAI;wBACzB,MAAM;wBACN,aAAa,EAAE,qBAAqB,CAAC,aAAa,CAAC;wBACnD,WAAW,EAAE,qBAAqB,CAAC,WAAW,CAAC;qBAChD,EACD,0CAA0C,CAC3C,CAAC;oBACF,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,WAAW,MAAM,kCAAkC,qBAAqB,CAAC,WAAW,CAAC,EAAE;wBAC/F,aAAa;wBACb,UAAU,EAAE,WAAW;wBACvB,gBAAgB,EAAE,MAAM;qBACzB,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,CAAC,KAAK,CACV;gBACE,SAAS,EAAE,SAAS,CAAC,IAAI;gBACzB,aAAa,EAAE,SAAS,CAAC,aAAa;aACvC,EACD,6BAA6B,CAC9B,CAAC;YAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,MAAkB;QAClC,iCAAiC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,2DAA2D;YAC3D,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;QAED,4BAA4B;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,SAA2B;QAChD,MAAM,EAAE,wBAAwB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEjD,yBAAyB;QACzB,IAAI,wBAAwB,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAClD,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,+CAA+C,CAAC,CAAC;YAC7F,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,iCAAiC;aAC1C,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,CAAC,wBAAwB,CAAC,mBAAmB,EAAE,CAAC;YAClD,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAChF,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,SAAS,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAClD,OAAO;oBACL,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,iEAAiE;iBAC1E,CAAC;YACJ,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1D,MAAM,iBAAiB,GAAG;oBACxB,GAAG,SAAS;oBACZ,OAAO,EAAE,SAAS,CAAC,YAAY;iBAChC,CAAC;gBACF,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,qCAAqC;oBAC7C,iBAAiB,EAAE,iBAAiB;iBACrC,CAAC;YACJ,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxD,MAAM,eAAe,GAAG;oBACtB,GAAG,SAAS;oBACZ,OAAO,EAAE,SAAS,CAAC,YAAY;iBAChC,CAAC;gBACF,OAAO;oBACL,MAAM,EAAE,UAAU;oBAClB,MAAM,EAAE,iCAAiC;oBACzC,iBAAiB,EAAE,eAAe;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,wBAAwB,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACrD,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,+CAA+C;aACxD,CAAC;QACJ,CAAC;aAAM,IAAI,wBAAwB,CAAC,SAAS,KAAK,YAAY,EAAE,CAAC;YAC/D,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,uCAAuC;aAChD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,IAAa;QAC7B,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,eAAe,GAAG,OAAO,CAAC;QAE9B,yBAAyB;QACzB,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEzB,iCAAiC;gBACjC,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACnD,eAAe,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBACzF,CAAC;qBAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;oBACxD,eAAe,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;wBAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC/E,OAAO,SAAS,IAAI,GAAG,CAAC;oBAC1B,CAAC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;QAE7C,yBAAyB;QACzB,IAAI,MAAgC,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzD,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,GAAG,UAAU,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;QAED,6CAA6C;QAC7C,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,eAAe,CAAC;QACjC,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CACV;gBACE,QAAQ,EAAE,aAAa;gBACvB,MAAM;aACP,EACD,sBAAsB,CACvB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,WAAW;YACX,QAAQ,EAAE,aAAa;YACvB,MAAM;YACN,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;SAC9D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,aAAqC;QACpD,OAAO,4BAA4B,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,WAAmB;QACpC,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;QAEnE,2DAA2D;QAC3D,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6CAA6C;QAC7C,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBACnE,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,OAAO,KAAK,WAAW,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,UAAgC;QAC5C,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,UAAgC;QACnD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,cAA8B,cAAc,CAAC,MAAM;IACjG,OAAO,IAAI,kBAAkB,CAAC;QAC5B,WAAW;QACX,eAAe,EAAE,EAAE;QACnB,wBAAwB,EAAE;YACxB,SAAS,EAAE,SAAS;YACpB,iBAAiB,EAAE,EAAE;YACrB,mBAAmB,EAAE,KAAK;SAC3B;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,QAAQ;SACnB;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mCAAmC;IACjD,OAAO,IAAI,kBAAkB,CAAC;QAC5B,WAAW,EAAE,cAAc,CAAC,WAAW;QACvC,eAAe,EAAE;YACf,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE;YAC3F,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,qCAAqC,EAAE;SAC3F;QACD,wBAAwB,EAAE;YACxB,SAAS,EAAE,MAAM;YACjB,iBAAiB,EAAE,EAAE;YACrB,mBAAmB,EAAE,KAAK;SAC3B;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,OAAO;SAClB;KACF,CAAC,CAAC;AACL,CAAC"}