@vorionsys/platform-core 0.1.0

package/dist/semantic-governance/service.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Semantic Governance Service - Main Service
+ *
+ * Orchestrates all semantic governance validators to provide comprehensive
+ * protection against the "confused deputy" problem in AI agents.
+ *
+ * Features:
+ * - Complete agent interaction validation
+ * - Pre-action checks (before agent acts)
+ * - Post-action checks (after agent produces output)
+ * - Credential loading and management
+ * - Metrics emission for observability
+ *
+ * @packageDocumentation
+ * @module @vorion/semantic-governance/service
+ */
+import { Registry } from 'prom-client';
+import { VorionError } from '../common/errors.js';
+import { InstructionValidator } from './instruction-validator.js';
+import { OutputValidator } from './output-validator.js';
+import { InferenceValidator } from './inference-validator.js';
+import { ContextValidator } from './context-validator.js';
+import { DualChannelEnforcer } from './dual-channel.js';
+import { SemanticCredentialManager } from './credential-manager.js';
+import type { AgentIdentity, AgentInteraction, ActionRequest, ActionRecord, SemanticGovernanceCredential, SemanticValidationResult, PreActionResult, PostActionResult } from './types.js';
+/**
+ * Error thrown when semantic governance validation fails
+ */
+export declare class SemanticGovernanceError extends VorionError {
+    code: string;
+    statusCode: number;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Semantic Governance Service
+ *
+ * Main service that orchestrates all semantic governance validators.
+ */
+export declare class SemanticGovernanceService {
+    private readonly instructionValidator;
+    private readonly outputValidator;
+    private readonly inferenceValidator;
+    private readonly contextValidator;
+    private readonly dualChannelEnforcer;
+    private readonly credentialManager;
+    private readonly credentialCache;
+    /**
+     * Create a new SemanticGovernanceService
+     *
+     * @param instructionValidator - Instruction integrity validator
+     * @param outputValidator - Output schema validator
+     * @param inferenceValidator - Inference scope validator
+     * @param contextValidator - Context authentication validator
+     * @param dualChannelEnforcer - Control/data plane enforcer
+     * @param credentialManager - Optional credential manager (uses default if not provided)
+     */
+    constructor(instructionValidator: InstructionValidator, outputValidator: OutputValidator, inferenceValidator: InferenceValidator, contextValidator: ContextValidator, dualChannelEnforcer: DualChannelEnforcer, credentialManager?: SemanticCredentialManager);
+    /**
+     * Validate a complete agent interaction
+     *
+     * @param interaction - The agent interaction to validate
+     * @returns Semantic validation result
+     */
+    validateInteraction(interaction: AgentInteraction): Promise<SemanticValidationResult>;
+    /**
+     * Perform pre-action validation
+     *
+     * @param agent - Agent identity
+     * @param action - Action request
+     * @returns Pre-action result
+     */
+    preActionCheck(agent: AgentIdentity, action: ActionRequest): PreActionResult;
+    /**
+     * Perform post-action validation
+     *
+     * @param agent - Agent identity
+     * @param action - Action record
+     * @returns Post-action result
+     */
+    postActionCheck(agent: AgentIdentity, action: ActionRecord): PostActionResult;
+    /**
+     * Load credential for an agent
+     *
+     * @param agentId - Agent identifier (DID)
+     * @returns Semantic governance credential or undefined
+     */
+    loadCredential(agentId: string): Promise<SemanticGovernanceCredential | undefined>;
+    /**
+     * Clear the credential cache
+     */
+    clearCredentialCache(): void;
+    /**
+     * Get metrics registry for this service
+     */
+    getMetricsRegistry(): Registry;
+    /**
+     * Run pre-action checks
+     */
+    private runPreActionChecks;
+    /**
+     * Run post-action checks
+     */
+    private runPostActionChecks;
+}
+/**
+ * Create a SemanticGovernanceService with default validators
+ *
+ * @param credential - Optional credential to use for validation
+ * @returns Configured SemanticGovernanceService
+ */
+export declare function createSemanticGovernanceService(credential?: SemanticGovernanceCredential): SemanticGovernanceService;
+/**
+ * Get metrics as Prometheus text format
+ */
+export declare function getSemanticGovernanceMetrics(): Promise<string>;
+/**
+ * Get metrics content type
+ */
+export declare function getSemanticGovernanceMetricsContentType(): string;
+//# sourceMappingURL=service.d.ts.map

package/dist/semantic-governance/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/semantic-governance/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAA6B,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAwB,MAAM,yBAAyB,CAAC;AAC1F,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,4BAA4B,EAC5B,wBAAwB,EACxB,eAAe,EACf,gBAAgB,EAIjB,MAAM,YAAY,CAAC;AA0DpB;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,WAAW;IAC7C,IAAI,SAA+B;IACnC,UAAU,SAAO;gBAEd,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;;;GAIG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAuB;IAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4B;IAC9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4C;IAE5E;;;;;;;;;OASG;gBAED,oBAAoB,EAAE,oBAAoB,EAC1C,eAAe,EAAE,eAAe,EAChC,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,mBAAmB,EAAE,mBAAmB,EACxC,iBAAiB,CAAC,EAAE,yBAAyB;IAa/C;;;;;OAKG;IACG,mBAAmB,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAuE3F;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,eAAe;IAoC5E;;;;;;OAMG;IACH,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,GAAG,gBAAgB;IAkB7E;;;;;OAKG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC;IAkBxF;;OAEG;IACH,oBAAoB,IAAI,IAAI;IAK5B;;OAEG;IACH,kBAAkB,IAAI,QAAQ;IAI9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAoI1B;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAqG5B;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,UAAU,CAAC,EAAE,4BAA4B,GACxC,yBAAyB,CAwC3B;AAED;;GAEG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED;;GAEG;AACH,wBAAgB,uCAAuC,IAAI,MAAM,CAEhE"}

package/dist/semantic-governance/service.js

@@ -0,0 +1,527 @@
+/**
+ * Semantic Governance Service - Main Service
+ *
+ * Orchestrates all semantic governance validators to provide comprehensive
+ * protection against the "confused deputy" problem in AI agents.
+ *
+ * Features:
+ * - Complete agent interaction validation
+ * - Pre-action checks (before agent acts)
+ * - Post-action checks (after agent produces output)
+ * - Credential loading and management
+ * - Metrics emission for observability
+ *
+ * @packageDocumentation
+ * @module @vorion/semantic-governance/service
+ */
+import { Registry, Counter, Histogram, Gauge } from 'prom-client';
+import { createLogger } from '../common/logger.js';
+import { VorionError } from '../common/errors.js';
+import { InstructionValidator } from './instruction-validator.js';
+import { OutputValidator } from './output-validator.js';
+import { InferenceValidator } from './inference-validator.js';
+import { ContextValidator } from './context-validator.js';
+import { DualChannelEnforcer } from './dual-channel.js';
+import { getCredentialManager } from './credential-manager.js';
+const logger = createLogger({ component: 'semantic-governance-service' });
+// =============================================================================
+// METRICS
+// =============================================================================
+const semanticGovernanceRegistry = new Registry();
+// Validation counters
+const validationTotal = new Counter({
+    name: 'vorion_semantic_validation_total',
+    help: 'Total semantic governance validations',
+    labelNames: ['type', 'result'],
+    registers: [semanticGovernanceRegistry],
+});
+// Validation duration
+const validationDuration = new Histogram({
+    name: 'vorion_semantic_validation_duration_seconds',
+    help: 'Semantic validation duration in seconds',
+    labelNames: ['type'],
+    buckets: [0.001, 0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1],
+    registers: [semanticGovernanceRegistry],
+});
+// Injection detection
+const injectionDetectedTotal = new Counter({
+    name: 'vorion_semantic_injection_detected_total',
+    help: 'Total injection attempts detected',
+    labelNames: ['severity'],
+    registers: [semanticGovernanceRegistry],
+});
+// PII detection
+const piiDetectedTotal = new Counter({
+    name: 'vorion_semantic_pii_detected_total',
+    help: 'Total PII instances detected',
+    labelNames: ['type', 'action'],
+    registers: [semanticGovernanceRegistry],
+});
+// Channel enforcement
+const channelEnforcementTotal = new Counter({
+    name: 'vorion_semantic_channel_enforcement_total',
+    help: 'Total channel enforcement actions',
+    labelNames: ['channel', 'action'],
+    registers: [semanticGovernanceRegistry],
+});
+// Active credentials gauge
+const activeCredentials = new Gauge({
+    name: 'vorion_semantic_active_credentials',
+    help: 'Number of active semantic governance credentials',
+    registers: [semanticGovernanceRegistry],
+});
+/**
+ * Error thrown when semantic governance validation fails
+ */
+export class SemanticGovernanceError extends VorionError {
+    code = 'SEMANTIC_GOVERNANCE_ERROR';
+    statusCode = 403;
+    constructor(message, details) {
+        super(message, details);
+        this.name = 'SemanticGovernanceError';
+    }
+}
+/**
+ * Semantic Governance Service
+ *
+ * Main service that orchestrates all semantic governance validators.
+ */
+export class SemanticGovernanceService {
+    instructionValidator;
+    outputValidator;
+    inferenceValidator;
+    contextValidator;
+    dualChannelEnforcer;
+    credentialManager;
+    credentialCache;
+    /**
+     * Create a new SemanticGovernanceService
+     *
+     * @param instructionValidator - Instruction integrity validator
+     * @param outputValidator - Output schema validator
+     * @param inferenceValidator - Inference scope validator
+     * @param contextValidator - Context authentication validator
+     * @param dualChannelEnforcer - Control/data plane enforcer
+     * @param credentialManager - Optional credential manager (uses default if not provided)
+     */
+    constructor(instructionValidator, outputValidator, inferenceValidator, contextValidator, dualChannelEnforcer, credentialManager) {
+        this.instructionValidator = instructionValidator;
+        this.outputValidator = outputValidator;
+        this.inferenceValidator = inferenceValidator;
+        this.contextValidator = contextValidator;
+        this.dualChannelEnforcer = dualChannelEnforcer;
+        this.credentialManager = credentialManager || getCredentialManager();
+        this.credentialCache = new Map();
+        logger.info('SemanticGovernanceService initialized');
+    }
+    /**
+     * Validate a complete agent interaction
+     *
+     * @param interaction - The agent interaction to validate
+     * @returns Semantic validation result
+     */
+    async validateInteraction(interaction) {
+        const startTime = Date.now();
+        try {
+            // Load credential for agent
+            const credential = await this.loadCredential(interaction.agent.did);
+            if (!credential) {
+                logger.warn({ agentDid: interaction.agent.did }, 'No credential found for agent');
+                return {
+                    valid: false,
+                    interactionId: interaction.id,
+                    agentDid: interaction.agent.did,
+                    reason: 'No semantic governance credential found for agent',
+                    validatedAt: new Date(),
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            // Pre-action validation
+            const preActionResult = this.runPreActionChecks(interaction, credential);
+            if (!preActionResult.allowed) {
+                validationTotal.inc({ type: 'interaction', result: 'rejected' });
+                return {
+                    valid: false,
+                    interactionId: interaction.id,
+                    agentDid: interaction.agent.did,
+                    preAction: preActionResult,
+                    reason: preActionResult.reason,
+                    validatedAt: new Date(),
+                    durationMs: Date.now() - startTime,
+                };
+            }
+            // Post-action validation (if action record provided)
+            let postActionResult;
+            if (interaction.action && 'output' in interaction.action) {
+                postActionResult = this.runPostActionChecks(interaction.agent, interaction.action, credential);
+                if (!postActionResult.valid) {
+                    validationTotal.inc({ type: 'interaction', result: 'rejected' });
+                    return {
+                        valid: false,
+                        interactionId: interaction.id,
+                        agentDid: interaction.agent.did,
+                        preAction: preActionResult,
+                        postAction: postActionResult,
+                        reason: postActionResult.reason,
+                        validatedAt: new Date(),
+                        durationMs: Date.now() - startTime,
+                    };
+                }
+            }
+            validationTotal.inc({ type: 'interaction', result: 'allowed' });
+            return {
+                valid: true,
+                interactionId: interaction.id,
+                agentDid: interaction.agent.did,
+                preAction: preActionResult,
+                postAction: postActionResult,
+                validatedAt: new Date(),
+                durationMs: Date.now() - startTime,
+            };
+        }
+        finally {
+            validationDuration.observe({ type: 'interaction' }, (Date.now() - startTime) / 1000);
+        }
+    }
+    /**
+     * Perform pre-action validation
+     *
+     * @param agent - Agent identity
+     * @param action - Action request
+     * @returns Pre-action result
+     */
+    preActionCheck(agent, action) {
+        const startTime = Date.now();
+        try {
+            const credential = this.credentialCache.get(agent.did);
+            if (!credential) {
+                return {
+                    allowed: false,
+                    reason: 'No credential loaded for agent',
+                };
+            }
+            const interaction = {
+                id: `pre-action-${Date.now()}`,
+                agent,
+                message: {
+                    source: 'pre-action-check',
+                    content: action.instruction || '',
+                    authenticated: true,
+                    timestamp: new Date(),
+                },
+                instruction: action.instruction,
+                context: action.contextSources?.map((cs) => ({
+                    providerId: cs.providerId,
+                    content: cs.content,
+                    signature: cs.signature,
+                })),
+                action,
+            };
+            return this.runPreActionChecks(interaction, credential);
+        }
+        finally {
+            validationDuration.observe({ type: 'pre-action' }, (Date.now() - startTime) / 1000);
+        }
+    }
+    /**
+     * Perform post-action validation
+     *
+     * @param agent - Agent identity
+     * @param action - Action record
+     * @returns Post-action result
+     */
+    postActionCheck(agent, action) {
+        const startTime = Date.now();
+        try {
+            const credential = this.credentialCache.get(agent.did);
+            if (!credential) {
+                return {
+                    valid: false,
+                    reason: 'No credential loaded for agent',
+                };
+            }
+            return this.runPostActionChecks(agent, action, credential);
+        }
+        finally {
+            validationDuration.observe({ type: 'post-action' }, (Date.now() - startTime) / 1000);
+        }
+    }
+    /**
+     * Load credential for an agent
+     *
+     * @param agentId - Agent identifier (DID)
+     * @returns Semantic governance credential or undefined
+     */
+    async loadCredential(agentId) {
+        // Check cache first
+        const cached = this.credentialCache.get(agentId);
+        if (cached) {
+            return cached;
+        }
+        // Load from credential manager
+        const credential = this.credentialManager.getCredentialByAgent(agentId);
+        if (credential) {
+            this.credentialCache.set(agentId, credential);
+            activeCredentials.set(this.credentialCache.size);
+            return credential;
+        }
+        return undefined;
+    }
+    /**
+     * Clear the credential cache
+     */
+    clearCredentialCache() {
+        this.credentialCache.clear();
+        activeCredentials.set(0);
+    }
+    /**
+     * Get metrics registry for this service
+     */
+    getMetricsRegistry() {
+        return semanticGovernanceRegistry;
+    }
+    /**
+     * Run pre-action checks
+     */
+    runPreActionChecks(interaction, credential) {
+        const warnings = [];
+        // 1. Classify message channel
+        const channelClassification = this.dualChannelEnforcer.classifyMessage({
+            source: interaction.message.source,
+            authenticated: interaction.message.authenticated,
+        });
+        // 2. Enforce channel separation
+        const channelEnforcement = this.dualChannelEnforcer.enforceChannelSeparation({
+            content: interaction.message.content,
+            source: interaction.message.source,
+            authenticated: interaction.message.authenticated,
+        }, channelClassification.channel);
+        channelEnforcementTotal.inc({
+            channel: channelClassification.channel,
+            action: channelEnforcement.action,
+        });
+        if (!channelEnforcement.allowed) {
+            return {
+                allowed: false,
+                reason: channelEnforcement.reason,
+                channelEnforcement,
+            };
+        }
+        if (channelEnforcement.action === 'warn' && channelEnforcement.strippedInstructions) {
+            warnings.push(`Warning: Instructions detected in ${channelClassification.channel} plane`);
+        }
+        // 3. Validate instruction integrity
+        if (interaction.instruction) {
+            // Create a temporary validator with the credential's config
+            const instructionValidator = new InstructionValidator(credential.instructionIntegrity);
+            const instructionValidation = instructionValidator.validateInstruction(interaction.instruction);
+            if (!instructionValidation.valid) {
+                validationTotal.inc({ type: 'instruction', result: 'rejected' });
+                return {
+                    allowed: false,
+                    reason: instructionValidation.reason || 'Instruction validation failed',
+                    instructionValidation,
+                    channelEnforcement,
+                };
+            }
+            validationTotal.inc({ type: 'instruction', result: 'allowed' });
+        }
+        // 4. Validate context sources
+        const contextValidations = [];
+        if (interaction.context) {
+            const contextValidator = new ContextValidator(credential.contextAuthentication);
+            for (const ctx of interaction.context) {
+                // Create a mock trust profile - in production, this would be fetched
+                const trustProfile = {
+                    did: ctx.providerId,
+                    trustTier: interaction.agent.trustTier,
+                    domains: interaction.agent.domains,
+                    trustScore: 500, // Default mid-range score
+                };
+                const contextValidation = contextValidator.validateContext(ctx.providerId, trustProfile, ctx.content, ctx.signature, ctx.timestamp);
+                contextValidations.push(contextValidation);
+                if (!contextValidation.valid) {
+                    validationTotal.inc({ type: 'context', result: 'rejected' });
+                    // Track injection detection
+                    if (contextValidation.injectionScan?.detected) {
+                        injectionDetectedTotal.inc({ severity: contextValidation.injectionScan.severity || 'unknown' });
+                    }
+                    return {
+                        allowed: false,
+                        reason: contextValidation.reason || 'Context validation failed',
+                        contextValidations,
+                        channelEnforcement,
+                    };
+                }
+            }
+            validationTotal.inc({ type: 'context', result: 'allowed' });
+        }
+        // 5. Validate inference operations
+        const inferenceValidations = [];
+        const actionRequest = interaction.action;
+        if (actionRequest?.inferenceOperations) {
+            const inferenceValidator = new InferenceValidator(credential.inferenceScope);
+            for (const op of actionRequest.inferenceOperations) {
+                const inferenceValidation = inferenceValidator.validateInference(op);
+                inferenceValidations.push(inferenceValidation);
+                if (!inferenceValidation.valid) {
+                    validationTotal.inc({ type: 'inference', result: 'rejected' });
+                    return {
+                        allowed: false,
+                        reason: inferenceValidation.reason || 'Inference validation failed',
+                        inferenceValidations,
+                        channelEnforcement,
+                    };
+                }
+            }
+            validationTotal.inc({ type: 'inference', result: 'allowed' });
+        }
+        return {
+            allowed: true,
+            channelEnforcement,
+            contextValidations: contextValidations.length > 0 ? contextValidations : undefined,
+            inferenceValidations: inferenceValidations.length > 0 ? inferenceValidations : undefined,
+            warnings: warnings.length > 0 ? warnings : undefined,
+        };
+    }
+    /**
+     * Run post-action checks
+     */
+    runPostActionChecks(agent, action, credential) {
+        const warnings = [];
+        // 1. Validate output against schemas
+        const outputValidator = new OutputValidator(credential.outputBinding);
+        const outputValidation = outputValidator.validateOutput(action.output);
+        if (!outputValidation.valid) {
+            validationTotal.inc({ type: 'output', result: 'rejected' });
+            return {
+                valid: false,
+                reason: outputValidation.reason || 'Output validation failed',
+                outputValidation,
+            };
+        }
+        validationTotal.inc({ type: 'output', result: 'allowed' });
+        // 2. Validate external endpoints
+        if (action.externalEndpoints) {
+            for (const endpoint of action.externalEndpoints) {
+                if (!outputValidator.validateExternalEndpoint(endpoint)) {
+                    return {
+                        valid: false,
+                        reason: `Unauthorized external endpoint: ${endpoint}`,
+                        outputValidation,
+                    };
+                }
+            }
+        }
+        // 3. Validate derived knowledge
+        const inferenceValidations = [];
+        const piiChecks = [];
+        if (action.derivedKnowledge) {
+            const inferenceValidator = new InferenceValidator(credential.inferenceScope);
+            for (const knowledge of action.derivedKnowledge) {
+                // Create inference operation from knowledge
+                const op = {
+                    type: knowledge.type,
+                    sourceDomains: knowledge.sourceDomains,
+                };
+                const inferenceValidation = inferenceValidator.validateInference(op);
+                inferenceValidations.push(inferenceValidation);
+                if (!inferenceValidation.valid) {
+                    return {
+                        valid: false,
+                        reason: inferenceValidation.reason || 'Derived knowledge exceeds inference scope',
+                        outputValidation,
+                        inferenceValidations,
+                    };
+                }
+                // Check PII in derived knowledge
+                const piiCheck = inferenceValidator.checkPIIInference(knowledge.content);
+                piiChecks.push(piiCheck);
+                if (piiCheck.containsPII) {
+                    for (const piiType of piiCheck.piiTypes) {
+                        piiDetectedTotal.inc({ type: piiType, action: piiCheck.action });
+                    }
+                    if (piiCheck.action === 'blocked') {
+                        return {
+                            valid: false,
+                            reason: `PII detected in derived knowledge: ${piiCheck.piiTypes.join(', ')}`,
+                            outputValidation,
+                            inferenceValidations,
+                            piiChecks,
+                        };
+                    }
+                }
+            }
+        }
+        // 4. Sanitize output if needed
+        let sanitizedOutput;
+        if (outputValidation.patternScan?.detected) {
+            const sanitized = outputValidator.sanitizeOutput(action.output);
+            if (sanitized.modified) {
+                sanitizedOutput = sanitized.content;
+                warnings.push(`Output sanitized: ${sanitized.redactions.map((r) => r.description).join(', ')}`);
+            }
+        }
+        return {
+            valid: true,
+            outputValidation,
+            inferenceValidations: inferenceValidations.length > 0 ? inferenceValidations : undefined,
+            piiChecks: piiChecks.length > 0 ? piiChecks : undefined,
+            sanitizedOutput,
+            warnings: warnings.length > 0 ? warnings : undefined,
+        };
+    }
+}
+/**
+ * Create a SemanticGovernanceService with default validators
+ *
+ * @param credential - Optional credential to use for validation
+ * @returns Configured SemanticGovernanceService
+ */
+export function createSemanticGovernanceService(credential) {
+    const config = credential || {
+        instructionIntegrity: {
+            allowedInstructionHashes: [],
+            instructionTemplates: [],
+            instructionSource: { allowedSources: [], requireSignature: false },
+        },
+        outputBinding: {
+            allowedSchemas: [],
+            prohibitedPatterns: [],
+            allowedExternalEndpoints: [],
+            blockedExternalEndpoints: ['*'],
+        },
+        inferenceScope: {
+            globalLevel: 2, // ENTITY level
+            domainOverrides: [],
+            derivedKnowledgeHandling: { retention: 'session', allowedRecipients: [], crossContextSharing: false },
+            piiInference: { allowed: false, handling: 'redact' },
+        },
+        contextAuthentication: {
+            required: true,
+            minTrustTier: 2,
+            allowedProviders: [],
+            blockedProviders: [],
+            contentIntegrity: { signatureRequired: false, maxAge: 300, allowedFormats: ['application/json', 'text/plain'] },
+        },
+        dualChannel: {
+            enforced: true,
+            controlPlaneSources: ['user-direct-input', 'signed-system-instruction', 'authenticated-api-command'],
+            dataPlaneTreatment: 'sanitize',
+        },
+    };
+    return new SemanticGovernanceService(new InstructionValidator(config.instructionIntegrity), new OutputValidator(config.outputBinding), new InferenceValidator(config.inferenceScope), new ContextValidator(config.contextAuthentication), new DualChannelEnforcer(config.dualChannel));
+}
+/**
+ * Get metrics as Prometheus text format
+ */
+export async function getSemanticGovernanceMetrics() {
+    return semanticGovernanceRegistry.metrics();
+}
+/**
+ * Get metrics content type
+ */
+export function getSemanticGovernanceMetricsContentType() {
+    return semanticGovernanceRegistry.contentType;
+}
+//# sourceMappingURL=service.js.map

package/dist/semantic-governance/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/semantic-governance/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAA6B,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAe1F,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,6BAA6B,EAAE,CAAC,CAAC;AAE1E,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,0BAA0B,GAAG,IAAI,QAAQ,EAAE,CAAC;AAElD,sBAAsB;AACtB,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC;IAClC,IAAI,EAAE,kCAAkC;IACxC,IAAI,EAAE,uCAAuC;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACvC,SAAS,EAAE,CAAC,0BAA0B,CAAC;CACxC,CAAC,CAAC;AAEH,sBAAsB;AACtB,MAAM,kBAAkB,GAAG,IAAI,SAAS,CAAC;IACvC,IAAI,EAAE,6CAA6C;IACnD,IAAI,EAAE,yCAAyC;IAC/C,UAAU,EAAE,CAAC,MAAM,CAAU;IAC7B,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7D,SAAS,EAAE,CAAC,0BAA0B,CAAC;CACxC,CAAC,CAAC;AAEH,sBAAsB;AACtB,MAAM,sBAAsB,GAAG,IAAI,OAAO,CAAC;IACzC,IAAI,EAAE,0CAA0C;IAChD,IAAI,EAAE,mCAAmC;IACzC,UAAU,EAAE,CAAC,UAAU,CAAU;IACjC,SAAS,EAAE,CAAC,0BAA0B,CAAC;CACxC,CAAC,CAAC;AAEH,gBAAgB;AAChB,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC;IACnC,IAAI,EAAE,oCAAoC;IAC1C,IAAI,EAAE,8BAA8B;IACpC,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAU;IACvC,SAAS,EAAE,CAAC,0BAA0B,CAAC;CACxC,CAAC,CAAC;AAEH,sBAAsB;AACtB,MAAM,uBAAuB,GAAG,IAAI,OAAO,CAAC;IAC1C,IAAI,EAAE,2CAA2C;IACjD,IAAI,EAAE,mCAAmC;IACzC,UAAU,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAU;IAC1C,SAAS,EAAE,CAAC,0BAA0B,CAAC;CACxC,CAAC,CAAC;AAEH,2BAA2B;AAC3B,MAAM,iBAAiB,GAAG,IAAI,KAAK,CAAC;IAClC,IAAI,EAAE,oCAAoC;IAC1C,IAAI,EAAE,kDAAkD;IACxD,SAAS,EAAE,CAAC,0BAA0B,CAAC;CACxC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,WAAW;IAC7C,IAAI,GAAG,2BAA2B,CAAC;IACnC,UAAU,GAAG,GAAG,CAAC;IAE1B,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IACnB,oBAAoB,CAAuB;IAC3C,eAAe,CAAkB;IACjC,kBAAkB,CAAqB;IACvC,gBAAgB,CAAmB;IACnC,mBAAmB,CAAsB;IACzC,iBAAiB,CAA4B;IAC7C,eAAe,CAA4C;IAE5E;;;;;;;;;OASG;IACH,YACE,oBAA0C,EAC1C,eAAgC,EAChC,kBAAsC,EACtC,gBAAkC,EAClC,mBAAwC,EACxC,iBAA6C;QAE7C,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QACzC,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,IAAI,oBAAoB,EAAE,CAAC;QACrE,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,EAAE,CAAC;QAEjC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CAAC,WAA6B;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,4BAA4B;YAC5B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,+BAA+B,CAAC,CAAC;gBAClF,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,aAAa,EAAE,WAAW,CAAC,EAAE;oBAC7B,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG;oBAC/B,MAAM,EAAE,mDAAmD;oBAC3D,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,wBAAwB;YACxB,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACzE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;gBAC7B,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjE,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,aAAa,EAAE,WAAW,CAAC,EAAE;oBAC7B,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG;oBAC/B,SAAS,EAAE,eAAe;oBAC1B,MAAM,EAAE,eAAe,CAAC,MAAM;oBAC9B,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACnC,CAAC;YACJ,CAAC;YAED,qDAAqD;YACrD,IAAI,gBAA8C,CAAC;YACnD,IAAI,WAAW,CAAC,MAAM,IAAI,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;gBACzD,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CACzC,WAAW,CAAC,KAAK,EACjB,WAAW,CAAC,MAAsB,EAClC,UAAU,CACX,CAAC;gBACF,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;oBAC5B,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBACjE,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,aAAa,EAAE,WAAW,CAAC,EAAE;wBAC7B,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG;wBAC/B,SAAS,EAAE,eAAe;wBAC1B,UAAU,EAAE,gBAAgB;wBAC5B,MAAM,EAAE,gBAAgB,CAAC,MAAM;wBAC/B,WAAW,EAAE,IAAI,IAAI,EAAE;wBACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,aAAa,EAAE,WAAW,CAAC,EAAE;gBAC7B,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG;gBAC/B,SAAS,EAAE,eAAe;gBAC1B,UAAU,EAAE,gBAAgB;gBAC5B,WAAW,EAAE,IAAI,IAAI,EAAE;gBACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACnC,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,KAAoB,EAAE,MAAqB;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,gCAAgC;iBACzC,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAqB;gBACpC,EAAE,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC9B,KAAK;gBACL,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;oBACjC,aAAa,EAAE,IAAI;oBACnB,SAAS,EAAE,IAAI,IAAI,EAAE;iBACtB;gBACD,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC3C,UAAU,EAAE,EAAE,CAAC,UAAU;oBACzB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,SAAS,EAAE,EAAE,CAAC,SAAS;iBACxB,CAAC,CAAC;gBACH,MAAM;aACP,CAAC;YAEF,OAAO,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;gBAAS,CAAC;YACT,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,KAAoB,EAAE,MAAoB;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,gCAAgC;iBACzC,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,+BAA+B;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9C,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,WAA6B,EAC7B,UAAwC;QAExC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,8BAA8B;QAC9B,MAAM,qBAAqB,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC;YACrE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM;YAClC,aAAa,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa;SACjD,CAAC,CAAC;QAEH,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,CAAC,wBAAwB,CAC1E;YACE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO;YACpC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM;YAClC,aAAa,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa;SACjD,EACD,qBAAqB,CAAC,OAAO,CAC9B,CAAC;QAEF,uBAAuB,CAAC,GAAG,CAAC;YAC1B,OAAO,EAAE,qBAAqB,CAAC,OAAO;YACtC,MAAM,EAAE,kBAAkB,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,CAAC,MAAM;gBACjC,kBAAkB;aACnB,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,CAAC,MAAM,KAAK,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,CAAC;YACpF,QAAQ,CAAC,IAAI,CAAC,qCAAqC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC;QAC5F,CAAC;QAED,oCAAoC;QACpC,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC;YAC5B,4DAA4D;YAC5D,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;YACvF,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAEhG,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;gBACjC,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,qBAAqB,CAAC,MAAM,IAAI,+BAA+B;oBACvE,qBAAqB;oBACrB,kBAAkB;iBACnB,CAAC;YACJ,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,8BAA8B;QAC9B,MAAM,kBAAkB,GAAG,EAAE,CAAC;QAC9B,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YAEhF,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;gBACtC,qEAAqE;gBACrE,MAAM,YAAY,GAAiB;oBACjC,GAAG,EAAE,GAAG,CAAC,UAAU;oBACnB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS;oBACtC,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO;oBAClC,UAAU,EAAE,GAAG,EAAE,0BAA0B;iBAC5C,CAAC;gBAEF,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,eAAe,CACxD,GAAG,CAAC,UAAU,EACd,YAAY,EACZ,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,SAAS,CACd,CAAC;gBAEF,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAE3C,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;oBAC7B,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBAE7D,4BAA4B;oBAC5B,IAAI,iBAAiB,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;wBAC9C,sBAAsB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,CAAC,aAAa,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;oBAClG,CAAC;oBAED,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,iBAAiB,CAAC,MAAM,IAAI,2BAA2B;wBAC/D,kBAAkB;wBAClB,kBAAkB;qBACnB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,mCAAmC;QACnC,MAAM,oBAAoB,GAAG,EAAE,CAAC;QAChC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAmC,CAAC;QACtE,IAAI,aAAa,EAAE,mBAAmB,EAAE,CAAC;YACvC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAE7E,KAAK,MAAM,EAAE,IAAI,aAAa,CAAC,mBAAmB,EAAE,CAAC;gBACnD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;gBACrE,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAE/C,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;oBAC/B,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC/D,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,mBAAmB,CAAC,MAAM,IAAI,6BAA6B;wBACnE,oBAAoB;wBACpB,kBAAkB;qBACnB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;YAClF,oBAAoB,EAAE,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;YACxF,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,KAAoB,EACpB,MAAoB,EACpB,UAAwC;QAExC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEvE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5D,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gBAAgB,CAAC,MAAM,IAAI,0BAA0B;gBAC7D,gBAAgB;aACjB,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAE3D,iCAAiC;QACjC,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAChD,IAAI,CAAC,eAAe,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxD,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,mCAAmC,QAAQ,EAAE;wBACrD,gBAAgB;qBACjB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,oBAAoB,GAAG,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,EAAE,CAAC;QAErB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAE7E,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAChD,4CAA4C;gBAC5C,MAAM,EAAE,GAAuB;oBAC7B,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,aAAa,EAAE,SAAS,CAAC,aAAa;iBACvC,CAAC;gBAEF,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;gBACrE,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAE/C,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;oBAC/B,OAAO;wBACL,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,mBAAmB,CAAC,MAAM,IAAI,2CAA2C;wBACjF,gBAAgB;wBAChB,oBAAoB;qBACrB,CAAC;gBACJ,CAAC;gBAED,iCAAiC;gBACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACzE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAEzB,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;oBACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;wBACxC,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBACnE,CAAC;oBAED,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAClC,OAAO;4BACL,KAAK,EAAE,KAAK;4BACZ,MAAM,EAAE,sCAAsC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;4BAC5E,gBAAgB;4BAChB,oBAAoB;4BACpB,SAAS;yBACV,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,eAAwB,CAAC;QAC7B,IAAI,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,gBAAgB;YAChB,oBAAoB,EAAE,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;YACxF,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACvD,eAAe;YACf,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;SACrD,CAAC;IACJ,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAC7C,UAAyC;IAEzC,MAAM,MAAM,GAAG,UAAU,IAAI;QAC3B,oBAAoB,EAAE;YACpB,wBAAwB,EAAE,EAAE;YAC5B,oBAAoB,EAAE,EAAE;YACxB,iBAAiB,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE;SACnE;QACD,aAAa,EAAE;YACb,cAAc,EAAE,EAAE;YAClB,kBAAkB,EAAE,EAAE;YACtB,wBAAwB,EAAE,EAAE;YAC5B,wBAAwB,EAAE,CAAC,GAAG,CAAC;SAChC;QACD,cAAc,EAAE;YACd,WAAW,EAAE,CAAC,EAAE,eAAe;YAC/B,eAAe,EAAE,EAAE;YACnB,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;YACrG,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACrD;QACD,qBAAqB,EAAE;YACrB,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,CAAC;YACf,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;SAChH;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,IAAI;YACd,mBAAmB,EAAE,CAAC,mBAAmB,EAAE,2BAA2B,EAAE,2BAA2B,CAAC;YACpG,kBAAkB,EAAE,UAAU;SAC/B;KACF,CAAC;IAEF,OAAO,IAAI,yBAAyB,CAClC,IAAI,oBAAoB,CAAC,MAAM,CAAC,oBAAoB,CAAC,EACrD,IAAI,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,EACzC,IAAI,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,EAC7C,IAAI,gBAAgB,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAClD,IAAI,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,OAAO,0BAA0B,CAAC,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uCAAuC;IACrD,OAAO,0BAA0B,CAAC,WAAW,CAAC;AAChD,CAAC"}