@yiaany/ghostapi 0.1.6 → 0.1.8

package/dist/inventory/analysis.js

@@ -0,0 +1,457 @@
+import { freshnessStatusFor, FRESHNESS_DEFAULT_DAYS, sha256Digest } from "./types.js";
+const PRODUCTION_ENVIRONMENT = "production";
+export function normalizeFreshnessDays(days) {
+    return {
+        edgeStaleDays: days?.edgeStaleDays ?? FRESHNESS_DEFAULT_DAYS.edgeStale,
+        credentialStaleDays: days?.credentialStaleDays ?? FRESHNESS_DEFAULT_DAYS.credentialStale,
+        evidenceFreshDays: days?.evidenceFreshDays ?? FRESHNESS_DEFAULT_DAYS.evidenceFresh
+    };
+}
+export function graphEdges(state, tenantId, now, freshnessDays) {
+    const normalized = normalizeFreshnessDays(freshnessDays);
+    return state.edges
+        .filter((edge) => edge.tenantId === tenantId)
+        .map((edge) => ({ ...edge, freshnessStatus: freshnessStatusFor(edge.lastSeenAt, now, normalized.edgeStaleDays) }));
+}
+export function findAttackPaths(state, tenantId, agentId, now, freshnessDays) {
+    const agent = state.agents.find((candidate) => candidate.tenantId === tenantId && candidate.agentId === agentId);
+    if (agent === undefined)
+        return { agentId, paths: [], incompletePaths: 0 };
+    const normalized = normalizeFreshnessDays(freshnessDays);
+    const staleBeforeMs = Date.parse(now) - normalized.edgeStaleDays * 24 * 60 * 60 * 1000;
+    const identities = state.identities.filter((identity) => identity.tenantId === tenantId);
+    const tools = state.tools.filter((tool) => tool.tenantId === tenantId);
+    const providers = state.providers.filter((provider) => provider.tenantId === tenantId);
+    const resources = state.resources.filter((resource) => resource.tenantId === tenantId);
+    const sideEffects = state.sideEffects.filter((sideEffect) => sideEffect.tenantId === tenantId);
+    const edges = state.edges.filter((edge) => edge.tenantId === tenantId && Date.parse(edge.lastSeenAt) >= staleBeforeMs);
+    const paths = [];
+    let incompletePaths = 0;
+    for (const identityId of agent.identityIds) {
+        const identity = identities.find((candidate) => candidate.identityId === identityId);
+        const identityStep = { kind: "identity", id: identityId, display: identity === undefined ? identityId : `${identity.principalId} (${identity.role})` };
+        if (identity === undefined) {
+            paths.push({ steps: [stepAgent(agentId), identityStep], complete: false, edges: [] });
+            incompletePaths += 1;
+            continue;
+        }
+        for (const toolId of identity.toolIds) {
+            const tool = tools.find((candidate) => candidate.toolId === toolId);
+            const toolStep = { kind: "tool", id: toolId, display: tool === undefined ? toolId : tool.name };
+            const identityEdge = edge(edges, "identity", identityId, "tool", toolId);
+            if (tool === undefined || tool.providerId === null) {
+                paths.push({
+                    steps: [stepAgent(agentId), identityStep, toolStep],
+                    complete: false,
+                    edges: identityEdge === undefined ? [] : [identityEdge]
+                });
+                incompletePaths += 1;
+                continue;
+            }
+            const provider = providers.find((candidate) => candidate.providerId === tool.providerId);
+            const providerStep = { kind: "provider", id: tool.providerId, display: provider === undefined ? tool.providerId : provider.name };
+            const toolEdge = edge(edges, "tool", toolId, "provider", tool.providerId);
+            if (provider === undefined) {
+                paths.push({
+                    steps: [stepAgent(agentId), identityStep, toolStep, providerStep],
+                    complete: false,
+                    edges: [identityEdge, toolEdge].filter((candidate) => candidate !== undefined)
+                });
+                incompletePaths += 1;
+                continue;
+            }
+            for (const resourceId of provider.resourceIds) {
+                const resource = resources.find((candidate) => candidate.resourceId === resourceId);
+                const resourceStep = { kind: "resource", id: resourceId, display: resource === undefined ? resourceId : resource.name };
+                const exposeEdge = edge(edges, "provider", provider.providerId, "resource", resourceId);
+                if (resource === undefined) {
+                    paths.push({
+                        steps: [stepAgent(agentId), identityStep, toolStep, providerStep, resourceStep],
+                        complete: false,
+                        edges: [identityEdge, toolEdge, exposeEdge].filter((candidate) => candidate !== undefined)
+                    });
+                    incompletePaths += 1;
+                    continue;
+                }
+                for (const sideEffectId of resource.sideEffectIds) {
+                    const sideEffect = sideEffects.find((candidate) => candidate.sideEffectId === sideEffectId);
+                    const sideEffectStep = { kind: "side_effect", id: sideEffectId, display: sideEffect === undefined ? sideEffectId : sideEffect.kind };
+                    const permitEdge = edge(edges, "resource", resourceId, "side_effect", sideEffectId);
+                    if (sideEffect === undefined) {
+                        paths.push({
+                            steps: [stepAgent(agentId), identityStep, toolStep, providerStep, resourceStep, sideEffectStep],
+                            complete: false,
+                            edges: [identityEdge, toolEdge, exposeEdge, permitEdge].filter((candidate) => candidate !== undefined)
+                        });
+                        incompletePaths += 1;
+                        continue;
+                    }
+                    const usedEdges = [identityEdge, toolEdge, exposeEdge, permitEdge].filter((candidate) => candidate !== undefined);
+                    paths.push({ steps: [stepAgent(agentId), identityStep, toolStep, providerStep, resourceStep, sideEffectStep], complete: true, edges: usedEdges });
+                }
+            }
+        }
+    }
+    return { agentId, paths, incompletePaths };
+}
+function stepAgent(agentId) {
+    return { kind: "agent", id: agentId, display: agentId };
+}
+function edge(edges, sourceKind, sourceId, targetKind, targetId) {
+    return edges.find((candidate) => candidate.sourceKind === sourceKind && candidate.sourceId === sourceId && candidate.targetKind === targetKind && candidate.targetId === targetId);
+}
+export function computeBlastRadius(state, tenantId, agentId, now, freshnessDays) {
+    const result = findAttackPaths(state, tenantId, agentId, now, freshnessDays);
+    const resources = state.resources.filter((resource) => resource.tenantId === tenantId);
+    const sideEffects = state.sideEffects.filter((sideEffect) => sideEffect.tenantId === tenantId);
+    const identities = state.identities.filter((identity) => identity.tenantId === tenantId);
+    const tools = state.tools.filter((tool) => tool.tenantId === tenantId);
+    const credentials = state.credentials.filter((credential) => credential.tenantId === tenantId);
+    const providers = state.providers.filter((provider) => provider.tenantId === tenantId);
+    const byResource = new Map();
+    const rules = [];
+    const ruleIds = new Set();
+    for (const path of result.paths) {
+        if (!path.complete || path.steps.length < 6)
+            continue;
+        const [agentStep, identityStep, toolStep, providerStep, resourceStep, sideEffectStep] = path.steps;
+        const resource = resources.find((candidate) => candidate.resourceId === resourceStep.id);
+        const sideEffect = sideEffects.find((candidate) => candidate.sideEffectId === sideEffectStep.id);
+        if (resource === undefined || sideEffect === undefined)
+            continue;
+        const identity = identities.find((candidate) => candidate.identityId === identityStep.id);
+        const tool = tools.find((candidate) => candidate.toolId === toolStep.id);
+        const provider = providers.find((candidate) => candidate.providerId === providerStep.id);
+        const credential = credentials.find((candidate) => candidate.toolIds.includes(toolStep.id));
+        const rulesForResource = [];
+        const ruleId = `blast.${resourceStep.id}.${sideEffectStep.id}`;
+        if (!ruleIds.has(ruleId)) {
+            const credentialScopeNote = credential === undefined ? "no tracked credential bound to the tool" : `credential ${credential.credentialId} grants [${credential.grantScopes.join(", ")}]`;
+            const explanation = `Agent ${agentStep.id} uses identity ${identityStep.id}${identity === undefined ? "" : ` (${identity.role}, scopes [${identity.scopes.join(", ")}])`} to reach tool ${toolStep.id}${tool === undefined ? "" : ` (${tool.name})`}, which connects to provider ${providerStep.id}${provider === undefined ? "" : ` (${provider.name})`} using ${credentialScopeNote}, exposing resource ${resourceStep.id}, which permits side effect ${sideEffectStep.id} (${sideEffect.kind}, severity ${sideEffect.severity}).`;
+            rules.push({ ruleId, explanation });
+            ruleIds.add(ruleId);
+        }
+        rulesForResource.push(ruleId);
+        const existing = byResource.get(resourceStep.id);
+        if (existing === undefined) {
+            byResource.set(resourceStep.id, {
+                resourceId: resourceStep.id,
+                resourceType: resource.resourceType,
+                sensitive: resource.sensitive,
+                providerId: providerStep.id,
+                sideEffects: [{ sideEffectId: sideEffectStep.id, kind: sideEffect.kind, severity: sideEffect.severity, heuristic: true }],
+                pathCount: 1,
+                rules: rulesForResource
+            });
+        }
+        else {
+            existing.pathCount += 1;
+            if (!existing.sideEffects.some((candidate) => candidate.sideEffectId === sideEffectStep.id)) {
+                existing.sideEffects.push({ sideEffectId: sideEffectStep.id, kind: sideEffect.kind, severity: sideEffect.severity, heuristic: true });
+            }
+            for (const rule of rulesForResource)
+                if (!existing.rules.includes(rule))
+                    existing.rules.push(rule);
+        }
+    }
+    const covered = new Set(byResource.keys());
+    for (const provider of providers) {
+        for (const resourceId of provider.resourceIds) {
+            if (covered.has(resourceId))
+                continue;
+            const resource = resources.find((candidate) => candidate.resourceId === resourceId);
+            if (resource === undefined)
+                continue;
+            const ruleId = `blast-adjacent.${resourceId}`;
+            if (!ruleIds.has(ruleId)) {
+                rules.push({ ruleId, explanation: `Provider ${provider.providerId} also exposes resource ${resourceId}; this resource is reachable through the same provider but has no verified complete path from agent ${agentId} in the current graph.` });
+                ruleIds.add(ruleId);
+            }
+            byResource.set(resourceId, {
+                resourceId,
+                resourceType: resource.resourceType,
+                sensitive: resource.sensitive,
+                providerId: provider.providerId,
+                sideEffects: resource.sideEffectIds
+                    .map((sideEffectId) => sideEffects.find((candidate) => candidate.sideEffectId === sideEffectId))
+                    .filter((candidate) => candidate !== undefined)
+                    .map((sideEffect) => ({ sideEffectId: sideEffect.sideEffectId, kind: sideEffect.kind, severity: sideEffect.severity, heuristic: true })),
+                pathCount: 0,
+                rules: [ruleId]
+            });
+        }
+    }
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.inventory-blast-radius",
+        tenantId,
+        agentId,
+        analyzedAt: now,
+        paths: result.paths,
+        incompletePaths: result.incompletePaths,
+        resources: [...byResource.values()],
+        rules,
+        heuristicNote: "Impact severities and reachability labels are heuristic classifications derived from recorded side effects and imported graph edges. They are advisory for review, not proof of exploitability or a measured blast radius."
+    };
+}
+export function computeFindings(state, tenantId, now, freshnessDays) {
+    const normalized = normalizeFreshnessDays(freshnessDays);
+    const findings = [];
+    const agents = state.agents.filter((agent) => agent.tenantId === tenantId);
+    const identities = state.identities.filter((identity) => identity.tenantId === tenantId);
+    const tools = state.tools.filter((tool) => tool.tenantId === tenantId);
+    const providers = state.providers.filter((provider) => provider.tenantId === tenantId);
+    const resources = state.resources.filter((resource) => resource.tenantId === tenantId);
+    const credentials = state.credentials.filter((credential) => credential.tenantId === tenantId);
+    const policies = state.policies.filter((policy) => policy.tenantId === tenantId);
+    const importRuns = state.importRuns.filter((run) => run.tenantId === tenantId);
+    const knownOwners = new Set(identities.map((identity) => identity.principalId));
+    for (const agent of agents) {
+        if (agent.ownerId === null || !knownOwners.has(agent.ownerId)) {
+            const severity = agent.environmentIds.includes(PRODUCTION_ENVIRONMENT) ? "high" : "medium";
+            findings.push(makeFinding(tenantId, "orphaned_agents", severity, "agent", agent.agentId, "rule.orphaned_agents", `Agent ${agent.agentId} has no declared owner${agent.ownerId === null ? "" : ` (owner ${agent.ownerId} is not a known identity principal)`}.`, "evidence", now));
+        }
+        if (!agent.gatewayManaged) {
+            findings.push(makeFinding(tenantId, "agents_outside_gateway", "medium", "agent", agent.agentId, "rule.agents_outside_gateway", `Agent ${agent.agentId} is not managed through the GhostAPI gateway and can reach tools or providers directly.`, "evidence", now));
+        }
+        if (agent.lastEvidenceAt === null) {
+            findings.push(makeFinding(tenantId, "missing_evidence", "medium", "agent", agent.agentId, "rule.missing_evidence", `Agent ${agent.agentId} has no recorded safety evidence (no evidence metadata imported).`, "evidence", now));
+        }
+        else {
+            const ageDays = (Date.parse(now) - Date.parse(agent.lastEvidenceAt)) / (24 * 60 * 60 * 1000);
+            if (ageDays > normalized.evidenceFreshDays) {
+                findings.push(makeFinding(tenantId, "missing_evidence", "low", "agent", agent.agentId, "rule.stale_evidence", `Agent ${agent.agentId} has evidence older than ${normalized.evidenceFreshDays} days (last evidence ${agent.lastEvidenceAt}).`, "evidence", now));
+            }
+        }
+        if (agent.environmentIds.includes(PRODUCTION_ENVIRONMENT) && !agent.killSwitchEnabled) {
+            findings.push(makeFinding(tenantId, "missing_kill_switch", "high", "agent", agent.agentId, "rule.missing_agent_kill_switch", `Agent ${agent.agentId} operates in a production environment without an enabled kill switch.`, "evidence", now));
+        }
+    }
+    for (const provider of providers) {
+        if (provider.environmentIds.includes(PRODUCTION_ENVIRONMENT) && provider.ownerId === null) {
+            findings.push(makeFinding(tenantId, "unowned_production_integrations", "high", "provider", provider.providerId, "rule.unowned_production_provider", `Provider ${provider.providerId} is a production integration without an owner.`, "evidence", now));
+        }
+        if (provider.environmentIds.includes(PRODUCTION_ENVIRONMENT) && !provider.killSwitchApplied) {
+            findings.push(makeFinding(tenantId, "missing_kill_switch", "high", "provider", provider.providerId, "rule.missing_provider_kill_switch", `Provider ${provider.providerId} is a production integration without a GhostAPI kill switch applied.`, "evidence", now));
+        }
+    }
+    for (const resource of resources) {
+        if (resource.environmentIds.includes(PRODUCTION_ENVIRONMENT) && resource.ownerId === null) {
+            findings.push(makeFinding(tenantId, "unowned_production_integrations", "high", "resource", resource.resourceId, "rule.unowned_production_resource", `Resource ${resource.resourceId} is a production resource without an owner.`, "evidence", now));
+        }
+    }
+    for (const credential of credentials) {
+        if (credential.status !== "active")
+            continue;
+        const unusedDays = credential.lastUsedAt === null ? null : (Date.parse(now) - Date.parse(credential.lastUsedAt)) / (24 * 60 * 60 * 1000);
+        if (unusedDays === null || unusedDays > normalized.credentialStaleDays) {
+            findings.push(makeFinding(tenantId, "stale_unused_credentials", "medium", "credential", credential.credentialId, "rule.stale_unused_credentials", `Credential ${credential.credentialId} is active but unused${unusedDays === null ? " (never used)" : ` for ${Math.floor(unusedDays)} days`}.`, "evidence", now));
+        }
+        const required = new Set();
+        for (const toolId of credential.toolIds) {
+            const tool = tools.find((candidate) => candidate.toolId === toolId);
+            if (tool !== undefined)
+                for (const scope of tool.requiredScopes)
+                    required.add(scope);
+        }
+        const extra = credential.grantScopes.filter((scope) => !required.has(scope));
+        if (extra.length > 0) {
+            findings.push(makeFinding(tenantId, "excessive_permissions", "medium", "credential", credential.credentialId, "rule.excessive_permissions", `Credential ${credential.credentialId} grants scopes [${extra.join(", ")}] that are not required by any bound tool. Heuristic scope analysis; confirm before reducing.`, "heuristic", now));
+        }
+    }
+    const environmentsWithAgents = new Set();
+    for (const agent of agents)
+        for (const environmentId of agent.environmentIds)
+            environmentsWithAgents.add(environmentId);
+    for (const environmentId of environmentsWithAgents) {
+        const covered = policies.some((policy) => policy.environmentIds.includes(environmentId));
+        if (!covered) {
+            const agentCount = agents.filter((agent) => agent.environmentIds.includes(environmentId)).length;
+            findings.push(makeFinding(tenantId, "policy_drift", "medium", "environment", environmentId, "rule.policy_missing", `No policy covers environment ${environmentId} used by ${agentCount} active agent(s).`, "evidence", now));
+        }
+    }
+    const latestExpectationsBySource = new Map();
+    for (const run of importRuns) {
+        if (run.expectedPolicyHashes.length > 0)
+            latestExpectationsBySource.set(run.source.sourceId, run);
+    }
+    for (const run of latestExpectationsBySource.values()) {
+        for (const expectation of run.expectedPolicyHashes) {
+            const matching = policies.filter((policy) => policy.environmentIds.includes(expectation.environmentId));
+            const matchingHash = matching.some((policy) => policy.hash === expectation.policyHash);
+            if (!matchingHash) {
+                const stored = matching.map((policy) => policy.hash).join(", ") || "none";
+                findings.push(makeFinding(tenantId, "policy_drift", "high", "environment", expectation.environmentId, "rule.policy_drift", `Policy drift for environment ${expectation.environmentId}: expected hash ${expectation.policyHash} from source ${run.source.sourceId}, stored policy hash(es) [${stored}].`, "evidence", now));
+            }
+        }
+    }
+    return findings;
+}
+export function computeCoverage(state, tenantId, now, freshnessDays) {
+    const normalized = normalizeFreshnessDays(freshnessDays);
+    const agents = state.agents.filter((agent) => agent.tenantId === tenantId);
+    const providers = state.providers.filter((provider) => provider.tenantId === tenantId);
+    const credentials = state.credentials.filter((credential) => credential.tenantId === tenantId);
+    const policies = state.policies.filter((policy) => policy.tenantId === tenantId);
+    let policyCoveredAgents = 0;
+    let evidenceFreshAgents = 0;
+    let gatewayManagedAgents = 0;
+    for (const agent of agents) {
+        if (policies.some((policy) => agent.environmentIds.some((environmentId) => policy.environmentIds.includes(environmentId))))
+            policyCoveredAgents += 1;
+        if (agent.lastEvidenceAt !== null) {
+            const ageDays = (Date.parse(now) - Date.parse(agent.lastEvidenceAt)) / (24 * 60 * 60 * 1000);
+            if (ageDays <= normalized.evidenceFreshDays)
+                evidenceFreshAgents += 1;
+        }
+        if (agent.gatewayManaged)
+            gatewayManagedAgents += 1;
+    }
+    const productionProviders = providers.filter((provider) => provider.environmentIds.includes(PRODUCTION_ENVIRONMENT));
+    const killSwitchProviders = productionProviders.filter((provider) => provider.killSwitchApplied).length;
+    const directCredentials = credentials.filter((credential) => credential.status === "active" && !credential.gatewayBound).length;
+    const outsideGatewayAgents = agents.filter((agent) => !agent.gatewayManaged).length;
+    const unownedProduction = state.providers.filter((provider) => provider.tenantId === tenantId && provider.environmentIds.includes(PRODUCTION_ENVIRONMENT) && provider.ownerId === null).length + resourcesInProductionWithoutOwner(state, tenantId);
+    return {
+        activeAgents: agents.length,
+        policyCoveredAgents,
+        evidenceFreshAgents,
+        gatewayManagedAgents,
+        productionProviders: productionProviders.length,
+        killSwitchProviders,
+        directCredentials,
+        outsideGatewayAgents,
+        unownedProduction,
+        policyCoverageBps: bps(policyCoveredAgents, agents.length),
+        evidenceCoverageBps: bps(evidenceFreshAgents, agents.length),
+        gatewayCoverageBps: bps(gatewayManagedAgents, agents.length),
+        killSwitchCoverageBps: bps(killSwitchProviders, productionProviders.length)
+    };
+}
+function resourcesInProductionWithoutOwner(state, tenantId) {
+    return state.resources.filter((resource) => resource.tenantId === tenantId && resource.environmentIds.includes(PRODUCTION_ENVIRONMENT) && resource.ownerId === null).length;
+}
+export function computeRemovalAnalysis(state, tenantId, now, freshnessDays) {
+    const coverage = computeCoverage(state, tenantId, now, freshnessDays);
+    const normalized = normalizeFreshnessDays(freshnessDays);
+    const lost = [];
+    if (coverage.policyCoveredAgents > 0) {
+        lost.push(`${coverage.policyCoveredAgents} of ${coverage.activeAgents} active agents (${coverage.policyCoverageBps} bps) currently rely on GhostAPI-stored policy coverage for their environments.`);
+    }
+    if (coverage.gatewayManagedAgents > 0) {
+        lost.push(`${coverage.gatewayManagedAgents} of ${coverage.activeAgents} active agents are gateway-managed; without GhostAPI they would revert to direct tool/provider access.`);
+    }
+    if (coverage.directCredentials > 0) {
+        lost.push(`${coverage.directCredentials} active credential(s) are not gateway-bound and already represent direct access.`);
+    }
+    if (coverage.productionProviders > 0) {
+        lost.push(`${coverage.killSwitchProviders} of ${coverage.productionProviders} production providers have a GhostAPI kill switch; without GhostAPI the remaining ${coverage.productionProviders - coverage.killSwitchProviders} are not stop-controlled in GhostAPI.`);
+    }
+    if (coverage.evidenceFreshAgents > 0) {
+        lost.push(`${coverage.evidenceFreshAgents} agents have evidence fresh within the last ${normalized.evidenceFreshDays} days; without GhostAPI no evidence freshness is tracked.`);
+    }
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.inventory-removal-analysis",
+        tenantId,
+        generatedAt: now,
+        basis: "local_inventory_data",
+        coverage,
+        lostWithoutGhostApi: lost
+    };
+}
+export function computeRoiReport(state, tenantId, now, freshnessDays) {
+    const coverage = computeCoverage(state, tenantId, now, freshnessDays);
+    const importRuns = state.importRuns.filter((run) => run.tenantId === tenantId && run.counters !== undefined);
+    const latestBySource = new Map();
+    for (const run of importRuns.sort((a, b) => Date.parse(a.importedAt) - Date.parse(b.importedAt)))
+        latestBySource.set(run.source.sourceId, run);
+    const preventedSources = [];
+    const reviewSources = [];
+    const mttcSources = [];
+    let preventedEgressAttempts = 0;
+    let reviewTimeMinutes = 0;
+    let reviewTimeMeasured = false;
+    let meanTimeToContainMinutes = 0;
+    let mttcMeasured = false;
+    for (const run of latestBySource.values()) {
+        if (run.counters.preventedEgressAttempts !== undefined) {
+            preventedEgressAttempts += run.counters.preventedEgressAttempts;
+            preventedSources.push({ sourceId: run.source.sourceId, sourceType: run.source.sourceType, sourceName: run.source.sourceName, value: run.counters.preventedEgressAttempts });
+        }
+        if (run.counters.reviewTimeMinutes !== undefined) {
+            reviewTimeMinutes += run.counters.reviewTimeMinutes;
+            reviewTimeMeasured = true;
+            reviewSources.push({ sourceId: run.source.sourceId, sourceType: run.source.sourceType, sourceName: run.source.sourceName, value: run.counters.reviewTimeMinutes });
+        }
+        if (run.counters.meanTimeToContainMinutes !== undefined) {
+            meanTimeToContainMinutes += run.counters.meanTimeToContainMinutes;
+            mttcMeasured = true;
+            mttcSources.push({ sourceId: run.source.sourceId, sourceType: run.source.sourceType, sourceName: run.source.sourceName, value: run.counters.meanTimeToContainMinutes });
+        }
+    }
+    const credentials = state.credentials.filter((credential) => credential.tenantId === tenantId);
+    const remediations = state.remediations.filter((remediation) => remediation.tenantId === tenantId && remediation.status === "applied");
+    const revokedCredentialIds = new Set(remediations.filter((remediation) => remediation.kind === "revoke" && remediation.targetKind === "credential").map((remediation) => remediation.targetId));
+    const unusedGrantsRemoved = credentials.filter((credential) => credential.status === "revoked" && revokedCredentialIds.has(credential.credentialId)).length;
+    const excessiveScopeReductions = remediations.filter((remediation) => remediation.kind === "reduce_scope").length;
+    const ownedGrants = remediations.filter((remediation) => remediation.kind === "assign_owner").length;
+    const onboardedAgents = remediations.filter((remediation) => remediation.kind === "onboard_through_gateway").length;
+    const evalsCreated = remediations.filter((remediation) => remediation.kind === "create_eval").length;
+    const notMeasured = [];
+    if (!reviewTimeMeasured)
+        notMeasured.push("review_time_minutes");
+    if (!mttcMeasured)
+        notMeasured.push("mean_time_to_contain_minutes");
+    if (preventedEgressAttempts === 0)
+        notMeasured.push("prevented_egress_attempts");
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.inventory-roi",
+        tenantId,
+        generatedAt: now,
+        basis: "local_inventory_data_only",
+        activeAgentCount: coverage.activeAgents,
+        productionProviderCount: coverage.productionProviders,
+        incidents: {
+            preventedEgressAttempts,
+            preventedEgressSources: preventedSources,
+            reviewTimeMinutes: reviewTimeMeasured ? reviewTimeMinutes : null,
+            reviewTimeSources: reviewSources,
+            meanTimeToContainMinutes: mttcMeasured ? meanTimeToContainMinutes : null,
+            meanTimeToContainSources: mttcSources
+        },
+        remediationOutcomes: { unusedGrantsRemoved, excessiveScopeReductions, ownedGrants, onboardedAgents, evalsCreated },
+        coverage: {
+            policyCoverageBps: coverage.policyCoverageBps,
+            evidenceCoverageBps: coverage.evidenceCoverageBps,
+            gatewayCoverageBps: coverage.gatewayCoverageBps,
+            killSwitchCoverageBps: coverage.killSwitchCoverageBps
+        },
+        notMeasured
+    };
+}
+function makeFinding(tenantId, kind, severity, targetKind, targetId, ruleId, reason, basis, now) {
+    const findingId = `finding-${sha256Digest(`${tenantId}:${kind}:${targetKind}:${targetId}`).slice(0, 32)}`;
+    return {
+        schemaVersion: 1,
+        tenantId,
+        findingId,
+        kind,
+        severity,
+        targetKind,
+        targetId,
+        ruleId,
+        reason,
+        basis,
+        discoveredAt: now,
+        status: "open"
+    };
+}
+export function findingKey(record) {
+    return `${record.kind}:${record.targetKind}:${record.targetId}`;
+}
+function bps(count, total) {
+    return total === 0 ? 0 : Math.floor((count * 10_000) / total);
+}
+//# sourceMappingURL=analysis.js.map

package/dist/inventory/analysis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis.js","sourceRoot":"","sources":["../../src/inventory/analysis.ts"],"names":[],"mappings":"AAAA,OAAO,EAkBL,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAI5C,MAAM,UAAU,sBAAsB,CAAC,IAAwC;IAC7E,OAAO;QACL,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,sBAAsB,CAAC,SAAS;QACtE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,IAAI,sBAAsB,CAAC,eAAe;QACxF,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,IAAI,sBAAsB,CAAC,aAAa;KACnF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAA0B,EAAE,QAAgB,EAAE,GAAW,EAAE,aAAiD;IACrI,MAAM,UAAU,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,KAAK;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA0B,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,aAAiD;IAC3J,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACjH,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,UAAU,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACvF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,CAAC;IACvH,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,UAAmB,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;QAChK,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACtF,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,MAAe,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzG,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC;oBACnD,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;iBACxD,CAAC,CAAC;gBACH,eAAe,IAAI,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,UAAW,CAAC,CAAC;YAC1F,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,UAAmB,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC3I,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC;oBACjE,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAiD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;iBAC9H,CAAC,CAAC;gBACH,eAAe,IAAI,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;gBACpF,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,UAAmB,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACjI,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBACxF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,KAAK,CAAC,IAAI,CAAC;wBACT,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC;wBAC/E,QAAQ,EAAE,KAAK;wBACf,KAAK,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAiD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;qBAC1I,CAAC,CAAC;oBACH,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,KAAK,MAAM,YAAY,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;oBAClD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;oBAC5F,MAAM,cAAc,GAAG,EAAE,IAAI,EAAE,aAAsB,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;oBAC9I,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;oBACpF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;wBAC7B,KAAK,CAAC,IAAI,CAAC;4BACT,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,CAAC;4BAC/F,QAAQ,EAAE,KAAK;4BACf,KAAK,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAiD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;yBACtJ,CAAC,CAAC;wBACH,eAAe,IAAI,CAAC,CAAC;wBACrB,SAAS;oBACX,CAAC;oBACD,MAAM,SAAS,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAiD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;oBACjK,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACpJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,IAAI,CAAC,KAAmC,EAAE,UAAoB,EAAE,QAAgB,EAAE,UAAoB,EAAE,QAAgB;IAC/H,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,KAAK,UAAU,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACrL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAA0B,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,aAAiD;IAC9J,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC1D,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACtD,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QACnG,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,YAAY,CAAC,EAAE,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,cAAc,CAAC,EAAE,CAAC,CAAC;QACjG,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,YAAY,CAAC,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,YAAY,CAAC,EAAE,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAE5F,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,YAAY,CAAC,EAAE,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,mBAAmB,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,cAAc,UAAU,CAAC,YAAY,YAAY,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACzL,MAAM,WAAW,GAAG,SAAS,SAAS,CAAC,EAAE,kBAAkB,YAAY,CAAC,EAAE,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,aAAa,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,QAAQ,CAAC,EAAE,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,gCAAgC,YAAY,CAAC,EAAE,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,GAAG,UAAU,mBAAmB,uBAAuB,YAAY,CAAC,EAAE,+BAA+B,cAAc,CAAC,EAAE,KAAK,UAAU,CAAC,IAAI,cAAc,UAAU,CAAC,QAAQ,IAAI,CAAC;YACrgB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE;gBAC9B,UAAU,EAAE,YAAY,CAAC,EAAE;gBAC3B,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU,EAAE,YAAY,CAAC,EAAE;gBAC3B,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBACzH,SAAS,EAAE,CAAC;gBACZ,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,SAAS,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5F,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxI,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,gBAAgB;gBAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;YACpF,IAAI,QAAQ,KAAK,SAAS;gBAAE,SAAS;YACrC,MAAM,MAAM,GAAG,kBAAkB,UAAU,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,QAAQ,CAAC,UAAU,0BAA0B,UAAU,uGAAuG,OAAO,wBAAwB,EAAE,CAAC,CAAC;gBAC/O,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE;gBACzB,UAAU;gBACV,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,WAAW,EAAE,QAAQ,CAAC,aAAa;qBAChC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;qBAC/F,MAAM,CAAC,CAAC,SAAS,EAAwD,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;qBACpG,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1I,SAAS,EAAE,CAAC;gBACZ,KAAK,EAAE,CAAC,MAAM,CAAC;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,iCAAiC;QACvC,QAAQ;QACR,OAAO;QACP,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,SAAS,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACnC,KAAK;QACL,aAAa,EAAE,4NAA4N;KAC5O,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA0B,EAAE,QAAgB,EAAE,GAAW,EAAE,aAAiD;IAC1I,MAAM,UAAU,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAEhF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAoB,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC5G,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,sBAAsB,EAAE,SAAS,KAAK,CAAC,OAAO,yBAAyB,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,OAAO,qCAAqC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACpR,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,wBAAwB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,6BAA6B,EAAE,SAAS,KAAK,CAAC,OAAO,yFAAyF,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACpQ,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,SAAS,KAAK,CAAC,OAAO,mEAAmE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QAClO,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7F,IAAI,OAAO,GAAG,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBAC3C,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,qBAAqB,EAAE,SAAS,KAAK,CAAC,OAAO,4BAA4B,UAAU,CAAC,iBAAiB,wBAAwB,KAAK,CAAC,cAAc,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;YAClQ,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,gCAAgC,EAAE,SAAS,KAAK,CAAC,OAAO,uEAAuE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QAChP,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1F,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,kCAAkC,EAAE,YAAY,QAAQ,CAAC,UAAU,gDAAgD,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACzP,CAAC;QACD,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC5F,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,qBAAqB,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,mCAAmC,EAAE,YAAY,QAAQ,CAAC,UAAU,sEAAsE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACpQ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1F,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,iCAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,kCAAkC,EAAE,YAAY,QAAQ,CAAC,UAAU,6CAA6C,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACtP,CAAC;IACH,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC7C,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACzI,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,GAAG,UAAU,CAAC,mBAAmB,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,0BAA0B,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,+BAA+B,EAAE,cAAc,UAAU,CAAC,YAAY,wBAAwB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QACrT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YACpE,IAAI,IAAI,KAAK,SAAS;gBAAE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc;oBAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,uBAAuB,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,4BAA4B,EAAE,cAAc,UAAU,CAAC,YAAY,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,+FAA+F,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1U,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,cAAc;YAAE,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxH,KAAK,MAAM,aAAa,IAAI,sBAAsB,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YACjG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,qBAAqB,EAAE,gCAAgC,aAAa,YAAY,UAAU,mBAAmB,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/N,CAAC;IACH,CAAC;IACD,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;YAAE,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,0BAA0B,CAAC,MAAM,EAAE,EAAE,CAAC;QACtD,KAAK,MAAM,WAAW,IAAI,GAAG,CAAC,oBAAoB,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC;YACxG,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,UAAU,CAAC,CAAC;YACvF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;gBAC1E,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,mBAAmB,EAAE,gCAAgC,WAAW,CAAC,aAAa,mBAAmB,WAAW,CAAC,UAAU,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,6BAA6B,MAAM,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7T,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA0B,EAAE,QAAgB,EAAE,GAAW,EAAE,aAAiD;IAC1I,MAAM,UAAU,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAEjF,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;YAAE,mBAAmB,IAAI,CAAC,CAAC;QACrJ,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC7F,IAAI,OAAO,IAAI,UAAU,CAAC,iBAAiB;gBAAE,mBAAmB,IAAI,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,cAAc;YAAE,oBAAoB,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,mBAAmB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACrH,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;IACxG,MAAM,iBAAiB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;IAChI,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;IACpF,MAAM,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,iCAAiC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEpP,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,mBAAmB;QACnB,mBAAmB;QACnB,oBAAoB;QACpB,mBAAmB,EAAE,mBAAmB,CAAC,MAAM;QAC/C,mBAAmB;QACnB,iBAAiB;QACjB,oBAAoB;QACpB,iBAAiB;QACjB,iBAAiB,EAAE,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1D,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5D,kBAAkB,EAAE,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5D,qBAAqB,EAAE,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,MAAM,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CAAC,KAA0B,EAAE,QAAgB;IACrF,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;AAC9K,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAA0B,EAAE,QAAgB,EAAE,GAAW,EAAE,aAAiD;IACjJ,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,QAAQ,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,mBAAmB,OAAO,QAAQ,CAAC,YAAY,mBAAmB,QAAQ,CAAC,iBAAiB,iFAAiF,CAAC,CAAC;IACvM,CAAC;IACD,IAAI,QAAQ,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,oBAAoB,OAAO,QAAQ,CAAC,YAAY,wGAAwG,CAAC,CAAC;IAClL,CAAC;IACD,IAAI,QAAQ,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,iBAAiB,kFAAkF,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,QAAQ,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,mBAAmB,OAAO,QAAQ,CAAC,mBAAmB,qFAAqF,QAAQ,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,uCAAuC,CAAC,CAAC;IACvQ,CAAC;IACD,IAAI,QAAQ,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,mBAAmB,+CAA+C,UAAU,CAAC,iBAAiB,2DAA2D,CAAC,CAAC;IACnL,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,qCAAqC;QAC3C,QAAQ;QACR,WAAW,EAAE,GAAG;QAChB,KAAK,EAAE,sBAAsB;QAC7B,QAAQ;QACR,mBAAmB,EAAE,IAAI;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAA0B,EAAE,QAAgB,EAAE,GAAW,EAAE,aAAiD;IAC3I,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAC7G,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC1D,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAAE,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE/I,MAAM,gBAAgB,GAAoB,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAoB,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,wBAAwB,GAAG,CAAC,CAAC;IACjC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,CAAC,QAAS,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;YACxD,uBAAuB,IAAI,GAAG,CAAC,QAAS,CAAC,uBAAuB,CAAC;YACjE,gBAAgB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,QAAS,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC/K,CAAC;QACD,IAAI,GAAG,CAAC,QAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAClD,iBAAiB,IAAI,GAAG,CAAC,QAAS,CAAC,iBAAiB,CAAC;YACrD,kBAAkB,GAAG,IAAI,CAAC;YAC1B,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,QAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACtK,CAAC;QACD,IAAI,GAAG,CAAC,QAAS,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACzD,wBAAwB,IAAI,GAAG,CAAC,QAAS,CAAC,wBAAwB,CAAC;YACnE,YAAY,GAAG,IAAI,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,QAAS,CAAC,wBAAwB,EAAE,CAAC,CAAC;QAC3K,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IACvI,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChM,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5J,MAAM,wBAAwB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,MAAM,CAAC;IAClH,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,MAAM,CAAC;IACrG,MAAM,eAAe,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,MAAM,CAAC;IACpH,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;IAErG,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,CAAC,kBAAkB;QAAE,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjE,IAAI,CAAC,YAAY;QAAE,WAAW,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACpE,IAAI,uBAAuB,KAAK,CAAC;QAAE,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAEjF,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ;QACR,WAAW,EAAE,GAAG;QAChB,KAAK,EAAE,2BAA2B;QAClC,gBAAgB,EAAE,QAAQ,CAAC,YAAY;QACvC,uBAAuB,EAAE,QAAQ,CAAC,mBAAmB;QACrD,SAAS,EAAE;YACT,uBAAuB;YACvB,sBAAsB,EAAE,gBAAgB;YACxC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI;YAChE,iBAAiB,EAAE,aAAa;YAChC,wBAAwB,EAAE,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;YACxE,wBAAwB,EAAE,WAAW;SACtC;QACD,mBAAmB,EAAE,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE;QAClH,QAAQ,EAAE;YACR,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;SACtD;QACD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,QAAgB,EAChB,IAA2B,EAC3B,QAAyB,EACzB,UAAuC,EACvC,QAAgB,EAChB,MAAc,EACd,MAAc,EACd,KAA6B,EAC7B,GAAW;IAEX,MAAM,SAAS,GAAG,WAAW,YAAY,CAAC,GAAG,QAAQ,IAAI,IAAI,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1G,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,MAAM;QACN,MAAM;QACN,KAAK;QACL,YAAY,EAAE,GAAG;QACjB,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA+D;IACxF,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa;IACvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/inventory/index.d.ts

@@ -0,0 +1,5 @@
+export { createDisabledInventoryOperatorAuthorizer, createLocalInventoryController, createTestInventoryOperatorAuthorizer, formatAttackPathReport, formatBlastRadiusReport, formatImportSummary, formatRemovalAnalysis, formatRoiReport, LocalInventoryController } from "./inventoryController.js";
+export type { InventoryControllerOptions } from "./inventoryController.js";
+export { buildRecordFreshness, buildRecordProvenance, canonicalPayloadDigest, clone, daysSince, edgeIdFor, emptyInventoryState, FRESHNESS_DEFAULT_DAYS, freshnessStatusFor, IDENTITY_ROLES, IMPACT_SEVERITIES, INVENTORY_KIND, INVENTORY_LIMITS, INVENTORY_SCHEMA_VERSION, InventoryError, REMEDIATION_KINDS, REMEDIATION_STATUSES, SIDE_EFFECT_KINDS, sha256Digest, sortedKeysReplacer, TOOL_KINDS, validateFindingsAndRemediations, validateImportPayload, validateOperator, validateState } from "./types.js";
+export type { AgentRecord, AttackPath, AttackPathResult, AttackPathStep, BlastRadiusReport, BlastRadiusResource, BlastRadiusRule, CoverageMetrics, CredentialRecord, EdgeRelation, ExpectedPolicyHash, FindingBasis, FindingKind, FindingRecord, FindingSeverity, FreshnessStatus, GraphEdge, GraphEdgeView, IdentityRecord, IdentityRole, ImpactSeverity, ImportCounters, ImportedAgent, ImportedCredential, ImportedIdentity, ImportedPolicy, ImportedProvider, ImportedResource, ImportedSideEffect, ImportedTool, ImportRunRecord, ImportSourceRecord, ImportSourceType, ImportSummary, InventoryExport, InventoryFreshnessDays, InventoryImportPayload, InventoryOperator, InventoryOperatorAuthorizer, InventoryOperatorPermission, InventorySnapshot, InventoryStoreState, NodeKind, PolicyRecord, ProviderRecord, RecordFreshness, RecordProvenance, RemediationKind, RemediationRecord, RemediationStatus, RemovalAnalysis, ResourceRecord, RoiCounterRow, RoiReport, SideEffectKind, SideEffectRecord, ToolKind, ToolRecord } from "./types.js";
+export { computeBlastRadius, computeCoverage, computeFindings, computeRemovalAnalysis, computeRoiReport, findAttackPaths, findingKey, graphEdges, normalizeFreshnessDays } from "./analysis.js";

package/dist/inventory/index.js

@@ -0,0 +1,4 @@
+export { createDisabledInventoryOperatorAuthorizer, createLocalInventoryController, createTestInventoryOperatorAuthorizer, formatAttackPathReport, formatBlastRadiusReport, formatImportSummary, formatRemovalAnalysis, formatRoiReport, LocalInventoryController } from "./inventoryController.js";
+export { buildRecordFreshness, buildRecordProvenance, canonicalPayloadDigest, clone, daysSince, edgeIdFor, emptyInventoryState, FRESHNESS_DEFAULT_DAYS, freshnessStatusFor, IDENTITY_ROLES, IMPACT_SEVERITIES, INVENTORY_KIND, INVENTORY_LIMITS, INVENTORY_SCHEMA_VERSION, InventoryError, REMEDIATION_KINDS, REMEDIATION_STATUSES, SIDE_EFFECT_KINDS, sha256Digest, sortedKeysReplacer, TOOL_KINDS, validateFindingsAndRemediations, validateImportPayload, validateOperator, validateState } from "./types.js";
+export { computeBlastRadius, computeCoverage, computeFindings, computeRemovalAnalysis, computeRoiReport, findAttackPaths, findingKey, graphEdges, normalizeFreshnessDays } from "./analysis.js";
+//# sourceMappingURL=index.js.map

package/dist/inventory/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/inventory/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yCAAyC,EACzC,8BAA8B,EAC9B,qCAAqC,EACrC,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,EACL,SAAS,EACT,SAAS,EACT,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,wBAAwB,EACxB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,+BAA+B,EAC/B,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACd,MAAM,YAAY,CAAC;AA6DpB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,UAAU,EACV,sBAAsB,EACvB,MAAM,eAAe,CAAC"}

package/dist/inventory/inventoryController.d.ts

@@ -0,0 +1,53 @@
+import { type AttackPathResult, type BlastRadiusReport, type GraphEdgeView, type ImportSummary, type InventoryExport, type InventoryFreshnessDays, type InventoryOperator, type InventoryOperatorAuthorizer, type InventorySnapshot, type InventoryStoreState, type RemovalAnalysis, type RoiReport } from "./types.js";
+export type InventoryControllerOptions = {
+    path?: string;
+    now?: () => Date;
+    operatorAuthorizer?: InventoryOperatorAuthorizer;
+    freshnessDays?: InventoryFreshnessDays;
+    evalScenarioExists?: (scenarioId: string) => boolean;
+};
+export declare class LocalInventoryController {
+    private readonly path;
+    private readonly now;
+    private readonly operatorAuthorizer;
+    private readonly freshnessDays;
+    private readonly evalScenarioExists;
+    constructor(options?: InventoryControllerOptions);
+    import(identityValue: unknown, payloadValue: unknown): Promise<ImportSummary>;
+    inspect(identityValue: unknown): Promise<InventorySnapshot>;
+    analyze(identityValue: unknown): Promise<{
+        findings: number;
+        resolved: number;
+    }>;
+    graph(identityValue: unknown): Promise<GraphEdgeView[]>;
+    attackPaths(identityValue: unknown, agentId: string): Promise<AttackPathResult>;
+    blastRadius(identityValue: unknown, agentId: string): Promise<BlastRadiusReport>;
+    removalAnalysis(identityValue: unknown): Promise<RemovalAnalysis>;
+    roiReport(identityValue: unknown): Promise<RoiReport>;
+    proposeRemediation(identityValue: unknown, input: unknown): Promise<InventoryStoreState["remediations"][number]>;
+    applyRemediation(identityValue: unknown, remediationId: string): Promise<InventoryStoreState["remediations"][number]>;
+    rejectRemediation(identityValue: unknown, remediationId: string): Promise<InventoryStoreState["remediations"][number]>;
+    listRemediations(identityValue: unknown): Promise<InventoryStoreState["remediations"][number][]>;
+    export(identityValue: unknown): Promise<InventoryExport>;
+    private authorize;
+    private timestamp;
+    private upsertSource;
+    private assertRemediationTargetExists;
+    private assertStoreBounds;
+    private pruneStaleEdges;
+    private rotateImportRuns;
+    private isRemediationEffective;
+    private read;
+    private mutate;
+}
+export declare function createLocalInventoryController(options?: InventoryControllerOptions): LocalInventoryController;
+export declare function createDisabledInventoryOperatorAuthorizer(): InventoryOperatorAuthorizer;
+export declare function createTestInventoryOperatorAuthorizer(): {
+    authorizer: InventoryOperatorAuthorizer;
+    issue(input: InventoryOperator): InventoryOperator;
+};
+export declare function formatImportSummary(summary: ImportSummary): string;
+export declare function formatAttackPathReport(report: AttackPathResult): string;
+export declare function formatBlastRadiusReport(report: BlastRadiusReport): string;
+export declare function formatRoiReport(report: RoiReport): string;
+export declare function formatRemovalAnalysis(report: RemovalAnalysis): string;