agentic-flow 2.0.1 → 2.0.2-alpha

package/agentic-flow/dist/core/attention-native.js

@@ -0,0 +1,268 @@
+/**
+ * Native Attention Wrappers
+ *
+ * Properly wraps @ruvector/attention native Rust implementations
+ * with TypedArray conversions and proper error handling
+ */
+import * as nativeAttention from '@ruvector/attention';
+/**
+ * Convert regular array to Float32Array if needed
+ */
+function toFloat32Array(input) {
+    if (input instanceof Float32Array) {
+        return input;
+    }
+    return new Float32Array(input);
+}
+/**
+ * Convert Float32Array to regular array for JS compatibility
+ */
+function toArray(input) {
+    return Array.from(input);
+}
+/**
+ * Native Multi-Head Attention (uses Rust implementation)
+ *
+ * This wrapper properly converts between JavaScript arrays and TypedArrays
+ * required by the native Rust implementation.
+ */
+export class MultiHeadAttention {
+    nativeInstance;
+    hiddenDim;
+    numHeads;
+    constructor(config) {
+        this.hiddenDim = config.hiddenDim;
+        this.numHeads = config.numHeads || 8;
+        try {
+            // Create native Rust instance
+            this.nativeInstance = new nativeAttention.MultiHeadAttention(this.hiddenDim, this.numHeads);
+        }
+        catch (error) {
+            throw new Error(`Failed to initialize native MultiHeadAttention: ${error.message}`);
+        }
+    }
+    /**
+     * Forward pass using native Rust implementation
+     */
+    forward(query, key, value, mask) {
+        try {
+            // Convert to Float32Array for native code
+            const q = toFloat32Array(query);
+            const k = toFloat32Array(key);
+            const v = toFloat32Array(value);
+            const m = mask ? toFloat32Array(mask) : undefined;
+            // Call native compute method
+            const result = this.nativeInstance.compute(q, k, v, m);
+            // Convert result back to regular arrays
+            return {
+                output: toArray(result),
+                attentionWeights: [[]] // Native doesn't return weights separately
+            };
+        }
+        catch (error) {
+            throw new Error(`MultiHeadAttention forward failed: ${error.message}`);
+        }
+    }
+    /**
+     * Get dimensions
+     */
+    get dim() {
+        return this.nativeInstance.dim;
+    }
+    get headDim() {
+        return this.nativeInstance.headDim;
+    }
+}
+/**
+ * Native Flash Attention (uses Rust implementation)
+ *
+ * Memory-efficient attention with tiling/chunking
+ */
+export class FlashAttention {
+    nativeInstance;
+    hiddenDim;
+    constructor(config) {
+        this.hiddenDim = config.hiddenDim;
+        try {
+            this.nativeInstance = new nativeAttention.FlashAttention(this.hiddenDim);
+        }
+        catch (error) {
+            throw new Error(`Failed to initialize native FlashAttention: ${error.message}`);
+        }
+    }
+    /**
+     * Forward pass with batch support
+     */
+    forward(query, key, value, numHeads = 8) {
+        try {
+            // Convert batch to Float32Array
+            const q = query.map(toFloat32Array);
+            const k = key.map(toFloat32Array);
+            const v = value.map(toFloat32Array);
+            // Call native compute
+            const result = this.nativeInstance.compute(q, k, v, numHeads);
+            // Convert result back
+            return {
+                output: result.map((r) => toArray(r)),
+                attentionScores: [[]]
+            };
+        }
+        catch (error) {
+            throw new Error(`FlashAttention forward failed: ${error.message}`);
+        }
+    }
+}
+/**
+ * Native Linear Attention (uses Rust implementation)
+ *
+ * O(n) complexity approximation of attention
+ */
+export class LinearAttention {
+    nativeInstance;
+    hiddenDim;
+    constructor(config) {
+        this.hiddenDim = config.hiddenDim;
+        try {
+            // LinearAttention constructor: (hiddenDim, seqLen)
+            // We'll use hiddenDim for both since seqLen varies per forward call
+            this.nativeInstance = new nativeAttention.LinearAttention(this.hiddenDim, this.hiddenDim);
+        }
+        catch (error) {
+            throw new Error(`Failed to initialize native LinearAttention: ${error.message}`);
+        }
+    }
+    forward(query, key, value) {
+        try {
+            const q = query.map(toFloat32Array);
+            const k = key.map(toFloat32Array);
+            const v = value.map(toFloat32Array);
+            const result = this.nativeInstance.compute(q, k, v);
+            return {
+                output: result.map((r) => toArray(r))
+            };
+        }
+        catch (error) {
+            throw new Error(`LinearAttention forward failed: ${error.message}`);
+        }
+    }
+}
+/**
+ * Native Hyperbolic Attention (uses Rust implementation)
+ */
+export class HyperbolicAttention {
+    nativeInstance;
+    hiddenDim;
+    constructor(config) {
+        this.hiddenDim = config.hiddenDim;
+        try {
+            this.nativeInstance = new nativeAttention.HyperbolicAttention(this.hiddenDim);
+        }
+        catch (error) {
+            throw new Error(`Failed to initialize native HyperbolicAttention: ${error.message}`);
+        }
+    }
+    forward(query, key, value) {
+        try {
+            const q = toFloat32Array(query);
+            const k = toFloat32Array(key);
+            const v = toFloat32Array(value);
+            const result = this.nativeInstance.compute(q, k, v);
+            return {
+                output: toArray(result.output),
+                distance: result.distance
+            };
+        }
+        catch (error) {
+            throw new Error(`HyperbolicAttention forward failed: ${error.message}`);
+        }
+    }
+}
+/**
+ * Native MoE Attention (uses Rust implementation)
+ *
+ * Mixture of Experts with top-k routing
+ */
+export class MoEAttention {
+    nativeInstance;
+    hiddenDim;
+    numExperts;
+    constructor(config) {
+        this.hiddenDim = config.hiddenDim;
+        this.numExperts = config.numExperts || 4;
+        try {
+            this.nativeInstance = new nativeAttention.MoEAttention(this.hiddenDim, this.numExperts);
+        }
+        catch (error) {
+            throw new Error(`Failed to initialize native MoEAttention: ${error.message}`);
+        }
+    }
+    forward(query, key, value, topK = 2) {
+        try {
+            const q = toFloat32Array(query);
+            const k = toFloat32Array(key);
+            const v = toFloat32Array(value);
+            const result = this.nativeInstance.compute(q, k, v, topK);
+            return {
+                output: toArray(result.output),
+                expertWeights: toArray(result.expertWeights)
+            };
+        }
+        catch (error) {
+            throw new Error(`MoEAttention forward failed: ${error.message}`);
+        }
+    }
+}
+/**
+ * Scaled Dot-Product Attention (pure JavaScript, always works)
+ */
+export function scaledDotProductAttention(query, key, value, mask) {
+    const dk = query.length;
+    // Compute attention scores: Q · K^T / sqrt(dk)
+    let score = 0;
+    for (let i = 0; i < dk; i++) {
+        score += query[i] * key[i];
+    }
+    score /= Math.sqrt(dk);
+    // Apply mask if provided
+    if (mask && mask[0] === 0) {
+        score = -Infinity;
+    }
+    // Softmax (single score version)
+    const expScore = Math.exp(score);
+    const weight = expScore;
+    // Weighted value
+    const output = value.map(v => v * weight);
+    return { output, weights: [weight] };
+}
+/**
+ * Check if native attention is available
+ */
+export function isNativeAttentionAvailable() {
+    try {
+        const test = new nativeAttention.MultiHeadAttention(128, 4);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Factory function to create appropriate attention module
+ */
+export function createAttention(type, config) {
+    switch (type) {
+        case 'multi-head':
+            return new MultiHeadAttention(config);
+        case 'flash':
+            return new FlashAttention(config);
+        case 'linear':
+            return new LinearAttention(config);
+        case 'hyperbolic':
+            return new HyperbolicAttention(config);
+        case 'moe':
+            return new MoEAttention(config);
+        default:
+            return new MultiHeadAttention(config);
+    }
+}
+//# sourceMappingURL=attention-native.js.map

package/agentic-flow/dist/core/attention-native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attention-native.js","sourceRoot":"","sources":["../../src/core/attention-native.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,eAAe,MAAM,qBAAqB,CAAC;AASvD;;GAEG;AACH,SAAS,cAAc,CAAC,KAA8B;IACpD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,OAAO,CAAC,KAAmB;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACrB,cAAc,CAAM;IACpB,SAAS,CAAS;IAClB,QAAQ,CAAS;IAEzB,YAAY,MAAuB;QACjC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,8BAA8B;YAC9B,IAAI,CAAC,cAAc,GAAG,IAAI,eAAe,CAAC,kBAAkB,CAC1D,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,QAAQ,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mDAAmD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO,CACL,KAA8B,EAC9B,GAA4B,EAC5B,KAA8B,EAC9B,IAA8B;QAE9B,IAAI,CAAC;YACH,0CAA0C;YAC1C,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAElD,6BAA6B;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAEvD,wCAAwC;YACxC,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;gBACvB,gBAAgB,EAAE,CAAC,EAAE,CAAC,CAAC,2CAA2C;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;IACjC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;IACrC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACjB,cAAc,CAAM;IACpB,SAAS,CAAS;IAE1B,YAAY,MAAuB;QACjC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAElC,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,IAAI,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO,CACL,KAAkC,EAClC,GAAgC,EAChC,KAAkC,EAClC,WAAmB,CAAC;QAEpB,IAAI,CAAC;YACH,gCAAgC;YAChC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAEpC,sBAAsB;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAE9D,sBAAsB;YACtB,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAe,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACnD,eAAe,EAAE,CAAC,EAAE,CAAC;aACtB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAClB,cAAc,CAAM;IACpB,SAAS,CAAS;IAE1B,YAAY,MAAuB;QACjC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAElC,IAAI,CAAC;YACH,mDAAmD;YACnD,oEAAoE;YACpE,IAAI,CAAC,cAAc,GAAG,IAAI,eAAe,CAAC,eAAe,CACvD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,OAAO,CACL,KAAkC,EAClC,GAAgC,EAChC,KAAkC;QAElC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACpC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAEpC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAEpD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAe,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;aACpD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACtB,cAAc,CAAM;IACpB,SAAS,CAAS;IAE1B,YAAY,MAAuB;QACjC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAElC,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,IAAI,eAAe,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,OAAO,CACL,KAA8B,EAC9B,GAA4B,EAC5B,KAA8B;QAE9B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAEpD,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACf,cAAc,CAAM;IACpB,SAAS,CAAS;IAClB,UAAU,CAAS;IAE3B,YAAY,MAAiD;QAC3D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,IAAI,eAAe,CAAC,YAAY,CACpD,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,CAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6CAA6C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,OAAO,CACL,KAA8B,EAC9B,GAA4B,EAC5B,KAA8B,EAC9B,OAAe,CAAC;QAEhB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAE1D,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC9B,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;aAC7C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAe,EACf,GAAa,EACb,KAAe,EACf,IAAe;IAEf,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IAExB,+CAA+C;IAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvB,yBAAyB;IACzB,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC,QAAQ,CAAC;IACpB,CAAC;IAED,iCAAiC;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC;IAExB,iBAAiB;IACjB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAE1C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA8D,EAC9D,MAAuB;IAEvB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY;YACf,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,OAAO;YACV,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,YAAY;YACf,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,KAAK;YACR,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC;YACE,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Native Attention Wrappers\n *\n * Properly wraps @ruvector/attention native Rust implementations\n * with TypedArray conversions and proper error handling\n */\n\nimport * as nativeAttention from '@ruvector/attention';\n\nexport interface AttentionConfig {\n  hiddenDim: number;\n  numHeads?: number;\n  dropoutRate?: number;\n  useFlash?: boolean;\n}\n\n/**\n * Convert regular array to Float32Array if needed\n */\nfunction toFloat32Array(input: number[] | Float32Array): Float32Array {\n  if (input instanceof Float32Array) {\n    return input;\n  }\n  return new Float32Array(input);\n}\n\n/**\n * Convert Float32Array to regular array for JS compatibility\n */\nfunction toArray(input: Float32Array): number[] {\n  return Array.from(input);\n}\n\n/**\n * Native Multi-Head Attention (uses Rust implementation)\n *\n * This wrapper properly converts between JavaScript arrays and TypedArrays\n * required by the native Rust implementation.\n */\nexport class MultiHeadAttention {\n  private nativeInstance: any;\n  private hiddenDim: number;\n  private numHeads: number;\n\n  constructor(config: AttentionConfig) {\n    this.hiddenDim = config.hiddenDim;\n    this.numHeads = config.numHeads || 8;\n\n    try {\n      // Create native Rust instance\n      this.nativeInstance = new nativeAttention.MultiHeadAttention(\n        this.hiddenDim,\n        this.numHeads\n      );\n    } catch (error: any) {\n      throw new Error(`Failed to initialize native MultiHeadAttention: ${error.message}`);\n    }\n  }\n\n  /**\n   * Forward pass using native Rust implementation\n   */\n  forward(\n    query: number[] | Float32Array,\n    key: number[] | Float32Array,\n    value: number[] | Float32Array,\n    mask?: number[] | Float32Array\n  ): { output: number[]; attentionWeights: number[][] } {\n    try {\n      // Convert to Float32Array for native code\n      const q = toFloat32Array(query);\n      const k = toFloat32Array(key);\n      const v = toFloat32Array(value);\n      const m = mask ? toFloat32Array(mask) : undefined;\n\n      // Call native compute method\n      const result = this.nativeInstance.compute(q, k, v, m);\n\n      // Convert result back to regular arrays\n      return {\n        output: toArray(result),\n        attentionWeights: [[]] // Native doesn't return weights separately\n      };\n    } catch (error: any) {\n      throw new Error(`MultiHeadAttention forward failed: ${error.message}`);\n    }\n  }\n\n  /**\n   * Get dimensions\n   */\n  get dim(): number {\n    return this.nativeInstance.dim;\n  }\n\n  get headDim(): number {\n    return this.nativeInstance.headDim;\n  }\n}\n\n/**\n * Native Flash Attention (uses Rust implementation)\n *\n * Memory-efficient attention with tiling/chunking\n */\nexport class FlashAttention {\n  private nativeInstance: any;\n  private hiddenDim: number;\n\n  constructor(config: AttentionConfig) {\n    this.hiddenDim = config.hiddenDim;\n\n    try {\n      this.nativeInstance = new nativeAttention.FlashAttention(this.hiddenDim);\n    } catch (error: any) {\n      throw new Error(`Failed to initialize native FlashAttention: ${error.message}`);\n    }\n  }\n\n  /**\n   * Forward pass with batch support\n   */\n  forward(\n    query: number[][] | Float32Array[],\n    key: number[][] | Float32Array[],\n    value: number[][] | Float32Array[],\n    numHeads: number = 8\n  ): { output: number[][]; attentionScores: number[][] } {\n    try {\n      // Convert batch to Float32Array\n      const q = query.map(toFloat32Array);\n      const k = key.map(toFloat32Array);\n      const v = value.map(toFloat32Array);\n\n      // Call native compute\n      const result = this.nativeInstance.compute(q, k, v, numHeads);\n\n      // Convert result back\n      return {\n        output: result.map((r: Float32Array) => toArray(r)),\n        attentionScores: [[]]\n      };\n    } catch (error: any) {\n      throw new Error(`FlashAttention forward failed: ${error.message}`);\n    }\n  }\n}\n\n/**\n * Native Linear Attention (uses Rust implementation)\n *\n * O(n) complexity approximation of attention\n */\nexport class LinearAttention {\n  private nativeInstance: any;\n  private hiddenDim: number;\n\n  constructor(config: AttentionConfig) {\n    this.hiddenDim = config.hiddenDim;\n\n    try {\n      // LinearAttention constructor: (hiddenDim, seqLen)\n      // We'll use hiddenDim for both since seqLen varies per forward call\n      this.nativeInstance = new nativeAttention.LinearAttention(\n        this.hiddenDim,\n        this.hiddenDim\n      );\n    } catch (error: any) {\n      throw new Error(`Failed to initialize native LinearAttention: ${error.message}`);\n    }\n  }\n\n  forward(\n    query: number[][] | Float32Array[],\n    key: number[][] | Float32Array[],\n    value: number[][] | Float32Array[]\n  ): { output: number[][] } {\n    try {\n      const q = query.map(toFloat32Array);\n      const k = key.map(toFloat32Array);\n      const v = value.map(toFloat32Array);\n\n      const result = this.nativeInstance.compute(q, k, v);\n\n      return {\n        output: result.map((r: Float32Array) => toArray(r))\n      };\n    } catch (error: any) {\n      throw new Error(`LinearAttention forward failed: ${error.message}`);\n    }\n  }\n}\n\n/**\n * Native Hyperbolic Attention (uses Rust implementation)\n */\nexport class HyperbolicAttention {\n  private nativeInstance: any;\n  private hiddenDim: number;\n\n  constructor(config: AttentionConfig) {\n    this.hiddenDim = config.hiddenDim;\n\n    try {\n      this.nativeInstance = new nativeAttention.HyperbolicAttention(this.hiddenDim);\n    } catch (error: any) {\n      throw new Error(`Failed to initialize native HyperbolicAttention: ${error.message}`);\n    }\n  }\n\n  forward(\n    query: number[] | Float32Array,\n    key: number[] | Float32Array,\n    value: number[] | Float32Array\n  ): { output: number[]; distance: number } {\n    try {\n      const q = toFloat32Array(query);\n      const k = toFloat32Array(key);\n      const v = toFloat32Array(value);\n\n      const result = this.nativeInstance.compute(q, k, v);\n\n      return {\n        output: toArray(result.output),\n        distance: result.distance\n      };\n    } catch (error: any) {\n      throw new Error(`HyperbolicAttention forward failed: ${error.message}`);\n    }\n  }\n}\n\n/**\n * Native MoE Attention (uses Rust implementation)\n *\n * Mixture of Experts with top-k routing\n */\nexport class MoEAttention {\n  private nativeInstance: any;\n  private hiddenDim: number;\n  private numExperts: number;\n\n  constructor(config: AttentionConfig & { numExperts?: number }) {\n    this.hiddenDim = config.hiddenDim;\n    this.numExperts = config.numExperts || 4;\n\n    try {\n      this.nativeInstance = new nativeAttention.MoEAttention(\n        this.hiddenDim,\n        this.numExperts\n      );\n    } catch (error: any) {\n      throw new Error(`Failed to initialize native MoEAttention: ${error.message}`);\n    }\n  }\n\n  forward(\n    query: number[] | Float32Array,\n    key: number[] | Float32Array,\n    value: number[] | Float32Array,\n    topK: number = 2\n  ): { output: number[]; expertWeights: number[] } {\n    try {\n      const q = toFloat32Array(query);\n      const k = toFloat32Array(key);\n      const v = toFloat32Array(value);\n\n      const result = this.nativeInstance.compute(q, k, v, topK);\n\n      return {\n        output: toArray(result.output),\n        expertWeights: toArray(result.expertWeights)\n      };\n    } catch (error: any) {\n      throw new Error(`MoEAttention forward failed: ${error.message}`);\n    }\n  }\n}\n\n/**\n * Scaled Dot-Product Attention (pure JavaScript, always works)\n */\nexport function scaledDotProductAttention(\n  query: number[],\n  key: number[],\n  value: number[],\n  mask?: number[]\n): { output: number[]; weights: number[] } {\n  const dk = query.length;\n\n  // Compute attention scores: Q · K^T / sqrt(dk)\n  let score = 0;\n  for (let i = 0; i < dk; i++) {\n    score += query[i] * key[i];\n  }\n  score /= Math.sqrt(dk);\n\n  // Apply mask if provided\n  if (mask && mask[0] === 0) {\n    score = -Infinity;\n  }\n\n  // Softmax (single score version)\n  const expScore = Math.exp(score);\n  const weight = expScore;\n\n  // Weighted value\n  const output = value.map(v => v * weight);\n\n  return { output, weights: [weight] };\n}\n\n/**\n * Check if native attention is available\n */\nexport function isNativeAttentionAvailable(): boolean {\n  try {\n    const test = new nativeAttention.MultiHeadAttention(128, 4);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Factory function to create appropriate attention module\n */\nexport function createAttention(\n  type: 'multi-head' | 'flash' | 'linear' | 'hyperbolic' | 'moe',\n  config: AttentionConfig\n): MultiHeadAttention | FlashAttention | LinearAttention | HyperbolicAttention | MoEAttention {\n  switch (type) {\n    case 'multi-head':\n      return new MultiHeadAttention(config);\n    case 'flash':\n      return new FlashAttention(config);\n    case 'linear':\n      return new LinearAttention(config);\n    case 'hyperbolic':\n      return new HyperbolicAttention(config);\n    case 'moe':\n      return new MoEAttention(config);\n    default:\n      return new MultiHeadAttention(config);\n  }\n}\n"]}

package/agentic-flow/dist/federation/SecurityManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityManager.d.ts","sourceRoot":"","sources":["../../src/federation/SecurityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,eAAe,CAA0C;;IAOjE;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmCnE;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkCjE;;OAEG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAqBlE;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB9F;;OAEG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBlB;;OAEG;IACG,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QACvD,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IAaF;;OAEG;IACH,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAW5E;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAI9B;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,UAAU,IAAI,IAAI;CAInB"}

package/agentic-flow/dist/federation/SecurityManager.js

@@ -0,0 +1,192 @@
+/**
+ * Security Manager - Authentication, encryption, and access control
+ *
+ * Features:
+ * - JWT token generation and validation
+ * - AES-256 encryption for data at rest
+ * - Tenant isolation
+ * - mTLS certificate management
+ */
+import crypto from 'crypto';
+import { logger } from '../utils/logger.js';
+export class SecurityManager {
+    algorithm = 'aes-256-gcm';
+    jwtSecret;
+    encryptionCache = new Map();
+    constructor() {
+        // In production, load from secure vault (AWS Secrets Manager, HashiCorp Vault, etc.)
+        this.jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex');
+    }
+    /**
+     * Create JWT token for agent authentication
+     */
+    async createAgentToken(payload) {
+        const header = {
+            alg: 'HS256',
+            typ: 'JWT'
+        };
+        const now = Date.now();
+        const tokenPayload = {
+            ...payload,
+            iat: now,
+            exp: payload.expiresAt,
+            iss: 'agentic-flow-federation'
+        };
+        // Encode header and payload
+        const encodedHeader = this.base64UrlEncode(JSON.stringify(header));
+        const encodedPayload = this.base64UrlEncode(JSON.stringify(tokenPayload));
+        // Create signature
+        const signature = crypto
+            .createHmac('sha256', this.jwtSecret)
+            .update(`${encodedHeader}.${encodedPayload}`)
+            .digest('base64url');
+        const token = `${encodedHeader}.${encodedPayload}.${signature}`;
+        logger.info('Created agent token', {
+            agentId: payload.agentId,
+            tenantId: payload.tenantId,
+            expiresAt: new Date(payload.expiresAt).toISOString()
+        });
+        return token;
+    }
+    /**
+     * Verify JWT token
+     */
+    async verifyAgentToken(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid token format');
+        }
+        const [encodedHeader, encodedPayload, signature] = parts;
+        // Verify signature
+        const expectedSignature = crypto
+            .createHmac('sha256', this.jwtSecret)
+            .update(`${encodedHeader}.${encodedPayload}`)
+            .digest('base64url');
+        if (signature !== expectedSignature) {
+            throw new Error('Invalid token signature');
+        }
+        // Decode payload
+        const payload = JSON.parse(this.base64UrlDecode(encodedPayload));
+        // Check expiration
+        if (Date.now() >= payload.exp) {
+            throw new Error('Token expired');
+        }
+        logger.debug('Token verified', {
+            agentId: payload.agentId,
+            tenantId: payload.tenantId
+        });
+        return payload;
+    }
+    /**
+     * Get or create encryption keys for a tenant
+     */
+    async getEncryptionKeys(tenantId) {
+        // Check cache
+        if (this.encryptionCache.has(tenantId)) {
+            return this.encryptionCache.get(tenantId);
+        }
+        // Generate new keys for tenant
+        // In production, these would be stored in a secure key management service
+        const encryptionKey = crypto.randomBytes(32); // 256-bit key
+        const iv = crypto.randomBytes(16); // 128-bit IV
+        const keys = { encryptionKey, iv };
+        // Cache keys
+        this.encryptionCache.set(tenantId, keys);
+        logger.info('Generated encryption keys for tenant', { tenantId });
+        return keys;
+    }
+    /**
+     * Encrypt data with AES-256-GCM
+     */
+    async encrypt(data, tenantId) {
+        const keys = await this.getEncryptionKeys(tenantId);
+        const cipher = crypto.createCipheriv(this.algorithm, keys.encryptionKey, keys.iv);
+        let encrypted = cipher.update(data, 'utf8', 'base64');
+        encrypted += cipher.final('base64');
+        const authTag = cipher.getAuthTag().toString('base64');
+        logger.debug('Data encrypted', {
+            tenantId,
+            originalLength: data.length,
+            encryptedLength: encrypted.length
+        });
+        return { encrypted, authTag };
+    }
+    /**
+     * Decrypt data with AES-256-GCM
+     */
+    async decrypt(encrypted, authTag, tenantId) {
+        const keys = await this.getEncryptionKeys(tenantId);
+        const decipher = crypto.createDecipheriv(this.algorithm, keys.encryptionKey, keys.iv);
+        decipher.setAuthTag(Buffer.from(authTag, 'base64'));
+        let decrypted = decipher.update(encrypted, 'base64', 'utf8');
+        decrypted += decipher.final('utf8');
+        logger.debug('Data decrypted', {
+            tenantId,
+            decryptedLength: decrypted.length
+        });
+        return decrypted;
+    }
+    /**
+     * Generate mTLS certificates for agent-to-hub communication
+     */
+    async generateMTLSCertificates(agentId) {
+        // Placeholder: Actual implementation would use OpenSSL or similar
+        // to generate X.509 certificates with proper CA chain
+        logger.info('Generating mTLS certificates', { agentId });
+        return {
+            cert: 'PLACEHOLDER_CERT',
+            key: 'PLACEHOLDER_KEY',
+            ca: 'PLACEHOLDER_CA'
+        };
+    }
+    /**
+     * Validate tenant access to data
+     */
+    validateTenantAccess(requestTenantId, dataTenantId) {
+        if (requestTenantId !== dataTenantId) {
+            logger.warn('Tenant access violation detected', {
+                requestTenantId,
+                dataTenantId
+            });
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Hash sensitive data for storage (one-way)
+     */
+    hashData(data) {
+        return crypto.createHash('sha256').update(data).digest('hex');
+    }
+    /**
+     * Generate secure random ID
+     */
+    generateSecureId() {
+        return crypto.randomBytes(16).toString('hex');
+    }
+    /**
+     * Base64 URL-safe encoding
+     */
+    base64UrlEncode(str) {
+        return Buffer.from(str)
+            .toString('base64')
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=/g, '');
+    }
+    /**
+     * Base64 URL-safe decoding
+     */
+    base64UrlDecode(str) {
+        const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+        return Buffer.from(base64, 'base64').toString('utf8');
+    }
+    /**
+     * Clear cached keys (for testing or security refresh)
+     */
+    clearCache() {
+        this.encryptionCache.clear();
+        logger.info('Encryption cache cleared');
+    }
+}
+//# sourceMappingURL=SecurityManager.js.map

package/agentic-flow/dist/federation/SecurityManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityManager.js","sourceRoot":"","sources":["../../src/federation/SecurityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAa5C,MAAM,OAAO,eAAe;IACT,SAAS,GAAG,aAAa,CAAC;IAC1B,SAAS,CAAS;IAC3B,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IAEjE;QACE,qFAAqF;QACrF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAA0B;QAC/C,MAAM,MAAM,GAAG;YACb,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,KAAK;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG;YACnB,GAAG,OAAO;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,OAAO,CAAC,SAAS;YACtB,GAAG,EAAE,yBAAyB;SAC/B,CAAC;QAEF,4BAA4B;QAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1E,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;aACpC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;aAC5C,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,MAAM,KAAK,GAAG,GAAG,aAAa,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC;QAEhE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACjC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAEzD,mBAAmB;QACnB,MAAM,iBAAiB,GAAG,MAAM;aAC7B,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;aACpC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;aAC5C,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC;QAEjE,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,cAAc;QACd,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAC7C,CAAC;QAED,+BAA+B;QAC/B,0EAA0E;QAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;QAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa;QAEhD,MAAM,IAAI,GAAmB,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAEnD,aAAa;QACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,QAAgB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAElF,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,QAAQ;YACR,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,OAAe,EACf,QAAgB;QAEhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEpD,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,QAAQ;YACR,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAAC,OAAe;QAK5C,kEAAkE;QAClE,sDAAsD;QAEtD,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,iBAAiB;YACtB,EAAE,EAAE,gBAAgB;SACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,eAAuB,EAAE,YAAoB;QAChE,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,eAAe;gBACf,YAAY;aACb,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,IAAY;QACnB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,GAAW;QACjC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACpB,QAAQ,CAAC,QAAQ,CAAC;aAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,GAAW;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;CACF","sourcesContent":["/**\n * Security Manager - Authentication, encryption, and access control\n *\n * Features:\n * - JWT token generation and validation\n * - AES-256 encryption for data at rest\n * - Tenant isolation\n * - mTLS certificate management\n */\n\nimport crypto from 'crypto';\nimport { logger } from '../utils/logger.js';\n\nexport interface AgentTokenPayload {\n  agentId: string;\n  tenantId: string;\n  expiresAt: number;\n}\n\nexport interface EncryptionKeys {\n  encryptionKey: Buffer;\n  iv: Buffer;\n}\n\nexport class SecurityManager {\n  private readonly algorithm = 'aes-256-gcm';\n  private readonly jwtSecret: string;\n  private encryptionCache: Map<string, EncryptionKeys> = new Map();\n\n  constructor() {\n    // In production, load from secure vault (AWS Secrets Manager, HashiCorp Vault, etc.)\n    this.jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex');\n  }\n\n  /**\n   * Create JWT token for agent authentication\n   */\n  async createAgentToken(payload: AgentTokenPayload): Promise<string> {\n    const header = {\n      alg: 'HS256',\n      typ: 'JWT'\n    };\n\n    const now = Date.now();\n    const tokenPayload = {\n      ...payload,\n      iat: now,\n      exp: payload.expiresAt,\n      iss: 'agentic-flow-federation'\n    };\n\n    // Encode header and payload\n    const encodedHeader = this.base64UrlEncode(JSON.stringify(header));\n    const encodedPayload = this.base64UrlEncode(JSON.stringify(tokenPayload));\n\n    // Create signature\n    const signature = crypto\n      .createHmac('sha256', this.jwtSecret)\n      .update(`${encodedHeader}.${encodedPayload}`)\n      .digest('base64url');\n\n    const token = `${encodedHeader}.${encodedPayload}.${signature}`;\n\n    logger.info('Created agent token', {\n      agentId: payload.agentId,\n      tenantId: payload.tenantId,\n      expiresAt: new Date(payload.expiresAt).toISOString()\n    });\n\n    return token;\n  }\n\n  /**\n   * Verify JWT token\n   */\n  async verifyAgentToken(token: string): Promise<AgentTokenPayload> {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      throw new Error('Invalid token format');\n    }\n\n    const [encodedHeader, encodedPayload, signature] = parts;\n\n    // Verify signature\n    const expectedSignature = crypto\n      .createHmac('sha256', this.jwtSecret)\n      .update(`${encodedHeader}.${encodedPayload}`)\n      .digest('base64url');\n\n    if (signature !== expectedSignature) {\n      throw new Error('Invalid token signature');\n    }\n\n    // Decode payload\n    const payload = JSON.parse(this.base64UrlDecode(encodedPayload));\n\n    // Check expiration\n    if (Date.now() >= payload.exp) {\n      throw new Error('Token expired');\n    }\n\n    logger.debug('Token verified', {\n      agentId: payload.agentId,\n      tenantId: payload.tenantId\n    });\n\n    return payload;\n  }\n\n  /**\n   * Get or create encryption keys for a tenant\n   */\n  async getEncryptionKeys(tenantId: string): Promise<EncryptionKeys> {\n    // Check cache\n    if (this.encryptionCache.has(tenantId)) {\n      return this.encryptionCache.get(tenantId)!;\n    }\n\n    // Generate new keys for tenant\n    // In production, these would be stored in a secure key management service\n    const encryptionKey = crypto.randomBytes(32); // 256-bit key\n    const iv = crypto.randomBytes(16); // 128-bit IV\n\n    const keys: EncryptionKeys = { encryptionKey, iv };\n\n    // Cache keys\n    this.encryptionCache.set(tenantId, keys);\n\n    logger.info('Generated encryption keys for tenant', { tenantId });\n\n    return keys;\n  }\n\n  /**\n   * Encrypt data with AES-256-GCM\n   */\n  async encrypt(data: string, tenantId: string): Promise<{ encrypted: string; authTag: string }> {\n    const keys = await this.getEncryptionKeys(tenantId);\n\n    const cipher = crypto.createCipheriv(this.algorithm, keys.encryptionKey, keys.iv);\n\n    let encrypted = cipher.update(data, 'utf8', 'base64');\n    encrypted += cipher.final('base64');\n\n    const authTag = cipher.getAuthTag().toString('base64');\n\n    logger.debug('Data encrypted', {\n      tenantId,\n      originalLength: data.length,\n      encryptedLength: encrypted.length\n    });\n\n    return { encrypted, authTag };\n  }\n\n  /**\n   * Decrypt data with AES-256-GCM\n   */\n  async decrypt(\n    encrypted: string,\n    authTag: string,\n    tenantId: string\n  ): Promise<string> {\n    const keys = await this.getEncryptionKeys(tenantId);\n\n    const decipher = crypto.createDecipheriv(this.algorithm, keys.encryptionKey, keys.iv);\n    decipher.setAuthTag(Buffer.from(authTag, 'base64'));\n\n    let decrypted = decipher.update(encrypted, 'base64', 'utf8');\n    decrypted += decipher.final('utf8');\n\n    logger.debug('Data decrypted', {\n      tenantId,\n      decryptedLength: decrypted.length\n    });\n\n    return decrypted;\n  }\n\n  /**\n   * Generate mTLS certificates for agent-to-hub communication\n   */\n  async generateMTLSCertificates(agentId: string): Promise<{\n    cert: string;\n    key: string;\n    ca: string;\n  }> {\n    // Placeholder: Actual implementation would use OpenSSL or similar\n    // to generate X.509 certificates with proper CA chain\n\n    logger.info('Generating mTLS certificates', { agentId });\n\n    return {\n      cert: 'PLACEHOLDER_CERT',\n      key: 'PLACEHOLDER_KEY',\n      ca: 'PLACEHOLDER_CA'\n    };\n  }\n\n  /**\n   * Validate tenant access to data\n   */\n  validateTenantAccess(requestTenantId: string, dataTenantId: string): boolean {\n    if (requestTenantId !== dataTenantId) {\n      logger.warn('Tenant access violation detected', {\n        requestTenantId,\n        dataTenantId\n      });\n      return false;\n    }\n    return true;\n  }\n\n  /**\n   * Hash sensitive data for storage (one-way)\n   */\n  hashData(data: string): string {\n    return crypto.createHash('sha256').update(data).digest('hex');\n  }\n\n  /**\n   * Generate secure random ID\n   */\n  generateSecureId(): string {\n    return crypto.randomBytes(16).toString('hex');\n  }\n\n  /**\n   * Base64 URL-safe encoding\n   */\n  private base64UrlEncode(str: string): string {\n    return Buffer.from(str)\n      .toString('base64')\n      .replace(/\\+/g, '-')\n      .replace(/\\//g, '_')\n      .replace(/=/g, '');\n  }\n\n  /**\n   * Base64 URL-safe decoding\n   */\n  private base64UrlDecode(str: string): string {\n    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n    return Buffer.from(base64, 'base64').toString('utf8');\n  }\n\n  /**\n   * Clear cached keys (for testing or security refresh)\n   */\n  clearCache(): void {\n    this.encryptionCache.clear();\n    logger.info('Encryption cache cleared');\n  }\n}\n"]}