agentic-flow 2.0.7 → 3.0.0-alpha.2

package/dist/agentic-flow/src/federation/SecurityManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityManager.d.ts","sourceRoot":"","sources":["../../../../src/federation/SecurityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,eAAe,CAA0C;;IAOjE;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmCnE;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkCjE;;OAEG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAqBlE;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB9F;;OAEG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBlB;;OAEG;IACG,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QACvD,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IAaF;;OAEG;IACH,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAW5E;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAI9B;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,UAAU,IAAI,IAAI;CAInB"}

package/dist/agentic-flow/src/federation/SecurityManager.js

@@ -0,0 +1,192 @@
+/**
+ * Security Manager - Authentication, encryption, and access control
+ *
+ * Features:
+ * - JWT token generation and validation
+ * - AES-256 encryption for data at rest
+ * - Tenant isolation
+ * - mTLS certificate management
+ */
+import crypto from 'crypto';
+import { logger } from '../utils/logger.js';
+export class SecurityManager {
+    algorithm = 'aes-256-gcm';
+    jwtSecret;
+    encryptionCache = new Map();
+    constructor() {
+        // In production, load from secure vault (AWS Secrets Manager, HashiCorp Vault, etc.)
+        this.jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex');
+    }
+    /**
+     * Create JWT token for agent authentication
+     */
+    async createAgentToken(payload) {
+        const header = {
+            alg: 'HS256',
+            typ: 'JWT'
+        };
+        const now = Date.now();
+        const tokenPayload = {
+            ...payload,
+            iat: now,
+            exp: payload.expiresAt,
+            iss: 'agentic-flow-federation'
+        };
+        // Encode header and payload
+        const encodedHeader = this.base64UrlEncode(JSON.stringify(header));
+        const encodedPayload = this.base64UrlEncode(JSON.stringify(tokenPayload));
+        // Create signature
+        const signature = crypto
+            .createHmac('sha256', this.jwtSecret)
+            .update(`${encodedHeader}.${encodedPayload}`)
+            .digest('base64url');
+        const token = `${encodedHeader}.${encodedPayload}.${signature}`;
+        logger.info('Created agent token', {
+            agentId: payload.agentId,
+            tenantId: payload.tenantId,
+            expiresAt: new Date(payload.expiresAt).toISOString()
+        });
+        return token;
+    }
+    /**
+     * Verify JWT token
+     */
+    async verifyAgentToken(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid token format');
+        }
+        const [encodedHeader, encodedPayload, signature] = parts;
+        // Verify signature
+        const expectedSignature = crypto
+            .createHmac('sha256', this.jwtSecret)
+            .update(`${encodedHeader}.${encodedPayload}`)
+            .digest('base64url');
+        if (signature !== expectedSignature) {
+            throw new Error('Invalid token signature');
+        }
+        // Decode payload
+        const payload = JSON.parse(this.base64UrlDecode(encodedPayload));
+        // Check expiration
+        if (Date.now() >= payload.exp) {
+            throw new Error('Token expired');
+        }
+        logger.debug('Token verified', {
+            agentId: payload.agentId,
+            tenantId: payload.tenantId
+        });
+        return payload;
+    }
+    /**
+     * Get or create encryption keys for a tenant
+     */
+    async getEncryptionKeys(tenantId) {
+        // Check cache
+        if (this.encryptionCache.has(tenantId)) {
+            return this.encryptionCache.get(tenantId);
+        }
+        // Generate new keys for tenant
+        // In production, these would be stored in a secure key management service
+        const encryptionKey = crypto.randomBytes(32); // 256-bit key
+        const iv = crypto.randomBytes(16); // 128-bit IV
+        const keys = { encryptionKey, iv };
+        // Cache keys
+        this.encryptionCache.set(tenantId, keys);
+        logger.info('Generated encryption keys for tenant', { tenantId });
+        return keys;
+    }
+    /**
+     * Encrypt data with AES-256-GCM
+     */
+    async encrypt(data, tenantId) {
+        const keys = await this.getEncryptionKeys(tenantId);
+        const cipher = crypto.createCipheriv(this.algorithm, keys.encryptionKey, keys.iv);
+        let encrypted = cipher.update(data, 'utf8', 'base64');
+        encrypted += cipher.final('base64');
+        const authTag = cipher.getAuthTag().toString('base64');
+        logger.debug('Data encrypted', {
+            tenantId,
+            originalLength: data.length,
+            encryptedLength: encrypted.length
+        });
+        return { encrypted, authTag };
+    }
+    /**
+     * Decrypt data with AES-256-GCM
+     */
+    async decrypt(encrypted, authTag, tenantId) {
+        const keys = await this.getEncryptionKeys(tenantId);
+        const decipher = crypto.createDecipheriv(this.algorithm, keys.encryptionKey, keys.iv);
+        decipher.setAuthTag(Buffer.from(authTag, 'base64'));
+        let decrypted = decipher.update(encrypted, 'base64', 'utf8');
+        decrypted += decipher.final('utf8');
+        logger.debug('Data decrypted', {
+            tenantId,
+            decryptedLength: decrypted.length
+        });
+        return decrypted;
+    }
+    /**
+     * Generate mTLS certificates for agent-to-hub communication
+     */
+    async generateMTLSCertificates(agentId) {
+        // Placeholder: Actual implementation would use OpenSSL or similar
+        // to generate X.509 certificates with proper CA chain
+        logger.info('Generating mTLS certificates', { agentId });
+        return {
+            cert: 'PLACEHOLDER_CERT',
+            key: 'PLACEHOLDER_KEY',
+            ca: 'PLACEHOLDER_CA'
+        };
+    }
+    /**
+     * Validate tenant access to data
+     */
+    validateTenantAccess(requestTenantId, dataTenantId) {
+        if (requestTenantId !== dataTenantId) {
+            logger.warn('Tenant access violation detected', {
+                requestTenantId,
+                dataTenantId
+            });
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Hash sensitive data for storage (one-way)
+     */
+    hashData(data) {
+        return crypto.createHash('sha256').update(data).digest('hex');
+    }
+    /**
+     * Generate secure random ID
+     */
+    generateSecureId() {
+        return crypto.randomBytes(16).toString('hex');
+    }
+    /**
+     * Base64 URL-safe encoding
+     */
+    base64UrlEncode(str) {
+        return Buffer.from(str)
+            .toString('base64')
+            .replace(/\+/g, '-')
+            .replace(/\//g, '_')
+            .replace(/=/g, '');
+    }
+    /**
+     * Base64 URL-safe decoding
+     */
+    base64UrlDecode(str) {
+        const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+        return Buffer.from(base64, 'base64').toString('utf8');
+    }
+    /**
+     * Clear cached keys (for testing or security refresh)
+     */
+    clearCache() {
+        this.encryptionCache.clear();
+        logger.info('Encryption cache cleared');
+    }
+}
+//# sourceMappingURL=SecurityManager.js.map

package/dist/agentic-flow/src/federation/SecurityManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityManager.js","sourceRoot":"","sources":["../../../../src/federation/SecurityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAa5C,MAAM,OAAO,eAAe;IACT,SAAS,GAAG,aAAa,CAAC;IAC1B,SAAS,CAAS;IAC3B,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IAEjE;QACE,qFAAqF;QACrF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAA0B;QAC/C,MAAM,MAAM,GAAG;YACb,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,KAAK;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG;YACnB,GAAG,OAAO;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,OAAO,CAAC,SAAS;YACtB,GAAG,EAAE,yBAAyB;SAC/B,CAAC;QAEF,4BAA4B;QAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1E,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;aACpC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;aAC5C,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,MAAM,KAAK,GAAG,GAAG,aAAa,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC;QAEhE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACjC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAEzD,mBAAmB;QACnB,MAAM,iBAAiB,GAAG,MAAM;aAC7B,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;aACpC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;aAC5C,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC;QAEjE,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,cAAc;QACd,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAC7C,CAAC;QAED,+BAA+B;QAC/B,0EAA0E;QAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;QAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa;QAEhD,MAAM,IAAI,GAAmB,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAEnD,aAAa;QACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,QAAgB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAElF,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,QAAQ;YACR,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,OAAe,EACf,QAAgB;QAEhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEpD,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,QAAQ;YACR,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAAC,OAAe;QAK5C,kEAAkE;QAClE,sDAAsD;QAEtD,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,iBAAiB;YACtB,EAAE,EAAE,gBAAgB;SACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,eAAuB,EAAE,YAAoB;QAChE,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,eAAe;gBACf,YAAY;aACb,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,IAAY;QACnB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,GAAW;QACjC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACpB,QAAQ,CAAC,QAAQ,CAAC;aAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,GAAW;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;CACF","sourcesContent":["/**\n * Security Manager - Authentication, encryption, and access control\n *\n * Features:\n * - JWT token generation and validation\n * - AES-256 encryption for data at rest\n * - Tenant isolation\n * - mTLS certificate management\n */\n\nimport crypto from 'crypto';\nimport { logger } from '../utils/logger.js';\n\nexport interface AgentTokenPayload {\n  agentId: string;\n  tenantId: string;\n  expiresAt: number;\n}\n\nexport interface EncryptionKeys {\n  encryptionKey: Buffer;\n  iv: Buffer;\n}\n\nexport class SecurityManager {\n  private readonly algorithm = 'aes-256-gcm';\n  private readonly jwtSecret: string;\n  private encryptionCache: Map<string, EncryptionKeys> = new Map();\n\n  constructor() {\n    // In production, load from secure vault (AWS Secrets Manager, HashiCorp Vault, etc.)\n    this.jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex');\n  }\n\n  /**\n   * Create JWT token for agent authentication\n   */\n  async createAgentToken(payload: AgentTokenPayload): Promise<string> {\n    const header = {\n      alg: 'HS256',\n      typ: 'JWT'\n    };\n\n    const now = Date.now();\n    const tokenPayload = {\n      ...payload,\n      iat: now,\n      exp: payload.expiresAt,\n      iss: 'agentic-flow-federation'\n    };\n\n    // Encode header and payload\n    const encodedHeader = this.base64UrlEncode(JSON.stringify(header));\n    const encodedPayload = this.base64UrlEncode(JSON.stringify(tokenPayload));\n\n    // Create signature\n    const signature = crypto\n      .createHmac('sha256', this.jwtSecret)\n      .update(`${encodedHeader}.${encodedPayload}`)\n      .digest('base64url');\n\n    const token = `${encodedHeader}.${encodedPayload}.${signature}`;\n\n    logger.info('Created agent token', {\n      agentId: payload.agentId,\n      tenantId: payload.tenantId,\n      expiresAt: new Date(payload.expiresAt).toISOString()\n    });\n\n    return token;\n  }\n\n  /**\n   * Verify JWT token\n   */\n  async verifyAgentToken(token: string): Promise<AgentTokenPayload> {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      throw new Error('Invalid token format');\n    }\n\n    const [encodedHeader, encodedPayload, signature] = parts;\n\n    // Verify signature\n    const expectedSignature = crypto\n      .createHmac('sha256', this.jwtSecret)\n      .update(`${encodedHeader}.${encodedPayload}`)\n      .digest('base64url');\n\n    if (signature !== expectedSignature) {\n      throw new Error('Invalid token signature');\n    }\n\n    // Decode payload\n    const payload = JSON.parse(this.base64UrlDecode(encodedPayload));\n\n    // Check expiration\n    if (Date.now() >= payload.exp) {\n      throw new Error('Token expired');\n    }\n\n    logger.debug('Token verified', {\n      agentId: payload.agentId,\n      tenantId: payload.tenantId\n    });\n\n    return payload;\n  }\n\n  /**\n   * Get or create encryption keys for a tenant\n   */\n  async getEncryptionKeys(tenantId: string): Promise<EncryptionKeys> {\n    // Check cache\n    if (this.encryptionCache.has(tenantId)) {\n      return this.encryptionCache.get(tenantId)!;\n    }\n\n    // Generate new keys for tenant\n    // In production, these would be stored in a secure key management service\n    const encryptionKey = crypto.randomBytes(32); // 256-bit key\n    const iv = crypto.randomBytes(16); // 128-bit IV\n\n    const keys: EncryptionKeys = { encryptionKey, iv };\n\n    // Cache keys\n    this.encryptionCache.set(tenantId, keys);\n\n    logger.info('Generated encryption keys for tenant', { tenantId });\n\n    return keys;\n  }\n\n  /**\n   * Encrypt data with AES-256-GCM\n   */\n  async encrypt(data: string, tenantId: string): Promise<{ encrypted: string; authTag: string }> {\n    const keys = await this.getEncryptionKeys(tenantId);\n\n    const cipher = crypto.createCipheriv(this.algorithm, keys.encryptionKey, keys.iv);\n\n    let encrypted = cipher.update(data, 'utf8', 'base64');\n    encrypted += cipher.final('base64');\n\n    const authTag = cipher.getAuthTag().toString('base64');\n\n    logger.debug('Data encrypted', {\n      tenantId,\n      originalLength: data.length,\n      encryptedLength: encrypted.length\n    });\n\n    return { encrypted, authTag };\n  }\n\n  /**\n   * Decrypt data with AES-256-GCM\n   */\n  async decrypt(\n    encrypted: string,\n    authTag: string,\n    tenantId: string\n  ): Promise<string> {\n    const keys = await this.getEncryptionKeys(tenantId);\n\n    const decipher = crypto.createDecipheriv(this.algorithm, keys.encryptionKey, keys.iv);\n    decipher.setAuthTag(Buffer.from(authTag, 'base64'));\n\n    let decrypted = decipher.update(encrypted, 'base64', 'utf8');\n    decrypted += decipher.final('utf8');\n\n    logger.debug('Data decrypted', {\n      tenantId,\n      decryptedLength: decrypted.length\n    });\n\n    return decrypted;\n  }\n\n  /**\n   * Generate mTLS certificates for agent-to-hub communication\n   */\n  async generateMTLSCertificates(agentId: string): Promise<{\n    cert: string;\n    key: string;\n    ca: string;\n  }> {\n    // Placeholder: Actual implementation would use OpenSSL or similar\n    // to generate X.509 certificates with proper CA chain\n\n    logger.info('Generating mTLS certificates', { agentId });\n\n    return {\n      cert: 'PLACEHOLDER_CERT',\n      key: 'PLACEHOLDER_KEY',\n      ca: 'PLACEHOLDER_CA'\n    };\n  }\n\n  /**\n   * Validate tenant access to data\n   */\n  validateTenantAccess(requestTenantId: string, dataTenantId: string): boolean {\n    if (requestTenantId !== dataTenantId) {\n      logger.warn('Tenant access violation detected', {\n        requestTenantId,\n        dataTenantId\n      });\n      return false;\n    }\n    return true;\n  }\n\n  /**\n   * Hash sensitive data for storage (one-way)\n   */\n  hashData(data: string): string {\n    return crypto.createHash('sha256').update(data).digest('hex');\n  }\n\n  /**\n   * Generate secure random ID\n   */\n  generateSecureId(): string {\n    return crypto.randomBytes(16).toString('hex');\n  }\n\n  /**\n   * Base64 URL-safe encoding\n   */\n  private base64UrlEncode(str: string): string {\n    return Buffer.from(str)\n      .toString('base64')\n      .replace(/\\+/g, '-')\n      .replace(/\\//g, '_')\n      .replace(/=/g, '');\n  }\n\n  /**\n   * Base64 URL-safe decoding\n   */\n  private base64UrlDecode(str: string): string {\n    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n    return Buffer.from(base64, 'base64').toString('utf8');\n  }\n\n  /**\n   * Clear cached keys (for testing or security refresh)\n   */\n  clearCache(): void {\n    this.encryptionCache.clear();\n    logger.info('Encryption cache cleared');\n  }\n}\n"]}

package/dist/agentic-flow/src/federation/debug/agent-debug-stream.d.ts

@@ -0,0 +1,171 @@
+/**
+ * Single Agent Debug Streaming
+ *
+ * Provides detailed visibility into a single agent's operations,
+ * lifecycle, and internal state changes.
+ *
+ * Features:
+ * - Agent lifecycle tracking (spawn → work → shutdown)
+ * - Task execution tracing
+ * - Memory operations
+ * - Communication events
+ * - Decision logging
+ * - State transitions
+ * - Performance metrics
+ * - Timeline visualization
+ */
+import { EventEmitter } from 'events';
+import { DebugLevel } from './debug-stream.js';
+export { DebugLevel } from './debug-stream.js';
+export interface AgentDebugConfig {
+    agentId: string;
+    tenantId?: string;
+    level?: DebugLevel;
+    format?: 'human' | 'json' | 'compact' | 'timeline';
+    output?: 'console' | 'file' | 'both';
+    outputFile?: string;
+    colorize?: boolean;
+    trackState?: boolean;
+    trackDecisions?: boolean;
+    trackCommunication?: boolean;
+    timeline?: boolean;
+}
+export interface AgentState {
+    phase: 'spawning' | 'initializing' | 'ready' | 'working' | 'idle' | 'shutting_down' | 'dead';
+    task?: string;
+    taskId?: string;
+    startTime: string;
+    lastActivity?: string;
+    metadata?: Record<string, any>;
+}
+export interface AgentDecision {
+    timestamp: string;
+    context: string;
+    options: any[];
+    selected: any;
+    reasoning?: string;
+    confidence?: number;
+}
+export interface AgentTask {
+    taskId: string;
+    description: string;
+    startTime: string;
+    endTime?: string;
+    status: 'pending' | 'running' | 'completed' | 'failed';
+    steps: AgentTaskStep[];
+    result?: any;
+    error?: Error;
+}
+export interface AgentTaskStep {
+    step: number;
+    operation: string;
+    startTime: string;
+    endTime?: string;
+    duration?: number;
+    data?: any;
+    error?: Error;
+}
+export declare class AgentDebugStream extends EventEmitter {
+    private config;
+    private debug;
+    private state;
+    private decisions;
+    private tasks;
+    private communications;
+    private timeline;
+    private performanceMetrics;
+    constructor(config: AgentDebugConfig);
+    /**
+     * Log agent lifecycle phase change
+     */
+    logAgentPhase(phase: AgentState['phase'], data?: any): void;
+    /**
+     * Log agent initialization
+     */
+    logInitialization(config: any): void;
+    /**
+     * Log agent ready
+     */
+    logReady(capabilities?: any): void;
+    /**
+     * Start tracking a task
+     */
+    startTask(taskId: string, description: string, data?: any): void;
+    /**
+     * Log task step
+     */
+    logTaskStep(taskId: string, step: number, operation: string, data?: any): void;
+    /**
+     * Complete task step
+     */
+    completeTaskStep(taskId: string, step: number, duration: number, data?: any): void;
+    /**
+     * Complete task
+     */
+    completeTask(taskId: string, result?: any): void;
+    /**
+     * Fail task
+     */
+    failTask(taskId: string, error: Error): void;
+    /**
+     * Log a decision
+     */
+    logDecision(context: string, options: any[], selected: any, reasoning?: string, confidence?: number): void;
+    /**
+     * Log communication
+     */
+    logCommunication(type: 'send' | 'receive', target: string, message: any): void;
+    /**
+     * Log memory operation
+     */
+    logMemoryOperation(operation: 'store' | 'retrieve' | 'search', data: any, duration?: number): void;
+    /**
+     * Log thought/reasoning
+     */
+    logThought(thought: string, context?: any): void;
+    /**
+     * Log agent shutdown
+     */
+    logShutdown(reason?: string): void;
+    /**
+     * Track performance metric
+     */
+    private trackPerformance;
+    /**
+     * Print agent summary
+     */
+    printSummary(): void;
+    /**
+     * Print timeline
+     */
+    printTimeline(): void;
+    /**
+     * Get current state
+     */
+    getState(): AgentState;
+    /**
+     * Get task history
+     */
+    getTasks(): AgentTask[];
+    /**
+     * Get decisions
+     */
+    getDecisions(): AgentDecision[];
+    /**
+     * Get communications
+     */
+    getCommunications(): any[];
+    /**
+     * Close debug stream
+     */
+    close(): void;
+}
+/**
+ * Create agent debug stream
+ */
+export declare function createAgentDebugStream(config: AgentDebugConfig): AgentDebugStream;
+/**
+ * Create from environment variables
+ */
+export declare function createAgentDebugStreamFromEnv(agentId: string, tenantId?: string): AgentDebugStream;
+//# sourceMappingURL=agent-debug-stream.d.ts.map

package/dist/agentic-flow/src/federation/debug/agent-debug-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-debug-stream.d.ts","sourceRoot":"","sources":["../../../../../src/federation/debug/agent-debug-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAe,UAAU,EAAqB,MAAM,mBAAmB,CAAC;AAG/E,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACnD,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,eAAe,GAAG,MAAM,CAAC;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,GAAG,EAAE,CAAC;IACf,QAAQ,EAAE,GAAG,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAa;IAC7B,OAAO,CAAC,kBAAkB,CAAoC;gBAElD,MAAM,EAAE,gBAAgB;IAuBpC;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI;IA+B3D;;OAEG;IACH,iBAAiB,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI;IAapC;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,GAAG,GAAG,IAAI;IAalC;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI;IAkChE;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI;IA4B9E;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI;IA0BlF;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,IAAI;IAuChD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI;IA0B5C;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAgC1G;;OAEG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI;IA4B9E;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAclG;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI;IAchD;;OAEG;IACH,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IA0BlC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;OAEG;IACH,YAAY,IAAI,IAAI;IAiCpB;;OAEG;IACH,aAAa,IAAI,IAAI;IAmBrB;;OAEG;IACH,QAAQ,IAAI,UAAU;IAItB;;OAEG;IACH,QAAQ,IAAI,SAAS,EAAE;IAIvB;;OAEG;IACH,YAAY,IAAI,aAAa,EAAE;IAI/B;;OAEG;IACH,iBAAiB,IAAI,GAAG,EAAE;IAI1B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAEjF;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAgBlG"}