agentic-flow 3.0.0-alpha.2 → 3.1.0

package/dist/agentic-flow/src/federation/SecurityManager.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"SecurityManager.d.ts","sourceRoot":"","sources":["../../../../src/federation/SecurityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,eAAe,CAA0C;;IAOjE;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmCnE;;OAEG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAkCjE;;OAEG;IACG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAqBlE;;OAEG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB9F;;OAEG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC;IAiBlB;;OAEG;IACG,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QACvD,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IAaF;;OAEG;IACH,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAW5E;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAI9B;;OAEG;IACH,gBAAgB,IAAI,MAAM;IAI1B;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB;;OAEG;IACH,UAAU,IAAI,IAAI;CAInB"}

package/dist/agentic-flow/src/federation/SecurityManager.js

@@ -1,192 +0,0 @@
-/**
- * Security Manager - Authentication, encryption, and access control
- *
- * Features:
- * - JWT token generation and validation
- * - AES-256 encryption for data at rest
- * - Tenant isolation
- * - mTLS certificate management
- */
-import crypto from 'crypto';
-import { logger } from '../utils/logger.js';
-export class SecurityManager {
-    algorithm = 'aes-256-gcm';
-    jwtSecret;
-    encryptionCache = new Map();
-    constructor() {
-        // In production, load from secure vault (AWS Secrets Manager, HashiCorp Vault, etc.)
-        this.jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex');
-    }
-    /**
-     * Create JWT token for agent authentication
-     */
-    async createAgentToken(payload) {
-        const header = {
-            alg: 'HS256',
-            typ: 'JWT'
-        };
-        const now = Date.now();
-        const tokenPayload = {
-            ...payload,
-            iat: now,
-            exp: payload.expiresAt,
-            iss: 'agentic-flow-federation'
-        };
-        // Encode header and payload
-        const encodedHeader = this.base64UrlEncode(JSON.stringify(header));
-        const encodedPayload = this.base64UrlEncode(JSON.stringify(tokenPayload));
-        // Create signature
-        const signature = crypto
-            .createHmac('sha256', this.jwtSecret)
-            .update(`${encodedHeader}.${encodedPayload}`)
-            .digest('base64url');
-        const token = `${encodedHeader}.${encodedPayload}.${signature}`;
-        logger.info('Created agent token', {
-            agentId: payload.agentId,
-            tenantId: payload.tenantId,
-            expiresAt: new Date(payload.expiresAt).toISOString()
-        });
-        return token;
-    }
-    /**
-     * Verify JWT token
-     */
-    async verifyAgentToken(token) {
-        const parts = token.split('.');
-        if (parts.length !== 3) {
-            throw new Error('Invalid token format');
-        }
-        const [encodedHeader, encodedPayload, signature] = parts;
-        // Verify signature
-        const expectedSignature = crypto
-            .createHmac('sha256', this.jwtSecret)
-            .update(`${encodedHeader}.${encodedPayload}`)
-            .digest('base64url');
-        if (signature !== expectedSignature) {
-            throw new Error('Invalid token signature');
-        }
-        // Decode payload
-        const payload = JSON.parse(this.base64UrlDecode(encodedPayload));
-        // Check expiration
-        if (Date.now() >= payload.exp) {
-            throw new Error('Token expired');
-        }
-        logger.debug('Token verified', {
-            agentId: payload.agentId,
-            tenantId: payload.tenantId
-        });
-        return payload;
-    }
-    /**
-     * Get or create encryption keys for a tenant
-     */
-    async getEncryptionKeys(tenantId) {
-        // Check cache
-        if (this.encryptionCache.has(tenantId)) {
-            return this.encryptionCache.get(tenantId);
-        }
-        // Generate new keys for tenant
-        // In production, these would be stored in a secure key management service
-        const encryptionKey = crypto.randomBytes(32); // 256-bit key
-        const iv = crypto.randomBytes(16); // 128-bit IV
-        const keys = { encryptionKey, iv };
-        // Cache keys
-        this.encryptionCache.set(tenantId, keys);
-        logger.info('Generated encryption keys for tenant', { tenantId });
-        return keys;
-    }
-    /**
-     * Encrypt data with AES-256-GCM
-     */
-    async encrypt(data, tenantId) {
-        const keys = await this.getEncryptionKeys(tenantId);
-        const cipher = crypto.createCipheriv(this.algorithm, keys.encryptionKey, keys.iv);
-        let encrypted = cipher.update(data, 'utf8', 'base64');
-        encrypted += cipher.final('base64');
-        const authTag = cipher.getAuthTag().toString('base64');
-        logger.debug('Data encrypted', {
-            tenantId,
-            originalLength: data.length,
-            encryptedLength: encrypted.length
-        });
-        return { encrypted, authTag };
-    }
-    /**
-     * Decrypt data with AES-256-GCM
-     */
-    async decrypt(encrypted, authTag, tenantId) {
-        const keys = await this.getEncryptionKeys(tenantId);
-        const decipher = crypto.createDecipheriv(this.algorithm, keys.encryptionKey, keys.iv);
-        decipher.setAuthTag(Buffer.from(authTag, 'base64'));
-        let decrypted = decipher.update(encrypted, 'base64', 'utf8');
-        decrypted += decipher.final('utf8');
-        logger.debug('Data decrypted', {
-            tenantId,
-            decryptedLength: decrypted.length
-        });
-        return decrypted;
-    }
-    /**
-     * Generate mTLS certificates for agent-to-hub communication
-     */
-    async generateMTLSCertificates(agentId) {
-        // Placeholder: Actual implementation would use OpenSSL or similar
-        // to generate X.509 certificates with proper CA chain
-        logger.info('Generating mTLS certificates', { agentId });
-        return {
-            cert: 'PLACEHOLDER_CERT',
-            key: 'PLACEHOLDER_KEY',
-            ca: 'PLACEHOLDER_CA'
-        };
-    }
-    /**
-     * Validate tenant access to data
-     */
-    validateTenantAccess(requestTenantId, dataTenantId) {
-        if (requestTenantId !== dataTenantId) {
-            logger.warn('Tenant access violation detected', {
-                requestTenantId,
-                dataTenantId
-            });
-            return false;
-        }
-        return true;
-    }
-    /**
-     * Hash sensitive data for storage (one-way)
-     */
-    hashData(data) {
-        return crypto.createHash('sha256').update(data).digest('hex');
-    }
-    /**
-     * Generate secure random ID
-     */
-    generateSecureId() {
-        return crypto.randomBytes(16).toString('hex');
-    }
-    /**
-     * Base64 URL-safe encoding
-     */
-    base64UrlEncode(str) {
-        return Buffer.from(str)
-            .toString('base64')
-            .replace(/\+/g, '-')
-            .replace(/\//g, '_')
-            .replace(/=/g, '');
-    }
-    /**
-     * Base64 URL-safe decoding
-     */
-    base64UrlDecode(str) {
-        const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
-        return Buffer.from(base64, 'base64').toString('utf8');
-    }
-    /**
-     * Clear cached keys (for testing or security refresh)
-     */
-    clearCache() {
-        this.encryptionCache.clear();
-        logger.info('Encryption cache cleared');
-    }
-}
-//# sourceMappingURL=SecurityManager.js.map

package/dist/agentic-flow/src/federation/SecurityManager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"SecurityManager.js","sourceRoot":"","sources":["../../../../src/federation/SecurityManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAa5C,MAAM,OAAO,eAAe;IACT,SAAS,GAAG,aAAa,CAAC;IAC1B,SAAS,CAAS;IAC3B,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IAEjE;QACE,qFAAqF;QACrF,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAA0B;QAC/C,MAAM,MAAM,GAAG;YACb,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,KAAK;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG;YACnB,GAAG,OAAO;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,OAAO,CAAC,SAAS;YACtB,GAAG,EAAE,yBAAyB;SAC/B,CAAC;QAEF,4BAA4B;QAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1E,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;aACpC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;aAC5C,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,MAAM,KAAK,GAAG,GAAG,aAAa,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC;QAEhE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACjC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SACrD,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAEzD,mBAAmB;QACnB,MAAM,iBAAiB,GAAG,MAAM;aAC7B,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;aACpC,MAAM,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;aAC5C,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,iBAAiB;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC;QAEjE,mBAAmB;QACnB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QACtC,cAAc;QACd,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAC7C,CAAC;QAED,+BAA+B;QAC/B,0EAA0E;QAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;QAC5D,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa;QAEhD,MAAM,IAAI,GAAmB,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAEnD,aAAa;QACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAElE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,QAAgB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAElF,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,QAAQ;YACR,cAAc,EAAE,IAAI,CAAC,MAAM;YAC3B,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,OAAe,EACf,QAAgB;QAEhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEpD,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC7B,QAAQ;YACR,eAAe,EAAE,SAAS,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAAC,OAAe;QAK5C,kEAAkE;QAClE,sDAAsD;QAEtD,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,GAAG,EAAE,iBAAiB;YACtB,EAAE,EAAE,gBAAgB;SACrB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,eAAuB,EAAE,YAAoB;QAChE,IAAI,eAAe,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC9C,eAAe;gBACf,YAAY;aACb,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,IAAY;QACnB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,GAAW;QACjC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACpB,QAAQ,CAAC,QAAQ,CAAC;aAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,GAAW;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;CACF","sourcesContent":["/**\n * Security Manager - Authentication, encryption, and access control\n *\n * Features:\n * - JWT token generation and validation\n * - AES-256 encryption for data at rest\n * - Tenant isolation\n * - mTLS certificate management\n */\n\nimport crypto from 'crypto';\nimport { logger } from '../utils/logger.js';\n\nexport interface AgentTokenPayload {\n  agentId: string;\n  tenantId: string;\n  expiresAt: number;\n}\n\nexport interface EncryptionKeys {\n  encryptionKey: Buffer;\n  iv: Buffer;\n}\n\nexport class SecurityManager {\n  private readonly algorithm = 'aes-256-gcm';\n  private readonly jwtSecret: string;\n  private encryptionCache: Map<string, EncryptionKeys> = new Map();\n\n  constructor() {\n    // In production, load from secure vault (AWS Secrets Manager, HashiCorp Vault, etc.)\n    this.jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(32).toString('hex');\n  }\n\n  /**\n   * Create JWT token for agent authentication\n   */\n  async createAgentToken(payload: AgentTokenPayload): Promise<string> {\n    const header = {\n      alg: 'HS256',\n      typ: 'JWT'\n    };\n\n    const now = Date.now();\n    const tokenPayload = {\n      ...payload,\n      iat: now,\n      exp: payload.expiresAt,\n      iss: 'agentic-flow-federation'\n    };\n\n    // Encode header and payload\n    const encodedHeader = this.base64UrlEncode(JSON.stringify(header));\n    const encodedPayload = this.base64UrlEncode(JSON.stringify(tokenPayload));\n\n    // Create signature\n    const signature = crypto\n      .createHmac('sha256', this.jwtSecret)\n      .update(`${encodedHeader}.${encodedPayload}`)\n      .digest('base64url');\n\n    const token = `${encodedHeader}.${encodedPayload}.${signature}`;\n\n    logger.info('Created agent token', {\n      agentId: payload.agentId,\n      tenantId: payload.tenantId,\n      expiresAt: new Date(payload.expiresAt).toISOString()\n    });\n\n    return token;\n  }\n\n  /**\n   * Verify JWT token\n   */\n  async verifyAgentToken(token: string): Promise<AgentTokenPayload> {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      throw new Error('Invalid token format');\n    }\n\n    const [encodedHeader, encodedPayload, signature] = parts;\n\n    // Verify signature\n    const expectedSignature = crypto\n      .createHmac('sha256', this.jwtSecret)\n      .update(`${encodedHeader}.${encodedPayload}`)\n      .digest('base64url');\n\n    if (signature !== expectedSignature) {\n      throw new Error('Invalid token signature');\n    }\n\n    // Decode payload\n    const payload = JSON.parse(this.base64UrlDecode(encodedPayload));\n\n    // Check expiration\n    if (Date.now() >= payload.exp) {\n      throw new Error('Token expired');\n    }\n\n    logger.debug('Token verified', {\n      agentId: payload.agentId,\n      tenantId: payload.tenantId\n    });\n\n    return payload;\n  }\n\n  /**\n   * Get or create encryption keys for a tenant\n   */\n  async getEncryptionKeys(tenantId: string): Promise<EncryptionKeys> {\n    // Check cache\n    if (this.encryptionCache.has(tenantId)) {\n      return this.encryptionCache.get(tenantId)!;\n    }\n\n    // Generate new keys for tenant\n    // In production, these would be stored in a secure key management service\n    const encryptionKey = crypto.randomBytes(32); // 256-bit key\n    const iv = crypto.randomBytes(16); // 128-bit IV\n\n    const keys: EncryptionKeys = { encryptionKey, iv };\n\n    // Cache keys\n    this.encryptionCache.set(tenantId, keys);\n\n    logger.info('Generated encryption keys for tenant', { tenantId });\n\n    return keys;\n  }\n\n  /**\n   * Encrypt data with AES-256-GCM\n   */\n  async encrypt(data: string, tenantId: string): Promise<{ encrypted: string; authTag: string }> {\n    const keys = await this.getEncryptionKeys(tenantId);\n\n    const cipher = crypto.createCipheriv(this.algorithm, keys.encryptionKey, keys.iv);\n\n    let encrypted = cipher.update(data, 'utf8', 'base64');\n    encrypted += cipher.final('base64');\n\n    const authTag = cipher.getAuthTag().toString('base64');\n\n    logger.debug('Data encrypted', {\n      tenantId,\n      originalLength: data.length,\n      encryptedLength: encrypted.length\n    });\n\n    return { encrypted, authTag };\n  }\n\n  /**\n   * Decrypt data with AES-256-GCM\n   */\n  async decrypt(\n    encrypted: string,\n    authTag: string,\n    tenantId: string\n  ): Promise<string> {\n    const keys = await this.getEncryptionKeys(tenantId);\n\n    const decipher = crypto.createDecipheriv(this.algorithm, keys.encryptionKey, keys.iv);\n    decipher.setAuthTag(Buffer.from(authTag, 'base64'));\n\n    let decrypted = decipher.update(encrypted, 'base64', 'utf8');\n    decrypted += decipher.final('utf8');\n\n    logger.debug('Data decrypted', {\n      tenantId,\n      decryptedLength: decrypted.length\n    });\n\n    return decrypted;\n  }\n\n  /**\n   * Generate mTLS certificates for agent-to-hub communication\n   */\n  async generateMTLSCertificates(agentId: string): Promise<{\n    cert: string;\n    key: string;\n    ca: string;\n  }> {\n    // Placeholder: Actual implementation would use OpenSSL or similar\n    // to generate X.509 certificates with proper CA chain\n\n    logger.info('Generating mTLS certificates', { agentId });\n\n    return {\n      cert: 'PLACEHOLDER_CERT',\n      key: 'PLACEHOLDER_KEY',\n      ca: 'PLACEHOLDER_CA'\n    };\n  }\n\n  /**\n   * Validate tenant access to data\n   */\n  validateTenantAccess(requestTenantId: string, dataTenantId: string): boolean {\n    if (requestTenantId !== dataTenantId) {\n      logger.warn('Tenant access violation detected', {\n        requestTenantId,\n        dataTenantId\n      });\n      return false;\n    }\n    return true;\n  }\n\n  /**\n   * Hash sensitive data for storage (one-way)\n   */\n  hashData(data: string): string {\n    return crypto.createHash('sha256').update(data).digest('hex');\n  }\n\n  /**\n   * Generate secure random ID\n   */\n  generateSecureId(): string {\n    return crypto.randomBytes(16).toString('hex');\n  }\n\n  /**\n   * Base64 URL-safe encoding\n   */\n  private base64UrlEncode(str: string): string {\n    return Buffer.from(str)\n      .toString('base64')\n      .replace(/\\+/g, '-')\n      .replace(/\\//g, '_')\n      .replace(/=/g, '');\n  }\n\n  /**\n   * Base64 URL-safe decoding\n   */\n  private base64UrlDecode(str: string): string {\n    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n    return Buffer.from(base64, 'base64').toString('utf8');\n  }\n\n  /**\n   * Clear cached keys (for testing or security refresh)\n   */\n  clearCache(): void {\n    this.encryptionCache.clear();\n    logger.info('Encryption cache cleared');\n  }\n}\n"]}

package/dist/agentic-flow/src/federation/debug/agent-debug-stream.d.ts

@@ -1,171 +0,0 @@
-/**
- * Single Agent Debug Streaming
- *
- * Provides detailed visibility into a single agent's operations,
- * lifecycle, and internal state changes.
- *
- * Features:
- * - Agent lifecycle tracking (spawn → work → shutdown)
- * - Task execution tracing
- * - Memory operations
- * - Communication events
- * - Decision logging
- * - State transitions
- * - Performance metrics
- * - Timeline visualization
- */
-import { EventEmitter } from 'events';
-import { DebugLevel } from './debug-stream.js';
-export { DebugLevel } from './debug-stream.js';
-export interface AgentDebugConfig {
-    agentId: string;
-    tenantId?: string;
-    level?: DebugLevel;
-    format?: 'human' | 'json' | 'compact' | 'timeline';
-    output?: 'console' | 'file' | 'both';
-    outputFile?: string;
-    colorize?: boolean;
-    trackState?: boolean;
-    trackDecisions?: boolean;
-    trackCommunication?: boolean;
-    timeline?: boolean;
-}
-export interface AgentState {
-    phase: 'spawning' | 'initializing' | 'ready' | 'working' | 'idle' | 'shutting_down' | 'dead';
-    task?: string;
-    taskId?: string;
-    startTime: string;
-    lastActivity?: string;
-    metadata?: Record<string, any>;
-}
-export interface AgentDecision {
-    timestamp: string;
-    context: string;
-    options: any[];
-    selected: any;
-    reasoning?: string;
-    confidence?: number;
-}
-export interface AgentTask {
-    taskId: string;
-    description: string;
-    startTime: string;
-    endTime?: string;
-    status: 'pending' | 'running' | 'completed' | 'failed';
-    steps: AgentTaskStep[];
-    result?: any;
-    error?: Error;
-}
-export interface AgentTaskStep {
-    step: number;
-    operation: string;
-    startTime: string;
-    endTime?: string;
-    duration?: number;
-    data?: any;
-    error?: Error;
-}
-export declare class AgentDebugStream extends EventEmitter {
-    private config;
-    private debug;
-    private state;
-    private decisions;
-    private tasks;
-    private communications;
-    private timeline;
-    private performanceMetrics;
-    constructor(config: AgentDebugConfig);
-    /**
-     * Log agent lifecycle phase change
-     */
-    logAgentPhase(phase: AgentState['phase'], data?: any): void;
-    /**
-     * Log agent initialization
-     */
-    logInitialization(config: any): void;
-    /**
-     * Log agent ready
-     */
-    logReady(capabilities?: any): void;
-    /**
-     * Start tracking a task
-     */
-    startTask(taskId: string, description: string, data?: any): void;
-    /**
-     * Log task step
-     */
-    logTaskStep(taskId: string, step: number, operation: string, data?: any): void;
-    /**
-     * Complete task step
-     */
-    completeTaskStep(taskId: string, step: number, duration: number, data?: any): void;
-    /**
-     * Complete task
-     */
-    completeTask(taskId: string, result?: any): void;
-    /**
-     * Fail task
-     */
-    failTask(taskId: string, error: Error): void;
-    /**
-     * Log a decision
-     */
-    logDecision(context: string, options: any[], selected: any, reasoning?: string, confidence?: number): void;
-    /**
-     * Log communication
-     */
-    logCommunication(type: 'send' | 'receive', target: string, message: any): void;
-    /**
-     * Log memory operation
-     */
-    logMemoryOperation(operation: 'store' | 'retrieve' | 'search', data: any, duration?: number): void;
-    /**
-     * Log thought/reasoning
-     */
-    logThought(thought: string, context?: any): void;
-    /**
-     * Log agent shutdown
-     */
-    logShutdown(reason?: string): void;
-    /**
-     * Track performance metric
-     */
-    private trackPerformance;
-    /**
-     * Print agent summary
-     */
-    printSummary(): void;
-    /**
-     * Print timeline
-     */
-    printTimeline(): void;
-    /**
-     * Get current state
-     */
-    getState(): AgentState;
-    /**
-     * Get task history
-     */
-    getTasks(): AgentTask[];
-    /**
-     * Get decisions
-     */
-    getDecisions(): AgentDecision[];
-    /**
-     * Get communications
-     */
-    getCommunications(): any[];
-    /**
-     * Close debug stream
-     */
-    close(): void;
-}
-/**
- * Create agent debug stream
- */
-export declare function createAgentDebugStream(config: AgentDebugConfig): AgentDebugStream;
-/**
- * Create from environment variables
- */
-export declare function createAgentDebugStreamFromEnv(agentId: string, tenantId?: string): AgentDebugStream;
-//# sourceMappingURL=agent-debug-stream.d.ts.map

package/dist/agentic-flow/src/federation/debug/agent-debug-stream.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-debug-stream.d.ts","sourceRoot":"","sources":["../../../../../src/federation/debug/agent-debug-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAe,UAAU,EAAqB,MAAM,mBAAmB,CAAC;AAG/E,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IACnD,MAAM,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,eAAe,GAAG,MAAM,CAAC;IAC7F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,GAAG,EAAE,CAAC;IACf,QAAQ,EAAE,GAAG,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAa;IAC7B,OAAO,CAAC,kBAAkB,CAAoC;gBAElD,MAAM,EAAE,gBAAgB;IAuBpC;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI;IA+B3D;;OAEG;IACH,iBAAiB,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI;IAapC;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,GAAG,GAAG,IAAI;IAalC;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI;IAkChE;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI;IA4B9E;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI;IA0BlF;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,IAAI;IAuChD;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI;IA0B5C;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAgC1G;;OAEG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI;IA4B9E;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAclG;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,IAAI;IAchD;;OAEG;IACH,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IA0BlC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;OAEG;IACH,YAAY,IAAI,IAAI;IAiCpB;;OAEG;IACH,aAAa,IAAI,IAAI;IAmBrB;;OAEG;IACH,QAAQ,IAAI,UAAU;IAItB;;OAEG;IACH,QAAQ,IAAI,SAAS,EAAE;IAIvB;;OAEG;IACH,YAAY,IAAI,aAAa,EAAE;IAI/B;;OAEG;IACH,iBAAiB,IAAI,GAAG,EAAE;IAI1B;;OAEG;IACH,KAAK,IAAI,IAAI;CAGd;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAEjF;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAgBlG"}