llm-trust-guard 4.0.0

package/dist/guards/agent-communication-guard.js

@@ -0,0 +1,468 @@
+"use strict";
+/**
+ * AgentCommunicationGuard (L12)
+ *
+ * Secures communication between agents in multi-agent systems.
+ * Prevents impersonation, replay attacks, and message tampering.
+ *
+ * Threat Model:
+ * - ASI07: Insecure Inter-Agent Communication
+ * - Agent impersonation attacks
+ * - Message replay attacks
+ * - Man-in-the-middle attacks
+ *
+ * Protection Capabilities:
+ * - Message authentication (HMAC signing)
+ * - Agent identity verification
+ * - Replay attack prevention (nonces)
+ * - Message encryption (optional)
+ * - Channel integrity validation
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentCommunicationGuard = void 0;
+const crypto = __importStar(require("crypto"));
+class AgentCommunicationGuard {
+    constructor(config = {}) {
+        this.registeredAgents = new Map();
+        this.usedNonces = new Map(); // nonce -> timestamp
+        this.messageHistory = new Map(); // messageId -> timestamp
+        this.agentViolations = new Map();
+        // Dangerous payload patterns
+        this.PAYLOAD_INJECTION_PATTERNS = [
+            { name: "instruction_injection", pattern: /"instruction"\s*:\s*"[^"]*ignore|override/i, severity: 40 },
+            { name: "role_escalation", pattern: /"(role|permission|capability)"\s*:\s*"(admin|root|system)"/i, severity: 50 },
+            { name: "command_injection", pattern: /"(command|action|execute)"\s*:\s*"(rm|delete|drop|exec)/i, severity: 55 },
+            { name: "redirect_attack", pattern: /"(redirect|forward|proxy)"\s*:\s*"https?:\/\/(?!localhost)/i, severity: 45 },
+            { name: "credential_request", pattern: /"(request|get|retrieve)"\s*:\s*"(password|secret|key|token)"/i, severity: 50 },
+        ];
+        this.config = {
+            signingKey: config.signingKey ?? crypto.randomBytes(32).toString("hex"),
+            enableEncryption: config.enableEncryption ?? false,
+            encryptionKey: config.encryptionKey ?? "",
+            nonceExpiration: config.nonceExpiration ?? 5 * 60 * 1000, // 5 minutes
+            maxMessageAge: config.maxMessageAge ?? 60 * 1000, // 1 minute
+            requireSignatures: config.requireSignatures ?? true,
+            allowedAgents: config.allowedAgents ?? [],
+            strictMode: config.strictMode ?? false,
+        };
+        this.signingKey = Buffer.from(this.config.signingKey, "hex");
+        if (this.config.enableEncryption) {
+            if (!this.config.encryptionKey) {
+                this.config.encryptionKey = crypto.randomBytes(32).toString("hex");
+            }
+            this.encryptionKey = Buffer.from(this.config.encryptionKey, "hex");
+        }
+        // Start nonce cleanup interval
+        setInterval(() => this.cleanupNonces(), 60 * 1000);
+    }
+    /**
+     * Register an agent for communication
+     */
+    registerAgent(agentId, agentType, capabilities, metadata) {
+        const identity = {
+            agentId,
+            agentType,
+            capabilities,
+            registeredAt: Date.now(),
+            trustScore: 80, // Start with good trust
+            metadata,
+        };
+        this.registeredAgents.set(agentId, identity);
+        return identity;
+    }
+    /**
+     * Unregister an agent
+     */
+    unregisterAgent(agentId) {
+        return this.registeredAgents.delete(agentId);
+    }
+    /**
+     * Create a signed message
+     */
+    createMessage(fromAgent, toAgent, type, payload, replyTo, ttl) {
+        const messageId = `msg-${Date.now()}-${crypto.randomBytes(8).toString("hex")}`;
+        const nonce = crypto.randomBytes(16).toString("hex");
+        const timestamp = Date.now();
+        let finalPayload = payload;
+        // Encrypt if enabled
+        if (this.config.enableEncryption && this.encryptionKey) {
+            finalPayload = this.encryptPayload(payload);
+        }
+        const message = {
+            messageId,
+            fromAgent,
+            toAgent,
+            type,
+            payload: finalPayload,
+            timestamp,
+            nonce,
+            replyTo,
+            ttl: ttl ?? this.config.maxMessageAge,
+            encrypted: this.config.enableEncryption,
+        };
+        // Sign the message
+        message.signature = this.signMessage(message);
+        return message;
+    }
+    /**
+     * Validate an incoming message
+     */
+    validateMessage(message, receivingAgentId, requestId) {
+        const reqId = requestId || `amsg-${Date.now()}`;
+        const violations = [];
+        let senderVerified = false;
+        let recipientValid = false;
+        let signatureValid = false;
+        let nonceValid = false;
+        let timestampValid = false;
+        let payloadSafe = false;
+        let trustScore = 0;
+        // Check sender is registered
+        const sender = this.registeredAgents.get(message.fromAgent);
+        if (sender) {
+            senderVerified = true;
+            trustScore = sender.trustScore;
+            // Check if sender is in allowed list (if configured)
+            if (this.config.allowedAgents.length > 0 && !this.config.allowedAgents.includes(message.fromAgent)) {
+                violations.push("sender_not_allowed");
+                senderVerified = false;
+            }
+        }
+        else {
+            violations.push("sender_not_registered");
+        }
+        // Check recipient
+        const recipients = Array.isArray(message.toAgent) ? message.toAgent : [message.toAgent];
+        if (recipients.includes(receivingAgentId) || recipients.includes("*")) {
+            recipientValid = true;
+        }
+        else {
+            violations.push("recipient_mismatch");
+        }
+        // Verify signature
+        if (this.config.requireSignatures) {
+            if (!message.signature) {
+                violations.push("missing_signature");
+            }
+            else {
+                const { signature: _, ...messageWithoutSig } = message;
+                const expectedSignature = this.signMessage(messageWithoutSig);
+                if (message.signature === expectedSignature) {
+                    signatureValid = true;
+                }
+                else {
+                    violations.push("invalid_signature");
+                }
+            }
+        }
+        else {
+            signatureValid = true; // Skip if not required
+        }
+        // Check nonce (replay prevention)
+        if (this.usedNonces.has(message.nonce)) {
+            violations.push("nonce_reused");
+        }
+        else {
+            nonceValid = true;
+            this.usedNonces.set(message.nonce, Date.now());
+        }
+        // Check message ID uniqueness
+        if (this.messageHistory.has(message.messageId)) {
+            violations.push("duplicate_message");
+        }
+        else {
+            this.messageHistory.set(message.messageId, Date.now());
+        }
+        // Check timestamp
+        const messageAge = Date.now() - message.timestamp;
+        if (messageAge < 0) {
+            violations.push("future_timestamp");
+        }
+        else if (messageAge > (message.ttl || this.config.maxMessageAge)) {
+            violations.push("message_expired");
+        }
+        else {
+            timestampValid = true;
+        }
+        // Validate payload
+        let decryptedPayload = message.payload;
+        if (message.encrypted && this.encryptionKey) {
+            try {
+                decryptedPayload = this.decryptPayload(message.payload);
+            }
+            catch {
+                violations.push("decryption_failed");
+            }
+        }
+        const payloadCheck = this.validatePayload(decryptedPayload);
+        if (payloadCheck.safe) {
+            payloadSafe = true;
+        }
+        else {
+            violations.push(...payloadCheck.violations);
+            trustScore -= payloadCheck.riskContribution;
+        }
+        // Update agent violations
+        if (violations.length > 0 && sender) {
+            const currentViolations = this.agentViolations.get(message.fromAgent) || 0;
+            this.agentViolations.set(message.fromAgent, currentViolations + violations.length);
+            // Reduce trust score for violations
+            sender.trustScore = Math.max(0, sender.trustScore - violations.length * 5);
+            this.registeredAgents.set(message.fromAgent, sender);
+        }
+        // Decision
+        const criticalViolations = violations.filter((v) => ["invalid_signature", "sender_not_registered", "nonce_reused", "duplicate_message"].includes(v));
+        const blocked = this.config.strictMode
+            ? violations.length > 0
+            : criticalViolations.length > 0;
+        return {
+            allowed: !blocked,
+            reason: blocked
+                ? `Message blocked: ${violations.slice(0, 3).join(", ")}`
+                : "Message validated successfully",
+            violations,
+            request_id: reqId,
+            validation: {
+                sender_verified: senderVerified,
+                recipient_valid: recipientValid,
+                signature_valid: signatureValid,
+                nonce_valid: nonceValid,
+                timestamp_valid: timestampValid,
+                payload_safe: payloadSafe,
+                trust_score: Math.max(0, trustScore),
+            },
+            decrypted_payload: !blocked ? decryptedPayload : undefined,
+            recommendations: this.generateRecommendations(violations),
+        };
+    }
+    /**
+     * Create a response to a message
+     */
+    createResponse(originalMessage, fromAgent, payload) {
+        return this.createMessage(fromAgent, originalMessage.fromAgent, "response", payload, originalMessage.messageId);
+    }
+    /**
+     * Get channel status for an agent
+     */
+    getChannelStatus(agentId) {
+        const agent = this.registeredAgents.get(agentId);
+        if (!agent)
+            return null;
+        const messageCount = [...this.messageHistory.entries()].filter(([id]) => id.includes(agentId)).length;
+        return {
+            agentId,
+            connected: true,
+            lastSeen: agent.registeredAt,
+            messageCount,
+            trustScore: agent.trustScore,
+            violations: this.agentViolations.get(agentId) || 0,
+        };
+    }
+    /**
+     * Get all registered agents
+     */
+    getRegisteredAgents() {
+        return [...this.registeredAgents.values()];
+    }
+    /**
+     * Check if agent has capability
+     */
+    hasCapability(agentId, capability) {
+        const agent = this.registeredAgents.get(agentId);
+        return agent?.capabilities.includes(capability) ?? false;
+    }
+    /**
+     * Update agent trust score
+     */
+    updateTrustScore(agentId, delta) {
+        const agent = this.registeredAgents.get(agentId);
+        if (agent) {
+            agent.trustScore = Math.max(0, Math.min(100, agent.trustScore + delta));
+            this.registeredAgents.set(agentId, agent);
+        }
+    }
+    /**
+     * Reset agent violations
+     */
+    resetViolations(agentId) {
+        this.agentViolations.delete(agentId);
+    }
+    /**
+     * Verify message chain (for multi-hop scenarios)
+     */
+    verifyMessageChain(messages) {
+        const violations = [];
+        for (let i = 1; i < messages.length; i++) {
+            const current = messages[i];
+            const previous = messages[i - 1];
+            // Check that current message replies to previous
+            if (current.replyTo !== previous.messageId) {
+                violations.push(`chain_broken_at_${i}`);
+                return { valid: false, broken_at: i, violations };
+            }
+            // Check timestamps are sequential
+            if (current.timestamp < previous.timestamp) {
+                violations.push(`timestamp_order_violation_at_${i}`);
+                return { valid: false, broken_at: i, violations };
+            }
+            // Verify signature
+            const { signature: _sig, ...currentWithoutSig } = current;
+            const expectedSig = this.signMessage(currentWithoutSig);
+            if (current.signature !== expectedSig) {
+                violations.push(`signature_invalid_at_${i}`);
+                return { valid: false, broken_at: i, violations };
+            }
+        }
+        return { valid: true, violations: [] };
+    }
+    signMessage(message) {
+        const data = JSON.stringify({
+            messageId: message.messageId,
+            fromAgent: message.fromAgent,
+            toAgent: message.toAgent,
+            type: message.type,
+            payload: message.payload,
+            timestamp: message.timestamp,
+            nonce: message.nonce,
+            replyTo: message.replyTo,
+        });
+        return crypto
+            .createHmac("sha256", this.signingKey)
+            .update(data)
+            .digest("hex");
+    }
+    encryptPayload(payload) {
+        if (!this.encryptionKey)
+            throw new Error("Encryption key not set");
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv("aes-256-gcm", this.encryptionKey, iv);
+        const plaintext = JSON.stringify(payload);
+        let encrypted = cipher.update(plaintext, "utf8", "hex");
+        encrypted += cipher.final("hex");
+        const authTag = cipher.getAuthTag();
+        return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted}`;
+    }
+    decryptPayload(encryptedPayload) {
+        if (!this.encryptionKey)
+            throw new Error("Encryption key not set");
+        const [ivHex, authTagHex, encrypted] = encryptedPayload.split(":");
+        const iv = Buffer.from(ivHex, "hex");
+        const authTag = Buffer.from(authTagHex, "hex");
+        const decipher = crypto.createDecipheriv("aes-256-gcm", this.encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encrypted, "hex", "utf8");
+        decrypted += decipher.final("utf8");
+        return JSON.parse(decrypted);
+    }
+    validatePayload(payload) {
+        const violations = [];
+        let riskContribution = 0;
+        const payloadStr = JSON.stringify(payload);
+        for (const { name, pattern, severity } of this.PAYLOAD_INJECTION_PATTERNS) {
+            if (pattern.test(payloadStr)) {
+                violations.push(`payload_${name}`);
+                riskContribution += severity;
+            }
+        }
+        // Check for excessive payload size
+        if (payloadStr.length > 100000) {
+            violations.push("payload_too_large");
+            riskContribution += 20;
+        }
+        // Check for deeply nested structures (potential DoS)
+        const depth = this.getObjectDepth(payload);
+        if (depth > 10) {
+            violations.push("payload_too_deep");
+            riskContribution += 15;
+        }
+        return {
+            safe: violations.length === 0,
+            violations,
+            riskContribution: Math.min(60, riskContribution),
+        };
+    }
+    getObjectDepth(obj, currentDepth = 0) {
+        if (typeof obj !== "object" || obj === null)
+            return currentDepth;
+        if (currentDepth > 15)
+            return currentDepth; // Prevent stack overflow
+        let maxDepth = currentDepth;
+        for (const value of Object.values(obj)) {
+            const depth = this.getObjectDepth(value, currentDepth + 1);
+            maxDepth = Math.max(maxDepth, depth);
+        }
+        return maxDepth;
+    }
+    cleanupNonces() {
+        const now = Date.now();
+        const expiration = this.config.nonceExpiration;
+        for (const [nonce, timestamp] of this.usedNonces) {
+            if (now - timestamp > expiration) {
+                this.usedNonces.delete(nonce);
+            }
+        }
+        // Also clean message history
+        for (const [messageId, timestamp] of this.messageHistory) {
+            if (now - timestamp > expiration * 2) {
+                this.messageHistory.delete(messageId);
+            }
+        }
+    }
+    generateRecommendations(violations) {
+        const recommendations = [];
+        if (violations.some((v) => v.includes("signature"))) {
+            recommendations.push("Ensure messages are properly signed before sending");
+        }
+        if (violations.some((v) => v.includes("nonce") || v.includes("duplicate"))) {
+            recommendations.push("Implement proper nonce generation to prevent replay attacks");
+        }
+        if (violations.some((v) => v.includes("sender"))) {
+            recommendations.push("Register agents before they can communicate");
+        }
+        if (violations.some((v) => v.includes("payload"))) {
+            recommendations.push("Sanitize message payloads before sending");
+        }
+        if (violations.some((v) => v.includes("expired") || v.includes("timestamp"))) {
+            recommendations.push("Ensure agent clocks are synchronized");
+        }
+        if (recommendations.length === 0) {
+            recommendations.push("Message validated successfully");
+        }
+        return recommendations;
+    }
+}
+exports.AgentCommunicationGuard = AgentCommunicationGuard;
+//# sourceMappingURL=agent-communication-guard.js.map

package/dist/guards/agent-communication-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-communication-guard.js","sourceRoot":"","sources":["../../src/guards/agent-communication-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,+CAAiC;AA0FjC,MAAa,uBAAuB;IAkBlC,YAAY,SAAwC,EAAE;QAd9C,qBAAgB,GAA+B,IAAI,GAAG,EAAE,CAAC;QACzD,eAAU,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,qBAAqB;QAClE,mBAAc,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,yBAAyB;QAC1E,oBAAe,GAAwB,IAAI,GAAG,EAAE,CAAC;QAEzD,6BAA6B;QACZ,+BAA0B,GAA+D;YACxG,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,EAAE,EAAE;YACtG,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,6DAA6D,EAAE,QAAQ,EAAE,EAAE,EAAE;YACjH,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,0DAA0D,EAAE,QAAQ,EAAE,EAAE,EAAE;YAChH,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,6DAA6D,EAAE,QAAQ,EAAE,EAAE,EAAE;YACjH,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,+DAA+D,EAAE,QAAQ,EAAE,EAAE,EAAE;SACvH,CAAC;QAGA,IAAI,CAAC,MAAM,GAAG;YACZ,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK;YAClD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,YAAY;YACtE,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,EAAE,WAAW;YAC7D,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,IAAI;YACnD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;SACvC,CAAC;QAEF,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACrE,CAAC;QAED,+BAA+B;QAC/B,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,aAAa,CACX,OAAe,EACf,SAAiB,EACjB,YAAsB,EACtB,QAA8B;QAE9B,MAAM,QAAQ,GAAkB;YAC9B,OAAO;YACP,SAAS;YACT,YAAY;YACZ,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,UAAU,EAAE,EAAE,EAAE,wBAAwB;YACxC,QAAQ;SACT,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAe;QAC7B,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,aAAa,CACX,SAAiB,EACjB,OAA0B,EAC1B,IAA0B,EAC1B,OAAY,EACZ,OAAgB,EAChB,GAAY;QAEZ,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,YAAY,GAAG,OAAO,CAAC;QAE3B,qBAAqB;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvD,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAAiB;YAC5B,SAAS;YACT,SAAS;YACT,OAAO;YACP,IAAI;YACJ,OAAO,EAAE,YAAY;YACrB,SAAS;YACT,KAAK;YACL,OAAO;YACP,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa;YACrC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SACxC,CAAC;QAEF,mBAAmB;QACnB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,eAAe,CACb,OAAqB,EACrB,gBAAwB,EACxB,SAAkB;QAElB,MAAM,KAAK,GAAG,SAAS,IAAI,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChD,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,MAAM,EAAE,CAAC;YACX,cAAc,GAAG,IAAI,CAAC;YACtB,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAE/B,qDAAqD;YACrD,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnG,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACtC,cAAc,GAAG,KAAK,CAAC;YACzB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,kBAAkB;QAClB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,IAAI,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,iBAAiB,EAAE,GAAG,OAAO,CAAC;gBACvD,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;gBAC9D,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;oBAC5C,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,IAAI,CAAC,CAAC,uBAAuB;QAChD,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,kBAAkB;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAClD,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,mBAAmB;QACnB,IAAI,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;QACvC,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAC5D,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;YACtB,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YAC5C,UAAU,IAAI,YAAY,CAAC,gBAAgB,CAAC;QAC9C,CAAC;QAED,0BAA0B;QAC1B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;YACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAEnF,oCAAoC;YACpC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3E,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAED,WAAW;QACX,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,CAAC,mBAAmB,EAAE,uBAAuB,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAChG,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU;YACpC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;QAElC,OAAO;YACL,OAAO,EAAE,CAAC,OAAO;YACjB,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,oBAAoB,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACzD,CAAC,CAAC,gCAAgC;YACpC,UAAU;YACV,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE;gBACV,eAAe,EAAE,cAAc;gBAC/B,eAAe,EAAE,cAAc;gBAC/B,eAAe,EAAE,cAAc;gBAC/B,WAAW,EAAE,UAAU;gBACvB,eAAe,EAAE,cAAc;gBAC/B,YAAY,EAAE,WAAW;gBACzB,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC;aACrC;YACD,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC1D,eAAe,EAAE,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,eAA6B,EAC7B,SAAiB,EACjB,OAAY;QAEZ,OAAO,IAAI,CAAC,aAAa,CACvB,SAAS,EACT,eAAe,CAAC,SAAS,EACzB,UAAU,EACV,OAAO,EACP,eAAe,CAAC,SAAS,CAC1B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAe;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC/B,CAAC,MAAM,CAAC;QAET,OAAO;YACL,OAAO;YACP,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK,CAAC,YAAY;YAC5B,YAAY;YACZ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;SACnD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe,EAAE,UAAkB;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,OAAO,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAe,EAAE,KAAa;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAe;QAC7B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,QAAwB;QAKzC,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAEjC,iDAAiD;YACjD,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3C,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;YACpD,CAAC;YAED,kCAAkC;YAClC,IAAI,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC3C,UAAU,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC;gBACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;YACpD,CAAC;YAED,mBAAmB;YACnB,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,iBAAiB,EAAE,GAAG,OAAO,CAAC;YAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;YACxD,IAAI,OAAO,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;gBAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;YACpD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAEO,WAAW,CAAC,OAAwC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;aACrC,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,cAAc,CAAC,OAAY;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAEnE,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAE5E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;IACzE,CAAC;IAEO,cAAc,CAAC,gBAAwB;QAC7C,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAEnE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAChF,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAEO,eAAe,CAAC,OAAY;QAKlC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,gBAAgB,GAAG,CAAC,CAAC;QAEzB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAE3C,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;gBACnC,gBAAgB,IAAI,QAAQ,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACrC,gBAAgB,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,qDAAqD;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACpC,gBAAgB,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;YAC7B,UAAU;YACV,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC;SACjD,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,GAAQ,EAAE,YAAY,GAAG,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,YAAY,CAAC;QACjE,IAAI,YAAY,GAAG,EAAE;YAAE,OAAO,YAAY,CAAC,CAAC,yBAAyB;QAErE,IAAI,QAAQ,GAAG,YAAY,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;YAC3D,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,aAAa;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QAE/C,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,IAAI,GAAG,GAAG,SAAS,GAAG,UAAU,EAAE,CAAC;gBACjC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACzD,IAAI,GAAG,GAAG,SAAS,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,uBAAuB,CAAC,UAAoB;QAClD,MAAM,eAAe,GAAa,EAAE,CAAC;QAErC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACpD,eAAe,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC3E,eAAe,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACjD,eAAe,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAClD,eAAe,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC7E,eAAe,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,eAAe,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;CACF;AAxfD,0DAwfC"}

package/dist/guards/autonomy-escalation-guard.d.ts

@@ -0,0 +1,137 @@
+/**
+ * AutonomyEscalationGuard (L21)
+ *
+ * Detects and prevents unauthorized autonomy escalation attempts.
+ * Implements ASI10 from OWASP Agentic Applications 2026.
+ *
+ * Threat Model:
+ * - ASI10: Unauthorized Autonomy Escalation
+ * - Self-modification attempts
+ * - Capability expansion
+ * - Human-in-the-loop bypass
+ * - Sub-agent spawning without approval
+ *
+ * Protection Capabilities:
+ * - Autonomy level tracking
+ * - Capability boundary enforcement
+ * - Self-modification detection
+ * - Sub-agent control
+ * - Escalation pattern detection
+ */
+export interface AutonomyEscalationGuardConfig {
+    /** Maximum allowed autonomy level (0-100) */
+    maxAutonomyLevel?: number;
+    /** Base autonomy level for new sessions */
+    baseAutonomyLevel?: number;
+    /** Enable self-modification detection */
+    detectSelfModification?: boolean;
+    /** Enable sub-agent spawning control */
+    controlSubAgents?: boolean;
+    /** Maximum allowed sub-agents */
+    maxSubAgents?: number;
+    /** Actions that require autonomy escalation approval */
+    escalationRequiredActions?: string[];
+    /** Enable capability boundary enforcement */
+    enforceCapabilityBoundaries?: boolean;
+    /** Allowed capabilities per autonomy level */
+    capabilityLevels?: Record<number, string[]>;
+    /** Enable human-in-the-loop enforcement */
+    enforceHITL?: boolean;
+    /** Actions that always require human approval */
+    alwaysRequireHuman?: string[];
+}
+export interface AutonomyRequest {
+    /** Request identifier */
+    request_id: string;
+    /** Type of autonomy request */
+    request_type: "capability_expansion" | "level_increase" | "spawn_agent" | "self_modify" | "bypass_hitl" | "persist_state";
+    /** Requested capability or action */
+    requested_capability?: string;
+    /** Requested autonomy level */
+    requested_level?: number;
+    /** Reason provided for the request */
+    reason?: string;
+    /** Source of the request (agent, tool, external) */
+    source: string;
+    /** Timestamp */
+    timestamp: number;
+    /** Additional metadata */
+    metadata?: Record<string, any>;
+}
+export interface AgentCapabilities {
+    /** Current capabilities */
+    capabilities: Set<string>;
+    /** Current autonomy level */
+    autonomy_level: number;
+    /** Sub-agents spawned */
+    sub_agents: string[];
+    /** Pending escalation requests */
+    pending_requests: AutonomyRequest[];
+    /** Denied requests history */
+    denied_requests: AutonomyRequest[];
+    /** Last capability change timestamp */
+    last_capability_change: number;
+    /** HITL checkpoint count */
+    hitl_checkpoints: number;
+}
+export interface AutonomyEscalationResult {
+    allowed: boolean;
+    reason: string;
+    violations: string[];
+    request_id: string;
+    analysis: {
+        current_autonomy_level: number;
+        requested_autonomy_level?: number;
+        capability_violation: boolean;
+        self_modification_detected: boolean;
+        sub_agent_limit_exceeded: boolean;
+        hitl_required: boolean;
+        escalation_patterns_detected: string[];
+    };
+    requires_approval: boolean;
+    approval_type?: "human" | "admin" | "system";
+    recommendations: string[];
+}
+export declare class AutonomyEscalationGuard {
+    private config;
+    private agentStates;
+    private readonly ESCALATION_PATTERNS;
+    private readonly DEFAULT_CAPABILITY_LEVELS;
+    constructor(config?: AutonomyEscalationGuardConfig);
+    /**
+     * Validate an autonomy-related action or request
+     */
+    validate(action: string, sessionId: string, params?: Record<string, any>, requestId?: string): AutonomyEscalationResult;
+    /**
+     * Request autonomy escalation
+     */
+    requestEscalation(sessionId: string, request: Omit<AutonomyRequest, "request_id" | "timestamp">): AutonomyEscalationResult;
+    /**
+     * Approve a pending escalation request (called by human/admin)
+     */
+    approveEscalation(sessionId: string, requestId: string): boolean;
+    /**
+     * Deny a pending escalation request
+     */
+    denyEscalation(sessionId: string, requestId: string): boolean;
+    /**
+     * Register a sub-agent
+     */
+    registerSubAgent(sessionId: string, subAgentId: string): boolean;
+    /**
+     * Get current agent capabilities
+     */
+    getAgentState(sessionId: string): AgentCapabilities | undefined;
+    /**
+     * Set autonomy level directly (admin only)
+     */
+    setAutonomyLevel(sessionId: string, level: number): void;
+    /**
+     * Reset agent state
+     */
+    resetSession(sessionId: string): void;
+    private createAgentState;
+    private getCapabilitiesForLevel;
+    private generateRecommendations;
+}
+//# sourceMappingURL=autonomy-escalation-guard.d.ts.map

package/dist/guards/autonomy-escalation-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autonomy-escalation-guard.d.ts","sourceRoot":"","sources":["../../src/guards/autonomy-escalation-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,6BAA6B;IAC5C,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yCAAyC;IACzC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iCAAiC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;IACrC,6CAA6C;IAC7C,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,2CAA2C;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,YAAY,EAAE,sBAAsB,GAAG,gBAAgB,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,eAAe,CAAC;IAC1H,qCAAqC;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,6BAA6B;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,kCAAkC;IAClC,gBAAgB,EAAE,eAAe,EAAE,CAAC;IACpC,8BAA8B;IAC9B,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,uCAAuC;IACvC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,4BAA4B;IAC5B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE;QACR,sBAAsB,EAAE,MAAM,CAAC;QAC/B,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,oBAAoB,EAAE,OAAO,CAAC;QAC9B,0BAA0B,EAAE,OAAO,CAAC;QACpC,wBAAwB,EAAE,OAAO,CAAC;QAClC,aAAa,EAAE,OAAO,CAAC;QACvB,4BAA4B,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,iBAAiB,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IAC7C,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,MAAM,CAA0C;IACxD,OAAO,CAAC,WAAW,CAA6C;IAGhE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAoClC;IAGF,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAMxC;gBAEU,MAAM,GAAE,6BAAkC;IA2BtD;;OAEG;IACH,QAAQ,CACN,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,SAAS,CAAC,EAAE,MAAM,GACjB,wBAAwB;IAmI3B;;OAEG;IACH,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,WAAW,CAAC,GACzD,wBAAwB;IA4H3B;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAqChE;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAiB7D;;OAEG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAgBhE;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAI/D;;OAEG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAUxD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMrC,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,uBAAuB;IAW/B,OAAO,CAAC,uBAAuB;CAgChC"}