@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/governance/approval-gate-enforcer.js

@@ -0,0 +1,405 @@
+/**
+ * ApprovalGateEnforcer -- Mandatory approval gates with per-class policy.
+ *
+ * Categorises actions into six explicit approval classes (destructive,
+ * irreversible, financial, data-export, network-egress, secret-rotation),
+ * applies per-class disposition policy (requires-approval /
+ * auto-approve-low-risk / always-deny), and blocks synchronously until a
+ * human approves, rejects, or the configured timeout elapses.
+ *
+ * RELATIONSHIP TO PR #24 (feat/p3-t1-autonomy-spectrum):
+ *   PR #24 ships AutonomySpectrumEnforcer (Level 0-4). At Level 4 certain
+ *   action classes are routed to an approval queue via `guardAction()` which
+ *   returns `{ decision: 'approval-required', approvalRequestId }`. The
+ *   Level 4 gate intentionally does NOT own the queue lifecycle -- it only
+ *   names the classes that need gating.
+ *
+ *   THIS MODULE owns the gate lifecycle:
+ *     - Explicit class definitions with rationale (action-classes.ts)
+ *     - Per-class disposition config (ClassPolicyMap)
+ *     - Synchronous blocking via Promise + polling (no busy-spin)
+ *     - Audit chain writes on every decision
+ *     - Replay protection in the store (PT-APPROVAL-3)
+ *     - Empty packBinding[] guard (PT-APPROVAL-1)
+ *     - Config validation at construction (PT-APPROVAL-2)
+ *     - Authorised-approver list enforcement (PT-APPROVAL-4)
+ *
+ * HOOK POSITION:
+ *   The gate should fire AFTER blast-radius enforcement (PR #42) but BEFORE
+ *   action-isolation (PR #29). Rationale: blast-radius has already confirmed
+ *   the action is within scope; the gate then checks whether it needs human
+ *   sign-off before it executes. Action-isolation runs post-approval to
+ *   sandbox the approved execution. As of main HEAD, PRs #42 and #29 are
+ *   not yet merged, so this ordering is documented here but has no direct
+ *   code coupling to either module.
+ *
+ * TIMEOUT SEMANTICS:
+ *   On timeout, the safe default is DENY. Operators may override per-class
+ *   via `ActionClassPolicy.timeoutMs`. There is no "allow on timeout" option.
+ *
+ * COMPLIANCE BINDINGS:
+ *   HIPAA 164.308(a)(1): Security management process
+ *   HIPAA 164.308(a)(3): Workforce authorisation and supervision
+ *   HIPAA 164.312(a)(1): Access controls
+ *   SOC 2 CC6.1: Logical access restrictions
+ *   GDPR Art. 22: Automated decision-making
+ *   PCI DSS Req 7: Restrict access by business need
+ *   NIST 800-53 AC-3: Access enforcement
+ *   ISO 27001 A.9.4.1: Information access restriction
+ *
+ * @connexum/ai-governance P3-T2
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { UnboundDataError } from '../errors/index.js';
+import { ActionClass, buildDefaultClassPolicies, validateClassPolicies, ConfigValidationError, } from './action-classes.js';
+import { InMemoryApprovalQueueStore, } from './approval-queue-store.js';
+// Re-export for consumers that only import from the enforcer file.
+export { ActionClass, ConfigValidationError };
+// ---------------------------------------------------------------------------
+// ApprovalGateEnforcer
+// ---------------------------------------------------------------------------
+export class ApprovalGateEnforcer {
+    cfg;
+    /**
+     * PT-APPROVAL-2: constructor validates the class policy map.
+     * Throws ConfigValidationError immediately on invalid configuration.
+     */
+    constructor(config = {}) {
+        // Merge caller-supplied partial policies over the defaults.
+        const defaults = buildDefaultClassPolicies();
+        const merged = config.classPolicies
+            ? { ...defaults, ...config.classPolicies }
+            : defaults;
+        // Validate before storing.
+        validateClassPolicies(merged);
+        // Additional config validation.
+        const defaultTimeoutMs = config.defaultTimeoutMs ?? 600_000;
+        if (!Number.isFinite(defaultTimeoutMs) || defaultTimeoutMs <= 0) {
+            throw new ConfigValidationError(`Invalid defaultTimeoutMs "${defaultTimeoutMs}". Must be a positive finite number.`);
+        }
+        const pollIntervalMs = config.pollIntervalMs ?? 200;
+        if (!Number.isFinite(pollIntervalMs) || pollIntervalMs <= 0) {
+            throw new ConfigValidationError(`Invalid pollIntervalMs "${pollIntervalMs}". Must be a positive finite number.`);
+        }
+        this.cfg = {
+            classPolicies: merged,
+            defaultTimeoutMs,
+            pollIntervalMs,
+            store: config.store ?? new InMemoryApprovalQueueStore(),
+            auditDir: config.auditDir ?? null,
+        };
+        if (this.cfg.auditDir) {
+            fs.mkdirSync(this.cfg.auditDir, { recursive: true });
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Primary enforcement API
+    // ---------------------------------------------------------------------------
+    /**
+     * Enforce the approval gate for a given action.
+     *
+     * Behaviour by disposition:
+     *   auto-approve-low-risk  -- Returns immediately with allowed=true.
+     *   always-deny            -- Returns immediately with allowed=false.
+     *   requires-approval      -- Blocks (polls) until approved/rejected/timeout.
+     *
+     * PT-APPROVAL-1: empty packBinding throws UnboundDataError before any
+     * queue insertion.
+     *
+     * @param actionContext  Describes the action and its governance context.
+     * @returns EnforcementResult promise that resolves when a decision is made.
+     */
+    async enforce(actionContext) {
+        // PT-APPROVAL-1: pack binding must be non-empty.
+        if (!actionContext.packBinding || actionContext.packBinding.length === 0) {
+            throw new UnboundDataError(`approval-gate:enforce[${actionContext.actionClass}]`, actionContext.tenantId ?? 'unknown');
+        }
+        const policy = this.cfg.classPolicies[actionContext.actionClass];
+        const now = new Date().toISOString();
+        // ---- auto-approve-low-risk ----
+        if (policy.disposition === 'auto-approve-low-risk') {
+            const result = {
+                allowed: true,
+                outcome: 'auto-approved',
+                decidedAt: now,
+                reason: policy.rationale ?? 'Auto-approved: class policy is auto-approve-low-risk.',
+            };
+            this.writeAudit({
+                type: 'APPROVAL_GATE_AUTO_APPROVED',
+                actionClass: actionContext.actionClass,
+                initiator: actionContext.initiator,
+                packBinding: actionContext.packBinding,
+                tenantId: actionContext.tenantId,
+                reason: result.reason,
+                timestamp: now,
+            });
+            return result;
+        }
+        // ---- always-deny ----
+        if (policy.disposition === 'always-deny') {
+            const result = {
+                allowed: false,
+                outcome: 'always-denied',
+                decidedAt: now,
+                reason: policy.rationale ?? 'Denied: class policy is always-deny.',
+            };
+            this.writeAudit({
+                type: 'APPROVAL_GATE_ALWAYS_DENIED',
+                actionClass: actionContext.actionClass,
+                initiator: actionContext.initiator,
+                packBinding: actionContext.packBinding,
+                tenantId: actionContext.tenantId,
+                reason: result.reason,
+                timestamp: now,
+            });
+            return result;
+        }
+        // ---- requires-approval ----
+        const timeoutMs = policy.timeoutMs ?? this.cfg.defaultTimeoutMs;
+        const expiresAt = new Date(Date.now() + timeoutMs).toISOString();
+        const approvalId = this.cfg.store.insert({
+            createdAt: now,
+            expiresAt,
+            actionClass: actionContext.actionClass,
+            actionDescription: actionContext.description,
+            initiator: actionContext.initiator,
+            packBinding: actionContext.packBinding,
+        });
+        this.writeAudit({
+            type: 'APPROVAL_GATE_QUEUED',
+            approvalId,
+            actionClass: actionContext.actionClass,
+            initiator: actionContext.initiator,
+            packBinding: actionContext.packBinding,
+            tenantId: actionContext.tenantId,
+            timestamp: now,
+        });
+        // Block (poll) until resolved or timed out.
+        const decision = await this.waitForDecision(approvalId, timeoutMs);
+        const record = this.cfg.store.get(approvalId);
+        const decidedAt = record.decidedAt ?? new Date().toISOString();
+        if (decision === 'timed-out') {
+            this.writeAudit({
+                type: 'APPROVAL_GATE_TIMED_OUT',
+                approvalId,
+                actionClass: actionContext.actionClass,
+                initiator: actionContext.initiator,
+                packBinding: actionContext.packBinding,
+                tenantId: actionContext.tenantId,
+                reason: 'Timed out. Default action: deny.',
+                timestamp: decidedAt,
+            });
+            return {
+                allowed: false,
+                outcome: 'timed-out',
+                approvalId,
+                decidedAt,
+                reason: 'Timed out waiting for human approval. Default action: deny.',
+            };
+        }
+        if (decision === 'approved') {
+            this.writeAudit({
+                type: 'APPROVAL_GATE_APPROVED',
+                approvalId,
+                actionClass: actionContext.actionClass,
+                initiator: actionContext.initiator,
+                packBinding: actionContext.packBinding,
+                tenantId: actionContext.tenantId,
+                approverId: record.approverId,
+                reason: record.reason,
+                timestamp: decidedAt,
+            });
+            return {
+                allowed: true,
+                outcome: 'approved',
+                approvalId,
+                approverId: record.approverId,
+                reason: record.reason,
+                decidedAt,
+            };
+        }
+        // rejected
+        this.writeAudit({
+            type: 'APPROVAL_GATE_REJECTED',
+            approvalId,
+            actionClass: actionContext.actionClass,
+            initiator: actionContext.initiator,
+            packBinding: actionContext.packBinding,
+            tenantId: actionContext.tenantId,
+            approverId: record.approverId,
+            reason: record.reason,
+            timestamp: decidedAt,
+        });
+        return {
+            allowed: false,
+            outcome: 'rejected',
+            approvalId,
+            approverId: record.approverId,
+            reason: record.reason,
+            decidedAt,
+        };
+    }
+    // ---------------------------------------------------------------------------
+    // Approval submission API (caller-side hooks for human approver)
+    // ---------------------------------------------------------------------------
+    /**
+     * Submit an approval decision for a pending gate.
+     *
+     * PT-APPROVAL-3: If the approvalId has already been decided, this call
+     * is a silent no-op (the store's replay protection handles it).
+     *
+     * PT-APPROVAL-4: If the class policy specifies `allowedApprovers` and
+     * `approverId` is not in that list, the approval is rejected and an
+     * APPROVAL_GATE_UNAUTHORIZED_APPROVER audit entry is written.
+     *
+     * @param approvalId  The ID returned by `enforce()`.
+     * @param approverId  Identity of the human approver.
+     * @param reason      Optional human-readable reason.
+     */
+    submitApproval(approvalId, approverId, reason) {
+        const record = this.cfg.store.get(approvalId);
+        if (!record)
+            return;
+        // PT-APPROVAL-4: check authorised approvers.
+        if (!this.isAuthorizedApprover(record.actionClass, approverId)) {
+            this.writeAudit({
+                type: 'APPROVAL_GATE_UNAUTHORIZED_APPROVER',
+                approvalId,
+                actionClass: record.actionClass,
+                initiator: record.initiator,
+                packBinding: record.packBinding,
+                approverId,
+                reason: `Approver "${approverId}" is not in the allowedApprovers list for class "${record.actionClass}".`,
+                timestamp: new Date().toISOString(),
+            });
+            // Reject the attempt rather than silently ignoring -- fail closed.
+            this.cfg.store.resolve(approvalId, 'rejected', `system:unauthorized:${approverId}`, `Approver "${approverId}" is not authorised for class "${record.actionClass}".`);
+            return;
+        }
+        this.cfg.store.resolve(approvalId, 'approved', approverId, reason);
+    }
+    /**
+     * Submit a rejection decision for a pending gate.
+     *
+     * PT-APPROVAL-3: If the approvalId has already been decided, this call
+     * is a silent no-op.
+     *
+     * @param approvalId  The ID returned by `enforce()`.
+     * @param approverId  Identity of the rejecting human.
+     * @param reason      Optional human-readable reason.
+     */
+    submitRejection(approvalId, approverId, reason) {
+        const record = this.cfg.store.get(approvalId);
+        if (!record)
+            return;
+        this.cfg.store.resolve(approvalId, 'rejected', approverId, reason);
+    }
+    // ---------------------------------------------------------------------------
+    // Query API
+    // ---------------------------------------------------------------------------
+    /**
+     * Return all currently pending approvals.
+     * Optionally filter by action class or initiator.
+     * Used by the dashboard / UI to display the approval queue.
+     */
+    getPendingApprovals(filter) {
+        return this.cfg.store.getPending(filter);
+    }
+    /**
+     * Return a snapshot of all approvals (pending and decided).
+     * Useful for audit queries.
+     */
+    getAllApprovals() {
+        return this.cfg.store.getAll();
+    }
+    /**
+     * Retrieve a single approval by ID.
+     */
+    getApproval(approvalId) {
+        return this.cfg.store.get(approvalId);
+    }
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    /**
+     * Poll the store until the approval is no longer 'pending' or timeout elapses.
+     *
+     * Uses setInterval-based polling (no busy-spin per AIAG-013).
+     * On timeout, calls `store.timeout()` to mark the record, then resolves.
+     */
+    waitForDecision(approvalId, timeoutMs) {
+        return new Promise((resolve) => {
+            const deadline = Date.now() + timeoutMs;
+            const interval = setInterval(() => {
+                const record = this.cfg.store.get(approvalId);
+                if (!record) {
+                    clearInterval(interval);
+                    resolve('rejected');
+                    return;
+                }
+                if (record.status === 'approved') {
+                    clearInterval(interval);
+                    resolve('approved');
+                    return;
+                }
+                if (record.status === 'rejected') {
+                    clearInterval(interval);
+                    resolve('rejected');
+                    return;
+                }
+                if (record.status === 'timed-out') {
+                    clearInterval(interval);
+                    resolve('timed-out');
+                    return;
+                }
+                // Still pending -- check if we're past deadline.
+                if (Date.now() >= deadline) {
+                    clearInterval(interval);
+                    this.cfg.store.timeout(approvalId);
+                    resolve('timed-out');
+                }
+            }, this.cfg.pollIntervalMs);
+        });
+    }
+    /**
+     * PT-APPROVAL-4: Returns true if the approverId is permitted to approve
+     * for the given action class. Always returns true when no allowedApprovers
+     * constraint is configured for that class.
+     */
+    isAuthorizedApprover(actionClass, approverId) {
+        const policy = this.cfg.classPolicies[actionClass];
+        if (!policy.allowedApprovers || policy.allowedApprovers.length === 0) {
+            return true;
+        }
+        return policy.allowedApprovers.includes(approverId);
+    }
+    /**
+     * Append an audit entry to the JSONL file when auditDir is configured.
+     * Errors are logged to stderr but never thrown -- the gate must not fail
+     * because the audit writer has a transient I/O error.
+     */
+    writeAudit(entry) {
+        if (!this.cfg.auditDir)
+            return;
+        const filePath = path.join(this.cfg.auditDir, 'approval-gate-audit.jsonl');
+        try {
+            fs.appendFileSync(filePath, JSON.stringify(entry) + '\n');
+        }
+        catch (err) {
+            process.stderr.write(`[APPROVAL GATE AUDIT] Failed to write audit entry: ${err.message}\n`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// generateApprovalId -- exported helper for tests / integrations
+// ---------------------------------------------------------------------------
+/**
+ * Generate a unique approval ID in the same format used by the enforcer.
+ * Exposed for testing and integration code that needs to pre-generate IDs.
+ */
+export function generateApprovalId() {
+    return `apg_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`;
+}
+//# sourceMappingURL=approval-gate-enforcer.js.map

package/dist/esm/governance/approval-gate-enforcer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-gate-enforcer.js","sourceRoot":"","sources":["../../../src/governance/approval-gate-enforcer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,WAAW,EAGX,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,0BAA0B,GAE3B,MAAM,wBAAwB,CAAC;AAEhC,mEAAmE;AACnE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;AAqI9C,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,OAAO,oBAAoB;IACd,GAAG,CAAiB;IAErC;;;OAGG;IACH,YAAY,SAAqC,EAAE;QACjD,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAmB,MAAM,CAAC,aAAa;YACjD,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE;YAC1C,CAAC,CAAC,QAAQ,CAAC;QAEb,2BAA2B;QAC3B,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAE9B,gCAAgC;QAChC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,qBAAqB,CAC7B,6BAA6B,gBAAgB,sCAAsC,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,qBAAqB,CAC7B,2BAA2B,cAAc,sCAAsC,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,GAAG;YACT,aAAa,EAAE,MAAM;YACrB,gBAAgB;YAChB,cAAc;YACd,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,0BAA0B,EAAE;YACvD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;SAClC,CAAC;QAEF,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,0BAA0B;IAC1B,8EAA8E;IAE9E;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,OAAO,CAAC,aAA4B;QACxC,iDAAiD;QACjD,IAAI,CAAC,aAAa,CAAC,WAAW,IAAI,aAAa,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,gBAAgB,CACxB,yBAAyB,aAAa,CAAC,WAAW,GAAG,EACrD,aAAa,CAAC,QAAQ,IAAI,SAAS,CACpC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,kCAAkC;QAClC,IAAI,MAAM,CAAC,WAAW,KAAK,uBAAuB,EAAE,CAAC;YACnD,MAAM,MAAM,GAAsB;gBAChC,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,GAAG;gBACd,MAAM,EAAE,MAAM,CAAC,SAAS,IAAI,uDAAuD;aACpF,CAAC;YACF,IAAI,CAAC,UAAU,CAAC;gBACd,IAAI,EAAE,6BAA6B;gBACnC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,wBAAwB;QACxB,IAAI,MAAM,CAAC,WAAW,KAAK,aAAa,EAAE,CAAC;YACzC,MAAM,MAAM,GAAsB;gBAChC,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,eAAe;gBACxB,SAAS,EAAE,GAAG;gBACd,MAAM,EAAE,MAAM,CAAC,SAAS,IAAI,sCAAsC;aACnE,CAAC;YACF,IAAI,CAAC,UAAU,CAAC;gBACd,IAAI,EAAE,6BAA6B;gBACnC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,8BAA8B;QAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAEjE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YACvC,SAAS,EAAE,GAAG;YACd,SAAS;YACT,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,iBAAiB,EAAE,aAAa,CAAC,WAAW;YAC5C,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,WAAW,EAAE,aAAa,CAAC,WAAW;SACvC,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,sBAAsB;YAC5B,UAAU;YACV,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEnE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE/D,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC;gBACd,IAAI,EAAE,yBAAyB;gBAC/B,UAAU;gBACV,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,MAAM,EAAE,kCAAkC;gBAC1C,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,WAAW;gBACpB,UAAU;gBACV,SAAS;gBACT,MAAM,EAAE,6DAA6D;aACtE,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,IAAI,CAAC,UAAU,CAAC;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,UAAU;gBACV,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,UAAU;gBACnB,UAAU;gBACV,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS;aACV,CAAC;QACJ,CAAC;QAED,WAAW;QACX,IAAI,CAAC,UAAU,CAAC;YACd,IAAI,EAAE,wBAAwB;YAC9B,UAAU;YACV,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,UAAU;YACnB,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS;SACV,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,iEAAiE;IACjE,8EAA8E;IAE9E;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,UAAkB,EAAE,UAAkB,EAAE,MAAe;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,6CAA6C;QAC7C,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAA0B,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,UAAU,CAAC;gBACd,IAAI,EAAE,qCAAqC;gBAC3C,UAAU;gBACV,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU;gBACV,MAAM,EAAE,aAAa,UAAU,oDAAoD,MAAM,CAAC,WAAW,IAAI;gBACzG,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YACH,mEAAmE;YACnE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CACpB,UAAU,EACV,UAAU,EACV,uBAAuB,UAAU,EAAE,EACnC,aAAa,UAAU,kCAAkC,MAAM,CAAC,WAAW,IAAI,CAChF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe,CAAC,UAAkB,EAAE,UAAkB,EAAE,MAAe;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,8EAA8E;IAC9E,YAAY;IACZ,8EAA8E;IAE9E;;;;OAIG;IACH,mBAAmB,CAAC,MAA0D;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAsD,CAAC,CAAC;IAC3F,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,UAAkB;QAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;;OAKG;IACK,eAAe,CACrB,UAAkB,EAClB,SAAiB;QAEjB,OAAO,IAAI,OAAO,CAAwC,CAAC,OAAO,EAAE,EAAE;YACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACxB,OAAO,CAAC,UAAU,CAAC,CAAC;oBACpB,OAAO;gBACT,CAAC;gBAED,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBAClC,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACxB,OAAO,CAAC,WAAW,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBAED,iDAAiD;gBACjD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;oBAC3B,aAAa,CAAC,QAAQ,CAAC,CAAC;oBACxB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;oBACnC,OAAO,CAAC,WAAW,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,oBAAoB,CAAC,WAAwB,EAAE,UAAkB;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,KAAiB;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sDAAuD,GAAa,CAAC,OAAO,IAAI,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC"}

package/dist/esm/governance/approval-notifications.js

@@ -0,0 +1,139 @@
+/**
+ * Approval Notification Channels (W1.10 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Thomas directive 2026-05-12: "make sure in the UX/UI for the human in the
+ * loop section we have the ability to email and/or send a text message to
+ * the user for approval."
+ *
+ * Extends the existing approval-required pipeline (ApprovalRoute / ApprovalTicket
+ * already shipped in packages/governance-server/src/approval-routing.ts) with
+ * out-of-band notification fan-out: dashboard inbox (existing), email (new),
+ * SMS (new). Per-reviewer channel preferences. Audit chain captures the
+ * channel used.
+ *
+ * Transport adapters are pluggable so we can swap Resend ↔ SES ↔ SendGrid for
+ * email and Twilio ↔ Vonage ↔ AWS-SNS for SMS without touching the dispatcher.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-APPROVAL-CHANNEL-EMAIL-SMS
+ */
+const NOOP_EMAIL = {
+    async send() {
+        return { ok: false, error: 'no email sender configured' };
+    },
+};
+const NOOP_SMS = {
+    async send() {
+        return { ok: false, error: 'no SMS sender configured' };
+    },
+};
+function renderEmailHtml(ctx, recipient) {
+    return (`<p>Hi ${escapeHtml(recipient.name)},</p>` +
+        `<p>An action by agent <strong>${escapeHtml(ctx.agentId)}</strong> in org <strong>${escapeHtml(ctx.orgId)}</strong> requires your approval.</p>` +
+        `<p><strong>Tool:</strong> ${escapeHtml(ctx.toolName)}<br>` +
+        `<strong>Risk:</strong> ${ctx.riskLevel.toUpperCase()}<br>` +
+        `<strong>Summary:</strong> ${escapeHtml(ctx.summary)}<br>` +
+        `<strong>SLA deadline:</strong> ${ctx.slaDeadline}</p>` +
+        `<p><a href="${escapeAttr(ctx.approveUrl)}">Approve</a> · <a href="${escapeAttr(ctx.denyUrl)}">Deny</a></p>` +
+        `<p>Ticket: <code>${escapeHtml(ctx.ticketId)}</code></p>`);
+}
+function renderEmailText(ctx, recipient) {
+    return (`Hi ${recipient.name},\n\n` +
+        `Agent ${ctx.agentId} (org ${ctx.orgId}) is requesting approval for tool ${ctx.toolName}.\n` +
+        `Risk: ${ctx.riskLevel.toUpperCase()}\n` +
+        `Summary: ${ctx.summary}\n` +
+        `SLA deadline: ${ctx.slaDeadline}\n\n` +
+        `Approve: ${ctx.approveUrl}\nDeny: ${ctx.denyUrl}\n\n` +
+        `Ticket: ${ctx.ticketId}`);
+}
+function renderSmsBody(ctx) {
+    // SMS bodies stay short. Caller can override by writing a custom dispatcher.
+    return (`[my-cc] Approval needed: agent ${ctx.agentId} -> ${ctx.toolName} (${ctx.riskLevel.toUpperCase()}). ` +
+        `Approve: ${ctx.approveUrl}`);
+}
+function escapeHtml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+function escapeAttr(s) {
+    return s.replace(/"/g, '&quot;').replace(/</g, '&lt;');
+}
+/**
+ * Dispatcher that fans out approval notifications across the requested
+ * channels. Returns one NotificationOutcome per (recipient, channel) pair.
+ */
+export class ApprovalChannelDispatcher {
+    emailSender;
+    smsSender;
+    dashboardSink;
+    constructor(options = {}) {
+        this.emailSender = options.emailSender ?? NOOP_EMAIL;
+        this.smsSender = options.smsSender ?? NOOP_SMS;
+        this.dashboardSink = options.dashboardSink;
+    }
+    async dispatch(ctx, recipients) {
+        const outcomes = [];
+        for (const r of recipients) {
+            const channels = r.channels && r.channels.length > 0 ? [...r.channels] : ['dashboard'];
+            for (const ch of channels) {
+                outcomes.push(await this.deliver(ctx, r, ch));
+            }
+        }
+        return outcomes;
+    }
+    async deliver(ctx, recipient, channel) {
+        if (channel === 'dashboard') {
+            this.dashboardSink?.(ctx, recipient);
+            return { recipientId: recipient.reviewerId, channel, delivered: true };
+        }
+        if (channel === 'email') {
+            if (!recipient.email) {
+                return {
+                    recipientId: recipient.reviewerId,
+                    channel,
+                    delivered: false,
+                    error: 'recipient has no email address configured',
+                };
+            }
+            const res = await this.emailSender.send({
+                to: recipient.email,
+                subject: `[my-cc] Approval needed: ${ctx.toolName} (${ctx.riskLevel.toUpperCase()})`,
+                html: renderEmailHtml(ctx, recipient),
+                text: renderEmailText(ctx, recipient),
+            });
+            return {
+                recipientId: recipient.reviewerId,
+                channel,
+                delivered: res.ok,
+                providerMessageId: res.messageId,
+                error: res.error,
+            };
+        }
+        if (channel === 'sms') {
+            if (!recipient.phoneE164) {
+                return {
+                    recipientId: recipient.reviewerId,
+                    channel,
+                    delivered: false,
+                    error: 'recipient has no phone number configured',
+                };
+            }
+            const res = await this.smsSender.send({
+                to: recipient.phoneE164,
+                body: renderSmsBody(ctx),
+            });
+            return {
+                recipientId: recipient.reviewerId,
+                channel,
+                delivered: res.ok,
+                providerMessageId: res.messageId,
+                error: res.error,
+            };
+        }
+        return {
+            recipientId: recipient.reviewerId,
+            channel,
+            delivered: false,
+            error: `unknown channel: ${channel}`,
+        };
+    }
+}
+//# sourceMappingURL=approval-notifications.js.map

package/dist/esm/governance/approval-notifications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-notifications.js","sourceRoot":"","sources":["../../../src/governance/approval-notifications.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAoEH,MAAM,UAAU,GAAgB;IAC9B,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC5D,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAc;IAC1B,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC1D,CAAC;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,GAAgC,EAAE,SAAwC;IACjG,OAAO,CACL,SAAS,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO;QAC1C,iCAAiC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,4BAA4B,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,uCAAuC;QAChJ,6BAA6B,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM;QAC3D,0BAA0B,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM;QAC3D,6BAA6B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM;QAC1D,kCAAkC,GAAG,CAAC,WAAW,MAAM;QACvD,eAAe,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,4BAA4B,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB;QAC5G,oBAAoB,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAgC,EAAE,SAAwC;IACjG,OAAO,CACL,MAAM,SAAS,CAAC,IAAI,OAAO;QAC3B,SAAS,GAAG,CAAC,OAAO,SAAS,GAAG,CAAC,KAAK,qCAAqC,GAAG,CAAC,QAAQ,KAAK;QAC5F,SAAS,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI;QACxC,YAAY,GAAG,CAAC,OAAO,IAAI;QAC3B,iBAAiB,GAAG,CAAC,WAAW,MAAM;QACtC,YAAY,GAAG,CAAC,UAAU,WAAW,GAAG,CAAC,OAAO,MAAM;QACtD,WAAW,GAAG,CAAC,QAAQ,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAgC;IACrD,6EAA6E;IAC7E,OAAO,CACL,kCAAkC,GAAG,CAAC,OAAO,OAAO,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK;QACrG,YAAY,GAAG,CAAC,UAAU,EAAE,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,CAAc;IACzB,SAAS,CAAY;IACrB,aAAa,CAAsC;IAEpE,YAAY,UAA6B,EAAE;QACzC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,GAAgC,EAChC,UAAwD;QAExD,MAAM,QAAQ,GAA0B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,QAAQ,GACZ,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACxE,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,GAAgC,EAChC,SAAwC,EACxC,OAAwB;QAExB,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACrC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACzE,CAAC;QAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;oBACL,WAAW,EAAE,SAAS,CAAC,UAAU;oBACjC,OAAO;oBACP,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,2CAA2C;iBACnD,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;gBACtC,EAAE,EAAE,SAAS,CAAC,KAAK;gBACnB,OAAO,EAAE,4BAA4B,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG;gBACpF,IAAI,EAAE,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC;gBACrC,IAAI,EAAE,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC;aACtC,CAAC,CAAC;YACH,OAAO;gBACL,WAAW,EAAE,SAAS,CAAC,UAAU;gBACjC,OAAO;gBACP,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,iBAAiB,EAAE,GAAG,CAAC,SAAS;gBAChC,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;gBACzB,OAAO;oBACL,WAAW,EAAE,SAAS,CAAC,UAAU;oBACjC,OAAO;oBACP,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,0CAA0C;iBAClD,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBACpC,EAAE,EAAE,SAAS,CAAC,SAAS;gBACvB,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC;aACzB,CAAC,CAAC;YACH,OAAO;gBACL,WAAW,EAAE,SAAS,CAAC,UAAU;gBACjC,OAAO;gBACP,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,iBAAiB,EAAE,GAAG,CAAC,SAAS;gBAChC,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,UAAU;YACjC,OAAO;YACP,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,oBAAoB,OAAiB,EAAE;SAC/C,CAAC;IACJ,CAAC;CACF"}