@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/governance/pack-evaluator.js

@@ -0,0 +1,324 @@
+/**
+ * PackEvaluator -- synchronous pack-aware enforcement for the execute() hot path.
+ *
+ * Resolves active packs for a tenant, runs a flattened classifier index against
+ * the action context, and returns a verdict (ALLOW / DENY / PENDING).
+ *
+ * Architecture decisions locked in KANBAN.md GAP-S3-01:
+ *  - Per-tenant cache, 5-minute TTL, explicit flush on pack change events.
+ *  - Synchronous evaluate() -- no await in the hot path.
+ *  - Strictest-wins across packs: DENY > PENDING > ALLOW.
+ *  - BLOCK action from dataPolicy.categoryActions -> DENY verdict.
+ *  - WARN action -> PENDING verdict (human review required by default).
+ *  - No classifier hit -> ALLOW.
+ *
+ * @connexum/ai-governance  GAP-S3-01
+ */
+// ---------------------------------------------------------------------------
+// Verdict precedence
+// ---------------------------------------------------------------------------
+const VERDICT_RANK = {
+    ALLOW: 0,
+    PENDING: 1,
+    DENY: 2,
+};
+function stricterVerdict(a, b) {
+    return VERDICT_RANK[a] >= VERDICT_RANK[b] ? a : b;
+}
+// ---------------------------------------------------------------------------
+// PackEvaluator
+// ---------------------------------------------------------------------------
+export class PackEvaluator {
+    config;
+    packRegistry;
+    cache = new Map();
+    constructor(packRegistry, eventBus, config) {
+        this.packRegistry = packRegistry;
+        this.config = {
+            ttlMs: config?.ttlMs ?? 5 * 60 * 1000,
+            enableCache: config?.enableCache ?? true,
+        };
+        // Subscribe to pack lifecycle events to invalidate cache.
+        // The orgId on the event payload is used as the tenant key.
+        for (const evType of ['pack:amended', 'pack:activated', 'pack:deactivated']) {
+            eventBus.on(evType, (event) => {
+                const tenantId = event.orgId ?? event.data.tenantId;
+                if (tenantId) {
+                    this.flushTenant(tenantId);
+                }
+                else {
+                    // No tenant context -- flush all to be safe.
+                    this.flushAll();
+                }
+            });
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Public API
+    // ---------------------------------------------------------------------------
+    /**
+     * Evaluate whether the action context is permitted under active pack policies.
+     *
+     * Synchronous by design: must not await anything.
+     * Cache hit: uses cached pack set.
+     * Cache miss: resolves from registry, populates cache, evaluates.
+     */
+    evaluate(tenantId, agentId, actionContext) {
+        const ts = Date.now();
+        const index = this.getClassifierIndex(tenantId, ts);
+        // Build a serialized representation of the action for classifier matching.
+        // We match against toolName + serialized input args.
+        const inputText = this.serializeActionForMatching(actionContext);
+        let currentVerdict = 'ALLOW';
+        const triggeringPackIds = [];
+        const triggeringClassifierIds = [];
+        const reasons = [];
+        for (const [categoryId, entry] of index) {
+            if (!this.categoryMatches(categoryId, inputText, actionContext, entry.classifierDef))
+                continue;
+            const packVerdict = this.actionToVerdict(entry.action);
+            if (packVerdict === 'ALLOW')
+                continue; // no restriction from this category
+            currentVerdict = stricterVerdict(currentVerdict, packVerdict);
+            triggeringClassifierIds.push(categoryId);
+            for (const pid of entry.packIds) {
+                if (!triggeringPackIds.includes(pid))
+                    triggeringPackIds.push(pid);
+            }
+            reasons.push(`Category '${categoryId}' (action=${entry.action}, packs=[${entry.packIds.join(',')}])`);
+        }
+        const reason = currentVerdict === 'ALLOW'
+            ? 'No pack policy restrictions matched this action.'
+            : `Pack policy enforced: ${reasons.join('; ')}`;
+        return {
+            verdict: currentVerdict,
+            triggeringPackIds,
+            triggeringClassifierIds,
+            reason,
+            timestamp: ts,
+        };
+    }
+    /**
+     * Flush the cache entry for a single tenant (break-glass, pack change).
+     */
+    flushTenant(tenantId) {
+        this.cache.delete(tenantId);
+    }
+    /**
+     * Flush all tenant cache entries.
+     */
+    flushAll() {
+        this.cache.clear();
+    }
+    // ---------------------------------------------------------------------------
+    // Internal helpers
+    // ---------------------------------------------------------------------------
+    /**
+     * Return the flattened classifier index for a tenant, resolving from the
+     * registry on cache miss or TTL expiry.
+     */
+    getClassifierIndex(tenantId, now) {
+        if (this.config.enableCache) {
+            const entry = this.cache.get(tenantId);
+            if (entry && entry.expiresAt > now) {
+                // F-NEW-PACK-HOT-RELOAD-1: version-check the per-tenant cache entry.
+                // If the PackRegistry has mutated the tenant's pack selection since the
+                // cache was built (activateForTenant / deactivateForTenant increments
+                // the tenant version), rebuild immediately rather than waiting for TTL.
+                const currentVersion = this.packRegistry.getTenantVersion(tenantId);
+                if (entry.tenantVersion === currentVersion) {
+                    return entry.classifierIndex;
+                }
+                // Version mismatch: fall through to rebuild.
+            }
+        }
+        // Cache miss, TTL expired, or version mismatch: resolve and build.
+        // F-NEW-PACK-HOT-RELOAD-1: use getActiveForTenant() so per-tenant pack
+        // selections (written by the activate/deactivate endpoints) are enforced
+        // per-tenant. Falls back to getActive() (global env defaults) for tenants
+        // that have never explicitly managed their packs.
+        const activePacks = this.packRegistry.getActiveForTenant(tenantId);
+        const classifierIndex = this.buildClassifierIndex(activePacks);
+        if (this.config.enableCache) {
+            this.cache.set(tenantId, {
+                activePacks,
+                classifierIndex,
+                expiresAt: now + this.config.ttlMs,
+                tenantVersion: this.packRegistry.getTenantVersion(tenantId),
+            });
+        }
+        return classifierIndex;
+    }
+    /**
+     * Build a flattened classifier index from a pack list.
+     * For categories present in multiple packs, the strictest action wins.
+     *
+     * The classifierDef is taken from the strictest-action pack (or the first
+     * pack declaring the category when actions tie). It is used in
+     * categoryMatches() to run the real regex/function classifier instead of
+     * falling back to keyword substring matching.
+     *
+     * Returns: Map<categoryId, { action: string; packIds: string[]; classifierDef?: CategoryClassifierDef }>
+     */
+    buildClassifierIndex(packs) {
+        const index = new Map();
+        // Action severity order (for strictest-wins merge)
+        const actionRank = {
+            ALLOW: 0,
+            LOG: 1,
+            WARN: 2,
+            REQUIRE_APPROVAL: 3,
+            BLOCK: 4,
+        };
+        for (const pack of packs) {
+            const categoryActions = pack.dataPolicy?.categoryActions ?? {};
+            // Cast to the extended pack type to access optional categoryClassifiers
+            const packWithClassifiers = pack;
+            for (const [categoryId, action] of Object.entries(categoryActions)) {
+                // Precompile the classifierDef regex at index-build time (not per evaluate() call)
+                // to satisfy the GAP-S3-01 p99 <= 50ms latency budget.
+                const classifierDef = packWithClassifiers.categoryClassifiers?.[categoryId];
+                const existing = index.get(categoryId);
+                if (!existing) {
+                    index.set(categoryId, { action, packIds: [pack.id], classifierDef });
+                }
+                else {
+                    const existingRank = actionRank[existing.action] ?? 0;
+                    const newRank = actionRank[action] ?? 0;
+                    if (newRank > existingRank) {
+                        // Stricter action takes over; adopt this pack's classifierDef too
+                        index.set(categoryId, { action, packIds: [pack.id], classifierDef });
+                    }
+                    else if (newRank === existingRank && !existing.packIds.includes(pack.id)) {
+                        // Same action from additional pack -- append pack to attribution list.
+                        // Prefer an existing real classifierDef over an undefined one.
+                        existing.packIds.push(pack.id);
+                        if (!existing.classifierDef && classifierDef) {
+                            existing.classifierDef = classifierDef;
+                        }
+                    }
+                    // If less strict, the existing entry wins -- no update.
+                }
+            }
+        }
+        return index;
+    }
+    /**
+     * Map a dataPolicy categoryAction string to a verdict.
+     * BLOCK -> DENY, WARN -> PENDING (human review), everything else -> ALLOW
+     * (LOG and REQUIRE_APPROVAL are also mapped: REQUIRE_APPROVAL -> PENDING).
+     */
+    actionToVerdict(action) {
+        switch (action) {
+            case 'BLOCK':
+                return 'DENY';
+            case 'WARN':
+            case 'REQUIRE_APPROVAL':
+                return 'PENDING';
+            case 'LOG':
+            case 'ALLOW':
+            default:
+                return 'ALLOW';
+        }
+    }
+    /**
+     * Determine whether a category fires for the given action context.
+     *
+     * Evaluation order (Task 2 fix, 2026-04-25):
+     *   1. If the pack declares a CategoryClassifierDef with a `classifier` function,
+     *      call it -- this is the authoritative runtime decision.
+     *   2. If the pack declares a `pattern` regex, test it against the serialized input.
+     *      Regex is precompiled at buildClassifierIndex time (not here) so no per-call
+     *      compilation overhead. Satisfies GAP-S3-01 p99 <= 50ms latency budget.
+     *   3. If neither classifier nor pattern is defined (pack declared the category
+     *      but hasn't instrumented it), fall through to the legacy broad substring
+     *      matching with a debug log so the gap is discoverable.
+     *
+     * Previously this method ran only keyword substring matching, meaning packs'
+     * carefully crafted regex classifiers were NEVER called in the enforcement
+     * hot path. This fix ensures SSNs, credit card numbers, and other regulated
+     * data are caught by the actual pattern the pack author specified.
+     *
+     * False positives produce PENDING (human review) -- safe.
+     * False negatives produce ALLOW -- unsafe. Err toward PENDING.
+     */
+    categoryMatches(categoryId, serializedInput, actionContext, classifierDef) {
+        // --- Path 1: real classifier function (highest fidelity) ---
+        if (classifierDef?.classifier) {
+            try {
+                return classifierDef.classifier(serializedInput, {
+                    agentId: actionContext.agent?.name,
+                    orgId: actionContext.orgId ?? actionContext.agent?.orgId,
+                });
+            }
+            catch {
+                // Classifier threw -- fall through to regex/substring as safety net.
+                // A broken classifier should not silently pass (ALLOW) -- drop to broad match.
+            }
+        }
+        // --- Path 2: compiled regex pattern ---
+        if (classifierDef?.pattern) {
+            try {
+                classifierDef.pattern.lastIndex = 0; // reset global flag state
+                return classifierDef.pattern.test(serializedInput);
+            }
+            catch {
+                // Regex threw (e.g. catastrophic backtrack guard) -- fall through.
+            }
+        }
+        // --- Path 3: legacy broad keyword matching (fallback for uninstrumented categories) ---
+        // This path fires when categoryClassifiers[categoryId] is absent or empty.
+        // It is intentionally broad: false positives are safe (PENDING), false negatives
+        // (missed matches, ALLOW) are unsafe.
+        // A structured debug log is emitted so ops teams can identify un-instrumented
+        // categories and add proper classifiers.
+        if (!classifierDef || (!classifierDef.classifier && !classifierDef.pattern)) {
+            // Only log once per category per session to avoid hot-path noise.
+            // Use a simple in-memory set (acceptable: resets on process restart).
+            if (!PackEvaluator._warnedUninstrumentedCategories.has(categoryId)) {
+                PackEvaluator._warnedUninstrumentedCategories.add(categoryId);
+                // Use stderr directly to avoid any I/O dependency in this synchronous path
+                process.stderr.write(`[pack-evaluator][WARN] Category '${categoryId}' has no classifierDef ` +
+                    `(no pattern or classifier function). Falling back to broad substring matching. ` +
+                    `Add categoryClassifiers['${categoryId}'] to the pack to use real enforcement.\n`);
+            }
+        }
+        const catLower = categoryId.toLowerCase();
+        const inputLower = serializedInput.toLowerCase();
+        const toolLower = actionContext.toolName.toLowerCase();
+        // 1. Tool name contains the category keyword
+        if (toolLower.includes(catLower))
+            return true;
+        // 2. Serialized input contains the category keyword
+        if (inputLower.includes(catLower))
+            return true;
+        // 3. Category keyword appears in common sensitive signal words
+        const SENSITIVE_KEYWORDS = [
+            'phi', 'pii', 'ssn', 'dob', 'pan', 'cvv', 'iban', 'swift',
+            'biometric', 'health', 'medical', 'patient', 'credit', 'password',
+            'secret', 'token', 'key', 'private', 'confidential',
+        ];
+        if (SENSITIVE_KEYWORDS.some(kw => catLower.includes(kw) && inputLower.includes(kw))) {
+            return true;
+        }
+        return false;
+    }
+    /** Set of category IDs already warned about missing classifierDef (de-dupe per process). */
+    static _warnedUninstrumentedCategories = new Set();
+    /**
+     * Produce a single string from an ActionContext suitable for classifier matching.
+     */
+    serializeActionForMatching(actionContext) {
+        try {
+            return JSON.stringify({
+                tool: actionContext.toolName,
+                input: actionContext.input,
+                agent: actionContext.agent?.name,
+            });
+        }
+        catch {
+            return actionContext.toolName;
+        }
+    }
+}
+//# sourceMappingURL=pack-evaluator.js.map

package/dist/esm/governance/pack-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-evaluator.js","sourceRoot":"","sources":["../../../src/governance/pack-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAqDH,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,YAAY,GAAiD;IACjE,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,SAAS,eAAe,CACtB,CAA+B,EAC/B,CAA+B;IAE/B,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,OAAO,aAAa;IACP,MAAM,CAAsB;IAC5B,YAAY,CAAe;IAC3B,KAAK,GAA4B,IAAI,GAAG,EAAE,CAAC;IAE5D,YACE,YAA0B,EAC1B,QAAkB,EAClB,MAAqC;QAErC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;YACrC,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,IAAI;SACzC,CAAC;QAEF,0DAA0D;QAC1D,4DAA4D;QAC5D,KAAK,MAAM,MAAM,IAAI,CAAC,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,CAAU,EAAE,CAAC;YACrF,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,IAAK,KAAK,CAAC,IAAI,CAAC,QAA+B,CAAC;gBAC5E,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,6CAA6C;oBAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,aAAa;IACb,8EAA8E;IAE9E;;;;;;OAMG;IACH,QAAQ,CACN,QAAgB,EAChB,OAAe,EACf,aAA4B;QAE5B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEpD,2EAA2E;QAC3E,qDAAqD;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAEjE,IAAI,cAAc,GAAiC,OAAO,CAAC;QAC3D,MAAM,iBAAiB,GAAa,EAAE,CAAC;QACvC,MAAM,uBAAuB,GAAa,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC;gBAAE,SAAS;YAE/F,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,WAAW,KAAK,OAAO;gBAAE,SAAS,CAAC,oCAAoC;YAE3E,cAAc,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC9D,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,CAAC,IAAI,CACV,aAAa,UAAU,aAAa,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,cAAc,KAAK,OAAO;YACxB,CAAC,CAAC,kDAAkD;YACpD,CAAC,CAAC,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAEpD,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,iBAAiB;YACjB,uBAAuB;YACvB,MAAM;YACN,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E;;;OAGG;IACK,kBAAkB,CACxB,QAAgB,EAChB,GAAW;QAEX,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACnC,qEAAqE;gBACrE,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACpE,IAAI,KAAK,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;oBAC3C,OAAO,KAAK,CAAC,eAAe,CAAC;gBAC/B,CAAC;gBACD,6CAA6C;YAC/C,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAE/D,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACvB,WAAW;gBACX,eAAe;gBACf,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;gBAClC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;;;;;;;;OAUG;IACK,oBAAoB,CAC1B,KAAuB;QAEvB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwF,CAAC;QAE9G,mDAAmD;QACnD,MAAM,UAAU,GAA2B;YACzC,KAAK,EAAE,CAAC;YACR,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;YACP,gBAAgB,EAAE,CAAC;YACnB,KAAK,EAAE,CAAC;SACT,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,CAAC;YAC/D,wEAAwE;YACxE,MAAM,mBAAmB,GAAG,IAAqC,CAAC;YAElE,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnE,mFAAmF;gBACnF,uDAAuD;gBACvD,MAAM,aAAa,GAAG,mBAAmB,CAAC,mBAAmB,EAAE,CAAC,UAAU,CAAC,CAAC;gBAE5E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACtD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACxC,IAAI,OAAO,GAAG,YAAY,EAAE,CAAC;wBAC3B,kEAAkE;wBAClE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;oBACvE,CAAC;yBAAM,IAAI,OAAO,KAAK,YAAY,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;wBAC3E,uEAAuE;wBACvE,+DAA+D;wBAC/D,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBAC/B,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,aAAa,EAAE,CAAC;4BAC7C,QAAQ,CAAC,aAAa,GAAG,aAAa,CAAC;wBACzC,CAAC;oBACH,CAAC;oBACD,wDAAwD;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,MAAc;QACpC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC;YAChB,KAAK,MAAM,CAAC;YACZ,KAAK,kBAAkB;gBACrB,OAAO,SAAS,CAAC;YACnB,KAAK,KAAK,CAAC;YACX,KAAK,OAAO,CAAC;YACb;gBACE,OAAO,OAAO,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,eAAe,CACrB,UAAkB,EAClB,eAAuB,EACvB,aAA4B,EAC5B,aAAqC;QAErC,8DAA8D;QAC9D,IAAI,aAAa,EAAE,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,OAAO,aAAa,CAAC,UAAU,CAAC,eAAe,EAAE;oBAC/C,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI;oBAClC,KAAK,EAAE,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK,EAAE,KAAK;iBACzD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,+EAA+E;YACjF,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,aAAa,EAAE,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,aAAa,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,0BAA0B;gBAC/D,OAAO,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;QACH,CAAC;QAED,yFAAyF;QACzF,2EAA2E;QAC3E,iFAAiF;QACjF,sCAAsC;QACtC,8EAA8E;QAC9E,yCAAyC;QACzC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5E,kEAAkE;YAClE,sEAAsE;YACtE,IAAI,CAAC,aAAa,CAAC,+BAA+B,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnE,aAAa,CAAC,+BAA+B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC9D,2EAA2E;gBAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,UAAU,yBAAyB;oBACvE,iFAAiF;oBACjF,4BAA4B,UAAU,2CAA2C,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAEvD,6CAA6C;QAC7C,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9C,oDAAoD;QACpD,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,+DAA+D;QAC/D,MAAM,kBAAkB,GAAG;YACzB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;YACzD,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;YACjE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc;SACpD,CAAC;QACF,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4FAA4F;IACpF,MAAM,CAAC,+BAA+B,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnE;;OAEG;IACK,0BAA0B,CAAC,aAA4B;QAC7D,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC;gBACpB,IAAI,EAAE,aAAa,CAAC,QAAQ;gBAC5B,KAAK,EAAE,aAAa,CAAC,KAAK;gBAC1B,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC,QAAQ,CAAC;QAChC,CAAC;IACH,CAAC"}

package/dist/esm/governance/pack-evaluator.test.js

@@ -0,0 +1,244 @@
+/**
+ * Tests for PackEvaluator (GAP-S3-01)
+ *
+ * @connexum/ai-governance
+ */
+import { describe, it } from 'node:test';
+import * as assert from 'node:assert/strict';
+import * as os from 'os';
+import * as path from 'path';
+import * as fs from 'fs';
+import { PackEvaluator } from './pack-evaluator.js';
+import { PackRegistry } from '../packs/index.js';
+import { EventBus } from '../audit/event-bus.js';
+import { createActionContext } from '../adapters/index.js';
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function makeTmpEventDir() {
+    return fs.mkdtempSync(path.join(os.tmpdir(), 'pe-test-'));
+}
+function makeEventBus(dir) {
+    return new EventBus({ eventDir: dir, agentName: 'test-evaluator' });
+}
+function makePackRegistry(packs) {
+    const registry = new PackRegistry();
+    for (const p of packs) {
+        registry.register(p);
+        registry.activate(p.id);
+    }
+    return registry;
+}
+function makeActionContext(toolName, input = {}) {
+    return createActionContext(toolName, input, { name: 'test-agent', orgId: 'tenant-x' });
+}
+function makePack(id, categoryActions, overrides = {}) {
+    return {
+        id,
+        name: `Pack ${id}`,
+        version: '1.0.0',
+        description: `Test pack ${id}`,
+        authority: 'Test',
+        industries: ['test'],
+        requiredModules: [],
+        moduleConfig: {},
+        providerPolicy: { blockedProviders: [], requiredCapabilities: [], blockReasons: {} },
+        dataPolicy: {
+            scanCategories: Object.keys(categoryActions),
+            categoryActions,
+            encryptionRequired: false,
+        },
+        retentionPolicy: {
+            auditLogRetentionDays: 90,
+            sessionRetentionDays: 30,
+            incidentRetentionDays: 365,
+            reference: 'Test',
+        },
+        incidentPolicy: {
+            notificationDeadlineHours: 72,
+            reference: 'Test',
+            requiredRecipients: [],
+            formalNotificationRequired: false,
+        },
+        validators: [],
+        ...overrides,
+    };
+}
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+describe('PackEvaluator', () => {
+    // (a) Cold-cache evaluate -> resolves from registry, caches, returns verdict
+    it('(a) cold-cache: resolves from registry and caches result', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        const pack = makePack('test-hipaa', { PHI: 'BLOCK' });
+        const registry = makePackRegistry([pack]);
+        const evaluator = new PackEvaluator(registry, bus);
+        // Deactivate the pack after caching -- a warm cache won't see this.
+        const verdict1 = evaluator.evaluate('tenant-1', 'agent-1', makeActionContext('Write', { content: 'phi data' }));
+        // Should produce DENY because PHI is in input text and action is BLOCK
+        assert.equal(verdict1.verdict, 'DENY');
+        assert.ok(verdict1.triggeringPackIds.includes('test-hipaa'));
+        assert.ok(verdict1.triggeringClassifierIds.includes('PHI'));
+    });
+    // (b) Warm-cache: uses cache, skips registry
+    it('(b) warm-cache: second call uses cached pack set', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        const pack = makePack('test-soc2', { PII: 'BLOCK' });
+        const registry = makePackRegistry([pack]);
+        const evaluator = new PackEvaluator(registry, bus, { ttlMs: 60_000, enableCache: true });
+        // First call -- cold cache
+        const v1 = evaluator.evaluate('tenant-warm', 'agent-1', makeActionContext('Write', { content: 'pii data' }));
+        assert.equal(v1.verdict, 'DENY');
+        // Manually deactivate the pack in the registry.
+        // A warm cache should still return DENY because it uses the cached pack set.
+        registry.deactivate('test-soc2');
+        const v2 = evaluator.evaluate('tenant-warm', 'agent-1', makeActionContext('Write', { content: 'pii data' }));
+        assert.equal(v2.verdict, 'DENY', 'warm cache should still produce DENY from cached pack set');
+    });
+    // (c) pack:amended event -> invalidates cache for affected tenant only
+    it('(c) pack:amended invalidates cache for affected tenant only', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        const pack = makePack('test-amended', { CREDIT: 'BLOCK' });
+        const registry = makePackRegistry([pack]);
+        const evaluator = new PackEvaluator(registry, bus, { ttlMs: 60_000 });
+        // Warm up both tenants
+        const ctx = makeActionContext('Write', { content: 'credit card data' });
+        const vt1Before = evaluator.evaluate('tenant-alpha', 'agent-1', ctx);
+        const vt2Before = evaluator.evaluate('tenant-beta', 'agent-1', ctx);
+        assert.equal(vt1Before.verdict, 'DENY');
+        assert.equal(vt2Before.verdict, 'DENY');
+        // Deactivate pack in registry (simulates pack amendment)
+        registry.deactivate('test-amended');
+        // Emit pack:amended for tenant-alpha -- should flush only tenant-alpha
+        bus.emit('pack:amended', { tenantId: 'tenant-alpha' });
+        // orgId field path: eventBus.emit sets event.orgId from options...
+        // Our bus.on handler checks event.orgId ?? event.data.tenantId
+        // The emit signature is: emit(type, data, target?) -- orgId is not directly set.
+        // We set tenantId in data above.
+        // tenant-alpha: cache flushed, resolves fresh (no active packs now -> ALLOW)
+        const vt1After = evaluator.evaluate('tenant-alpha', 'agent-1', ctx);
+        assert.equal(vt1After.verdict, 'ALLOW', 'tenant-alpha cache should be flushed');
+        // tenant-beta: cache untouched, still DENY
+        const vt2After = evaluator.evaluate('tenant-beta', 'agent-1', ctx);
+        assert.equal(vt2After.verdict, 'DENY', 'tenant-beta cache should be untouched');
+    });
+    // (d) flushTenant() -> invalidates one tenant
+    it('(d) flushTenant() invalidates exactly one tenant', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        const pack = makePack('test-flush', { SSN: 'BLOCK' });
+        const registry = makePackRegistry([pack]);
+        const evaluator = new PackEvaluator(registry, bus, { ttlMs: 60_000 });
+        const ctx = makeActionContext('Write', { content: 'ssn 123-45-6789' });
+        evaluator.evaluate('t1', 'a1', ctx); // warm t1
+        evaluator.evaluate('t2', 'a1', ctx); // warm t2
+        // Remove the pack from registry before flushing
+        registry.deactivate('test-flush');
+        evaluator.flushTenant('t1');
+        const v1 = evaluator.evaluate('t1', 'a1', ctx);
+        const v2 = evaluator.evaluate('t2', 'a1', ctx);
+        assert.equal(v1.verdict, 'ALLOW', 't1 flushed -> resolves fresh with no packs');
+        assert.equal(v2.verdict, 'DENY', 't2 still cached');
+    });
+    // (e) flushAll() -> invalidates everything
+    it('(e) flushAll() invalidates all tenants', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        const pack = makePack('test-flush-all', { PAN: 'BLOCK' });
+        const registry = makePackRegistry([pack]);
+        const evaluator = new PackEvaluator(registry, bus, { ttlMs: 60_000 });
+        const ctx = makeActionContext('Write', { content: 'pan 4111111111111111' });
+        evaluator.evaluate('ta', 'a1', ctx);
+        evaluator.evaluate('tb', 'a1', ctx);
+        registry.deactivate('test-flush-all');
+        evaluator.flushAll();
+        const va = evaluator.evaluate('ta', 'a1', ctx);
+        const vb = evaluator.evaluate('tb', 'a1', ctx);
+        assert.equal(va.verdict, 'ALLOW', 'ta should re-resolve with no packs');
+        assert.equal(vb.verdict, 'ALLOW', 'tb should re-resolve with no packs');
+    });
+    // (f) BLOCK action -> DENY verdict
+    it('(f) BLOCK categoryAction produces DENY verdict', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        const pack = makePack('block-pack', { BIOMETRIC: 'BLOCK' });
+        const registry = makePackRegistry([pack]);
+        const evaluator = new PackEvaluator(registry, bus);
+        const v = evaluator.evaluate('tenant-f', 'a1', makeActionContext('Write', { content: 'biometric fingerprint data' }));
+        assert.equal(v.verdict, 'DENY');
+        assert.ok(v.triggeringPackIds.includes('block-pack'));
+    });
+    // (g) WARN action -> PENDING verdict
+    it('(g) WARN categoryAction produces PENDING verdict', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        const pack = makePack('warn-pack', { HEALTH: 'WARN' });
+        const registry = makePackRegistry([pack]);
+        const evaluator = new PackEvaluator(registry, bus);
+        const v = evaluator.evaluate('tenant-g', 'a1', makeActionContext('Write', { content: 'health record data' }));
+        assert.equal(v.verdict, 'PENDING');
+        assert.ok(v.triggeringPackIds.includes('warn-pack'));
+    });
+    // (h) No classifier hit -> ALLOW verdict
+    it('(h) no classifier hit produces ALLOW verdict', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        const pack = makePack('benign-pack', { NUCLEAR_LAUNCH_CODES: 'BLOCK' });
+        const registry = makePackRegistry([pack]);
+        const evaluator = new PackEvaluator(registry, bus);
+        // A completely innocuous action with no sensitive content
+        const v = evaluator.evaluate('tenant-h', 'a1', makeActionContext('Read', { path: '/readme.txt' }));
+        assert.equal(v.verdict, 'ALLOW');
+        assert.equal(v.triggeringPackIds.length, 0);
+    });
+    // (i) Multiple packs hitting same action -> strictest-wins (DENY > PENDING > ALLOW)
+    it('(i) multiple packs: strictest verdict wins (DENY > PENDING > ALLOW)', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        // Pack A: WARN on PHI
+        // Pack B: BLOCK on PHI
+        // Strictest-wins should produce DENY.
+        const packA = makePack('pack-a', { PHI: 'WARN' });
+        const packB = makePack('pack-b', { PHI: 'BLOCK' });
+        const registry = makePackRegistry([packA, packB]);
+        const evaluator = new PackEvaluator(registry, bus);
+        const v = evaluator.evaluate('tenant-i', 'a1', makeActionContext('Write', { content: 'phi medical record' }));
+        assert.equal(v.verdict, 'DENY', 'BLOCK from pack-b should dominate WARN from pack-a');
+        assert.ok(v.triggeringPackIds.includes('pack-b'), 'pack-b should be in triggering packs');
+    });
+    // (j) Latency: 1,000 sequential evaluate() calls with 5-pack tenant config -- p99 <= 50ms
+    it('(j) latency: p99 <= 50ms over 1,000 sequential calls with 5-pack tenant config', () => {
+        const dir = makeTmpEventDir();
+        const bus = makeEventBus(dir);
+        // Build 5 packs each with 10 categories
+        const packs = [];
+        for (let i = 0; i < 5; i++) {
+            const categoryActions = {};
+            for (let j = 0; j < 10; j++) {
+                categoryActions[`CATEGORY_${i}_${j}`] = j % 2 === 0 ? 'BLOCK' : 'WARN';
+            }
+            packs.push(makePack(`perf-pack-${i}`, categoryActions));
+        }
+        const registry = makePackRegistry(packs);
+        const evaluator = new PackEvaluator(registry, bus, { ttlMs: 60_000, enableCache: true });
+        const ctx = makeActionContext('Read', { path: '/safe/path.txt' });
+        const latencies = [];
+        // Warm the cache with one call first (not counted in p99)
+        evaluator.evaluate('tenant-j', 'a1', ctx);
+        for (let i = 0; i < 1000; i++) {
+            const t0 = performance.now();
+            evaluator.evaluate('tenant-j', 'a1', ctx);
+            latencies.push(performance.now() - t0);
+        }
+        latencies.sort((a, b) => a - b);
+        const p99Index = Math.floor(latencies.length * 0.99);
+        const p99Ms = latencies[p99Index];
+        console.log(`  [perf] p50=${latencies[Math.floor(latencies.length * 0.50)].toFixed(3)}ms  p99=${p99Ms.toFixed(3)}ms`);
+        assert.ok(p99Ms <= 50, `p99 latency must be <= 50ms (GAP-S3-01 gate). Measured: ${p99Ms.toFixed(3)}ms`);
+    });
+});
+//# sourceMappingURL=pack-evaluator.test.js.map

package/dist/esm/governance/pack-evaluator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-evaluator.test.js","sourceRoot":"","sources":["../../../src/governance/pack-evaluator.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,OAAO,EAAE,aAAa,EAA4B,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAsB,MAAM,mBAAmB,CAAC;AAE5E,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,eAAe;IACtB,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,IAAI,QAAQ,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAuB;IAC/C,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,QAAiC,EAAE;IAC9E,OAAO,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CACf,EAAU,EACV,eAAuC,EACvC,YAAqC,EAAE;IAEvC,OAAO;QACL,EAAE;QACF,IAAI,EAAE,QAAQ,EAAE,EAAE;QAClB,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,aAAa,EAAE,EAAE;QAC9B,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;QACpF,UAAU,EAAE;YACV,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;YAC5C,eAAe;YACf,kBAAkB,EAAE,KAAK;SAC1B;QACD,eAAe,EAAE;YACf,qBAAqB,EAAE,EAAE;YACzB,oBAAoB,EAAE,EAAE;YACxB,qBAAqB,EAAE,GAAG;YAC1B,SAAS,EAAE,MAAM;SAClB;QACD,cAAc,EAAE;YACd,yBAAyB,EAAE,EAAE;YAC7B,SAAS,EAAE,MAAM;YACjB,kBAAkB,EAAE,EAAE;YACtB,0BAA0B,EAAE,KAAK;SAClC;QACD,UAAU,EAAE,EAAE;QACd,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAE7B,6EAA6E;IAC7E,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEnD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAChH,uEAAuE;QACvE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzF,2BAA2B;QAC3B,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAC7G,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEjC,gDAAgD;QAChD,6EAA6E;QAC7E,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAC7G,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,2DAA2D,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtE,uBAAuB;QACvB,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExC,yDAAyD;QACzD,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAEpC,uEAAuE;QACvE,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QACvD,mEAAmE;QACnE,+DAA+D;QAC/D,iFAAiF;QACjF,iCAAiC;QAEjC,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,sCAAsC,CAAC,CAAC;QAEhF,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,uCAAuC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtE,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvE,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU;QAC/C,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU;QAE/C,gDAAgD;QAChD,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAElC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAE/C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAG,iBAAiB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,2CAA2C;IAC3C,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtE,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC5E,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAEpC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACtC,SAAS,CAAC,QAAQ,EAAE,CAAC;QAErB,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAE/C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,oCAAoC,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,mCAAmC;IACnC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEnD,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;QACtH,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEnD,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC9G,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEnD,0DAA0D;QAC1D,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QACnG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,oFAAoF;IACpF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,sBAAsB;QACtB,uBAAuB;QACvB,sCAAsC;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEnD,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QAC9G,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,oDAAoD,CAAC,CAAC;QACtF,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,sCAAsC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,0FAA0F;IAC1F,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,wCAAwC;QACxC,MAAM,KAAK,GAAqB,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,eAAe,GAA2B,EAAE,CAAC;YACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YACzE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzF,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,0DAA0D;QAC1D,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC7B,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1C,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAElC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAEtH,MAAM,CAAC,EAAE,CACP,KAAK,IAAI,EAAE,EACX,2DAA2D,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAChF,CAAC;IACJ,CAAC,CAAC,CAAC;AAEL,CAAC,CAAC,CAAC"}