@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/governance/pack-inheritance.js

@@ -0,0 +1,173 @@
+/**
+ * Pack Inheritance (W1.3 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Lets a customer declare org-wide rules ONCE at the org-baseline pack
+ * (e.g. "no agent deletes a DB without approval", "no MCP across the
+ * fleet") and inherit them into every per-agent company pack with optional
+ * per-agent additions on top.
+ *
+ * Inheritance semantics:
+ *   - Org-baseline rules apply to ALL agents in the org by default.
+ *   - Per-agent pack adds agent-specific rules.
+ *   - When the same capability class appears in both, STRICTEST-WINS.
+ *   - Composed pack carries provenance pointers to both source pack IDs.
+ *
+ * Composition produces a single CompliancePackWithClassifiers that can be
+ * activated per-agent in PackRegistry. Single-pack activation is intentional
+ * — customers can stay with one pack-per-agent mental model while still
+ * getting org-wide rule propagation under the hood.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-PACK-INHERITANCE
+ */
+import { buildCompanyPack, } from './company-pack-builder.js';
+const ACTION_RANK = {
+    ALLOW: 0,
+    LOG: 1,
+    WARN: 2,
+    REQUIRE_APPROVAL: 3,
+    BLOCK: 4,
+};
+/**
+ * Build an org-baseline pack. Conceptually identical to a company pack except
+ * that its rules apply to every agent in the org by inheritance.
+ */
+export function buildOrgBaselinePack(input) {
+    const baselineId = input.id ?? `org-baseline-${input.orgId}`;
+    return buildCompanyPack({
+        id: baselineId,
+        name: input.name ?? `${input.orgId} org-wide baseline`,
+        orgId: input.orgId,
+        rules: input.rules,
+        isolation: input.isolation,
+        description: `Org-baseline pack for ${input.orgId} — inherited by all per-agent packs`,
+    });
+}
+/**
+ * Compose org-baseline + per-agent rules into one pack with strictest-wins
+ * semantics on every category. Tracks provenance via `aliases` so audit tooling
+ * can identify both sources.
+ *
+ * Per-agent overrides (W1.9) skip strictest-wins for the named capability:
+ * the override's relaxed action replaces whatever strictest-wins would have
+ * produced. Each override emits an OverrideEvent via the optional sink.
+ */
+export function composeAgentPack(baseline, agentInput, options) {
+    validateOverrides(agentInput.overrides);
+    const agentDelta = buildCompanyPack({
+        id: agentInput.id,
+        name: agentInput.name,
+        orgId: agentInput.orgId,
+        rules: agentInput.rules,
+        isolation: agentInput.isolation,
+        description: `Per-agent pack for ${agentInput.agentId} (inherits from ${baseline.id})`,
+    });
+    // Strictest-wins merge of categoryActions.
+    const baselineActions = baseline.dataPolicy?.categoryActions ?? {};
+    const agentActions = agentDelta.dataPolicy.categoryActions ?? {};
+    const mergedActions = {};
+    // W1.9 override lookup — capability -> override descriptor.
+    const overrideMap = new Map();
+    for (const ov of agentInput.overrides ?? []) {
+        overrideMap.set(ov.capability, ov);
+    }
+    const composedAt = new Date().toISOString();
+    const overrideEvents = [];
+    const allKeys = new Set([
+        ...Object.keys(baselineActions),
+        ...Object.keys(agentActions),
+        ...overrideMap.keys(),
+    ]);
+    for (const key of allKeys) {
+        const ov = overrideMap.get(key);
+        if (ov) {
+            // W1.9 — override skips strictest-wins for this capability.
+            mergedActions[key] = ov.action;
+            const overrideId = ov.overrideId ?? `${agentInput.agentId}::${key}::${ov.approvedAt}`;
+            overrideEvents.push({
+                overrideId,
+                orgId: agentInput.orgId,
+                agentId: agentInput.agentId,
+                capability: key,
+                baselineAction: baselineActions[key],
+                relaxedAction: ov.action,
+                approver: ov.approver,
+                justification: ov.justification,
+                approvedAt: ov.approvedAt,
+                composedAt,
+            });
+            continue;
+        }
+        const a = baselineActions[key];
+        const b = agentActions[key];
+        if (a === undefined)
+            mergedActions[key] = b;
+        else if (b === undefined)
+            mergedActions[key] = a;
+        else {
+            const actA = a;
+            const actB = b;
+            const rankA = ACTION_RANK[actA] ?? 0;
+            const rankB = ACTION_RANK[actB] ?? 0;
+            mergedActions[key] = rankB > rankA ? actB : actA;
+        }
+    }
+    if (options?.onOverride) {
+        for (const ev of overrideEvents)
+            options.onOverride(ev);
+    }
+    // Merge classifiers: prefer agent's classifier if present, otherwise baseline's.
+    const baselineClassifiers = baseline.categoryClassifiers ?? {};
+    const agentClassifiers = agentDelta.categoryClassifiers ?? {};
+    const mergedClassifiers = { ...baselineClassifiers };
+    for (const [k, v] of Object.entries(agentClassifiers)) {
+        mergedClassifiers[k] = v;
+    }
+    // Strictest isolation across the two packs.
+    const baselineIso = baseline.requiresActionIsolation;
+    const agentIso = agentDelta.requiresActionIsolation;
+    const isolationRank = { none: 0, 'sourced-only': 1, strict: 2 };
+    const isoA = isolationRank[String(baselineIso ?? 'none')] ?? 0;
+    const isoB = isolationRank[String(agentIso ?? 'none')] ?? 0;
+    const mergedIsolation = isoB > isoA ? agentIso : baselineIso;
+    const composed = {
+        ...agentDelta,
+        aliases: [baseline.id, agentDelta.id],
+        description: `Composed pack: agent ${agentInput.agentId} extends baseline ${baseline.id}. ` +
+            `Strictest-wins on overlapping rules.`,
+        dataPolicy: {
+            ...agentDelta.dataPolicy,
+            scanCategories: Object.keys(mergedActions),
+            categoryActions: mergedActions,
+        },
+        categoryClassifiers: mergedClassifiers,
+        requiresActionIsolation: mergedIsolation,
+    };
+    return composed;
+}
+/**
+ * Convenience: build baseline + compose into per-agent pack in one call.
+ */
+export function buildInheritedAgentPack(baselineInput, agentInput) {
+    const baseline = buildOrgBaselinePack(baselineInput);
+    const composed = composeAgentPack(baseline, agentInput);
+    return { baseline, composed };
+}
+function validateOverrides(overrides) {
+    if (!overrides)
+        return;
+    for (const ov of overrides) {
+        if (!ov.approver || ov.approver.trim() === '') {
+            throw new Error(`PerAgentOverride for capability '${ov.capability}' is missing an approver. ` +
+                'Overrides require explicit employee approval per F-NEW-PRODUCT-PER-AGENT-OVERRIDE-AUTHORITY.');
+        }
+        if (!ov.justification || ov.justification.trim() === '') {
+            throw new Error(`PerAgentOverride for capability '${ov.capability}' is missing a justification. ` +
+                'Overrides must record the reason in the audit chain.');
+        }
+        if (!ov.approvedAt || !/^\d{4}-\d{2}-\d{2}T/.test(ov.approvedAt)) {
+            throw new Error(`PerAgentOverride for capability '${ov.capability}' has invalid approvedAt. ` +
+                'Expect ISO 8601 timestamp.');
+        }
+    }
+}
+//# sourceMappingURL=pack-inheritance.js.map

package/dist/esm/governance/pack-inheritance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-inheritance.js","sourceRoot":"","sources":["../../../src/governance/pack-inheritance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,EACL,gBAAgB,GAGjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,GAAqC;IACpD,KAAK,EAAE,CAAC;IACR,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;IACP,gBAAgB,EAAE,CAAC;IACnB,KAAK,EAAE,CAAC;CACT,CAAC;AAcF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA2B;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,EAAE,IAAI,gBAAgB,KAAK,CAAC,KAAK,EAAE,CAAC;IAC7D,OAAO,gBAAgB,CAAC;QACtB,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,oBAAoB;QACtD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,yBAAyB,KAAK,CAAC,KAAK,qCAAqC;KACvF,CAAC,CAAC;AACL,CAAC;AAiED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAwB,EACxB,UAA0B,EAC1B,OAAyD;IAEzD,iBAAiB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,WAAW,EAAE,sBAAsB,UAAU,CAAC,OAAO,mBAAmB,QAAQ,CAAC,EAAE,GAAG;KACvF,CAAC,CAAC;IAEH,2CAA2C;IAC3C,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,EAAE,eAAe,IAAI,EAAE,CAAC;IACnE,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC;IACjE,MAAM,aAAa,GAAqC,EAAE,CAAC;IAE3D,4DAA4D;IAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAC5C,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAoB,EAAE,CAAC;IAE3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;QAC/B,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5B,GAAG,WAAW,CAAC,IAAI,EAAE;KACtB,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,EAAE,CAAC;YACP,4DAA4D;YAC5D,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;YAC/B,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,IAAI,GAAG,UAAU,CAAC,OAAO,KAAK,GAAG,KAAK,EAAE,CAAC,UAAU,EAAE,CAAC;YACtF,cAAc,CAAC,IAAI,CAAC;gBAClB,UAAU;gBACV,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,UAAU,EAAE,GAAG;gBACf,cAAc,EAAE,eAAe,CAAC,GAAG,CAAiC;gBACpE,aAAa,EAAE,EAAE,CAAC,MAAM;gBACxB,QAAQ,EAAE,EAAE,CAAC,QAAQ;gBACrB,aAAa,EAAE,EAAE,CAAC,aAAa;gBAC/B,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,UAAU;aACX,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,SAAS;YAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAqB,CAAC;aAC3D,IAAI,CAAC,KAAK,SAAS;YAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAqB,CAAC;aAChE,CAAC;YACJ,MAAM,IAAI,GAAG,CAAqB,CAAC;YACnC,MAAM,IAAI,GAAG,CAAqB,CAAC;YACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,aAAa,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,KAAK,MAAM,EAAE,IAAI,cAAc;YAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,iFAAiF;IACjF,MAAM,mBAAmB,GACtB,QAA0C,CAAC,mBAAmB,IAAI,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,UAAU,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC9D,MAAM,iBAAiB,GAAwB,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAC1E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtD,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,4CAA4C;IAC5C,MAAM,WAAW,GAAG,QAAQ,CAAC,uBAAuB,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,uBAAuB,CAAC;IACpD,MAAM,aAAa,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACxF,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;IAE7D,MAAM,QAAQ,GAAkC;QAC9C,GAAG,UAAU;QACb,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;QACrC,WAAW,EACT,wBAAwB,UAAU,CAAC,OAAO,qBAAqB,QAAQ,CAAC,EAAE,IAAI;YAC9E,sCAAsC;QACxC,UAAU,EAAE;YACV,GAAG,UAAU,CAAC,UAAU;YACxB,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;YAC1C,eAAe,EAAE,aAAa;SAC/B;QACD,mBAAmB,EAAE,iBAAiB;QACtC,uBAAuB,EAAE,eAAe;KACzC,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,aAAmC,EACnC,UAA0B;IAK1B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAyC;IAClE,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,oCAAoC,EAAE,CAAC,UAAU,4BAA4B;gBAC3E,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,oCAAoC,EAAE,CAAC,UAAU,gCAAgC;gBAC/E,sDAAsD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,UAAU,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,oCAAoC,EAAE,CAAC,UAAU,4BAA4B;gBAC3E,4BAA4B,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/esm/governance/pack-inheritance.test.js

@@ -0,0 +1,172 @@
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-PACK-INHERITANCE (W1.3 of
+ * F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Customer-path probe:
+ *   - Org-baseline declares "no MCP (BLOCK)" and "shell-exec (REQUIRE_APPROVAL)"
+ *   - Per-agent pack declares "shell-exec (BLOCK)" and "filesystem-write (REQUIRE_APPROVAL)"
+ *   - Composed pack:
+ *       capability:mcp -> BLOCK            (from baseline)
+ *       capability:shell-exec -> BLOCK     (strictest-wins; agent override)
+ *       capability:filesystem-write -> REQUIRE_APPROVAL  (from agent)
+ *   - Verify with real PackEvaluator: BLOCK -> DENY, REQUIRE_APPROVAL -> PENDING
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-PACK-INHERITANCE
+ */
+import { describe, it } from 'node:test';
+import * as assert from 'node:assert/strict';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { buildOrgBaselinePack, composeAgentPack, buildInheritedAgentPack, } from './pack-inheritance.js';
+import { CAPABILITY_CLASS } from './capability-classes.js';
+import { PackEvaluator } from './pack-evaluator.js';
+import { PackRegistry } from '../packs/index.js';
+import { EventBus } from '../audit/event-bus.js';
+import { createActionContext } from '../adapters/index.js';
+function evalActionWithPack(pack, toolName, input = {}) {
+    const registry = new PackRegistry();
+    registry.register(pack);
+    registry.activate(pack.id);
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'inh-'));
+    const bus = new EventBus({ eventDir: dir, agentName: 'inh-test' });
+    const evaluator = new PackEvaluator(registry, bus, { ttlMs: 60_000, enableCache: false });
+    const ac = createActionContext(toolName, input, { name: 'agent-1', orgId: 'org-x' });
+    return evaluator.evaluate('org-x', 'agent-1', ac);
+}
+describe('F-NEW-PRODUCT-PACK-INHERITANCE — org-baseline + per-agent composition', () => {
+    it('composed pack inherits baseline rules where agent has no override', () => {
+        const baseline = buildOrgBaselinePack({
+            orgId: 'org-x',
+            rules: [{ capability: CAPABILITY_CLASS.MCP, action: 'BLOCK' }],
+        });
+        const composed = composeAgentPack(baseline, {
+            id: 'agent-x-pack',
+            name: 'agent x pack',
+            orgId: 'org-x',
+            agentId: 'agent-x',
+            rules: [{ capability: CAPABILITY_CLASS.FILESYSTEM_WRITE, action: 'REQUIRE_APPROVAL' }],
+        });
+        const v1 = evalActionWithPack(composed, 'mcp__list_resources');
+        assert.equal(v1.verdict, 'DENY', 'MCP inherited from baseline');
+        const v2 = evalActionWithPack(composed, 'Write', { file_path: '/tmp/x' });
+        assert.equal(v2.verdict, 'PENDING', 'filesystem-write from agent-specific');
+    });
+    it('STRICTEST-WINS: agent BLOCK overrides baseline REQUIRE_APPROVAL', () => {
+        const baseline = buildOrgBaselinePack({
+            orgId: 'org-x',
+            rules: [{ capability: CAPABILITY_CLASS.SHELL_EXEC, action: 'REQUIRE_APPROVAL' }],
+        });
+        const composed = composeAgentPack(baseline, {
+            id: 'agent-strict',
+            name: 'agent strict',
+            orgId: 'org-x',
+            agentId: 'agent-strict',
+            rules: [{ capability: CAPABILITY_CLASS.SHELL_EXEC, action: 'BLOCK' }],
+        });
+        const verdict = evalActionWithPack(composed, 'Bash', { command: 'ls' });
+        assert.equal(verdict.verdict, 'DENY', 'agent BLOCK wins over baseline REQUIRE_APPROVAL');
+    });
+    it('STRICTEST-WINS: baseline BLOCK survives agent LOG (less strict)', () => {
+        const baseline = buildOrgBaselinePack({
+            orgId: 'org-x',
+            rules: [{ capability: CAPABILITY_CLASS.MCP, action: 'BLOCK' }],
+        });
+        const composed = composeAgentPack(baseline, {
+            id: 'agent-relaxed',
+            name: 'agent relaxed',
+            orgId: 'org-x',
+            agentId: 'agent-relaxed',
+            rules: [{ capability: CAPABILITY_CLASS.MCP, action: 'LOG' }],
+        });
+        const verdict = evalActionWithPack(composed, 'mcp__list_resources');
+        assert.equal(verdict.verdict, 'DENY', 'baseline BLOCK cannot be relaxed by agent LOG');
+    });
+    it('composed pack carries provenance via aliases', () => {
+        const baseline = buildOrgBaselinePack({
+            orgId: 'org-x',
+            rules: [{ capability: CAPABILITY_CLASS.MCP, action: 'BLOCK' }],
+        });
+        const composed = composeAgentPack(baseline, {
+            id: 'agent-prov',
+            name: 'agent prov',
+            orgId: 'org-x',
+            agentId: 'agent-prov',
+            rules: [{ capability: CAPABILITY_CLASS.SHELL_EXEC, action: 'BLOCK' }],
+        });
+        assert.ok(composed.aliases?.includes('org-baseline-org-x'));
+        assert.ok(composed.aliases?.includes('agent-prov'));
+    });
+    it('strictest isolation across baseline + agent', () => {
+        const baseline = buildOrgBaselinePack({
+            orgId: 'org-x',
+            rules: [{ capability: CAPABILITY_CLASS.MCP, action: 'BLOCK' }],
+            isolation: 'sourced-only',
+        });
+        const composed = composeAgentPack(baseline, {
+            id: 'agent-iso',
+            name: 'agent iso',
+            orgId: 'org-x',
+            agentId: 'agent-iso',
+            rules: [{ capability: CAPABILITY_CLASS.SHELL_EXEC, action: 'BLOCK' }],
+            isolation: 'strict',
+        });
+        assert.equal(composed.requiresActionIsolation, 'strict');
+        const baseline2 = buildOrgBaselinePack({
+            orgId: 'org-y',
+            rules: [{ capability: CAPABILITY_CLASS.MCP, action: 'BLOCK' }],
+            isolation: 'strict',
+        });
+        const composed2 = composeAgentPack(baseline2, {
+            id: 'agent-iso-2',
+            name: 'agent iso 2',
+            orgId: 'org-y',
+            agentId: 'agent-iso-2',
+            rules: [{ capability: CAPABILITY_CLASS.SHELL_EXEC, action: 'BLOCK' }],
+            isolation: 'none',
+        });
+        assert.equal(composed2.requiresActionIsolation, 'strict', 'baseline strict survives agent none');
+    });
+    it('buildInheritedAgentPack returns both baseline and composed', () => {
+        const { baseline, composed } = buildInheritedAgentPack({
+            orgId: 'org-x',
+            rules: [{ capability: CAPABILITY_CLASS.MCP, action: 'BLOCK' }],
+        }, {
+            id: 'a-1',
+            name: 'a-1',
+            orgId: 'org-x',
+            agentId: 'a-1',
+            rules: [{ capability: CAPABILITY_CLASS.SHELL_EXEC, action: 'REQUIRE_APPROVAL' }],
+        });
+        assert.equal(baseline.id, 'org-baseline-org-x');
+        assert.equal(composed.id, 'a-1');
+        assert.ok(composed.aliases?.includes(baseline.id));
+        const v = evalActionWithPack(composed, 'mcp__list_resources');
+        assert.equal(v.verdict, 'DENY');
+    });
+    it('non-overlapping baseline + agent unions all rules', () => {
+        const baseline = buildOrgBaselinePack({
+            orgId: 'org-x',
+            rules: [
+                { capability: CAPABILITY_CLASS.MCP, action: 'BLOCK' },
+                { capability: CAPABILITY_CLASS.WEB_FETCH, action: 'REQUIRE_APPROVAL' },
+            ],
+        });
+        const composed = composeAgentPack(baseline, {
+            id: 'a-2',
+            name: 'a-2',
+            orgId: 'org-x',
+            agentId: 'a-2',
+            rules: [
+                { capability: CAPABILITY_CLASS.SHELL_EXEC, action: 'BLOCK' },
+                { capability: CAPABILITY_CLASS.FILESYSTEM_WRITE, action: 'REQUIRE_APPROVAL' },
+            ],
+        });
+        const actions = composed.dataPolicy.categoryActions ?? {};
+        assert.equal(actions[CAPABILITY_CLASS.MCP], 'BLOCK');
+        assert.equal(actions[CAPABILITY_CLASS.WEB_FETCH], 'REQUIRE_APPROVAL');
+        assert.equal(actions[CAPABILITY_CLASS.SHELL_EXEC], 'BLOCK');
+        assert.equal(actions[CAPABILITY_CLASS.FILESYSTEM_WRITE], 'REQUIRE_APPROVAL');
+    });
+});
+//# sourceMappingURL=pack-inheritance.test.js.map

package/dist/esm/governance/pack-inheritance.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-inheritance.test.js","sourceRoot":"","sources":["../../../src/governance/pack-inheritance.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,SAAS,kBAAkB,CAAC,IAAS,EAAE,QAAgB,EAAE,QAAiC,EAAE;IAC1F,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,MAAM,EAAE,GAAG,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,OAAO,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACrF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;SACvF,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC;QAEhE,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,sCAAsC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;SACjF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;SACtE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,iDAAiD,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,eAAe;YACxB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,+CAA+C,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,YAAY;YACrB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;SACtE,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9D,SAAS,EAAE,cAAc;SAC1B,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACrE,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,oBAAoB,CAAC;YACrC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9D,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,EAAE;YAC5C,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACrE,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CACV,SAAS,CAAC,uBAAuB,EACjC,QAAQ,EACR,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,uBAAuB,CACpD;YACE,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;SAC/D,EACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;SACjF,CACF,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnD,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,KAAK,EAAE,OAAO;YACd,KAAK,EAAE;gBACL,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;gBACrD,EAAE,UAAU,EAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACvE;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE;YAC1C,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE;gBAC5D,EAAE,UAAU,EAAE,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,EAAE;aAC9E;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/governance/pack-publish-workflow.js

@@ -0,0 +1,80 @@
+/**
+ * Pack Publish Workflow (orchestrator across W2.3 + W1.4).
+ *
+ * Pulls together the auto-pack generator (W2.3) and the pack version store
+ * (W1.4) into a single customer happy-path:
+ *
+ *   1. Customer scans an agent (W2.1 / W2.2 / W4.3 produce AgentManifest).
+ *   2. Scanner + auto-pack generator emits proposedRules.
+ *   3. Customer reviews + selects acceptedRules.
+ *   4. publishGeneratedPack(...) authors the pack, publishes a version,
+ *      optionally activates it (or sets shadow mode for a soft rollout),
+ *      and returns the result + the version events.
+ *
+ * Pure orchestration — uses already-tested W1.4 + W2.3 modules. No HTTP,
+ * no IO beyond what the version store itself does (in-memory by default).
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12
+ */
+import { autoGenerateCompanyPack, } from './auto-pack-generator.js';
+import { PackVersionStore, } from './pack-versioning.js';
+import { validatePackInput } from './pack-rule-validator.js';
+/**
+ * Thrown when validatePackInput() returns errors (ERROR-severity issues
+ * in the auto-generated pack). The report is preserved so the caller / UI
+ * can surface the specific issues to the customer.
+ */
+export class PackValidationError extends Error {
+    report;
+    constructor(message, report) {
+        super(message);
+        this.name = 'PackValidationError';
+        this.report = report;
+    }
+}
+/**
+ * End-to-end happy-path: scan -> auto-pack -> publish -> (activate | shadow).
+ * Returns the AutoPackResult, the resulting PackVersionRecord, and every
+ * PackVersionEvent emitted during this call (for audit forwarding).
+ */
+export function publishGeneratedPack(input) {
+    if (!input.publishedBy || input.publishedBy.trim() === '') {
+        throw new Error('publishGeneratedPack: publishedBy is required (audit)');
+    }
+    const events = [];
+    const versionStore = input.versionStore ?? new PackVersionStore((e) => events.push(e));
+    // If the caller passed their own store, we still capture events emitted
+    // from THIS call by sub-classing the sink. Cheapest: re-fire through
+    // a local sink wrapper. The caller's store has its own sink.
+    // For local-only stores we already attached the sink at construction.
+    const autoPack = autoGenerateCompanyPack(input.manifest, input.autoPack);
+    // Schema-gate the pack BEFORE persisting a version. Errors block the publish;
+    // warnings are surfaced in the result for the UI/CLI to render.
+    const validation = validatePackInput({
+        id: autoPack.pack.id,
+        version: autoPack.pack.version,
+        orgId: input.manifest.agentId ? `org-${input.manifest.agentId}` : undefined,
+        rules: autoPack.acceptedRules,
+        isolation: autoPack.pack.requiresActionIsolation,
+    });
+    if (!validation.ok) {
+        throw new PackValidationError(`publishGeneratedPack: schema validation failed with ${validation.errors.length} error(s)`, validation);
+    }
+    let versionRecord = versionStore.publishVersion(autoPack.pack, input.publishedBy, input.changelog ?? buildDefaultChangelog(autoPack));
+    const postPublish = input.postPublish ?? 'draft';
+    if (postPublish === 'active') {
+        versionRecord = versionStore.setActive(autoPack.pack.id, autoPack.pack.version, input.publishedBy);
+    }
+    else if (postPublish === 'shadow') {
+        versionRecord = versionStore.setShadow(autoPack.pack.id, autoPack.pack.version, input.publishedBy);
+    }
+    return { autoPack, versionRecord, events, validation };
+}
+function buildDefaultChangelog(autoPack) {
+    const c = autoPack.scanReport.countsBySeverity;
+    return (`Auto-published from OWASP Agentic scan. ` +
+        `Findings: CRIT=${c.CRIT} HIGH=${c.HIGH} MED=${c.MED} LOW=${c.LOW}. ` +
+        `Build-structure score: ${autoPack.scanReport.buildStructureScore}. ` +
+        `Rules accepted: ${autoPack.acceptedRules.length} / ${autoPack.proposedRules.length}.`);
+}
+//# sourceMappingURL=pack-publish-workflow.js.map

package/dist/esm/governance/pack-publish-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-publish-workflow.js","sourceRoot":"","sources":["../../../src/governance/pack-publish-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,uBAAuB,GAGxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,GAGjB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAyB,MAAM,0BAA0B,CAAC;AAEpF;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAmB;IAClC,YAAY,OAAe,EAAE,MAAwB;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AA0BD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgC;IAEhC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,wEAAwE;IACxE,qEAAqE;IACrE,6DAA6D;IAC7D,sEAAsE;IACtE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEzE,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,UAAU,GAAG,iBAAiB,CAAC;QACnC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO;QAC9B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3E,KAAK,EAAE,QAAQ,CAAC,aAAa;QAC7B,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,uDAAuD,UAAU,CAAC,MAAM,CAAC,MAAM,WAAW,EAC1F,UAAU,CACX,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,GAAG,YAAY,CAAC,cAAc,CAC7C,QAAQ,CAAC,IAAI,EACb,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,SAAS,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CACnD,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC;IACjD,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACrG,CAAC;SAAM,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACrG,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAwB;IACrD,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;IAC/C,OAAO,CACL,0CAA0C;QAC1C,kBAAkB,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,IAAI;QACrE,0BAA0B,QAAQ,CAAC,UAAU,CAAC,mBAAmB,IAAI;QACrE,mBAAmB,QAAQ,CAAC,aAAa,CAAC,MAAM,MAAM,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CACvF,CAAC;AACJ,CAAC"}

package/dist/esm/governance/pack-publish-workflow.test.js

@@ -0,0 +1,176 @@
+/**
+ * RED-GREEN tests for the pack-publish workflow orchestrator.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12
+ */
+import { describe, it } from 'node:test';
+import * as assert from 'node:assert/strict';
+import { publishGeneratedPack, PackValidationError } from './pack-publish-workflow.js';
+import { PackVersionStore } from './pack-versioning.js';
+const baseManifest = (over = {}) => ({
+    agentId: 'a',
+    tools: ['Bash', 'WebFetch'],
+    hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+    llmProvider: 'connexum-proxy/anthropic',
+    pluginIntegrityVerified: true,
+    rateLimitsConfigured: true,
+    declaredApprovalGates: [],
+    declaredForbiddenCapabilities: [],
+    ...over,
+});
+describe('publishGeneratedPack workflow', () => {
+    it('scan -> auto-pack -> publish (draft default) returns full result', () => {
+        const result = publishGeneratedPack({
+            manifest: baseManifest(),
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true },
+        });
+        assert.ok(result.autoPack.pack.id.startsWith('auto-pack-'));
+        assert.equal(result.versionRecord.state, 'draft');
+        assert.equal(result.versionRecord.publishedBy, 'alice');
+        assert.ok(result.events.some((e) => e.kind === 'VERSION_PUBLISHED'));
+    });
+    it('postPublish: active transitions the version to active', () => {
+        const result = publishGeneratedPack({
+            manifest: baseManifest(),
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true },
+            postPublish: 'active',
+        });
+        assert.equal(result.versionRecord.state, 'active');
+        assert.ok(result.events.some((e) => e.kind === 'VERSION_ACTIVATED'));
+    });
+    it('postPublish: shadow places the version in shadow state', () => {
+        const result = publishGeneratedPack({
+            manifest: baseManifest(),
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true },
+            postPublish: 'shadow',
+        });
+        assert.equal(result.versionRecord.state, 'shadow');
+        assert.ok(result.events.some((e) => e.kind === 'VERSION_SHADOW_ENABLED'));
+    });
+    it('default changelog includes finding counts + score + acceptance ratio', () => {
+        const result = publishGeneratedPack({
+            manifest: baseManifest(),
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true },
+        });
+        assert.match(result.versionRecord.changelog ?? '', /Findings:/);
+        assert.match(result.versionRecord.changelog ?? '', /Build-structure score/);
+        assert.match(result.versionRecord.changelog ?? '', /Rules accepted/);
+    });
+    it('custom changelog overrides the default', () => {
+        const result = publishGeneratedPack({
+            manifest: baseManifest(),
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true },
+            changelog: 'manual override',
+        });
+        assert.equal(result.versionRecord.changelog, 'manual override');
+    });
+    it('missing publishedBy throws (fail-closed)', () => {
+        assert.throws(() => publishGeneratedPack({
+            manifest: baseManifest(),
+            publishedBy: '',
+            autoPack: { acceptAllSuggestedRules: true },
+        }), /publishedBy is required/);
+    });
+    it('caller-supplied versionStore is used; subsequent publishes share state', () => {
+        const events = [];
+        const store = new PackVersionStore((e) => events.push(e));
+        // Publish v1 of agent-1, set active.
+        const r1 = publishGeneratedPack({
+            manifest: { ...baseManifest({ agentId: 'agent-1' }) },
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true, version: '1.0.0' },
+            versionStore: store,
+            postPublish: 'active',
+        });
+        assert.equal(r1.versionRecord.state, 'active');
+        // Publish v2 of the SAME agent — strictest-wins applies inside the
+        // generator; the version store sees two distinct versions.
+        const r2 = publishGeneratedPack({
+            manifest: { ...baseManifest({ agentId: 'agent-1' }) },
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true, version: '1.1.0' },
+            versionStore: store,
+            postPublish: 'active',
+        });
+        assert.equal(r2.versionRecord.state, 'active');
+        const versions = store.listVersions(r1.autoPack.pack.id).map((v) => v.version);
+        assert.deepEqual(versions, ['1.0.0', '1.1.0']);
+        // After r2's setActive, v1 should be archived.
+        assert.equal(store.getVersion(r1.autoPack.pack.id, '1.0.0')?.state, 'archived');
+        assert.equal(store.getActiveVersion(r1.autoPack.pack.id)?.version, '1.1.0');
+    });
+    it('events array contains exactly the publish event when postPublish is draft', () => {
+        const result = publishGeneratedPack({
+            manifest: baseManifest(),
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true },
+            // postPublish defaults to draft
+        });
+        const publishedEvents = result.events.filter((e) => e.kind === 'VERSION_PUBLISHED');
+        const activatedEvents = result.events.filter((e) => e.kind === 'VERSION_ACTIVATED');
+        assert.equal(publishedEvents.length, 1);
+        assert.equal(activatedEvents.length, 0);
+    });
+    it('end-to-end: Lethal Trifecta manifest -> pack with proposed rules -> publish + active', () => {
+        const result = publishGeneratedPack({
+            manifest: baseManifest({ tools: ['WebFetch', 'Bash', 'postgres_query'] }),
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true },
+            postPublish: 'active',
+        });
+        assert.ok(result.autoPack.acceptedRules.length >= 2);
+        assert.ok(result.autoPack.reviewRequiredRisks.some((r) => r.startsWith('A01')));
+        assert.equal(result.versionRecord.state, 'active');
+    });
+    // F-NEW-CLUSTER-UNWIRED-STUBS-2026-05-12 integration #1 — validator gate
+    it('validation: successful publish returns the ValidationReport with ok=true', () => {
+        const result = publishGeneratedPack({
+            manifest: baseManifest(),
+            publishedBy: 'alice',
+            autoPack: { acceptAllSuggestedRules: true },
+        });
+        assert.equal(result.validation.ok, true);
+        assert.deepEqual(result.validation.errors, []);
+    });
+    it('validation: invalid pack id throws PackValidationError carrying the report', () => {
+        // packIdPrefix with whitespace -> built id "auto-pack-bad id-a" fails ID_RE
+        let caught;
+        try {
+            publishGeneratedPack({
+                manifest: baseManifest(),
+                publishedBy: 'alice',
+                autoPack: { acceptAllSuggestedRules: true, packIdPrefix: 'auto-pack-bad id' },
+            });
+        }
+        catch (e) {
+            caught = e;
+        }
+        assert.ok(caught instanceof PackValidationError);
+        const err = caught;
+        assert.equal(err.report.ok, false);
+        assert.ok(err.report.errors.some((i) => i.field === 'id' && i.code === 'INVALID_FORMAT'));
+    });
+    it('validation: store is NOT mutated when validation fails (fail-closed)', () => {
+        const events = [];
+        const store = new PackVersionStore((e) => events.push(e));
+        try {
+            publishGeneratedPack({
+                manifest: baseManifest(),
+                publishedBy: 'alice',
+                autoPack: { acceptAllSuggestedRules: true, packIdPrefix: 'auto-pack-bad id' },
+                versionStore: store,
+            });
+        }
+        catch {
+            // expected
+        }
+        // No VERSION_PUBLISHED event reached the store sink.
+        assert.equal(events.filter((e) => e.kind === 'VERSION_PUBLISHED').length, 0);
+    });
+});
+//# sourceMappingURL=pack-publish-workflow.test.js.map

package/dist/esm/governance/pack-publish-workflow.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-publish-workflow.test.js","sourceRoot":"","sources":["../../../src/governance/pack-publish-workflow.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,mBAAmB,CAAC;AAG5E,MAAM,YAAY,GAAG,CAAC,OAA+B,EAAE,EAAiB,EAAE,CAAC,CAAC;IAC1E,OAAO,EAAE,GAAG;IACZ,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;IAC3B,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;IAClE,WAAW,EAAE,0BAA0B;IACvC,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,EAAE;IACzB,6BAA6B,EAAE,EAAE;IACjC,GAAG,IAAI;CACR,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,QAAQ,EAAE,YAAY,EAAE;YACxB,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,QAAQ,EAAE,YAAY,EAAE;YACxB,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;YAC3C,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,QAAQ,EAAE,YAAY,EAAE;YACxB,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;YAC3C,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,QAAQ,EAAE,YAAY,EAAE;YACxB,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,QAAQ,EAAE,YAAY,EAAE;YACxB,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;YAC3C,SAAS,EAAE,iBAAiB;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CACH,oBAAoB,CAAC;YACnB,QAAQ,EAAE,YAAY,EAAE;YACxB,WAAW,EAAE,EAAE;YACf,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;SAC5C,CAAC,EACJ,yBAAyB,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,qCAAqC;QACrC,MAAM,EAAE,GAAG,oBAAoB,CAAC;YAC9B,QAAQ,EAAE,EAAE,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;YACrD,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;YAC7D,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE/C,mEAAmE;QACnE,2DAA2D;QAC3D,MAAM,EAAE,GAAG,oBAAoB,CAAC;YAC9B,QAAQ,EAAE,EAAE,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;YACrD,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE;YAC7D,YAAY,EAAE,KAAK;YACnB,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,+CAA+C;QAC/C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,QAAQ,EAAE,YAAY,EAAE;YACxB,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;YAC3C,gCAAgC;SACjC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;QACpF,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;QACpF,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,QAAQ,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACzE,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;YAC3C,WAAW,EAAE,QAAQ;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,QAAQ,EAAE,YAAY,EAAE;YACxB,WAAW,EAAE,OAAO;YACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,4EAA4E;QAC5E,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,oBAAoB,CAAC;gBACnB,QAAQ,EAAE,YAAY,EAAE;gBACxB,WAAW,EAAE,OAAO;gBACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE;aAC9E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;QACD,MAAM,CAAC,EAAE,CAAC,MAAM,YAAY,mBAAmB,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAA6B,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,oBAAoB,CAAC;gBACnB,QAAQ,EAAE,YAAY,EAAE;gBACxB,WAAW,EAAE,OAAO;gBACpB,QAAQ,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE;gBAC7E,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}