@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/governance/state-manager.js

@@ -0,0 +1,249 @@
+/**
+ * StateManager -- Centralized governance state coordination.
+ *
+ * Provides a single source of truth for governance state across
+ * all modules. Prevents duplicate initialization, manages module
+ * lifecycle, and coordinates shared resources.
+ *
+ * T-024: Shared state manager to prevent fragmented governance state.
+ *
+ * @connexum/ai-governance
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import { createLogger } from '../util/log.js';
+const log = createLogger('state-manager');
+export class StateManager {
+    config;
+    modules = new Map();
+    version = 0;
+    stateFile;
+    lockFile;
+    saveTimer = null;
+    dirty = false;
+    constructor(config) {
+        this.config = {
+            useLocking: true,
+            saveIntervalMs: 30000,
+            ...config,
+        };
+        if (!fs.existsSync(config.stateDir)) {
+            fs.mkdirSync(config.stateDir, { recursive: true });
+        }
+        this.stateFile = path.join(config.stateDir, `state-${config.agentId}.json`);
+        this.lockFile = path.join(config.stateDir, `state-${config.agentId}.lock`);
+        // Load existing state if available
+        this.loadState();
+    }
+    /**
+     * Register a governance module.
+     */
+    registerModule(name, initialData) {
+        if (this.modules.has(name)) {
+            log.warn('Module already registered', { name });
+            return;
+        }
+        this.modules.set(name, {
+            name,
+            initialized: true,
+            lastActivity: new Date().toISOString(),
+            data: initialData || {},
+        });
+        this.dirty = true;
+        this.version++;
+        log.info('Module registered', { name });
+    }
+    /**
+     * Update module state data.
+     */
+    updateModule(name, data) {
+        const module = this.modules.get(name);
+        if (!module) {
+            throw new Error(`Module '${name}' not registered`);
+        }
+        module.data = { ...module.data, ...data };
+        module.lastActivity = new Date().toISOString();
+        this.dirty = true;
+        this.version++;
+    }
+    /**
+     * Get module state.
+     */
+    getModule(name) {
+        return this.modules.get(name);
+    }
+    /**
+     * Get data from a specific module.
+     */
+    getModuleData(name, key) {
+        const module = this.modules.get(name);
+        if (!module)
+            return undefined;
+        return module.data[key];
+    }
+    /**
+     * Check if a module is registered and initialized.
+     */
+    isModuleReady(name) {
+        const module = this.modules.get(name);
+        return module?.initialized === true;
+    }
+    /**
+     * Deregister a module (cleanup).
+     */
+    deregisterModule(name) {
+        const existed = this.modules.delete(name);
+        if (existed) {
+            this.dirty = true;
+            this.version++;
+        }
+        return existed;
+    }
+    /**
+     * Get a full snapshot of governance state.
+     */
+    getSnapshot() {
+        const modulesObj = {};
+        for (const [name, state] of this.modules) {
+            modulesObj[name] = { ...state };
+        }
+        const snapshot = {
+            agentId: this.config.agentId,
+            version: this.version,
+            modules: modulesObj,
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+            checksum: '',
+        };
+        snapshot.checksum = this.computeChecksum(snapshot);
+        return snapshot;
+    }
+    /**
+     * Verify snapshot integrity.
+     */
+    verifySnapshot(snapshot) {
+        const expected = snapshot.checksum;
+        const actual = this.computeChecksum({ ...snapshot, checksum: '' });
+        return expected === actual;
+    }
+    /**
+     * List all registered modules.
+     */
+    listModules() {
+        return Array.from(this.modules.keys());
+    }
+    /**
+     * Get module count.
+     */
+    getModuleCount() {
+        return this.modules.size;
+    }
+    /**
+     * Save state to disk.
+     */
+    save() {
+        if (this.config.useLocking) {
+            this.acquireLock();
+        }
+        try {
+            const snapshot = this.getSnapshot();
+            fs.writeFileSync(this.stateFile, JSON.stringify(snapshot, null, 2));
+            this.dirty = false;
+            log.info('State saved', { version: this.version, modules: this.modules.size });
+        }
+        finally {
+            if (this.config.useLocking) {
+                this.releaseLock();
+            }
+        }
+    }
+    /**
+     * Start periodic auto-save.
+     */
+    startAutoSave() {
+        if (this.saveTimer)
+            return;
+        this.saveTimer = setInterval(() => {
+            if (this.dirty) {
+                try {
+                    this.save();
+                }
+                catch (err) {
+                    log.error('Auto-save failed', { error: err.message });
+                }
+            }
+        }, this.config.saveIntervalMs);
+    }
+    /**
+     * Stop auto-save and do a final save.
+     */
+    stop() {
+        if (this.saveTimer) {
+            clearInterval(this.saveTimer);
+            this.saveTimer = null;
+        }
+        if (this.dirty) {
+            try {
+                this.save();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    // --- Private ---
+    loadState() {
+        if (!fs.existsSync(this.stateFile))
+            return;
+        try {
+            const raw = fs.readFileSync(this.stateFile, 'utf-8');
+            const snapshot = JSON.parse(raw);
+            if (!this.verifySnapshot(snapshot)) {
+                log.error('State file integrity check failed -- starting fresh');
+                return;
+            }
+            for (const [name, state] of Object.entries(snapshot.modules)) {
+                this.modules.set(name, state);
+            }
+            this.version = snapshot.version;
+            log.info('State loaded', { version: this.version, modules: this.modules.size });
+        }
+        catch (err) {
+            log.error('Failed to load state', { error: err.message });
+        }
+    }
+    computeChecksum(snapshot) {
+        const data = JSON.stringify({
+            agentId: snapshot.agentId,
+            version: snapshot.version,
+            modules: snapshot.modules,
+        });
+        return crypto.createHash('sha256').update(data).digest('hex');
+    }
+    acquireLock() {
+        const maxWait = 5000;
+        const start = Date.now();
+        while (fs.existsSync(this.lockFile)) {
+            if (Date.now() - start > maxWait) {
+                // Stale lock -- force break
+                log.warn('Breaking stale lock', { lockFile: this.lockFile });
+                try {
+                    fs.unlinkSync(this.lockFile);
+                }
+                catch { /* ignore */ }
+                break;
+            }
+            // Sleep 50ms without busy-spinning (uses Atomics.wait on a dummy buffer)
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
+        }
+        fs.writeFileSync(this.lockFile, `${process.pid}\n${new Date().toISOString()}`);
+    }
+    releaseLock() {
+        try {
+            if (fs.existsSync(this.lockFile)) {
+                fs.unlinkSync(this.lockFile);
+            }
+        }
+        catch { /* ignore */ }
+    }
+}
+//# sourceMappingURL=state-manager.js.map

package/dist/esm/governance/state-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-manager.js","sourceRoot":"","sources":["../../../src/governance/state-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA6B1C,MAAM,OAAO,YAAY;IACf,MAAM,CAA+B;IACrC,OAAO,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC9C,OAAO,GAAW,CAAC,CAAC;IACpB,SAAS,CAAS;IAClB,QAAQ,CAAS;IACjB,SAAS,GAA0C,IAAI,CAAC;IACxD,KAAK,GAAY,KAAK,CAAC;IAE/B,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG;YACZ,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE,KAAK;YACrB,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,MAAM,CAAC,OAAO,OAAO,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,MAAM,CAAC,OAAO,OAAO,CAAC,CAAC;QAE3E,mCAAmC;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAY,EAAE,WAAqC;QAChE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YACrB,IAAI;YACJ,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,IAAI,EAAE,WAAW,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,IAAY,EAAE,IAA6B;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,CAAC,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;QAC1C,MAAM,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,aAAa,CAAc,IAAY,EAAE,GAAW;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAM,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAY;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,IAAY;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,MAAM,UAAU,GAAgC,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,UAAU;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,QAAQ,EAAE,EAAE;SACb,CAAC;QAEF,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAA4B;QACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,OAAO,QAAQ,KAAK,MAAM,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAE3B,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,kBAAkB;IAEV,SAAS;QACf,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO;QAE3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAuB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;YAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChC,CAAC;YAED,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,QAA4B;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAEO,WAAW;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEzB,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,OAAO,EAAE,CAAC;gBACjC,4BAA4B;gBAC5B,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC5D,MAAM;YACR,CAAC;YACD,yEAAyE;YACzE,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/esm/governance/tenant-provider-agreements.js

@@ -0,0 +1,398 @@
+/**
+ * TenantProviderAgreementRegistry -- Per-tenant, per-provider BAA/DPA/SCC/BCR tracking.
+ *
+ * Provider-level compliance (src/security/provider-compliance.ts) answers:
+ *   "Does Anthropic offer a BAA product?"
+ * This module answers:
+ *   "Does tenant A have a signed, active BAA with Anthropic?"
+ *
+ * The two questions are distinct. HIPAA 45 CFR 164.308(b) requires a Business
+ * Associate Agreement between a Covered Entity and each Business Associate. An
+ * Anthropic BAA held by Org A does not transfer to Org B. Without per-tenant
+ * tracking, the platform cannot assert "PHI flows only to providers with a
+ * tenant-active BAA" for any individual customer -- every audit, every CCO
+ * Q&A, every HIPAA assessment will identify this as a control gap.
+ *
+ * GDPR Art. 28 parallels this: each controller-processor relationship requires
+ * its own Data Processing Agreement. Tenant-scoped DPA tracking is the only
+ * compliant posture.
+ *
+ * Gate enforcement:
+ *   1. Look up bound packs for the action.
+ *   2. Union all `requiredAgreementKinds` across bound packs.
+ *   3. Call requireActive(tenantId, providerId, unionKinds).
+ *   4. Any missing kind: throw MissingTenantProviderAgreementError + emit
+ *      TENANT_PROVIDER_AGREEMENT_MISSING severity ERROR; deny the action.
+ *
+ * v0 storage: in-memory map. State is rebuilt on process restart.
+ * v1 plan: persist to the @connexum/database Prisma store (TenantProviderAgreement
+ * model) so freeze state and agreement records survive pod restarts. The v0
+ * in-memory store is correct for single-process deployments; production
+ * multi-pod deployments require v1 persistence.
+ *
+ * Document hash semantics (v0):
+ *   The operator supplies a SHA-256 hash of their agreement document at
+ *   registration. We store it. On every gate evaluation we compare the stored
+ *   hash against itself (immutability promise at rest). An operator who later
+ *   registers a *different* hash for an existing (tenantId, providerId, kind,
+ *   effectiveDate) combo triggers AGREEMENT_DOCUMENT_TAMPERED (PT-BAA-2).
+ *
+ *   v1 plan: operator provides a signed-URL (with X-Document-Sha256 header)
+ *   pointing to their document store (S3, Azure Blob, KMS-vaulted). The
+ *   registry fetches the header on each gate evaluation and compares the
+ *   live hash to the stored hash. Acceptable operator-side primitives:
+ *   (a) S3 pre-signed URL with ETag/Content-SHA256 header, or
+ *   (b) Azure Blob with x-ms-content-md5 + SHA-256 Content-MD5 equivalent, or
+ *   (c) KMS attestation document (AWS KMS GenerateDataKeyPair with signed hash),
+ *   or (d) Hashicorp Vault transit engine signature. Option (c) KMS attestation
+ *   is recommended for HIPAA/GDPR regulated environments as it provides a
+ *   hardware-root-of-trust chain. See docs/runtime/tenant-provider-agreements.md.
+ *
+ * Pack-binding primacy invariant: every operation that writes a record requires
+ * a non-empty packBinding[]. Ref: feedback_pack_binding_primacy.md.
+ *
+ * Audit chain: every gate decision (allow/deny) and every lifecycle event
+ * (register/revoke) emits an audit event with SHA-256 chained prev-SHA.
+ *
+ * Required permission: 'governance.compliance.register' (ADMIN role).
+ * Enforcement: OperatorRoles.checkPermission is injected at construction time
+ * to avoid circular dependency.
+ *
+ * @connexum/ai-governance
+ */
+import * as crypto from 'node:crypto';
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+export class MissingTenantProviderAgreementError extends Error {
+    tenantId;
+    providerId;
+    missingKinds;
+    packBinding;
+    constructor(opts) {
+        super(`Tenant '${opts.tenantId}' lacks active agreement(s) [${opts.missingKinds.join(', ')}] ` +
+            `with provider '${opts.providerId}'. Action denied. ` +
+            `An OPERATOR_ADMIN must register the required agreement(s) before PHI/PII can be routed ` +
+            `through this provider for this tenant. Packs requiring these kinds: [${opts.packBinding.join(', ')}].`);
+        this.name = 'MissingTenantProviderAgreementError';
+        this.tenantId = opts.tenantId;
+        this.providerId = opts.providerId;
+        this.missingKinds = opts.missingKinds;
+        this.packBinding = opts.packBinding;
+    }
+}
+export class AgreementRegistrationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AgreementRegistrationError';
+    }
+}
+export class AgreementRevocationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AgreementRevocationError';
+    }
+}
+export class EmptyPackBindingError extends Error {
+    operation;
+    constructor(operation) {
+        super(`Operation '${operation}' requires a non-empty packBinding. ` +
+            `Per the Connexum AI Governance pack-binding-primacy invariant, ` +
+            `every record must carry at least one compliance pack binding.`);
+        this.name = 'EmptyPackBindingError';
+        this.operation = operation;
+    }
+}
+export class AgreementPermissionError extends Error {
+    operatorId;
+    constructor(operatorId, action, reason) {
+        super(`Permission denied for operator '${operatorId}' attempting '${action}': ${reason}. ` +
+            `Only ADMIN-role operators may register or revoke tenant provider agreements.`);
+        this.name = 'AgreementPermissionError';
+        this.operatorId = operatorId;
+    }
+}
+// ---------------------------------------------------------------------------
+// TenantProviderAgreementRegistry
+// ---------------------------------------------------------------------------
+export class TenantProviderAgreementRegistry {
+    records = new Map();
+    onAudit;
+    permissionChecker;
+    tenantContext;
+    // SHA chain state
+    lastSha = '';
+    constructor(config = {}) {
+        this.onAudit = config.onAudit ?? (() => undefined);
+        this.permissionChecker = config.permissionChecker ?? {
+            checkPermission: () => ({ allowed: true, reason: 'No checker injected (dev mode)' }),
+        };
+        this.tenantContext = config.tenantContext;
+    }
+    // ---------------------------------------------------------------------------
+    // register()
+    // ---------------------------------------------------------------------------
+    /**
+     * Register a tenant-provider agreement.
+     *
+     * Operator-only (governance.compliance.register). Pack-binding mandatory.
+     * Throws on effectiveDate > expirationDate.
+     * Audit-chained as TENANT_PROVIDER_AGREEMENT_REGISTERED severity ERROR.
+     *
+     * PT-BAA-2: If an agreement with the same (tenantId, providerId, kind,
+     * effectiveDate) exists and the caller supplies a different documentSha256,
+     * emits AGREEMENT_DOCUMENT_TAMPERED severity ERROR before overwriting.
+     */
+    register(tenantId, providerId, payload, approverIdentity, packBinding) {
+        this.assertTenantContext(tenantId, 'register');
+        this.assertNonEmptyPackBinding(packBinding, 'register');
+        // Permission check
+        const perm = this.permissionChecker.checkPermission(approverIdentity, 'governance.compliance.register');
+        if (!perm.allowed) {
+            throw new AgreementPermissionError(approverIdentity, 'governance.compliance.register', perm.reason);
+        }
+        // Date validation
+        if (payload.expirationDate !== undefined &&
+            payload.effectiveDate > payload.expirationDate) {
+            throw new AgreementRegistrationError(`effectiveDate (${payload.effectiveDate.toISOString()}) must not be after ` +
+                `expirationDate (${payload.expirationDate.toISOString()}).`);
+        }
+        const key = this.tenantKey(tenantId);
+        if (!this.records.has(key)) {
+            this.records.set(key, []);
+        }
+        const tenantRecords = this.records.get(key);
+        // PT-BAA-2: check for document hash tampering on re-registration
+        const existing = tenantRecords.find(r => r.providerId === providerId &&
+            r.agreementKind === payload.kind &&
+            r.effectiveDate.getTime() === payload.effectiveDate.getTime() &&
+            r.status !== 'REVOKED');
+        if (existing && payload.documentSha256 !== undefined) {
+            if (existing.documentSha256 !== undefined &&
+                existing.documentSha256 !== payload.documentSha256) {
+                this.emitEvent({
+                    type: 'AGREEMENT_DOCUMENT_TAMPERED',
+                    severity: 'ERROR',
+                    tenantId,
+                    providerId,
+                    packBinding,
+                    existingId: existing.id,
+                    detail: `Operator submitted a different documentSha256 for an existing ` +
+                        `(tenantId=${tenantId}, providerId=${providerId}, kind=${payload.kind}, ` +
+                        `effectiveDate=${payload.effectiveDate.toISOString()}) agreement. ` +
+                        `Stored: ${existing.documentSha256}, submitted: ${payload.documentSha256}. ` +
+                        `This may indicate the operator replaced the agreement document without ` +
+                        `a formal amendment process. Flag for compliance review.`,
+                });
+            }
+        }
+        const record = {
+            id: `agr_${crypto.randomBytes(8).toString('hex')}`,
+            tenantId,
+            providerId,
+            agreementKind: payload.kind,
+            agreementId: payload.agreementId,
+            effectiveDate: payload.effectiveDate,
+            expirationDate: payload.expirationDate,
+            documentRef: payload.documentRef,
+            documentSha256: payload.documentSha256,
+            signedBy: payload.signedBy,
+            status: 'ACTIVE',
+            packBinding: [...packBinding],
+            createdAt: new Date(),
+            registeredBy: approverIdentity,
+        };
+        tenantRecords.push(record);
+        this.emitEvent({
+            type: 'TENANT_PROVIDER_AGREEMENT_REGISTERED',
+            severity: 'ERROR', // Compliance posture change = audit-grade
+            tenantId,
+            providerId,
+            packBinding,
+            agreementId: record.id,
+            kind: payload.kind,
+            effectiveDate: payload.effectiveDate.toISOString(),
+            expirationDate: payload.expirationDate?.toISOString(),
+            registeredBy: approverIdentity,
+        });
+        return record;
+    }
+    // ---------------------------------------------------------------------------
+    // revoke()
+    // ---------------------------------------------------------------------------
+    /**
+     * Revoke a tenant-provider agreement by kind.
+     *
+     * Operator-only (governance.compliance.register). Mandatory reason.
+     * Sets status REVOKED on all matching ACTIVE records for this (tenant, provider, kind).
+     * Audit-chained as TENANT_PROVIDER_AGREEMENT_REVOKED severity ERROR.
+     */
+    revoke(tenantId, providerId, agreementKind, approverIdentity, reason, packBinding) {
+        this.assertTenantContext(tenantId, 'revoke');
+        this.assertNonEmptyPackBinding(packBinding, 'revoke');
+        if (!reason || reason.trim().length === 0) {
+            throw new AgreementRevocationError(`Revocation requires a non-empty reason string. ` +
+                `Document the reason for revoking the ${agreementKind} agreement with ` +
+                `provider '${providerId}' for tenant '${tenantId}'.`);
+        }
+        const perm = this.permissionChecker.checkPermission(approverIdentity, 'governance.compliance.register');
+        if (!perm.allowed) {
+            throw new AgreementPermissionError(approverIdentity, 'governance.compliance.register', perm.reason);
+        }
+        const key = this.tenantKey(tenantId);
+        const tenantRecords = this.records.get(key) ?? [];
+        const now = new Date();
+        let revokedCount = 0;
+        for (const record of tenantRecords) {
+            if (record.providerId === providerId &&
+                record.agreementKind === agreementKind &&
+                record.status === 'ACTIVE') {
+                record.status = 'REVOKED';
+                record.revokedAt = now;
+                record.revokedReason = reason;
+                revokedCount++;
+            }
+        }
+        this.emitEvent({
+            type: 'TENANT_PROVIDER_AGREEMENT_REVOKED',
+            severity: 'ERROR',
+            tenantId,
+            providerId,
+            packBinding,
+            agreementKind,
+            reason,
+            revokedCount,
+            revokedBy: approverIdentity,
+            revokedAt: now.toISOString(),
+        });
+    }
+    // ---------------------------------------------------------------------------
+    // getActive()
+    // ---------------------------------------------------------------------------
+    /**
+     * Return the first active, non-expired agreement of the given kind for this
+     * (tenantId, providerId) pair, or null if none exists.
+     */
+    getActive(tenantId, providerId, agreementKind) {
+        this.assertTenantContext(tenantId, 'getActive');
+        const key = this.tenantKey(tenantId);
+        const tenantRecords = this.records.get(key) ?? [];
+        const now = new Date();
+        return (tenantRecords.find(r => r.providerId === providerId &&
+            r.agreementKind === agreementKind &&
+            r.status === 'ACTIVE' &&
+            (r.expirationDate === undefined || r.expirationDate > now)) ?? null);
+    }
+    // ---------------------------------------------------------------------------
+    // requireActive()
+    // ---------------------------------------------------------------------------
+    /**
+     * Enforcement gate. Throws MissingTenantProviderAgreementError if any
+     * required kind has no active, non-expired agreement.
+     *
+     * Called by upstream pack evaluation before routing PHI/PII through a provider.
+     * Emits TENANT_PROVIDER_AGREEMENT_GATE_ALLOW or _GATE_DENY (both chained).
+     */
+    requireActive(tenantId, providerId, requiredKinds, packBinding = []) {
+        this.assertTenantContext(tenantId, 'requireActive');
+        const missing = [];
+        for (const kind of requiredKinds) {
+            const active = this.getActive(tenantId, providerId, kind);
+            if (!active) {
+                missing.push(kind);
+            }
+        }
+        if (missing.length > 0) {
+            this.emitEvent({
+                type: 'TENANT_PROVIDER_AGREEMENT_MISSING',
+                severity: 'ERROR',
+                tenantId,
+                providerId,
+                packBinding,
+                missingKinds: missing,
+                requiredKinds,
+            });
+            this.emitEvent({
+                type: 'TENANT_PROVIDER_AGREEMENT_GATE_DENY',
+                severity: 'ERROR',
+                tenantId,
+                providerId,
+                packBinding,
+                missingKinds: missing,
+                requiredKinds,
+            });
+            throw new MissingTenantProviderAgreementError({
+                tenantId,
+                providerId,
+                missingKinds: missing,
+                packBinding,
+            });
+        }
+        this.emitEvent({
+            type: 'TENANT_PROVIDER_AGREEMENT_GATE_ALLOW',
+            severity: 'INFO',
+            tenantId,
+            providerId,
+            packBinding,
+            requiredKinds,
+        });
+    }
+    // ---------------------------------------------------------------------------
+    // listExpiringWithin()
+    // ---------------------------------------------------------------------------
+    /**
+     * Return all ACTIVE agreements expiring within the given number of days.
+     * Used by operator dashboards and automated renewal reminders.
+     */
+    listExpiringWithin(daysAhead) {
+        const cutoff = new Date(Date.now() + daysAhead * 24 * 60 * 60 * 1000);
+        const results = [];
+        for (const [, tenantRecords] of this.records) {
+            for (const record of tenantRecords) {
+                if (record.status === 'ACTIVE' &&
+                    record.expirationDate !== undefined &&
+                    record.expirationDate <= cutoff) {
+                    results.push(record);
+                }
+            }
+        }
+        return results;
+    }
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    tenantKey(tenantId) {
+        return `tenant::${tenantId}`;
+    }
+    /**
+     * Cross-tenant isolation guard.
+     * When the registry is constructed with a tenantContext, only that tenant's
+     * records may be accessed. A different tenantId is a cross-tenant traversal
+     * attempt (PT-BAA-1) and is blocked.
+     */
+    assertTenantContext(tenantId, operation) {
+        if (this.tenantContext !== undefined && this.tenantContext !== tenantId) {
+            throw new Error(`[PT-BAA-1] Cross-tenant access denied. ` +
+                `Registry is scoped to tenant '${this.tenantContext}'; ` +
+                `attempted to '${operation}' for tenant '${tenantId}'. ` +
+                `Cross-tenant agreement lookups are a security boundary violation.`);
+        }
+    }
+    assertNonEmptyPackBinding(packBinding, operation) {
+        if (!packBinding || packBinding.length === 0) {
+            throw new EmptyPackBindingError(operation);
+        }
+    }
+    emitEvent(payload) {
+        const now = new Date().toISOString();
+        const eventContent = JSON.stringify({ ...payload, timestamp: now });
+        const currentSha = crypto.createHash('sha256').update(this.lastSha + eventContent).digest('hex');
+        const event = Object.assign({}, payload, {
+            timestamp: now,
+            prevSha: this.lastSha || undefined,
+        });
+        this.lastSha = currentSha;
+        this.onAudit(event);
+    }
+}
+//# sourceMappingURL=tenant-provider-agreements.js.map

package/dist/esm/governance/tenant-provider-agreements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-provider-agreements.js","sourceRoot":"","sources":["../../../src/governance/tenant-provider-agreements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAmEtC,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IACnD,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,YAAY,CAAW;IACvB,WAAW,CAAW;IAE/B,YAAY,IAKX;QACC,KAAK,CACH,WAAW,IAAI,CAAC,QAAQ,gCAAgC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtF,kBAAkB,IAAI,CAAC,UAAU,oBAAoB;YACrD,yFAAyF;YACzF,wEAAwE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC1G,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,SAAS,CAAS;IAE3B,YAAY,SAAiB;QAC3B,KAAK,CACH,cAAc,SAAS,sCAAsC;YAC3D,iEAAiE;YACjE,+DAA+D,CAClE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,UAAU,CAAS;IAE5B,YAAY,UAAkB,EAAE,MAAc,EAAE,MAAc;QAC5D,KAAK,CACH,mCAAmC,UAAU,iBAAiB,MAAM,MAAM,MAAM,IAAI;YAClF,8EAA8E,CACjF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAoCD,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,OAAO,+BAA+B;IACzB,OAAO,GAAiD,IAAI,GAAG,EAAE,CAAC;IAClE,OAAO,CAAuC;IAC9C,iBAAiB,CAAoB;IACrC,aAAa,CAAU;IAExC,kBAAkB;IACV,OAAO,GAAW,EAAE,CAAC;IAE7B,YAAY,SAAgD,EAAE;QAC5D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI;YACnD,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;SACrF,CAAC;QACF,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC5C,CAAC;IAED,8EAA8E;IAC9E,aAAa;IACb,8EAA8E;IAE9E;;;;;;;;;;OAUG;IACH,QAAQ,CACN,QAAgB,EAChB,UAAkB,EAClB,OAAqC,EACrC,gBAAwB,EACxB,WAAqB;QAErB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAExD,mBAAmB;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CACjD,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,wBAAwB,CAChC,gBAAgB,EAChB,gCAAgC,EAChC,IAAI,CAAC,MAAM,CACZ,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,IACE,OAAO,CAAC,cAAc,KAAK,SAAS;YACpC,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,cAAc,EAC9C,CAAC;YACD,MAAM,IAAI,0BAA0B,CAClC,kBAAkB,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,sBAAsB;gBACzE,mBAAmB,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAE7C,iEAAiE;QACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,UAAU,KAAK,UAAU;YAC3B,CAAC,CAAC,aAAa,KAAK,OAAO,CAAC,IAAI;YAChC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE;YAC7D,CAAC,CAAC,MAAM,KAAK,SAAS,CACzB,CAAC;QAEF,IAAI,QAAQ,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACrD,IACE,QAAQ,CAAC,cAAc,KAAK,SAAS;gBACrC,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,EAClD,CAAC;gBACD,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,6BAA6B;oBACnC,QAAQ,EAAE,OAAO;oBACjB,QAAQ;oBACR,UAAU;oBACV,WAAW;oBACX,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,MAAM,EACJ,gEAAgE;wBAChE,aAAa,QAAQ,gBAAgB,UAAU,UAAU,OAAO,CAAC,IAAI,IAAI;wBACzE,iBAAiB,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE,eAAe;wBACnE,WAAW,QAAQ,CAAC,cAAc,gBAAgB,OAAO,CAAC,cAAc,IAAI;wBAC5E,yEAAyE;wBACzE,yDAAyD;iBAC5D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAkC;YAC5C,EAAE,EAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAClD,QAAQ;YACR,UAAU;YACV,aAAa,EAAE,OAAO,CAAC,IAAI;YAC3B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;YAC7B,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,YAAY,EAAE,gBAAgB;SAC/B,CAAC;QAEF,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3B,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,OAAO,EAAE,0CAA0C;YAC7D,QAAQ;YACR,UAAU;YACV,WAAW;YACX,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE;YAClD,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,WAAW,EAAE;YACrD,YAAY,EAAE,gBAAgB;SAC/B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,WAAW;IACX,8EAA8E;IAE9E;;;;;;OAMG;IACH,MAAM,CACJ,QAAgB,EAChB,UAAkB,EAClB,aAA4B,EAC5B,gBAAwB,EACxB,MAAc,EACd,WAAqB;QAErB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,wBAAwB,CAChC,iDAAiD;gBAC/C,wCAAwC,aAAa,kBAAkB;gBACvE,aAAa,UAAU,iBAAiB,QAAQ,IAAI,CACvD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CACjD,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,wBAAwB,CAChC,gBAAgB,EAChB,gCAAgC,EAChC,IAAI,CAAC,MAAM,CACZ,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IACE,MAAM,CAAC,UAAU,KAAK,UAAU;gBAChC,MAAM,CAAC,aAAa,KAAK,aAAa;gBACtC,MAAM,CAAC,MAAM,KAAK,QAAQ,EAC1B,CAAC;gBACD,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;gBAC1B,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;gBACvB,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;gBAC9B,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,mCAAmC;YACzC,QAAQ,EAAE,OAAO;YACjB,QAAQ;YACR,UAAU;YACV,WAAW;YACX,aAAa;YACb,MAAM;YACN,YAAY;YACZ,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAE9E;;;OAGG;IACH,SAAS,CACP,QAAgB,EAChB,UAAkB,EAClB,aAA4B;QAE5B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,OAAO,CACL,aAAa,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,UAAU,KAAK,UAAU;YAC3B,CAAC,CAAC,aAAa,KAAK,aAAa;YACjC,CAAC,CAAC,MAAM,KAAK,QAAQ;YACrB,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,GAAG,GAAG,CAAC,CAC7D,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;;;;OAMG;IACH,aAAa,CACX,QAAgB,EAChB,UAAkB,EAClB,aAAuB,EACvB,cAAwB,EAAE;QAE1B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACpD,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAqB,CAAC,CAAC;YAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,OAAO;gBACjB,QAAQ;gBACR,UAAU;gBACV,WAAW;gBACX,YAAY,EAAE,OAAO;gBACrB,aAAa;aACd,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,qCAAqC;gBAC3C,QAAQ,EAAE,OAAO;gBACjB,QAAQ;gBACR,UAAU;gBACV,WAAW;gBACX,YAAY,EAAE,OAAO;gBACrB,aAAa;aACd,CAAC,CAAC;YAEH,MAAM,IAAI,mCAAmC,CAAC;gBAC5C,QAAQ;gBACR,UAAU;gBACV,YAAY,EAAE,OAAO;gBACrB,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,sCAAsC;YAC5C,QAAQ,EAAE,MAAM;YAChB,QAAQ;YACR,UAAU;YACV,WAAW;YACX,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E;;;OAGG;IACH,kBAAkB,CAAC,SAAiB;QAClC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACtE,MAAM,OAAO,GAAoC,EAAE,CAAC;QAEpD,KAAK,MAAM,CAAC,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;gBACnC,IACE,MAAM,CAAC,MAAM,KAAK,QAAQ;oBAC1B,MAAM,CAAC,cAAc,KAAK,SAAS;oBACnC,MAAM,CAAC,cAAc,IAAI,MAAM,EAC/B,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAEtE,SAAS,CAAC,QAAgB;QAChC,OAAO,WAAW,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,QAAgB,EAAE,SAAiB;QAC7D,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,yCAAyC;gBACvC,iCAAiC,IAAI,CAAC,aAAa,KAAK;gBACxD,iBAAiB,SAAS,iBAAiB,QAAQ,KAAK;gBACxD,mEAAmE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,yBAAyB,CAAC,WAAqB,EAAE,SAAiB;QACxE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAEO,SAAS,CACf,OAA2D;QAE3D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjG,MAAM,KAAK,GAAwB,MAAM,CAAC,MAAM,CAC9C,EAAE,EACF,OAAO,EACP;YACE,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;SACnC,CACqB,CAAC;QAEzB,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;CACF"}