@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/packs/ca-qc-law25.js

@@ -0,0 +1,188 @@
+/**
+ * Quebec Law 25 -- Provincial Quebec Privacy Pack
+ *
+ * Split notice: Quebec Law 25 was previously bundled with PIPEDA in
+ * `src/packs/pipeda.ts`. Split per Thomas's 2026-04-24 principle: one
+ * country, one regulation, one pack. Federal CA (PIPEDA, OPC-enforced) and
+ * provincial QC (Law 25, CAI-enforced) are distinct jurisdictions with
+ * distinct enforcers.
+ *
+ * Cross-pack interaction: when both ca-pipeda and ca-qc-law25 are active
+ * (Quebec resident's data held by a federally-regulated organization),
+ * strictest-wins applies. Quebec Law 25's enhanced consent requirements
+ * (explicit opt-in, high-risk PIA gate, s. 12.1 ADM information disclosure)
+ * typically govern the data-handling side because they are stricter than
+ * PIPEDA Principles 3-4 defaults. PIPEDA governs inter-provincial transfer
+ * obligations and OPC enforcement pathway. Both breach clocks run in
+ * parallel; the first deadline governs.
+ *
+ * Act to modernize legislative provisions as regards the protection of
+ * personal information (Quebec Law 25, formerly Bill 64). Fully in force
+ * September 22, 2024.
+ *
+ * Standards referenced:
+ *   - Quebec Law 25 (Act to modernize legislative provisions as regards
+ *     the protection of personal information, SQ 2021, c 25)
+ *   - Quebec Law 25 s. 12.1 (ADM information obligations for automated
+ *     decision-making systems, in force Sept 2023)
+ *   - Quebec Law 25 s. 3.3 (high-risk processing PIA requirement)
+ *   - CAI (Commission d'acces a l'information) enforcement guidance
+ *   - OPC-CAI Memorandum of Understanding on coordinated enforcement
+ *
+ * @connexum/ai-governance
+ */
+/**
+ * QC Law 25 category classifiers.
+ * Covers Quebec high-risk personal information categories requiring
+ * enhanced protection under s. 3.3, and Quebec-specific identifiers.
+ */
+export const QC_LAW25_CATEGORY_CLASSIFIERS = {
+    QC_LAW25_PERSONAL_INFO: {
+        references: ['Quebec Law 25 s. 3 -- personal information; any information about an identifiable individual processed by a Quebec-subject organization'],
+        classifier: (input) => {
+            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
+                return true;
+            // Canadian SIN (Social Insurance Number)
+            if (/\b\d{3}[-\s]\d{3}[-\s]\d{3}\b/.test(input))
+                return true;
+            // Canadian postal code (Quebec postal codes start with H, J, or G)
+            if (/\b[HJGhjg]\d[A-Za-z]\s?\d[A-Za-z]\d\b/.test(input))
+                return true;
+            // General Canadian postal code
+            if (/\b[A-Za-z]\d[A-Za-z]\s?\d[A-Za-z]\d\b/.test(input))
+                return true;
+            if (/\b(?:social\s+insurance\s+number|SIN|carte\s+d.assurance.maladie|RAMQ|renseignement\s+personnel)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    QC_LAW25_HIGH_RISK_PI: {
+        references: ['Quebec Law 25 s. 3.3 -- high-risk PI; health + financial + biometric + political / religious opinions + genetic data'],
+        classifier: (input) => {
+            if (/\b(?:health\s+(?:information|record|data)|medical\s+(?:history|record|diagnosis)|dossier\s+(?:medical|de\s+sante))\b/i.test(input))
+                return true;
+            if (/\b(?:biometric\s+(?:data|information)|genetic\s+data|fingerprint|facial\s+recognition|donnee\s+biometrique)\b/i.test(input))
+                return true;
+            if (/\b(?:financial\s+(?:account|statement)|credit\s+(?:score|report)|renseignement\s+(?:financier|de\s+sante))\b/i.test(input))
+                return true;
+            if (/\b(?:political\s+opinion|religious\s+belief|racial\s+origin|ethnic\s+origin|sexual\s+orientation|opinion\s+politique|croyance\s+religieuse)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    QC_LAW25_ADM_OUTPUT: {
+        references: ['Quebec Law 25 s. 12.1 -- automated decision-making information obligations; individual right to know ADM is used and to obtain human review'],
+        classifier: (input) => {
+            if (/\b(?:automated.decision|decision.automatisee|algorithmic.decision|profiling.output|systeme.de.decision.automatisee|ADM.output|QC_LAW25_ADM_OUTPUT)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+export const QC_LAW25_PACK = {
+    categoryClassifiers: QC_LAW25_CATEGORY_CLASSIFIERS,
+    /**
+     * P3.5: Quebec personal information and high-risk categories are
+     * subject-keyed per Quebec Law 25. Each event must carry a data
+     * subject ID to satisfy CAI audit obligations.
+     */
+    subjectKeyedCategories: ['QC_LAW25_PERSONAL_INFO', 'QC_LAW25_HIGH_RISK_PI'],
+    id: 'ca-qc-law25',
+    name: 'Quebec Law 25 (Canada -- Provincial Quebec)',
+    version: '1.0.0',
+    description: 'Quebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information, SQ 2021 c 25). CAI-enforced. Fully in force September 2024. Adds AI-specific ADM disclosure (s. 12.1), high-risk PIA gate (s. 3.3), explicit consent requirements. Activate alongside ca-pipeda for complete Quebec compliance.',
+    authority: 'Commission d\'acces a l\'information (CAI) -- Quebec provincial privacy regulator',
+    industries: ['all-ca', 'saas', 'fintech', 'healthcare-ca', 'ecommerce', 'quebec-private-sector'],
+    requiredModules: [
+        { name: 'governance-runtime', required: true, reason: 'Meaningful consent per identifiable purpose + Quebec high-risk review gate', reference: 'Quebec Law 25 s. 3.3; PIPEDA Schedule 1 Principle 3 (incorporated by reference)' },
+        { name: 'audit-integrity', required: true, reason: 'Processing records + CAI-required breach log retention', reference: 'Quebec Law 25 s. 3.5; Breach notification requirements' },
+        { name: 'data-classifier', required: true, reason: 'QC_LAW25_PERSONAL_INFO + QC_LAW25_HIGH_RISK_PI + QC_LAW25_ADM_OUTPUT classification', reference: 'Quebec Law 25 s. 3.3' },
+        { name: 'session-persistence', required: true, reason: 'Consent withdrawal continuity + DSR state', reference: 'Quebec Law 25 consent and access rights' },
+        { name: 'supply-chain', required: true, reason: 'Cross-border transfer safeguards + confidentiality undertakings for Quebec residents\' data', reference: 'Quebec Law 25 s. 17 (cross-border disclosure conditions)' },
+        { name: 'approval-queue', required: true, reason: 'High-risk processing PIA gate; human review for automated decisions affecting individuals', reference: 'Quebec Law 25 s. 3.3; s. 12.1' },
+        { name: 'attestation-manager', required: true, reason: 'Privacy Management Program + accountable individual + PIA documentation', reference: 'Quebec Law 25 s. 3.3; OPC-CAI joint accountability guidance' },
+        { name: 'data-subject-rights', required: true, reason: 'Access + correction + portability + right to know ADM used + human review right', reference: 'Quebec Law 25 subject rights provisions' },
+        { name: 'transparency-injector', required: true, reason: 'Quebec Law 25 s. 12.1 ADM information obligations -- must inform individuals that automated decision-making is used', reference: 'Quebec Law 25 s. 12.1' },
+        { name: 'event-bus', required: true, reason: 'CAI breach notification clock; incident escalation to CAI and affected individuals', reference: 'Quebec Law 25 breach notification requirements' },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            meaningfulConsentRequired: true,
+            quebecLaw25HighRiskReviewRequired: true,
+        },
+        'data-classifier': {
+            enabledCategories: ['QC_LAW25_PERSONAL_INFO', 'QC_LAW25_HIGH_RISK_PI', 'QC_LAW25_ADM_OUTPUT'],
+            quebecHighRiskAction: 'BLOCK_WITHOUT_PIA',
+        },
+        'session-persistence': {
+            consentWithdrawalSupportRequired: true,
+        },
+        'supply-chain': {
+            crossBorderSafeguardsRequired: true,
+            quebecCrossBorderConfidentialityUndertakingRequired: true,
+        },
+        'approval-queue': {
+            highRiskProcessingReviewRequired: true,
+            quebecAdmHumanReviewRequired: true,
+        },
+        'attestation-manager': {
+            privacyManagementProgramRequired: true,
+            accountableIndividualRequired: true,
+            quebecPiaRequired: true,
+            breachLogRetentionDays: 730, // 24 months per breach regulation
+        },
+        'data-subject-rights': {
+            responseDeadlineDays: 30,
+            supportedRights: ['ACCESS', 'CORRECTION', 'PORTABILITY', 'ADM_INFORMATION', 'HUMAN_REVIEW_OF_ADM'],
+        },
+        'transparency-injector': {
+            quebecLaw25AdmInformationRequired: true,
+        },
+        'event-bus': {
+            caiBreachNotificationActive: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: [],
+        requiredCapabilities: ['PIPEDA-READY', 'QUEBEC-LAW25-READY'],
+        blockReasons: {},
+    },
+    dataPolicy: {
+        scanCategories: ['QC_LAW25_PERSONAL_INFO', 'QC_LAW25_HIGH_RISK_PI', 'QC_LAW25_ADM_OUTPUT'],
+        categoryActions: {
+            QC_LAW25_PERSONAL_INFO: 'WARN',
+            QC_LAW25_HIGH_RISK_PI: 'BLOCK',
+            QC_LAW25_ADM_OUTPUT: 'REQUIRE_APPROVAL',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'CONFIDENTIAL',
+    },
+    retentionPolicy: {
+        sovereignty: ['CA-QC'],
+        auditLogRetentionDays: 1095, // 3 years default
+        sessionRetentionDays: 365,
+        incidentRetentionDays: 730, // 24 months per Quebec breach regulation
+        reference: 'Quebec Law 25 breach notification requirements; CAI guidance on data retention; Pax1 default 3 years',
+    },
+    incidentPolicy: {
+        notificationDeadlineHours: 72,
+        reference: 'Quebec Law 25 -- breach notification to CAI and affected individuals when risk of serious injury. Pax1 default 72h.',
+        requiredRecipients: ['cai', 'accountable-individual', 'affected-individuals'],
+        formalNotificationRequired: true,
+    },
+    // F-NEW-VERA-PACK-FINAL-006 (2026-05-03): renamed 6 borrowed pipeda_* check IDs to
+    // ca_qc_law25_* namespace. ca-pipeda validators continue to use pipeda_* (unchanged).
+    // New checks registered in src/packs/check-registry.ts.
+    validators: [
+        { id: 'qc-law25-consent', description: 'Meaningful consent per identifiable purpose (Quebec enhanced standard)', reference: 'Quebec Law 25 consent provisions; PIPEDA Schedule 1 Principle 3 (incorporated)', check: 'ca_qc_law25_consent_active', failSeverity: 'CRITICAL' },
+        { id: 'qc-law25-high-risk-review', description: 'High-risk processing PIA gate active', reference: 'Quebec Law 25 s. 3.3', check: 'ca_qc_law25_high_risk_review_active', failSeverity: 'CRITICAL' },
+        { id: 'qc-law25-adm-info', description: 'Quebec Law 25 s. 12.1 ADM information obligations active', reference: 'Quebec Law 25 s. 12.1', check: 'quebec_law25_adm_active', failSeverity: 'HIGH' },
+        { id: 'qc-law25-pia', description: 'Quebec Law 25 PIA for high-risk processing active', reference: 'Quebec Law 25 s. 3.3', check: 'quebec_law25_pia_active', failSeverity: 'HIGH' },
+        { id: 'qc-law25-breach-log', description: '24-month breach log retention', reference: 'Quebec Law 25 breach notification requirements', check: 'ca_qc_law25_breach_log_active', failSeverity: 'HIGH' },
+        { id: 'qc-law25-dsr', description: 'Access + correction + portability + ADM information + human review DSR workflow', reference: 'Quebec Law 25 subject rights provisions', check: 'ca_qc_law25_dsr_active', failSeverity: 'HIGH' },
+        { id: 'qc-law25-cross-border', description: 'Cross-border transfer safeguards + confidentiality undertakings', reference: 'Quebec Law 25 s. 17', check: 'ca_qc_law25_cross_border_active', failSeverity: 'HIGH' },
+        { id: 'qc-law25-breach-notification', description: 'CAI breach notification on risk of serious injury', reference: 'Quebec Law 25 breach notification requirements', check: 'ca_qc_law25_breach_notification_active', failSeverity: 'CRITICAL' },
+    ],
+};
+//# sourceMappingURL=ca-qc-law25.js.map

package/dist/esm/packs/ca-qc-law25.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca-qc-law25.js","sourceRoot":"","sources":["../../../src/packs/ca-qc-law25.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwB;IAChE,sBAAsB,EAAE;QACtB,UAAU,EAAE,CAAC,yIAAyI,CAAC;QACvJ,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,yCAAyC;YACzC,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7D,mEAAmE;YACnE,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrE,+BAA+B;YAC/B,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrE,IAAI,qGAAqG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,qBAAqB,EAAE;QACrB,UAAU,EAAE,CAAC,sHAAsH,CAAC;QACpI,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,uHAAuH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrJ,IAAI,gHAAgH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9I,IAAI,+GAA+G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7I,IAAI,gJAAgJ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9K,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,mBAAmB,EAAE;QACnB,UAAU,EAAE,CAAC,6IAA6I,CAAC;QAC3J,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,uJAAuJ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrL,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAoG;IAC5H,mBAAmB,EAAE,6BAA6B;IAClD;;;;OAIG;IACH,sBAAsB,EAAE,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;IAC3E,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,6CAA6C;IACnD,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,2UAA2U;IAC7U,SAAS,EAAE,mFAAmF;IAC9F,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,uBAAuB,CAAC;IAEhG,eAAe,EAAE;QACf,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,4EAA4E,EAAE,SAAS,EAAE,iFAAiF,EAAE;QAClO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wDAAwD,EAAE,SAAS,EAAE,wDAAwD,EAAE;QAClL,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,qFAAqF,EAAE,SAAS,EAAE,sBAAsB,EAAE;QAC7K,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,2CAA2C,EAAE,SAAS,EAAE,yCAAyC,EAAE;QAC1J,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,6FAA6F,EAAE,SAAS,EAAE,0DAA0D,EAAE;QACtN,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,2FAA2F,EAAE,SAAS,EAAE,+BAA+B,EAAE;QAC3L,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,yEAAyE,EAAE,SAAS,EAAE,6DAA6D,EAAE;QAC5M,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iFAAiF,EAAE,SAAS,EAAE,yCAAyC,EAAE;QAChM,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,qHAAqH,EAAE,SAAS,EAAE,uBAAuB,EAAE;QACpN,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,oFAAoF,EAAE,SAAS,EAAE,gDAAgD,EAAE;KACjM;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,yBAAyB,EAAE,IAAI;YAC/B,iCAAiC,EAAE,IAAI;SACxC;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,CAAC,wBAAwB,EAAE,uBAAuB,EAAE,qBAAqB,CAAC;YAC7F,oBAAoB,EAAE,mBAAmB;SAC1C;QACD,qBAAqB,EAAE;YACrB,gCAAgC,EAAE,IAAI;SACvC;QACD,cAAc,EAAE;YACd,6BAA6B,EAAE,IAAI;YACnC,mDAAmD,EAAE,IAAI;SAC1D;QACD,gBAAgB,EAAE;YAChB,gCAAgC,EAAE,IAAI;YACtC,4BAA4B,EAAE,IAAI;SACnC;QACD,qBAAqB,EAAE;YACrB,gCAAgC,EAAE,IAAI;YACtC,6BAA6B,EAAE,IAAI;YACnC,iBAAiB,EAAE,IAAI;YACvB,sBAAsB,EAAE,GAAG,EAAE,kCAAkC;SAChE;QACD,qBAAqB,EAAE;YACrB,oBAAoB,EAAE,EAAE;YACxB,eAAe,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,qBAAqB,CAAC;SACnG;QACD,uBAAuB,EAAE;YACvB,iCAAiC,EAAE,IAAI;SACxC;QACD,WAAW,EAAE;YACX,2BAA2B,EAAE,IAAI;SAClC;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,CAAC,cAAc,EAAE,oBAAoB,CAAC;QAC5D,YAAY,EAAE,EAAE;KACjB;IAED,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,wBAAwB,EAAE,uBAAuB,EAAE,qBAAqB,CAAC;QAC1F,eAAe,EAAE;YACf,sBAAsB,EAAE,MAAM;YAC9B,qBAAqB,EAAE,OAAO;YAC9B,mBAAmB,EAAE,kBAAkB;SACxC;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,cAAc;KACtC;IAED,eAAe,EAAE;QACf,WAAW,EAAE,CAAC,OAAO,CAAC;QACtB,qBAAqB,EAAE,IAAI,EAAE,kBAAkB;QAC/C,oBAAoB,EAAE,GAAG;QACzB,qBAAqB,EAAE,GAAG,EAAE,yCAAyC;QACrE,SAAS,EAAE,sGAAsG;KAClH;IAED,cAAc,EAAE;QACd,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EAAE,qHAAqH;QAChI,kBAAkB,EAAE,CAAC,KAAK,EAAE,wBAAwB,EAAE,sBAAsB,CAAC;QAC7E,0BAA0B,EAAE,IAAI;KACjC;IAED,mFAAmF;IACnF,sFAAsF;IACtF,wDAAwD;IACxD,UAAU,EAAE;QACV,EAAE,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE,wEAAwE,EAAE,SAAS,EAAE,gFAAgF,EAAE,KAAK,EAAE,4BAA4B,EAAE,YAAY,EAAE,UAAU,EAAE;QAC7Q,EAAE,EAAE,EAAE,2BAA2B,EAAE,WAAW,EAAE,sCAAsC,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,qCAAqC,EAAE,YAAY,EAAE,UAAU,EAAE;QACnM,EAAE,EAAE,EAAE,mBAAmB,EAAE,WAAW,EAAE,0DAA0D,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,EAAE;QAChM,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,mDAAmD,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,EAAE;QACnL,EAAE,EAAE,EAAE,qBAAqB,EAAE,WAAW,EAAE,+BAA+B,EAAE,SAAS,EAAE,gDAAgD,EAAE,KAAK,EAAE,+BAA+B,EAAE,YAAY,EAAE,MAAM,EAAE;QACtM,EAAE,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,iFAAiF,EAAE,SAAS,EAAE,yCAAyC,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,EAAE;QACnO,EAAE,EAAE,EAAE,uBAAuB,EAAE,WAAW,EAAE,iEAAiE,EAAE,SAAS,EAAE,qBAAqB,EAAE,KAAK,EAAE,iCAAiC,EAAE,YAAY,EAAE,MAAM,EAAE;QACjN,EAAE,EAAE,EAAE,8BAA8B,EAAE,WAAW,EAAE,mDAAmD,EAAE,SAAS,EAAE,gDAAgD,EAAE,KAAK,EAAE,wCAAwC,EAAE,YAAY,EAAE,UAAU,EAAE;KACjP;CACF,CAAC"}

package/dist/esm/packs/caldicott-principles.js

@@ -0,0 +1,441 @@
+/**
+ * Caldicott Principles Compliance Pack
+ *
+ * Framework:
+ *   The Caldicott Principles (eight, 2020 revision) — the UK's foundational
+ *   principles for handling patient confidential information across health
+ *   and adult social care. Originally published as six principles (Caldicott
+ *   Review 1997), expanded to seven (Caldicott Review 2 / Information
+ *   Governance Review 2013), and finalised at eight in the 2020 revision
+ *   under the National Data Guardian.
+ *
+ *   The Caldicott Guardian is the named role inside each NHS organisation
+ *   (and many adult-social-care organisations) responsible for ensuring
+ *   patient confidential information is handled in line with the
+ *   principles. The Caldicott Guardian Manual (NHS England, current
+ *   edition) sets the operational expectations.
+ *
+ * Jurisdiction: GB — England-led; equivalent practice in Scotland, Wales,
+ *   and Northern Ireland under their devolved health bodies.
+ * Authority: National Data Guardian (NDG, statutory under Health and Social
+ *   Care (National Data Guardian) Act 2018) + Caldicott Guardian (named
+ *   role within each organisation) + UK Caldicott Guardian Council
+ *   (UKCGC, professional support body)
+ *
+ * The Eight Caldicott Principles (2020 revision):
+ *   1. Justify the purpose(s) for using confidential information
+ *   2. Use confidential information only when it is necessary
+ *   3. Use the minimum necessary confidential information
+ *   4. Access to confidential information should be on a strict
+ *      need-to-know basis
+ *   5. Everyone with access to confidential information should be aware
+ *      of their responsibilities
+ *   6. Comply with the law (UK GDPR, DPA 2018, Common Law Duty of
+ *      Confidentiality, statutory duty to share, etc.)
+ *   7. The duty to share information for individual care is as important
+ *      as the duty to protect patient confidentiality
+ *   8. Inform patients and service users about how their confidential
+ *      information is used
+ *
+ * Why this pack:
+ *   - Required of every NHS organisation and any supplier processing
+ *     patient confidential information for direct care purposes; widely
+ *     adopted in adult social care.
+ *   - DTAC pack (PR #404) currently captures Caldicott Guardian
+ *     designation as a transitional measure
+ *     (`caldicottHandlingMode: 'TRANSITIONAL_LOCAL'`). When this
+ *     standalone pack is registered alongside DTAC, DTAC defers
+ *     Caldicott enforcement to this pack. NHS DSPT pack (PR #395)
+ *     similarly references Caldicott Guardian sign-off — the role-
+ *     designation now has a single source of truth.
+ *   - Pairs with: NHS DSPT (data security baseline), nhs-clinical-safety
+ *     (DCB0129/0160), uk-gdpr (Article 6/9 lawful basis), and DTAC
+ *     (composite assessment).
+ *
+ * Distinction from UK GDPR pack:
+ *   - UK GDPR governs all personal-data handling (NHS or otherwise).
+ *   - Caldicott governs the additional NHS-specific obligations on
+ *     confidential patient information including the duty-to-share
+ *     side (principle 7) which is not present in UK GDPR. A processor
+ *     handling NHS patient data needs BOTH packs active.
+ *
+ * Out of scope:
+ *   - Data security technical baseline (separate pack: nhs-dspt)
+ *   - Clinical safety case (separate pack: nhs-clinical-safety)
+ *   - SaMD UKCA marking (separate pack: mhra-samd-ukca)
+ *   - General UK personal-data handling (separate pack: uk-gdpr)
+ *
+ * @connexum/ai-governance
+ */
+/**
+ * Caldicott category classifiers.
+ *
+ * Pack scope is the Caldicott-evidence layer: justification records,
+ * Caldicott Guardian sign-off, need-to-know access decisions, duty-to-
+ * share decisions, patient-facing transparency artefacts. Underlying
+ * NHS-data classification (NHS Number, SNOMED-CT, ICD-10) is delegated
+ * to the nhs-dspt pack; UK GDPR personal-data classification is
+ * delegated to the uk-gdpr pack.
+ */
+export const CALDICOTT_CATEGORY_CLASSIFIERS = {
+    PURPOSE_JUSTIFICATION: {
+        references: [
+            'Caldicott Principle 1: Justify the purpose(s) for using confidential information',
+            'Caldicott Principle 2: Use confidential information only when it is necessary',
+        ],
+        classifier: (input) => {
+            if (/\b(?:purpose\s+(?:justification|of\s+use|for\s+access)|caldicott\s+principle\s+1)\b/i.test(input))
+                return true;
+            if (/\b(?:lawful\s+basis\s+caldicott|necessity\s+test|why\s+do\s+we\s+need\s+this\s+(?:patient|confidential)\s+information)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    MINIMUM_NECESSARY_DECISION: {
+        references: [
+            'Caldicott Principle 3: Use the minimum necessary confidential information',
+        ],
+        classifier: (input) => {
+            if (/\b(?:minimum\s+necessary|min[\s-]?necessary\s+(?:check|decision|review))\b/i.test(input))
+                return true;
+            if (/\b(?:data\s+minimisation\s+(?:nhs|caldicott)|fields\s+(?:redacted|removed|excluded))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    NEED_TO_KNOW_ACCESS: {
+        references: [
+            'Caldicott Principle 4: Access to confidential information should be on a strict need-to-know basis',
+        ],
+        classifier: (input) => {
+            if (/\b(?:need[\s-]?to[\s-]?know\s+(?:access|decision|justification)|ntk\s+gate)\b/i.test(input))
+                return true;
+            if (/\b(?:role[\s-]?based\s+access\s+caldicott|smartcard\s+role|role\s+profile\s+nhs)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    DUTY_TO_SHARE: {
+        references: [
+            'Caldicott Principle 7: The duty to share information for individual care is as important as the duty to protect patient confidentiality',
+        ],
+        classifier: (input) => {
+            if (/\b(?:duty[\s-]?to[\s-]?share|principle\s+7\s+caldicott|share\s+for\s+(?:individual|direct)\s+care)\b/i.test(input))
+                return true;
+            if (/\b(?:cross[\s-]?(?:trust|provider|organisation)\s+share|interoperability\s+share\s+decision)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CALDICOTT_GUARDIAN_DESIGNATION: {
+        references: [
+            'Caldicott Guardian Manual (NHS England) — designation requirements',
+            'UK Caldicott Guardian Council (UKCGC) registration',
+        ],
+        classifier: (input) => {
+            if (/\b(?:caldicott\s+guardian\s+(?:designation|named|appointed|delegation|registration)|cg\s+sign[\s-]?off)\b/i.test(input))
+                return true;
+            if (/\b(?:ukcgc\s+register|caldicott\s+log\s+entry|caldicott\s+council)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PATIENT_TRANSPARENCY: {
+        references: [
+            'Caldicott Principle 8: Inform patients and service users about how their confidential information is used',
+            'NHS Privacy Notice + Patient Information Standard',
+        ],
+        classifier: (input) => {
+            if (/\b(?:patient[\s-]?facing\s+(?:notice|disclosure|information)|nhs\s+privacy\s+notice|fair\s+processing\s+notice)\b/i.test(input))
+                return true;
+            if (/\b(?:national\s+data\s+opt[\s-]?out|type\s+1\s+opt[\s-]?out|patient\s+information\s+standard)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['Cross-pack secrets safety; Caldicott Guardian artefacts must not embed credentials'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+export const CALDICOTT_PRINCIPLES_PACK = {
+    categoryClassifiers: CALDICOTT_CATEGORY_CLASSIFIERS,
+    id: 'caldicott-principles',
+    aliases: [
+        'caldicott',
+        'caldicott-principles-2020',
+        'caldicott-guardian',
+        'ndg-caldicott',
+        'uk-caldicott',
+    ],
+    name: 'Caldicott Principles (2020 revision)',
+    version: '1.0.0',
+    description: 'Caldicott Principles eight (2020 revision) covering NHS-specific patient confidential information handling: purpose justification, necessity test, minimum-necessary decisions, need-to-know access gating, role awareness, lawful-basis compliance, duty-to-share for individual care (principle 7), and patient-facing transparency. Caldicott Guardian named-role designation captured here as the single source of truth — NHS DSPT pack (PR #395) and DTAC pack (PR #404) both defer to this pack for Caldicott Guardian sign-off when this pack is registered. Pairs with UK GDPR (general personal-data handling), NHS DSPT (technical security baseline), nhs-clinical-safety (clinical safety case), and DTAC (composite assessment).',
+    authority: 'National Data Guardian (NDG, statutory under Health and Social Care (National Data Guardian) Act 2018) + Caldicott Guardian (named role) + UK Caldicott Guardian Council (UKCGC)',
+    industries: ['healthcare', 'pharma', 'public-sector', 'social-care', 'digital-health', 'clinical-research'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Caldicott Principle 1 (justify purpose) + Principle 2 (only when necessary) + Principle 3 (minimum necessary) form a default-deny gate on patient confidential information access. Every access path must carry a recorded purpose and necessity rationale.',
+            reference: 'Caldicott Principles 1-3, 2020 revision',
+        },
+        {
+            name: 'agent-auth',
+            required: true,
+            reason: 'Caldicott Principle 4 need-to-know enforcement: role-based access binding to NHS smartcard / role profile; access denied unless caller has the role + need-to-know justification on the record.',
+            reference: 'Caldicott Principle 4; NHS Identity and Access Management standard',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Caldicott Guardian (T2 named-role) sign-off gate on (a) non-routine sharing, (b) cross-trust transfers, (c) duty-to-share decisions where consent is absent, (d) cross-organisation interoperability shares.',
+            reference: 'Caldicott Principles 6 + 7; Caldicott Guardian Manual sign-off requirements',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident audit chain for purpose justification records, Caldicott Guardian sign-off events, need-to-know access decisions, duty-to-share decisions, and patient-facing transparency artefact versions.',
+            reference: 'Caldicott Principle 5 (awareness of responsibilities); UK GDPR Art. 5(2) accountability overlay',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'Caldicott Guardian designation (named role + UKCGC registration) tracked; per-organisation Caldicott Guardian record; annual training attestation for staff with patient-data access.',
+            reference: 'Caldicott Guardian Manual; UKCGC registration',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Surface Caldicott-specific evidence categories for the audit trail and the Caldicott Guardian dashboard; cross-pack overlap with nhs-dspt (NHS Number / clinical codes) and uk-gdpr (PII) for cross-pack reporting.',
+            reference: 'Caldicott Principles operational evidence',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'Caldicott Principle 8: patient-facing transparency. NHS Privacy Notice publication, National Data Opt-Out compliance, patient-information-standard surface for AI-generated outputs.',
+            reference: 'Caldicott Principle 8; National Data Opt-Out policy 2018',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Caldicott Guardian notification events (non-routine sharing requests, duty-to-share decisions, cross-organisation transfers); aggregate metric for the Caldicott Guardian annual report to the SIRO.',
+            reference: 'Caldicott Guardian Manual annual report obligations',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Purpose-justification records and Caldicott Guardian sign-offs retained alongside the underlying clinical record (8-year clinical record default per nhs-dspt pack; 25-year paediatric / 30-year maternity overrides on the underlying record).',
+            reference: 'NHS Records Management Code of Practice 2021; UK GDPR Art. 5(1)(e)',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Caldicott Principle 6 lawful-basis compliance flows down to processors; sub-supplier Caldicott posture recorded.',
+            reference: 'Caldicott Principle 6; UK GDPR Art. 28',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            caldicottPrinciple1JustifyPurposeRequired: true,
+            caldicottPrinciple2NecessityTestRequired: true,
+            caldicottPrinciple3MinimumNecessaryEnforced: true,
+        },
+        'agent-auth': {
+            caldicottPrinciple4NeedToKnowGateRequired: true,
+            nhsSmartcardRoleBindingSupported: true,
+            accessDenialOnMissingNeedToKnow: true,
+        },
+        'approval-queue': {
+            caldicottGuardianSignOffRequired: true,
+            nonRoutineSharingApprovalRequired: true,
+            crossTrustTransferApprovalRequired: true,
+            dutyToShareDecisionApprovalRequired: true,
+            reviewTier: 'T2',
+            reviewerCompetence: 'CALDICOTT_GUARDIAN',
+        },
+        'attestation-manager': {
+            caldicottGuardianDesignationTracked: true,
+            ukcgcRegistrationTracked: true,
+            annualTrainingAttestationRequired: true,
+        },
+        'data-classifier': {
+            enabledCategories: [
+                'PURPOSE_JUSTIFICATION',
+                'MINIMUM_NECESSARY_DECISION',
+                'NEED_TO_KNOW_ACCESS',
+                'DUTY_TO_SHARE',
+                'CALDICOTT_GUARDIAN_DESIGNATION',
+                'PATIENT_TRANSPARENCY',
+                'CREDENTIALS',
+            ],
+            credentialsAction: 'BLOCK',
+        },
+        'transparency-injector': {
+            caldicottPrinciple8TransparencyRequired: true,
+            nhsPrivacyNoticePublicationRequired: true,
+            nationalDataOptOutHonoured: true,
+        },
+        'event-bus': {
+            caldicottGuardianNotificationsRoutingRequired: true,
+            annualReportAggregationRequired: true,
+        },
+        'audit-integrity': {
+            tamperEvidentRequired: true,
+        },
+        'session-persistence': {
+            retentionAlignmentWithUnderlyingClinicalRecord: true,
+        },
+        'supply-chain': {
+            processorCaldicottPostureRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['DATA-RESIDENCY-UK', 'PROCESSOR-CONTRACT', 'NHS-DSPT-SUBSCRIBED'],
+        blockReasons: {
+            deepseek: 'PRC jurisdiction. Patient confidential information must reside in UK or adequate jurisdiction; PRC routing is incompatible with Caldicott Principle 6 lawful-basis compliance for NHS data.',
+            baidu: 'PRC jurisdiction. NHS patient confidential information cannot route through PRC infrastructure.',
+            alibaba: 'PRC jurisdiction. NHS patient confidential information cannot route through PRC infrastructure.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: [
+            'PURPOSE_JUSTIFICATION',
+            'MINIMUM_NECESSARY_DECISION',
+            'NEED_TO_KNOW_ACCESS',
+            'DUTY_TO_SHARE',
+            'CALDICOTT_GUARDIAN_DESIGNATION',
+            'PATIENT_TRANSPARENCY',
+            'CREDENTIALS',
+        ],
+        categoryActions: {
+            PURPOSE_JUSTIFICATION: 'WARN',
+            MINIMUM_NECESSARY_DECISION: 'WARN',
+            NEED_TO_KNOW_ACCESS: 'WARN',
+            DUTY_TO_SHARE: 'WARN',
+            CALDICOTT_GUARDIAN_DESIGNATION: 'WARN',
+            PATIENT_TRANSPARENCY: 'WARN',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        // Caldicott evidence is held alongside the underlying clinical record:
+        // 8-year adult clinical default per nhs-dspt + Records Management Code of
+        // Practice 2021. Paediatric (25-year) and maternity (30-year) overrides
+        // ride on the clinical-record metadata.
+        auditLogRetentionDays: 2920, // 8 years
+        sessionRetentionDays: 2920,
+        incidentRetentionDays: 2920,
+        reference: 'Aligned with NHS Records Management Code of Practice 2021; Caldicott audit alongside clinical record',
+        forceDelete: false,
+        requiresLegalHoldSupport: true,
+        sovereignty: ['gb'],
+    },
+    incidentPolicy: {
+        // No standalone Caldicott notification window; defers to UK GDPR Art. 33
+        // (72-hour ICO) when personal data breach, NHS DSPT CareCERT for cyber
+        // incidents, and PSIRF for clinical-safety incidents. Caldicott Guardian
+        // notification is mandatory in parallel.
+        notificationDeadlineHours: 72,
+        reference: 'UK GDPR Art. 33 (72-hour ICO) overlay; NHS DSPT CareCERT; PSIRF; Caldicott Guardian parallel notification',
+        requiredRecipients: [
+            'caldicott-guardian',
+            'data-protection-officer',
+            'senior-information-risk-owner',
+            'ico',
+        ],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'caldicott-purpose-justification',
+            description: 'Every patient-confidential-information access path carries a recorded purpose justification and necessity-test outcome.',
+            reference: 'Caldicott Principles 1 + 2',
+            check: 'governance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'caldicott-minimum-necessary',
+            description: 'Minimum-necessary decision recorded for every share / access; data minimisation enforced.',
+            reference: 'Caldicott Principle 3',
+            check: 'governance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'caldicott-need-to-know',
+            description: 'Strict need-to-know access gate active; role binding to NHS smartcard / role profile.',
+            reference: 'Caldicott Principle 4',
+            check: 'rbac_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'caldicott-guardian-designated',
+            description: 'Caldicott Guardian named-role designation recorded; UKCGC registration current; sign-off path wired into approval-queue.',
+            reference: 'Caldicott Guardian Manual; UKCGC',
+            check: 'attestation_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'caldicott-guardian-signoff-on-non-routine',
+            description: 'Caldicott Guardian sign-off captured on non-routine sharing, cross-trust transfers, and duty-to-share decisions.',
+            reference: 'Caldicott Principles 6 + 7; Caldicott Guardian Manual',
+            check: 'approval_queue_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'caldicott-duty-to-share',
+            description: 'Principle 7 duty-to-share decisions captured as first-class; refusal-to-share decisions also justified.',
+            reference: 'Caldicott Principle 7 (2020 revision)',
+            check: 'governance_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'caldicott-patient-transparency',
+            description: 'NHS Privacy Notice published; National Data Opt-Out honoured for non-direct-care use (research, planning).',
+            reference: 'Caldicott Principle 8; National Data Opt-Out policy 2018',
+            check: 'transparency_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'caldicott-annual-training',
+            description: 'Annual Caldicott / data-security training attestation recorded for all staff with patient-data access.',
+            reference: 'Caldicott Principle 5; NDG Data Security Standard #3',
+            check: 'attestation_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'caldicott-audit-trail',
+            description: 'Tamper-evident audit trail covers purpose justifications, Caldicott Guardian sign-off events, need-to-know access decisions, and patient-transparency artefact versions.',
+            reference: 'Caldicott Principle 5; UK GDPR Art. 5(2)',
+            check: 'audit_trail_exists',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'caldicott-supplier-flow-down',
+            description: 'Sub-supplier Caldicott posture recorded; data processor contracts include Caldicott obligations.',
+            reference: 'Caldicott Principle 6; UK GDPR Art. 28',
+            check: 'subservice_registry_active',
+            failSeverity: 'MEDIUM',
+        },
+        {
+            id: 'caldicott-encryption',
+            description: 'Patient confidential information encrypted at rest and in transit; consistent with NHS DSPT Section 7 and UK GDPR Art. 32.',
+            reference: 'NHS DSPT Section 7; UK GDPR Art. 32(1)(a)',
+            check: 'encryption_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=caldicott-principles.js.map

package/dist/esm/packs/caldicott-principles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caldicott-principles.js","sourceRoot":"","sources":["../../../src/packs/caldicott-principles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAKH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB;IACjE,qBAAqB,EAAE;QACrB,UAAU,EAAE;YACV,kFAAkF;YAClF,+EAA+E;SAChF;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,sFAAsF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpH,IAAI,2HAA2H,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE;YACV,2EAA2E;SAC5E;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,6EAA6E,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3G,IAAI,yFAAyF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,mBAAmB,EAAE;QACnB,UAAU,EAAE;YACV,oGAAoG;SACrG;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gFAAgF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9G,IAAI,qFAAqF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnH,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,aAAa,EAAE;QACb,UAAU,EAAE;YACV,yIAAyI;SAC1I;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,uGAAuG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrI,IAAI,iGAAiG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,8BAA8B,EAAE;QAC9B,UAAU,EAAE;YACV,oEAAoE;YACpE,oDAAoD;SACrD;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,4GAA4G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1I,IAAI,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,oBAAoB,EAAE;QACpB,UAAU,EAAE;YACV,2GAA2G;YAC3G,mDAAmD;SACpD;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,oHAAoH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClJ,IAAI,kGAAkG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,oFAAoF,CAAC;QAClG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAkE;IACtG,mBAAmB,EAAE,8BAA8B;IACnD,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EAAE;QACP,WAAW;QACX,2BAA2B;QAC3B,oBAAoB;QACpB,eAAe;QACf,cAAc;KACf;IACD,IAAI,EAAE,sCAAsC;IAC5C,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,gtBAAgtB;IACltB,SAAS,EAAE,kLAAkL;IAC7L,UAAU,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,CAAC;IAE3G,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6PAA6P;YACrQ,SAAS,EAAE,yCAAyC;SACrD;QACD;YACE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iMAAiM;YACzM,SAAS,EAAE,oEAAoE;SAChF;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8MAA8M;YACtN,SAAS,EAAE,6EAA6E;SACzF;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8MAA8M;YACtN,SAAS,EAAE,iGAAiG;SAC7G;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,uLAAuL;YAC/L,SAAS,EAAE,+CAA+C;SAC3D;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,qNAAqN;YAC7N,SAAS,EAAE,2CAA2C;SACvD;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,sLAAsL;YAC9L,SAAS,EAAE,0DAA0D;SACtE;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,sMAAsM;YAC9M,SAAS,EAAE,qDAAqD;SACjE;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iPAAiP;YACzP,SAAS,EAAE,oEAAoE;SAChF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kHAAkH;YAC1H,SAAS,EAAE,wCAAwC;SACpD;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,yCAAyC,EAAE,IAAI;YAC/C,wCAAwC,EAAE,IAAI;YAC9C,2CAA2C,EAAE,IAAI;SAClD;QACD,YAAY,EAAE;YACZ,yCAAyC,EAAE,IAAI;YAC/C,gCAAgC,EAAE,IAAI;YACtC,+BAA+B,EAAE,IAAI;SACtC;QACD,gBAAgB,EAAE;YAChB,gCAAgC,EAAE,IAAI;YACtC,iCAAiC,EAAE,IAAI;YACvC,kCAAkC,EAAE,IAAI;YACxC,mCAAmC,EAAE,IAAI;YACzC,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,oBAAoB;SACzC;QACD,qBAAqB,EAAE;YACrB,mCAAmC,EAAE,IAAI;YACzC,wBAAwB,EAAE,IAAI;YAC9B,iCAAiC,EAAE,IAAI;SACxC;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE;gBACjB,uBAAuB;gBACvB,4BAA4B;gBAC5B,qBAAqB;gBACrB,eAAe;gBACf,gCAAgC;gBAChC,sBAAsB;gBACtB,aAAa;aACd;YACD,iBAAiB,EAAE,OAAO;SAC3B;QACD,uBAAuB,EAAE;YACvB,uCAAuC,EAAE,IAAI;YAC7C,mCAAmC,EAAE,IAAI;YACzC,0BAA0B,EAAE,IAAI;SACjC;QACD,WAAW,EAAE;YACX,6CAA6C,EAAE,IAAI;YACnD,+BAA+B,EAAE,IAAI;SACtC;QACD,iBAAiB,EAAE;YACjB,qBAAqB,EAAE,IAAI;SAC5B;QACD,qBAAqB,EAAE;YACrB,8CAA8C,EAAE,IAAI;SACrD;QACD,cAAc,EAAE;YACd,iCAAiC,EAAE,IAAI;SACxC;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;QACxF,YAAY,EAAE;YACZ,QAAQ,EAAE,6LAA6L;YACvM,KAAK,EAAE,iGAAiG;YACxG,OAAO,EAAE,iGAAiG;SAC3G;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE;YACd,uBAAuB;YACvB,4BAA4B;YAC5B,qBAAqB;YACrB,eAAe;YACf,gCAAgC;YAChC,sBAAsB;YACtB,aAAa;SACd;QACD,eAAe,EAAE;YACf,qBAAqB,EAAE,MAAM;YAC7B,0BAA0B,EAAE,MAAM;YAClC,mBAAmB,EAAE,MAAM;YAC3B,aAAa,EAAE,MAAM;YACrB,8BAA8B,EAAE,MAAM;YACtC,oBAAoB,EAAE,MAAM;YAC5B,WAAW,EAAE,OAAO;SACrB;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,YAAY;KACpC;IAED,eAAe,EAAE;QACf,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,wCAAwC;QACxC,qBAAqB,EAAE,IAAI,EAAE,UAAU;QACvC,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EACP,sGAAsG;QACxG,WAAW,EAAE,KAAK;QAClB,wBAAwB,EAAE,IAAI;QAC9B,WAAW,EAAE,CAAC,IAAI,CAAC;KACpB;IAED,cAAc,EAAE;QACd,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,yCAAyC;QACzC,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EACP,2GAA2G;QAC7G,kBAAkB,EAAE;YAClB,oBAAoB;YACpB,yBAAyB;YACzB,+BAA+B;YAC/B,KAAK;SACN;QACD,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,iCAAiC;YACrC,WAAW,EACT,yHAAyH;YAC3H,SAAS,EAAE,4BAA4B;YACvC,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,2FAA2F;YACxG,SAAS,EAAE,uBAAuB;YAClC,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,wBAAwB;YAC5B,WAAW,EAAE,uFAAuF;YACpG,SAAS,EAAE,uBAAuB;YAClC,KAAK,EAAE,aAAa;YACpB,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,+BAA+B;YACnC,WAAW,EACT,0HAA0H;YAC5H,SAAS,EAAE,kCAAkC;YAC7C,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,2CAA2C;YAC/C,WAAW,EACT,kHAAkH;YACpH,SAAS,EAAE,uDAAuD;YAClE,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EACT,yGAAyG;YAC3G,SAAS,EAAE,uCAAuC;YAClD,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,gCAAgC;YACpC,WAAW,EACT,4GAA4G;YAC9G,SAAS,EAAE,0DAA0D;YACrE,KAAK,EAAE,qBAAqB;YAC5B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EAAE,wGAAwG;YACrH,SAAS,EAAE,sDAAsD;YACjE,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EACT,0KAA0K;YAC5K,SAAS,EAAE,0CAA0C;YACrD,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,8BAA8B;YAClC,WAAW,EAAE,kGAAkG;YAC/G,SAAS,EAAE,wCAAwC;YACnD,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,QAAQ;SACvB;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,WAAW,EACT,4HAA4H;YAC9H,SAAS,EAAE,2CAA2C;YACtD,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC"}