@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/scanner/remediation.js

@@ -0,0 +1,255 @@
+/**
+ * RemediationPlanner -- Generates actionable remediation plans from gap reports.
+ *
+ * For each identified governance gap, produces specific steps including
+ * files to create/modify, configuration changes, and pack recommendations.
+ * Steps are priority-ordered with critical gaps first.
+ *
+ * GATE 9: T-148
+ *
+ * @connexum/ai-governance
+ */
+import * as path from 'path';
+import { createLogger } from '../util/log.js';
+const log = createLogger('remediation-planner');
+/** Severity weight for priority ordering */
+const SEVERITY_WEIGHT = {
+    CRITICAL: 4,
+    HIGH: 3,
+    MEDIUM: 2,
+    LOW: 1,
+};
+export class RemediationPlanner {
+    /**
+     * Generate a remediation plan from a gap report.
+     */
+    generate(gapReport) {
+        log.info(`Generating remediation plan for ${gapReport.agentGaps.length} agents`);
+        const steps = [];
+        // Generate steps for each agent gap
+        for (const agentGap of gapReport.agentGaps) {
+            for (const control of agentGap.missingControls) {
+                const step = this.buildStep(agentGap, control, gapReport.projectDir);
+                steps.push(step);
+            }
+        }
+        // Sort by priority (severity weight descending, then alphabetical by agent)
+        steps.sort((a, b) => {
+            const weightDiff = SEVERITY_WEIGHT[b.gap.severity] - SEVERITY_WEIGHT[a.gap.severity];
+            if (weightDiff !== 0)
+                return weightDiff;
+            return a.agent.localeCompare(b.agent);
+        });
+        // Assign sequential priority numbers after sorting
+        steps.forEach((step, idx) => {
+            step.priority = idx + 1;
+        });
+        // Compute effort summary
+        const effortSummary = {
+            low: steps.filter(s => s.estimatedEffort === 'low').length,
+            medium: steps.filter(s => s.estimatedEffort === 'medium').length,
+            high: steps.filter(s => s.estimatedEffort === 'high').length,
+        };
+        // Project the score improvement
+        const projectedScore = this.projectScore(gapReport);
+        log.info(`Remediation plan: ${steps.length} steps, projected score: ${projectedScore}/100`);
+        return {
+            projectDir: gapReport.projectDir,
+            generatedAt: new Date().toISOString(),
+            currentScore: gapReport.overallScore,
+            projectedScore,
+            totalSteps: steps.length,
+            steps,
+            effortSummary,
+        };
+    }
+    /**
+     * Build a remediation step for a specific missing control.
+     */
+    buildStep(agentGap, control, projectDir) {
+        const template = REMEDIATION_TEMPLATES[control.controlId];
+        if (template) {
+            return {
+                priority: 0, // Will be set after sorting
+                agent: agentGap.name,
+                gap: {
+                    controlId: control.controlId,
+                    name: control.name,
+                    severity: control.severity,
+                },
+                actions: template.actions(agentGap.name, projectDir),
+                files: template.files(agentGap.name, projectDir),
+                estimatedEffort: template.effort,
+                relatedPacks: control.frameworks,
+            };
+        }
+        // Fallback for unknown controls
+        return {
+            priority: 0,
+            agent: agentGap.name,
+            gap: {
+                controlId: control.controlId,
+                name: control.name,
+                severity: control.severity,
+            },
+            actions: [
+                `Review governance requirements for control ${control.controlId}`,
+                `Implement ${control.name} for agent '${agentGap.name}'`,
+                'Validate implementation and update governance configuration',
+            ],
+            files: [],
+            estimatedEffort: 'medium',
+            relatedPacks: control.frameworks,
+        };
+    }
+    /**
+     * Project the governance score after full remediation.
+     * Assumes all steps are completed successfully.
+     */
+    projectScore(gapReport) {
+        if (gapReport.agentGaps.length === 0)
+            return 100;
+        // If all gaps are fixed, each agent reaches 100% coverage
+        // But realistically, project a high but not perfect score
+        // to account for ongoing monitoring needs
+        const currentScore = gapReport.overallScore;
+        const gapSize = 100 - currentScore;
+        // Remediation closes ~90% of the gap (10% remains for validation/monitoring)
+        return Math.min(100, Math.round(currentScore + gapSize * 0.9));
+    }
+}
+/**
+ * Remediation templates for each governance control.
+ * Provides specific, actionable guidance per control type.
+ */
+const REMEDIATION_TEMPLATES = {
+    'GOV-001': {
+        actions: (agentName, projectDir) => [
+            `Create permissions file for agent '${agentName}'`,
+            'Define allowed tools with ALLOWED status',
+            'Define blocked tools with BLOCKED status',
+            'Set APPROVAL_REQUIRED for sensitive operations',
+            'Run governance validation to confirm deny-by-default is active',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+        ],
+        effort: 'low',
+    },
+    'GOV-002': {
+        actions: (agentName) => [
+            `Enable deny-by-default access model for agent '${agentName}'`,
+            'Ensure no permissions file means zero tool access (not full access)',
+            'Verify GovernanceRuntime.filterTools() returns empty array for unknown agents',
+            'Test that unlisted tools are blocked',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+            path.join(projectDir, '.claude', 'governance.json'),
+        ],
+        effort: 'low',
+    },
+    'GOV-003': {
+        actions: (agentName) => [
+            'Configure audit logging for all agent tool calls',
+            'Set up JSONL audit trail with timestamps, agent ID, tool name, and result',
+            'Enable activity log persistence to disk',
+            'Verify log rotation is configured to prevent disk exhaustion',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'logs', `activity-${agentName}.jsonl`),
+            path.join(projectDir, '.claude', 'hooks', 'audit-logger.sh'),
+        ],
+        effort: 'medium',
+    },
+    'GOV-004': {
+        actions: (agentName) => [
+            'Enable SHA-256 tamper detection on governance files',
+            'Generate initial hash manifest for all governance files',
+            'Configure verification check on session start',
+            'Set up GovernanceTamperError handling',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'hash-manifest.json'),
+            path.join(projectDir, '.claude', 'hooks', 'verify-governance.sh'),
+        ],
+        effort: 'medium',
+    },
+    'GOV-005': {
+        actions: (agentName) => [
+            `Define explicit capability boundaries for agent '${agentName}'`,
+            'List all tools the agent may use in its permissions file',
+            'Document the rationale for each allowed capability',
+            'Block capabilities outside the agent\'s role',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+        ],
+        effort: 'low',
+    },
+    'GOV-006': {
+        actions: (agentName) => [
+            'Implement web access rate limiting (max 20 requests per session)',
+            'Enable content safety scanning for fetched web content',
+            'Enforce isolation between web fetch and consequential actions',
+            'Configure HTTPS-only policy for all web requests',
+            'Block raw IP address requests',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.claude', 'rules', 'web-interaction-security.md'),
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+        ],
+        effort: 'medium',
+    },
+    'GOV-007': {
+        actions: (agentName) => [
+            'Enable DataClassifier for PHI/PII detection in agent interactions',
+            'Configure scan categories for the relevant compliance framework',
+            'Set up automated alerts for sensitive data exposure',
+            'Implement data masking for logged content',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'data-classification.json'),
+            path.join(projectDir, '.claude', 'hooks', 'data-classifier.sh'),
+        ],
+        effort: 'high',
+    },
+    'GOV-008': {
+        actions: (agentName) => [
+            'Configure incident response procedures',
+            'Set breach notification deadline per compliance requirements',
+            'Define notification recipients and escalation paths',
+            'Create incident response template',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'incident-response.json'),
+            path.join(projectDir, '.governance', 'notification-template.md'),
+        ],
+        effort: 'medium',
+    },
+    'GOV-009': {
+        actions: (agentName) => [
+            'Enable TransparencyInjector for AI content labeling',
+            'Configure AI-generated content markers per EU AI Act Art. 50',
+            'Verify labels are present in all agent-generated outputs',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'transparency.json'),
+        ],
+        effort: 'low',
+    },
+    'GOV-010': {
+        actions: (agentName) => [
+            'Configure approval queue for critical agent actions',
+            'Define which tool calls require human approval',
+            'Set up approval notification channel',
+            'Implement timeout handling for pending approvals',
+        ],
+        files: (agentName, projectDir) => [
+            path.join(projectDir, '.governance', 'approval-queue.json'),
+            path.join(projectDir, '.claude', 'permissions', `${agentName}.md`),
+        ],
+        effort: 'high',
+    },
+};
+//# sourceMappingURL=remediation.js.map

package/dist/esm/scanner/remediation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../../src/scanner/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,GAAG,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAiDhD,4CAA4C;AAC5C,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACP,CAAC;AAEF,MAAM,OAAO,kBAAkB;IAC7B;;OAEG;IACH,QAAQ,CAAC,SAAoB;QAC3B,GAAG,CAAC,IAAI,CAAC,mCAAmC,SAAS,CAAC,SAAS,CAAC,MAAM,SAAS,CAAC,CAAC;QAEjF,MAAM,KAAK,GAAsB,EAAE,CAAC;QAEpC,oCAAoC;QACpC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrF,IAAI,UAAU,KAAK,CAAC;gBAAE,OAAO,UAAU,CAAC;YACxC,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,mDAAmD;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC1B,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,yBAAyB;QACzB,MAAM,aAAa,GAAG;YACpB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,MAAM;YAC1D,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,MAAM;YAChE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,MAAM;SAC7D,CAAC;QAEF,gCAAgC;QAChC,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAEpD,GAAG,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,MAAM,4BAA4B,cAAc,MAAM,CAAC,CAAC;QAE5F,OAAO;YACL,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc;YACd,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,KAAK;YACL,aAAa;SACd,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,SAAS,CACf,QAAkB,EAClB,OAAuB,EACvB,UAAkB;QAElB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,CAAC,EAAE,4BAA4B;gBACzC,KAAK,EAAE,QAAQ,CAAC,IAAI;gBACpB,GAAG,EAAE;oBACH,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B;gBACD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;gBACpD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;gBAChD,eAAe,EAAE,QAAQ,CAAC,MAAM;gBAChC,YAAY,EAAE,OAAO,CAAC,UAAU;aACjC,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,QAAQ,CAAC,IAAI;YACpB,GAAG,EAAE;gBACH,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;YACD,OAAO,EAAE;gBACP,8CAA8C,OAAO,CAAC,SAAS,EAAE;gBACjE,aAAa,OAAO,CAAC,IAAI,eAAe,QAAQ,CAAC,IAAI,GAAG;gBACxD,6DAA6D;aAC9D;YACD,KAAK,EAAE,EAAE;YACT,eAAe,EAAE,QAAQ;YACzB,YAAY,EAAE,OAAO,CAAC,UAAU;SACjC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,SAAoB;QACvC,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAEjD,0DAA0D;QAC1D,0DAA0D;QAC1D,0CAA0C;QAC1C,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;QAC5C,MAAM,OAAO,GAAG,GAAG,GAAG,YAAY,CAAC;QAEnC,6EAA6E;QAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC;IACjE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,qBAAqB,GAItB;IACH,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAClC,sCAAsC,SAAS,GAAG;YAClD,0CAA0C;YAC1C,0CAA0C;YAC1C,gDAAgD;YAChD,gEAAgE;SACjE;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;SACnE;QACD,MAAM,EAAE,KAAK;KACd;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,kDAAkD,SAAS,GAAG;YAC9D,qEAAqE;YACrE,+EAA+E;YAC/E,sCAAsC;SACvC;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,iBAAiB,CAAC;SACpD;QACD,MAAM,EAAE,KAAK;KACd;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,kDAAkD;YAClD,2EAA2E;YAC3E,yCAAyC;YACzC,8DAA8D;SAC/D;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,SAAS,QAAQ,CAAC;YAC3E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC;SAC7D;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,qDAAqD;YACrD,yDAAyD;YACzD,+CAA+C;YAC/C,uCAAuC;SACxC;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,oBAAoB,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC;SAClE;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,oDAAoD,SAAS,GAAG;YAChE,0DAA0D;YAC1D,oDAAoD;YACpD,8CAA8C;SAC/C;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;SACnE;QACD,MAAM,EAAE,KAAK;KACd;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,kEAAkE;YAClE,wDAAwD;YACxD,+DAA+D;YAC/D,kDAAkD;YAClD,+BAA+B;SAChC;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,6BAA6B,CAAC;YACxE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;SACnE;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,mEAAmE;YACnE,iEAAiE;YACjE,qDAAqD;YACrD,2CAA2C;SAC5C;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,0BAA0B,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,CAAC;SAChE;QACD,MAAM,EAAE,MAAM;KACf;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,wCAAwC;YACxC,8DAA8D;YAC9D,qDAAqD;YACrD,mCAAmC;SACpC;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,wBAAwB,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,0BAA0B,CAAC;SACjE;QACD,MAAM,EAAE,QAAQ;KACjB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,qDAAqD;YACrD,8DAA8D;YAC9D,0DAA0D;SAC3D;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,mBAAmB,CAAC;SAC1D;QACD,MAAM,EAAE,KAAK;KACd;IACD,SAAS,EAAE;QACT,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,qDAAqD;YACrD,gDAAgD;YAChD,sCAAsC;YACtC,kDAAkD;SACnD;QACD,KAAK,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,qBAAqB,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,SAAS,KAAK,CAAC;SACnE;QACD,MAAM,EAAE,MAAM;KACf;CACF,CAAC"}

package/dist/esm/security/access-review.js

@@ -0,0 +1,235 @@
+/**
+ * AccessReview -- Quarterly access review for compliance frameworks.
+ *
+ * SOC 2, HIPAA, and ISO 27001 require periodic review of access rights.
+ * This module automates the review process:
+ *   - Generates access review reports
+ *   - Flags inactive operators for deactivation
+ *   - Tracks review completion status
+ *   - Maintains review audit trail
+ *
+ * T-060: Quarterly access review automation.
+ *
+ * @connexum/ai-governance
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import { createLogger } from '../util/log.js';
+const log = createLogger('access-review');
+export class AccessReview {
+    config;
+    cyclesFile;
+    auditFile;
+    constructor(config) {
+        this.config = {
+            reviewFrequencyMs: 30 * 60 * 1000, // 30 min (DEV MODE -- production: 90 * 24 * 60 * 60 * 1000 / 90 days)
+            inactivityThresholdDays: 1, // 1 day (DEV MODE -- production: 30)
+            organizationName: 'Organization',
+            ...config,
+        };
+        if (!fs.existsSync(config.reviewDir)) {
+            fs.mkdirSync(config.reviewDir, { recursive: true });
+        }
+        this.cyclesFile = path.join(config.reviewDir, 'review-cycles.json');
+        this.auditFile = path.join(config.reviewDir, 'review-audit.jsonl');
+    }
+    /**
+     * Start a new review cycle.
+     */
+    startReview(operators) {
+        const now = new Date();
+        const cycle = {
+            id: `review_${crypto.randomBytes(6).toString('hex')}`,
+            startedAt: now.toISOString(),
+            deadline: new Date(now.getTime() + 14 * 24 * 60 * 60 * 1000).toISOString(), // 14 days to complete
+            status: 'IN_PROGRESS',
+            entries: operators.map(op => this.createEntry(op)),
+        };
+        const cycles = this.loadCycles();
+        cycles.push(cycle);
+        this.saveCycles(cycles);
+        this.audit('REVIEW_STARTED', cycle.id, { operatorCount: operators.length });
+        log.info('Access review started', { id: cycle.id, operators: operators.length });
+        return cycle;
+    }
+    /**
+     * Record a review decision for an operator.
+     */
+    recordDecision(cycleId, operatorId, decision, reviewedBy, notes) {
+        const cycles = this.loadCycles();
+        const cycle = cycles.find(c => c.id === cycleId);
+        if (!cycle)
+            throw new Error(`Review cycle ${cycleId} not found`);
+        if (cycle.status === 'COMPLETED')
+            throw new Error('Review cycle already completed');
+        const entry = cycle.entries.find(e => e.operatorId === operatorId);
+        if (!entry)
+            throw new Error(`Operator ${operatorId} not in this review`);
+        entry.decision = decision;
+        entry.reviewedBy = reviewedBy;
+        entry.reviewedAt = new Date().toISOString();
+        entry.notes = notes;
+        this.saveCycles(cycles);
+        this.audit('DECISION_RECORDED', cycleId, { operatorId, decision, reviewedBy });
+    }
+    /**
+     * Complete a review cycle (all decisions must be recorded).
+     */
+    completeReview(cycleId) {
+        const cycles = this.loadCycles();
+        const cycle = cycles.find(c => c.id === cycleId);
+        if (!cycle)
+            throw new Error(`Review cycle ${cycleId} not found`);
+        const pendingCount = cycle.entries.filter(e => e.decision === 'PENDING').length;
+        if (pendingCount > 0) {
+            throw new Error(`Cannot complete: ${pendingCount} operators still pending review`);
+        }
+        cycle.status = 'COMPLETED';
+        cycle.completedAt = new Date().toISOString();
+        cycle.summary = this.computeSummary(cycle);
+        this.saveCycles(cycles);
+        this.audit('REVIEW_COMPLETED', cycleId, cycle.summary);
+        return cycle.summary;
+    }
+    /**
+     * Check if a review is due based on the last completed review.
+     *
+     * SYSTEMIC-M2 contract (2026-04-22): the return direction is
+     * "review IS due" -- callers must treat `true` as "access must be
+     * re-attested NOW" and `false` as "review not yet due, no action
+     * needed." Any caller that interprets `true` as "no review needed"
+     * has the direction inverted and must be fixed immediately.
+     *
+     * @returns {boolean} true = review is due (access must be re-attested);
+     *                    false = review not yet due, no action needed.
+     */
+    isReviewDue() {
+        const cycles = this.loadCycles();
+        const completed = cycles
+            .filter(c => c.status === 'COMPLETED' && c.completedAt)
+            .sort((a, b) => new Date(b.completedAt).getTime() - new Date(a.completedAt).getTime());
+        if (completed.length === 0)
+            return true;
+        const lastCompleted = new Date(completed[0].completedAt).getTime();
+        return (Date.now() - lastCompleted) > this.config.reviewFrequencyMs;
+    }
+    /**
+     * Get the current (most recent) review cycle.
+     */
+    getCurrentCycle() {
+        const cycles = this.loadCycles();
+        return cycles[cycles.length - 1];
+    }
+    /**
+     * Get all review cycles.
+     */
+    getAllCycles() {
+        return this.loadCycles();
+    }
+    /**
+     * Get overdue review cycles.
+     */
+    getOverdue() {
+        const now = Date.now();
+        const cycles = this.loadCycles();
+        return cycles.filter(c => {
+            if (c.status === 'COMPLETED')
+                return false;
+            return new Date(c.deadline).getTime() < now;
+        });
+    }
+    /**
+     * Get review statistics across all cycles.
+     */
+    getStats() {
+        const cycles = this.loadCycles();
+        const completed = cycles.filter(c => c.status === 'COMPLETED');
+        const overdue = this.getOverdue();
+        const lastCompleted = completed
+            .sort((a, b) => new Date(b.completedAt).getTime() - new Date(a.completedAt).getTime())[0];
+        return {
+            totalCycles: cycles.length,
+            completedCycles: completed.length,
+            overdueCycles: overdue.length,
+            isReviewDue: this.isReviewDue(),
+            lastCompletedAt: lastCompleted?.completedAt,
+        };
+    }
+    // --- Private ---
+    createEntry(op) {
+        const flags = [];
+        const now = Date.now();
+        const threshold = this.config.inactivityThresholdDays * 24 * 60 * 60 * 1000;
+        if (!op.active) {
+            flags.push('INACTIVE');
+        }
+        if (op.lastActivity) {
+            const lastActive = new Date(op.lastActivity).getTime();
+            if (now - lastActive > threshold) {
+                flags.push('NO_RECENT_LOGIN');
+            }
+        }
+        else {
+            flags.push('NO_RECENT_LOGIN');
+        }
+        if (op.role === 'ADMIN') {
+            flags.push('ELEVATED_PRIVILEGES');
+        }
+        if (op.createdAt) {
+            const created = new Date(op.createdAt).getTime();
+            if (now - created < 30 * 24 * 60 * 60 * 1000) {
+                flags.push('NEW_OPERATOR');
+            }
+        }
+        return {
+            operatorId: op.id,
+            operatorName: op.name,
+            role: op.role,
+            active: op.active,
+            lastActivity: op.lastActivity,
+            flags,
+            decision: 'PENDING',
+        };
+    }
+    computeSummary(cycle) {
+        const entries = cycle.entries;
+        return {
+            totalOperators: entries.length,
+            retained: entries.filter(e => e.decision === 'RETAIN').length,
+            modified: entries.filter(e => e.decision === 'MODIFY').length,
+            revoked: entries.filter(e => e.decision === 'REVOKE').length,
+            pending: entries.filter(e => e.decision === 'PENDING').length,
+            flaggedInactive: entries.filter(e => e.flags.includes('INACTIVE') || e.flags.includes('NO_RECENT_LOGIN')).length,
+            completionRate: entries.filter(e => e.decision !== 'PENDING').length / entries.length,
+        };
+    }
+    loadCycles() {
+        if (!fs.existsSync(this.cyclesFile))
+            return [];
+        try {
+            return JSON.parse(fs.readFileSync(this.cyclesFile, 'utf-8'));
+        }
+        catch {
+            return [];
+        }
+    }
+    saveCycles(cycles) {
+        fs.writeFileSync(this.cyclesFile, JSON.stringify(cycles, null, 2));
+    }
+    audit(action, cycleId, data) {
+        const entry = {
+            timestamp: new Date().toISOString(),
+            action,
+            cycleId,
+            ...data,
+        };
+        try {
+            fs.appendFileSync(this.auditFile, JSON.stringify(entry) + '\n');
+        }
+        catch {
+            log.error('Failed to write review audit', { cycleId, action });
+        }
+    }
+}
+//# sourceMappingURL=access-review.js.map

package/dist/esm/security/access-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-review.js","sourceRoot":"","sources":["../../../src/security/access-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AA8D1C,MAAM,OAAO,YAAY;IACf,MAAM,CAA+B;IACrC,UAAU,CAAS;IACnB,SAAS,CAAS;IAE1B,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG;YACZ,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,sEAAsE;YACzG,uBAAuB,EAAE,CAAC,EAAE,qCAAqC;YACjE,gBAAgB,EAAE,cAAc;YAChC,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAyB;QACnC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAgB;YACzB,EAAE,EAAE,UAAU,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YACrD,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,sBAAsB;YAClG,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;SACnD,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAExB,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAEjF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,OAAe,EACf,UAAkB,EAClB,QAAwC,EACxC,UAAkB,EAClB,KAAc;QAEd,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,YAAY,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAEpF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,UAAU,qBAAqB,CAAC,CAAC;QAEzE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9B,KAAK,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;QAEpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAe;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,YAAY,CAAC,CAAC;QAEjE,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QAChF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,YAAY,iCAAiC,CAAC,CAAC;QACrF,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC;QAC3B,KAAK,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAE3C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,OAA6C,CAAC,CAAC;QAE7F,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,WAAW;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,WAAW,CAAC;aACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,eAAe;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAEjC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACvB,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QAON,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAElC,MAAM,aAAa,GAAG,SAAS;aAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9F,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,eAAe,EAAE,SAAS,CAAC,MAAM;YACjC,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC/B,eAAe,EAAE,aAAa,EAAE,WAAW;SAC5C,CAAC;IACJ,CAAC;IAED,kBAAkB;IAEV,WAAW,CAAC,EAAgB;QAClC,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAE5E,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;YACvD,IAAI,GAAG,GAAG,UAAU,GAAG,SAAS,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;YACjD,IAAI,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC7C,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO;YACL,UAAU,EAAE,EAAE,CAAC,EAAE;YACjB,YAAY,EAAE,EAAE,CAAC,IAAI;YACrB,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,YAAY,EAAE,EAAE,CAAC,YAAY;YAC7B,KAAK;YACL,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,KAAkB;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,OAAO;YACL,cAAc,EAAE,OAAO,CAAC,MAAM;YAC9B,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC7D,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC7D,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC5D,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;YAC7D,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM;YAChH,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;SACtF,CAAC;IACJ,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAqB;QACtC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,MAAc,EAAE,OAAe,EAAE,IAA6B;QAC1E,MAAM,KAAK,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM;YACN,OAAO;YACP,GAAG,IAAI;SACR,CAAC;QAEF,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF"}