@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/tenant/rbac.js

@@ -0,0 +1,178 @@
+/**
+ * Workspace-scoped RBAC for multi-tenant team-tier substrate.
+ *
+ * Six canonical workspace roles map to discrete permission sets.
+ * These roles are workspace-scoped and distinct from the org-level
+ * Role enum in packages/auth/src/rbac.ts (ORG_ADMIN, ORG_VIEWER, etc.).
+ *
+ * New permissions added here that did not exist in packages/auth/src/rbac.ts:
+ *   WORKSPACE_ADMIN, POLICY_WRITE, POLICY_READ, REVIEW_APPROVE,
+ *   REVIEW_DECLINE, BILLING_READ, BILLING_WRITE, MEMBER_INVITE,
+ *   MEMBER_SUSPEND.
+ *
+ * Design rule: Owner has every permission. All other roles are additive
+ * subsets -- never full-inherit to avoid privilege creep.
+ *
+ * @connexum/ai-governance tenant substrate
+ */
+// ---------------------------------------------------------------------------
+// WorkspacePermission enum
+// ---------------------------------------------------------------------------
+export var WorkspacePermission;
+(function (WorkspacePermission) {
+    // Workspace administration
+    WorkspacePermission["WORKSPACE_ADMIN"] = "workspace:admin";
+    // Policy management
+    WorkspacePermission["POLICY_WRITE"] = "policy:write";
+    WorkspacePermission["POLICY_READ"] = "policy:read";
+    // Review actions
+    WorkspacePermission["REVIEW_APPROVE"] = "review:approve";
+    WorkspacePermission["REVIEW_DECLINE"] = "review:decline";
+    // Billing
+    WorkspacePermission["BILLING_READ"] = "billing:read";
+    WorkspacePermission["BILLING_WRITE"] = "billing:write";
+    // Member management
+    WorkspacePermission["MEMBER_INVITE"] = "member:invite";
+    WorkspacePermission["MEMBER_SUSPEND"] = "member:suspend";
+    // Agent registry + scanning (developer surface)
+    WorkspacePermission["AGENT_READ"] = "agent:read";
+    WorkspacePermission["SCAN_RUN"] = "scan:run";
+    // Audit reads
+    WorkspacePermission["AUDIT_READ"] = "audit:read";
+    // Pack reads (compliance-officer surface)
+    WorkspacePermission["PACK_READ"] = "pack:read";
+})(WorkspacePermission || (WorkspacePermission = {}));
+// ---------------------------------------------------------------------------
+// ROLE_PERMISSIONS: the canonical permission map
+// ---------------------------------------------------------------------------
+/**
+ * Strictest-wins policy still applies here: a workspace-scoped role
+ * CANNOT grant permissions the org-level role forbids. Enforcement
+ * of org-level caps is done at the route layer (decodeClaims + this map).
+ */
+export const WORKSPACE_ROLE_PERMISSIONS = {
+    /**
+     * owner: full control over the workspace they created.
+     */
+    owner: [
+        WorkspacePermission.WORKSPACE_ADMIN,
+        WorkspacePermission.POLICY_WRITE,
+        WorkspacePermission.POLICY_READ,
+        WorkspacePermission.REVIEW_APPROVE,
+        WorkspacePermission.REVIEW_DECLINE,
+        WorkspacePermission.BILLING_READ,
+        WorkspacePermission.BILLING_WRITE,
+        WorkspacePermission.MEMBER_INVITE,
+        WorkspacePermission.MEMBER_SUSPEND,
+        WorkspacePermission.AGENT_READ,
+        WorkspacePermission.SCAN_RUN,
+        WorkspacePermission.AUDIT_READ,
+        WorkspacePermission.PACK_READ,
+    ],
+    /**
+     * compliance-officer: reads packs, reads policy, approves reviews,
+     * reads audit trail. No billing, no member management, no policy writes.
+     */
+    'compliance-officer': [
+        WorkspacePermission.PACK_READ,
+        WorkspacePermission.POLICY_READ,
+        WorkspacePermission.REVIEW_APPROVE,
+        WorkspacePermission.AUDIT_READ,
+        WorkspacePermission.AGENT_READ,
+    ],
+    /**
+     * security-admin: manages members, writes policy, reads audit.
+     * No billing, no review-approve (conflict-of-interest), no billing writes.
+     */
+    'security-admin': [
+        WorkspacePermission.MEMBER_INVITE,
+        WorkspacePermission.MEMBER_SUSPEND,
+        WorkspacePermission.POLICY_WRITE,
+        WorkspacePermission.POLICY_READ,
+        WorkspacePermission.AUDIT_READ,
+        WorkspacePermission.PACK_READ,
+        WorkspacePermission.AGENT_READ,
+        WorkspacePermission.SCAN_RUN,
+    ],
+    /**
+     * reviewer: approve and decline reviews only.
+     * Cannot touch members, policy, or billing.
+     */
+    reviewer: [
+        WorkspacePermission.REVIEW_APPROVE,
+        WorkspacePermission.REVIEW_DECLINE,
+    ],
+    /**
+     * developer: reads agent registry and can run scans.
+     * No policy writes, no member management, no billing.
+     */
+    developer: [
+        WorkspacePermission.AGENT_READ,
+        WorkspacePermission.SCAN_RUN,
+        WorkspacePermission.PACK_READ,
+    ],
+    /**
+     * billing-admin: billing reads and writes only.
+     * No access to audit, agents, policies, or member management.
+     */
+    'billing-admin': [
+        WorkspacePermission.BILLING_READ,
+        WorkspacePermission.BILLING_WRITE,
+    ],
+};
+// ---------------------------------------------------------------------------
+// Helper: check permission for a workspace role
+// ---------------------------------------------------------------------------
+export function hasWorkspacePermission(role, permission) {
+    const perms = WORKSPACE_ROLE_PERMISSIONS[role];
+    if (!perms)
+        return false;
+    return perms.includes(permission);
+}
+/**
+ * Look up the caller's membership in the workspace and verify they hold
+ * at least the required role. Returns the claims or throws with a 403 message.
+ *
+ * Usage at route layer:
+ *   const claims = requireRole(memberStore, workspaceId, userId, 'owner');
+ *
+ * Throws WorkspaceAuthError on access denied.
+ */
+export function requireRole(member, requiredRole) {
+    if (!member || member.status !== 'active') {
+        throw new WorkspaceAuthError('Workspace membership required', 403);
+    }
+    // owner always passes
+    if (member.role === 'owner') {
+        return { userId: member.userId, workspaceId: member.workspaceId, role: member.role };
+    }
+    if (member.role !== requiredRole) {
+        throw new WorkspaceAuthError(`Requires role '${requiredRole}', caller has '${member.role}'`, 403);
+    }
+    return { userId: member.userId, workspaceId: member.workspaceId, role: member.role };
+}
+/**
+ * Check that the caller's workspace role includes the specified permission.
+ * Throws WorkspaceAuthError (403) if not.
+ */
+export function requirePermission(member, permission) {
+    if (!member || member.status !== 'active') {
+        throw new WorkspaceAuthError('Workspace membership required', 403);
+    }
+    if (!hasWorkspacePermission(member.role, permission)) {
+        throw new WorkspaceAuthError(`Permission '${permission}' required, role '${member.role}' does not have it`, 403);
+    }
+    return { userId: member.userId, workspaceId: member.workspaceId, role: member.role };
+}
+// ---------------------------------------------------------------------------
+// Error class
+// ---------------------------------------------------------------------------
+export class WorkspaceAuthError extends Error {
+    statusCode;
+    constructor(message, statusCode = 403) {
+        super(message);
+        this.name = 'WorkspaceAuthError';
+        this.statusCode = statusCode;
+    }
+}
+//# sourceMappingURL=rbac.js.map

package/dist/esm/tenant/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../../src/tenant/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,MAAM,CAAN,IAAY,mBA6BX;AA7BD,WAAY,mBAAmB;IAC7B,2BAA2B;IAC3B,0DAAmC,CAAA;IAEnC,oBAAoB;IACpB,oDAA6B,CAAA;IAC7B,kDAA2B,CAAA;IAE3B,iBAAiB;IACjB,wDAAiC,CAAA;IACjC,wDAAiC,CAAA;IAEjC,UAAU;IACV,oDAA6B,CAAA;IAC7B,sDAA+B,CAAA;IAE/B,oBAAoB;IACpB,sDAA+B,CAAA;IAC/B,wDAAiC,CAAA;IAEjC,gDAAgD;IAChD,gDAAyB,CAAA;IACzB,4CAAqB,CAAA;IAErB,cAAc;IACd,gDAAyB,CAAA;IAEzB,0CAA0C;IAC1C,8CAAuB,CAAA;AACzB,CAAC,EA7BW,mBAAmB,KAAnB,mBAAmB,QA6B9B;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAiD;IACtF;;OAEG;IACH,KAAK,EAAE;QACL,mBAAmB,CAAC,eAAe;QACnC,mBAAmB,CAAC,YAAY;QAChC,mBAAmB,CAAC,WAAW;QAC/B,mBAAmB,CAAC,cAAc;QAClC,mBAAmB,CAAC,cAAc;QAClC,mBAAmB,CAAC,YAAY;QAChC,mBAAmB,CAAC,aAAa;QACjC,mBAAmB,CAAC,aAAa;QACjC,mBAAmB,CAAC,cAAc;QAClC,mBAAmB,CAAC,UAAU;QAC9B,mBAAmB,CAAC,QAAQ;QAC5B,mBAAmB,CAAC,UAAU;QAC9B,mBAAmB,CAAC,SAAS;KAC9B;IAED;;;OAGG;IACH,oBAAoB,EAAE;QACpB,mBAAmB,CAAC,SAAS;QAC7B,mBAAmB,CAAC,WAAW;QAC/B,mBAAmB,CAAC,cAAc;QAClC,mBAAmB,CAAC,UAAU;QAC9B,mBAAmB,CAAC,UAAU;KAC/B;IAED;;;OAGG;IACH,gBAAgB,EAAE;QAChB,mBAAmB,CAAC,aAAa;QACjC,mBAAmB,CAAC,cAAc;QAClC,mBAAmB,CAAC,YAAY;QAChC,mBAAmB,CAAC,WAAW;QAC/B,mBAAmB,CAAC,UAAU;QAC9B,mBAAmB,CAAC,SAAS;QAC7B,mBAAmB,CAAC,UAAU;QAC9B,mBAAmB,CAAC,QAAQ;KAC7B;IAED;;;OAGG;IACH,QAAQ,EAAE;QACR,mBAAmB,CAAC,cAAc;QAClC,mBAAmB,CAAC,cAAc;KACnC;IAED;;;OAGG;IACH,SAAS,EAAE;QACT,mBAAmB,CAAC,UAAU;QAC9B,mBAAmB,CAAC,QAAQ;QAC5B,mBAAmB,CAAC,SAAS;KAC9B;IAED;;;OAGG;IACH,eAAe,EAAE;QACf,mBAAmB,CAAC,YAAY;QAChC,mBAAmB,CAAC,aAAa;KAClC;CACF,CAAC;AAEF,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,MAAM,UAAU,sBAAsB,CACpC,IAAmB,EACnB,UAA+B;IAE/B,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,MAA8B,EAC9B,YAA2B;IAE3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACvF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,YAAY,kBAAkB,MAAM,CAAC,IAAI,GAAG,EAC9D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA8B,EAC9B,UAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,kBAAkB,CAC1B,eAAe,UAAU,qBAAqB,MAAM,CAAC,IAAI,oBAAoB,EAC7E,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACvF,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,UAAU,CAAS;IAC5B,YAAY,OAAe,EAAE,aAAwB,GAAG;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF"}

package/dist/esm/tenant/workspace.js

@@ -0,0 +1,274 @@
+/**
+ * Workspace entity and store for multi-tenant team-workspace support.
+ *
+ * Each Workspace maps to a billable tenant (design-partner, team, or
+ * enterprise tier). WorkspaceMembers hold the per-user role assignment
+ * inside a workspace.
+ *
+ * All mutations emit to the tamper-evident audit chain.
+ * In-memory store -- Prisma migration flagged at bottom of file.
+ *
+ * @connexum/ai-governance tenant substrate
+ */
+import * as crypto from 'node:crypto';
+// ---------------------------------------------------------------------------
+// WorkspaceStore
+// ---------------------------------------------------------------------------
+export class WorkspaceStore {
+    workspaces = new Map();
+    byTenant = new Map(); // tenantId -> workspaceId[]
+    audit;
+    constructor(opts) {
+        this.audit = opts?.appendAudit;
+    }
+    async emit(workspaceId, entry) {
+        if (!this.audit)
+            return;
+        try {
+            await this.audit(workspaceId, { ...entry, timestamp: new Date().toISOString() });
+        }
+        catch {
+            // Audit chain failure must not block the write.
+        }
+    }
+    /** Create a new workspace. The caller automatically becomes owner. */
+    async create(params) {
+        const workspaceId = crypto.randomUUID();
+        const now = new Date().toISOString();
+        const workspace = {
+            ...params,
+            workspaceId,
+            createdAt: now,
+        };
+        this.workspaces.set(workspaceId, workspace);
+        let tenantSet = this.byTenant.get(params.tenantId);
+        if (!tenantSet) {
+            tenantSet = new Set();
+            this.byTenant.set(params.tenantId, tenantSet);
+        }
+        tenantSet.add(workspaceId);
+        await this.emit(workspaceId, {
+            kind: 'tenant:workspace-created',
+            workspaceId,
+            tenantId: params.tenantId,
+            name: params.name,
+            billingTier: params.billingTier,
+            createdBy: params.createdBy,
+        });
+        return workspace;
+    }
+    /** Retrieve a workspace by ID, or null if not found. */
+    get(workspaceId) {
+        return this.workspaces.get(workspaceId) ?? null;
+    }
+    /** Update mutable workspace fields. Emits audit event on any change. */
+    async update(workspaceId, updates, actor) {
+        const existing = this.workspaces.get(workspaceId);
+        if (!existing)
+            throw new Error(`Workspace not found: ${workspaceId}`);
+        const updated = { ...existing, ...updates };
+        this.workspaces.set(workspaceId, updated);
+        await this.emit(workspaceId, {
+            kind: 'tenant:workspace-updated',
+            workspaceId,
+            actor,
+            fields: Object.keys(updates),
+        });
+        return updated;
+    }
+    /** Delete a workspace (owner only -- enforced at route layer). */
+    async delete(workspaceId, actor) {
+        const existing = this.workspaces.get(workspaceId);
+        if (!existing)
+            return; // idempotent
+        this.workspaces.delete(workspaceId);
+        this.byTenant.get(existing.tenantId)?.delete(workspaceId);
+        await this.emit(workspaceId, {
+            kind: 'tenant:workspace-deleted',
+            workspaceId,
+            tenantId: existing.tenantId,
+            actor,
+        });
+    }
+    /** List all workspaces for a tenant. */
+    listByTenant(tenantId) {
+        const ids = this.byTenant.get(tenantId);
+        if (!ids)
+            return [];
+        const result = [];
+        for (const id of ids) {
+            const w = this.workspaces.get(id);
+            if (w)
+                result.push(w);
+        }
+        return result;
+    }
+    /** List all workspaces (for super-admin). */
+    listAll() {
+        return Array.from(this.workspaces.values());
+    }
+}
+// ---------------------------------------------------------------------------
+// WorkspaceMemberStore
+// ---------------------------------------------------------------------------
+export class WorkspaceMemberStore {
+    members = new Map(); // key: workspaceId:userId
+    byWorkspace = new Map(); // workspaceId -> userId[]
+    audit;
+    constructor(opts) {
+        this.audit = opts?.appendAudit;
+    }
+    key(workspaceId, userId) {
+        return `${workspaceId}:${userId}`;
+    }
+    async emit(workspaceId, entry) {
+        if (!this.audit)
+            return;
+        try {
+            await this.audit(workspaceId, { ...entry, timestamp: new Date().toISOString() });
+        }
+        catch {
+            // Non-blocking.
+        }
+    }
+    /** Add or update a member record. */
+    async upsert(member) {
+        const k = this.key(member.workspaceId, member.userId);
+        const existing = this.members.get(k);
+        this.members.set(k, member);
+        let wsSet = this.byWorkspace.get(member.workspaceId);
+        if (!wsSet) {
+            wsSet = new Set();
+            this.byWorkspace.set(member.workspaceId, wsSet);
+        }
+        wsSet.add(member.userId);
+        await this.emit(member.workspaceId, {
+            kind: existing ? 'tenant:member-updated' : 'tenant:member-added',
+            workspaceId: member.workspaceId,
+            userId: member.userId,
+            email: member.email,
+            role: member.role,
+            status: member.status,
+            invitedBy: member.invitedBy,
+        });
+        return member;
+    }
+    /** Retrieve a single member. */
+    get(workspaceId, userId) {
+        return this.members.get(this.key(workspaceId, userId)) ?? null;
+    }
+    /** List all members of a workspace. */
+    listByWorkspace(workspaceId) {
+        const ids = this.byWorkspace.get(workspaceId);
+        if (!ids)
+            return [];
+        const result = [];
+        for (const userId of ids) {
+            const m = this.members.get(this.key(workspaceId, userId));
+            if (m)
+                result.push(m);
+        }
+        return result;
+    }
+    /** Remove a member from a workspace. Emits audit event. */
+    async remove(workspaceId, userId, actor) {
+        const k = this.key(workspaceId, userId);
+        const existing = this.members.get(k);
+        if (!existing)
+            return; // idempotent
+        this.members.delete(k);
+        this.byWorkspace.get(workspaceId)?.delete(userId);
+        await this.emit(workspaceId, {
+            kind: 'tenant:member-removed',
+            workspaceId,
+            userId,
+            actor,
+        });
+    }
+    /** Update the role of an existing member. */
+    async setRole(workspaceId, userId, role, actor) {
+        const k = this.key(workspaceId, userId);
+        const existing = this.members.get(k);
+        if (!existing)
+            throw new Error(`Member not found: ${userId} in workspace ${workspaceId}`);
+        const updated = { ...existing, role };
+        this.members.set(k, updated);
+        await this.emit(workspaceId, {
+            kind: 'tenant:member-role-changed',
+            workspaceId,
+            userId,
+            previousRole: existing.role,
+            newRole: role,
+            actor,
+        });
+        return updated;
+    }
+    /** Suspend a member (status -> suspended). */
+    async suspend(workspaceId, userId, actor) {
+        const k = this.key(workspaceId, userId);
+        const existing = this.members.get(k);
+        if (!existing)
+            throw new Error(`Member not found: ${userId} in workspace ${workspaceId}`);
+        const updated = { ...existing, status: 'suspended' };
+        this.members.set(k, updated);
+        await this.emit(workspaceId, {
+            kind: 'tenant:member-suspended',
+            workspaceId,
+            userId,
+            actor,
+        });
+        return updated;
+    }
+}
+// ---------------------------------------------------------------------------
+// Singleton stores (shared within a process)
+// ---------------------------------------------------------------------------
+let _workspaceStore = null;
+let _memberStore = null;
+export function getWorkspaceStore(opts) {
+    if (!_workspaceStore)
+        _workspaceStore = new WorkspaceStore(opts);
+    return _workspaceStore;
+}
+export function getWorkspaceMemberStore(opts) {
+    if (!_memberStore)
+        _memberStore = new WorkspaceMemberStore(opts);
+    return _memberStore;
+}
+/** Test helper: reset both singletons. */
+export function __resetWorkspaceStoresForTest() {
+    _workspaceStore = null;
+    _memberStore = null;
+}
+// ---------------------------------------------------------------------------
+// Prisma migration note (flagged for later)
+// ---------------------------------------------------------------------------
+//
+// TODO(Prisma migration): Add three models to schema.prisma:
+//
+// model Workspace {
+//   workspaceId   String   @id @default(uuid())
+//   tenantId      String
+//   name          String
+//   createdBy     String
+//   createdAt     DateTime @default(now())
+//   billingTier   String
+//   activePackIds String[]
+//   ssoProviderId String?
+//   settings      Json
+//   members       WorkspaceMember[]
+//   policies      TenantPolicy[]
+// }
+//
+// model WorkspaceMember {
+//   workspaceId String
+//   userId      String
+//   email       String
+//   role        String
+//   joinedAt    DateTime @default(now())
+//   invitedBy   String
+//   status      String   @default("pending")
+//   workspace   Workspace @relation(fields: [workspaceId], references: [workspaceId])
+//   @@id([workspaceId, userId])
+// }
+//# sourceMappingURL=workspace.js.map

package/dist/esm/tenant/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../src/tenant/workspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAuEtC,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,OAAO,cAAc;IACjB,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC,CAAC,4BAA4B;IAEvE,KAAK,CAA0B;IAEvC,YAAY,IAA+C;QACzD,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,WAAW,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,KAA8B;QACpE,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,MAAM,CACV,MAAoD;QAEpD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,MAAM,SAAS,GAAc;YAC3B,GAAG,MAAM;YACT,WAAW;YACX,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAE5C,IAAI,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE3B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC3B,IAAI,EAAE,0BAA0B;YAChC,WAAW;YACX,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,wDAAwD;IACxD,GAAG,CAAC,WAAmB;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;IAClD,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,OAA0G,EAC1G,KAAa;QAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAc,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC3B,IAAI,EAAE,0BAA0B;YAChC,WAAW;YACX,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SAC7B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,KAAa;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,aAAa;QAEpC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAE1D,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC3B,IAAI,EAAE,0BAA0B;YAChC,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,YAAY,CAAC,QAAgB;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6CAA6C;IAC7C,OAAO;QACL,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,OAAO,oBAAoB;IACvB,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC,CAAC,0BAA0B;IACxE,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC,CAAC,0BAA0B;IAExE,KAAK,CAA0B;IAEvC,YAAY,IAA+C;QACzD,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,WAAW,CAAC;IACjC,CAAC;IAEO,GAAG,CAAC,WAAmB,EAAE,MAAc;QAC7C,OAAO,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB,EAAE,KAA8B;QACpE,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,MAAM,CAAC,MAAuB;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAE5B,IAAI,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEzB,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAClC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB;YAChE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gCAAgC;IAChC,GAAG,CAAC,WAAmB,EAAE,MAAc;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;IACjE,CAAC;IAED,uCAAuC;IACvC,eAAe,CAAC,WAAmB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,MAAc,EAAE,KAAa;QAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,aAAa;QAEpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC3B,IAAI,EAAE,uBAAuB;YAC7B,WAAW;YACX,MAAM;YACN,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,OAAO,CACX,WAAmB,EACnB,MAAc,EACd,IAAmB,EACnB,KAAa;QAEb,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,iBAAiB,WAAW,EAAE,CAAC,CAAC;QAE1F,MAAM,OAAO,GAAoB,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAE7B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC3B,IAAI,EAAE,4BAA4B;YAClC,WAAW;YACX,MAAM;YACN,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,OAAO,EAAE,IAAI;YACb,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,MAAc,EAAE,KAAa;QAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,iBAAiB,WAAW,EAAE,CAAC,CAAC;QAE1F,MAAM,OAAO,GAAoB,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAE7B,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC3B,IAAI,EAAE,yBAAyB;YAC/B,WAAW;YACX,MAAM;YACN,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,IAAI,eAAe,GAA0B,IAAI,CAAC;AAClD,IAAI,YAAY,GAAgC,IAAI,CAAC;AAErD,MAAM,UAAU,iBAAiB,CAAC,IAA+C;IAC/E,IAAI,CAAC,eAAe;QAAE,eAAe,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAA+C;IAE/C,IAAI,CAAC,YAAY;QAAE,YAAY,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,6BAA6B;IAC3C,eAAe,GAAG,IAAI,CAAC;IACvB,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAC9E,EAAE;AACF,6DAA6D;AAC7D,EAAE;AACF,oBAAoB;AACpB,gDAAgD;AAChD,yBAAyB;AACzB,yBAAyB;AACzB,yBAAyB;AACzB,2CAA2C;AAC3C,yBAAyB;AACzB,2BAA2B;AAC3B,0BAA0B;AAC1B,uBAAuB;AACvB,oCAAoC;AACpC,iCAAiC;AACjC,IAAI;AACJ,EAAE;AACF,0BAA0B;AAC1B,uBAAuB;AACvB,uBAAuB;AACvB,uBAAuB;AACvB,uBAAuB;AACvB,yCAAyC;AACzC,uBAAuB;AACvB,6CAA6C;AAC7C,sFAAsF;AACtF,gCAAgC;AAChC,IAAI"}

package/dist/esm/trust-passport/index.js

@@ -0,0 +1,119 @@
+/**
+ * Trust passport surface for @connexum/ai-governance.
+ *
+ * Closes CR-CRIT-01 SDK piece (`docs/audits/2026-05-12-client-ready-integration-audit.md`):
+ * before this module, the trust-api package + daemon existed but `grep -rn
+ * 'AgentPassport|/v1/agents/register' --include='*.ts' packages apps src |
+ * grep -v '/trust-api/'` returned zero matches — no customer-installable code
+ * path called the daemon. This module bridges that gap.
+ *
+ * Two operations:
+ *   - `issuePassport(opts)` — HTTP POST to the daemon's /v1/agents/register
+ *     endpoint. Returns the SignedPassport. Requires daemon to be reachable.
+ *   - `verifyInboundPassport(passport, platformCaPublicKey)` — Locked
+ *     Invariant 4 offline verifier. Uses the org public key embedded in the
+ *     passport claims; no daemon contact required.
+ *
+ * Locked Architectural Invariant binding (see CLAUDE.md):
+ *   - 1 (self-sovereign) — daemon issues passports; relying party verifies
+ *     offline against the cached platform CA public key.
+ *   - 2 (advisory) — verifyInboundPassport never throws on a malformed
+ *     passport; returns a discriminated union. SDK callers branch on
+ *     `result.valid` and apply their own policy on `valid:false`.
+ *   - 3 (graceful degradation) — issuePassport accepts a `timeoutMs` (default
+ *     5000) and rejects with a structured error if the daemon is unreachable
+ *     so callers can apply their own fallback policy (cache the last
+ *     passport, retry, surface to operator, etc.).
+ *   - 4 (offline-verifiable) — verifyInboundPassport calls verifyPassportOffline
+ *     from @connexum/trust-api which extracts the org public key from
+ *     `passport.public_key_b64` (signed-in field; tampering invalidates the
+ *     signature).
+ *   - 5 (structured response) — verifyInboundPassport returns a
+ *     VerificationResult discriminated union; never throws.
+ *
+ * @connexum/ai-governance — F-NEW-SDK-PASSPORT-SURFACE-2026-05-12
+ */
+import { verifyPassportOffline, } from '@connexum/trust-api';
+/**
+ * Issue a passport for an agent by calling the trust-api daemon's
+ * POST /v1/agents/register endpoint. The org keypair is generated daemon-side
+ * (Locked Invariant 1 self-sovereign); both signatures are returned in the
+ * response.
+ *
+ * Customers cache the returned passport locally and present it to relying
+ * parties. Offline verification uses `verifyInboundPassport()` below.
+ */
+export async function issuePassport(opts) {
+    const daemonUrl = (opts.daemonUrl ?? 'http://127.0.0.1:4200').replace(/\/$/, '');
+    const timeoutMs = opts.timeoutMs ?? 5000;
+    const url = `${daemonUrl}/v1/agents/register`;
+    const body = JSON.stringify({
+        display_name: opts.displayName,
+        model_lineage_hash: opts.modelLineageHash,
+        governance_policy_version: opts.governancePolicyVersion,
+        authorized_scope: opts.authorizedScope,
+        pack_binding: opts.packBinding,
+        ttl_seconds: opts.ttlSeconds,
+    });
+    const controller = new AbortController();
+    const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${opts.bearerToken}`,
+            },
+            body,
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        clearTimeout(timeoutHandle);
+        const message = err instanceof Error ? err.message : String(err);
+        if (controller.signal.aborted) {
+            return { ok: false, reason: 'timeout', detail: `request exceeded ${timeoutMs}ms` };
+        }
+        return { ok: false, reason: 'network', detail: message };
+    }
+    finally {
+        clearTimeout(timeoutHandle);
+    }
+    if (res.status === 401 || res.status === 403) {
+        return { ok: false, reason: 'unauthorized', statusCode: res.status, detail: await res.text().catch(() => '') };
+    }
+    if (res.status >= 400 && res.status < 500) {
+        return { ok: false, reason: 'bad_request', statusCode: res.status, detail: await res.text().catch(() => '') };
+    }
+    if (res.status >= 500) {
+        return { ok: false, reason: 'server_error', statusCode: res.status, detail: await res.text().catch(() => '') };
+    }
+    let parsed;
+    try {
+        parsed = (await res.json());
+    }
+    catch (err) {
+        void err;
+        return { ok: false, reason: 'malformed_response', detail: 'JSON parse failed' };
+    }
+    if (!parsed.passport || typeof parsed.passport !== 'object') {
+        return { ok: false, reason: 'malformed_response', detail: 'response missing `passport` field' };
+    }
+    return { ok: true, passport: parsed.passport };
+}
+/**
+ * Verify a passport using ONLY the platform CA public key (Locked Invariant 4
+ * offline path). Suitable for relying parties who have cached the CA pub key
+ * out-of-band and want to verify inbound passports with no daemon contact.
+ *
+ * `platformCaPublicKey` is the raw 32-byte Ed25519 public key. Operators
+ * fetch + cache it from the daemon at deployment time; rotation is rare and
+ * communicated through the platform's regular channels.
+ *
+ * Returns a structured VerificationResult — never throws (Invariant 5).
+ */
+export function verifyInboundPassport(passport, platformCaPublicKey, options = {}) {
+    return verifyPassportOffline(passport, platformCaPublicKey, options);
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/trust-passport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/trust-passport/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC;AAyC7B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,SAAS,qBAAqB,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,kBAAkB,EAAE,IAAI,CAAC,gBAAgB;QACzC,yBAAyB,EAAE,IAAI,CAAC,uBAAuB;QACvD,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,WAAW,EAAE,IAAI,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAEtE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC9C;YACD,IAAI;YACJ,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,SAAS,IAAI,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACjH,CAAC;IAED,IAAI,MAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,GAAG,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAiB,EACjB,mBAA+B,EAC/B,UAA6D,EAAE;IAE/D,OAAO,qBAAqB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC"}