@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/audit/report-templates/prompts/dora.js

@@ -0,0 +1,118 @@
+/**
+ * DORA per-framework narrative prompt context.
+ *
+ * Declares section headings, evidence-linkage requirements, and required
+ * control mappings for DORA compliance narratives.
+ *
+ * References:
+ *   Regulation (EU) 2022/2554 -- Digital Operational Resilience Act (DORA)
+ *   RTS on ICT risk management tools (ESAs joint consultation paper, 2023)
+ *   EBA/ESMA/EIOPA DORA implementing technical standards (ITS), 2024
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export const DORA_PROMPT_SPEC = {
+    frameworkId: 'dora',
+    frameworkName: 'DORA',
+    version: 'Regulation (EU) 2022/2554 (applicable from 2025-01-17)',
+    sections: [
+        {
+            sectionId: 'dora-art5-governance',
+            heading: 'Article 5 ICT Risk Governance',
+            regulatoryRef: 'DORA Article 5-6',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                'Art. 5(1) -- Management body responsibility for ICT risk framework',
+                'Art. 5(2) -- Definition and approval of ICT risk strategy',
+                'Art. 5(4) -- Allocation of ICT-related roles and responsibilities',
+                'Art. 6(1) -- Documented ICT risk management framework',
+                'Art. 6(4) -- ICT risk management strategy approved by management body',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Document ICT risk governance structure as applied to AI agent operations. ' +
+                'Describe how the AI governance platform implements the documented risk management ' +
+                'framework required by Art. 6(1). Cite agent registration events as evidence of ' +
+                'structured ICT asset onboarding. Reference governance verdicts as evidence of ' +
+                'systematic policy enforcement under the approved risk strategy.',
+        },
+        {
+            sectionId: 'dora-art9-protection',
+            heading: 'Article 9 Protection and Prevention',
+            regulatoryRef: 'DORA Article 9',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                'Art. 9(1) -- Continuous monitoring and control of ICT systems',
+                'Art. 9(2) -- Dedicated ICT security policies (identity, access, encryption)',
+                'Art. 9(3)(a) -- ICT asset inventory policies',
+                'Art. 9(3)(b) -- Change management for ICT assets',
+                'Art. 9(4) -- Policies for legitimate software use',
+                'Art. 9(4)(a) -- Limitation of ICT access (least privilege)',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Provide evidence of protection and prevention controls meeting Art. 9. ' +
+                'Cite governance verdict events as continuous monitoring evidence. ' +
+                'Cite deny-decision events as evidence of least-privilege access enforcement (Art. 9(4)(a)). ' +
+                'Quantify: total access decisions, denial rate, and policy enforcement events. ' +
+                'Note agent registration as ICT asset inventory control (Art. 9(3)(a)).',
+        },
+        {
+            sectionId: 'dora-art10-detection',
+            heading: 'Article 10 Detection',
+            regulatoryRef: 'DORA Article 10',
+            requiredEventTypes: ['governance:verdict', 'incident:created'],
+            controlMappings: [
+                'Art. 10(1) -- Mechanisms to detect anomalous activities promptly',
+                'Art. 10(2) -- Multiple layers of control including anomaly detection',
+                'Art. 10(3) -- Alert systems for anomalous patterns',
+                'Art. 10(4) -- ICT-related incident reporting processes',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document detection capabilities under Art. 10. Describe anomaly detection events ' +
+                '(circuit-breaker trips, threshold violations, unexpected behaviour flags) as evidence ' +
+                'of the multi-layer detection requirement. For any incident events, document detection ' +
+                'latency from first anomaly signal to incident classification. ' +
+                'Quantify: anomalies detected, escalated incidents, and mean time to detect (MTTD).',
+        },
+        {
+            sectionId: 'dora-art11-response-recovery',
+            heading: 'Article 11 Response and Recovery',
+            regulatoryRef: 'DORA Article 11',
+            requiredEventTypes: ['incident:created'],
+            controlMappings: [
+                'Art. 11(1) -- ICT Business Continuity Policy',
+                'Art. 11(2) -- ICT response and recovery plans and procedures',
+                'Art. 11(3) -- Crisis communication plans for ICT incidents',
+                'Art. 11(5) -- Post-incident review and lessons learned',
+                'Art. 11(6) -- Activation of response plans with due care',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document incident response and recovery activities for any ICT incidents. ' +
+                'For each incident event, trace the response timeline: detection, containment, ' +
+                'recovery, and post-incident review. If no qualifying incidents occurred, document ' +
+                'the absence of incident events with chain evidence and describe the response ' +
+                'readiness posture (plans tested, recovery time objectives defined).',
+        },
+        {
+            sectionId: 'dora-art17-major-incident',
+            heading: 'Article 17-23 ICT-Related Incident Reporting',
+            regulatoryRef: 'DORA Article 17-23',
+            requiredEventTypes: ['incident:created'],
+            controlMappings: [
+                'Art. 17 -- Classification of ICT-related incidents and cyber threats',
+                'Art. 18 -- Classification criteria (impact on operations, data, reputation)',
+                'Art. 19 -- Reporting of major ICT-related incidents to competent authorities',
+                'Art. 20 -- Harmonised reporting templates (initial/intermediate/final)',
+                'Art. 21 -- Centralised reporting hub (single integrated reporting)',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Assess major incident reporting obligations under DORA Art. 17-23. ' +
+                'For any incident events, apply the Art. 18 classification criteria to determine ' +
+                'whether they meet the "major incident" threshold. Document the notification timeline ' +
+                'against the regulatory deadlines (initial report: 4 hours; intermediate: 72 hours; ' +
+                'final: 1 month). If no major incidents occurred, document this with chain evidence.',
+        },
+    ],
+};
+//# sourceMappingURL=dora.js.map

package/dist/esm/audit/report-templates/prompts/dora.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dora.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/dora.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,MAAM,CAAC,MAAM,gBAAgB,GAAwB;IACnD,WAAW,EAAE,MAAM;IACnB,aAAa,EAAE,MAAM;IACrB,OAAO,EAAE,wDAAwD;IACjE,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,+BAA+B;YACxC,aAAa,EAAE,kBAAkB;YACjC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,oEAAoE;gBACpE,2DAA2D;gBAC3D,mEAAmE;gBACnE,uDAAuD;gBACvD,uEAAuE;aACxE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,4EAA4E;gBAC5E,oFAAoF;gBACpF,iFAAiF;gBACjF,gFAAgF;gBAChF,iEAAiE;SACpE;QACD;YACE,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,qCAAqC;YAC9C,aAAa,EAAE,gBAAgB;YAC/B,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,+DAA+D;gBAC/D,6EAA6E;gBAC7E,8CAA8C;gBAC9C,kDAAkD;gBAClD,mDAAmD;gBACnD,4DAA4D;aAC7D;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,yEAAyE;gBACzE,oEAAoE;gBACpE,8FAA8F;gBAC9F,gFAAgF;gBAChF,wEAAwE;SAC3E;QACD;YACE,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,sBAAsB;YAC/B,aAAa,EAAE,iBAAiB;YAChC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;YAC9D,eAAe,EAAE;gBACf,kEAAkE;gBAClE,sEAAsE;gBACtE,oDAAoD;gBACpD,wDAAwD;aACzD;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,mFAAmF;gBACnF,wFAAwF;gBACxF,wFAAwF;gBACxF,gEAAgE;gBAChE,oFAAoF;SACvF;QACD;YACE,SAAS,EAAE,8BAA8B;YACzC,OAAO,EAAE,kCAAkC;YAC3C,aAAa,EAAE,iBAAiB;YAChC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;YACxC,eAAe,EAAE;gBACf,8CAA8C;gBAC9C,8DAA8D;gBAC9D,4DAA4D;gBAC5D,wDAAwD;gBACxD,0DAA0D;aAC3D;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,4EAA4E;gBAC5E,gFAAgF;gBAChF,oFAAoF;gBACpF,+EAA+E;gBAC/E,qEAAqE;SACxE;QACD;YACE,SAAS,EAAE,2BAA2B;YACtC,OAAO,EAAE,8CAA8C;YACvD,aAAa,EAAE,oBAAoB;YACnC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;YACxC,eAAe,EAAE;gBACf,sEAAsE;gBACtE,6EAA6E;gBAC7E,8EAA8E;gBAC9E,wEAAwE;gBACxE,oEAAoE;aACrE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,qEAAqE;gBACrE,kFAAkF;gBAClF,uFAAuF;gBACvF,qFAAqF;gBACrF,qFAAqF;SACxF;KACF;CACF,CAAC"}

package/dist/esm/audit/report-templates/prompts/euaiact.js

@@ -0,0 +1,123 @@
+/**
+ * EU AI Act per-framework narrative prompt context.
+ *
+ * Declares section headings, evidence-linkage requirements, and required
+ * control mappings for EU AI Act compliance narratives.
+ *
+ * References:
+ *   Regulation (EU) 2024/1689 -- EU Artificial Intelligence Act
+ *   Annex IV -- Technical documentation for high-risk AI systems
+ *   Annex VII -- Conformity assessment based on quality management system
+ *   ISO/IEC 42001:2023 -- AI Management System (referenced by EU AI Act)
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export const EU_AI_ACT_PROMPT_SPEC = {
+    frameworkId: 'eu-ai-act',
+    frameworkName: 'EU AI Act',
+    version: 'Regulation (EU) 2024/1689 (entered into force 2024-08-01)',
+    sections: [
+        {
+            sectionId: 'euaiact-art9-risk-management',
+            heading: 'Article 9 Risk Management System',
+            regulatoryRef: 'EU AI Act Article 9',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                'Art. 9(1) -- Continuous iterative risk management process',
+                'Art. 9(2) -- Risk identification, analysis, and evaluation',
+                'Art. 9(3) -- Adoption of risk management measures',
+                'Art. 9(4) -- Residual risk acceptability assessment',
+                'Art. 9(7) -- Testing against pre-defined metrics before market placement',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document the AI risk management system operating during the review period. ' +
+                'Cite governance verdict events as evidence of continuous risk identification and control. ' +
+                'Cite deny-decision events as evidence of risk mitigation measures being actively applied. ' +
+                'Quantify: total AI agent actions governed, risk-triggered denials, and any residual ' +
+                'risk events escalated for human review. This section maps to the Art. 9 iterative ' +
+                'risk management requirement.',
+        },
+        {
+            sectionId: 'euaiact-art10-data-governance',
+            heading: 'Article 10 Data and Data Governance',
+            regulatoryRef: 'EU AI Act Article 10',
+            requiredEventTypes: ['governance:verdict'],
+            controlMappings: [
+                'Art. 10(2) -- Data governance practices for training, validation, testing data',
+                'Art. 10(3) -- Relevant data preparation practices (labelling, cleaning)',
+                'Art. 10(5) -- Special category data processing with appropriate safeguards',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Describe data governance controls applied to AI agent training and inference data. ' +
+                'Document controls that prevent agents from accessing or processing prohibited data ' +
+                'categories without appropriate safeguards. Reference governance verdicts that ' +
+                'enforced data access restrictions. Note any data lineage controls captured in ' +
+                'the audit chain.',
+        },
+        {
+            sectionId: 'euaiact-art12-logging',
+            heading: 'Article 12 Record-Keeping and Logging',
+            regulatoryRef: 'EU AI Act Article 12',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                'Art. 12(1) -- Automatic logging of events throughout operational lifetime',
+                'Art. 12(2) -- Logging capabilities commensurate with intended purpose',
+                'Art. 12(3) -- Traceability throughout AI system lifecycle',
+                'Annex IV (3) -- Technical documentation: description of monitoring measures',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Demonstrate compliance with Article 12 logging requirements. ' +
+                'Describe the audit chain architecture (hash-linked chain, tamper detection, ' +
+                'event type coverage). Cite agent registration and governance verdict events as ' +
+                'evidence that automatic logging fired for all regulated AI operations. ' +
+                'Quantify log completeness: events captured vs actions taken ratio. ' +
+                'Document log retention period against the Article 12 traceability obligation.',
+        },
+        {
+            sectionId: 'euaiact-art14-human-oversight',
+            heading: 'Article 14 Human Oversight',
+            regulatoryRef: 'EU AI Act Article 14',
+            requiredEventTypes: ['approval:decided'],
+            controlMappings: [
+                'Art. 14(1) -- Design enables effective oversight by natural persons',
+                'Art. 14(2) -- Oversight measures for use-phase identification of risks',
+                'Art. 14(3)(a) -- Ability to fully understand AI system capacities and limitations',
+                'Art. 14(3)(b) -- Awareness of automation bias risk',
+                'Art. 14(3)(e) -- Ability to decide not to use or override AI system output',
+                'Art. 14(4) -- Deployment oversight by operator',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Provide evidence of human oversight effectiveness under Article 14. ' +
+                'Cite approval-decision events showing human review of AI agent actions prior to ' +
+                'consequential execution. Quantify: total approval requests, approvals, rejections, ' +
+                'and any override events. Document the average human response latency to demonstrate ' +
+                'meaningful (non-rubber-stamp) oversight. Note any cases where humans intervened to ' +
+                'override AI decisions as evidence of Art. 14(3)(e) capability.',
+        },
+        {
+            sectionId: 'euaiact-art17-quality-management',
+            heading: 'Article 17 Quality Management System',
+            regulatoryRef: 'EU AI Act Article 17',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                'Art. 17(1)(a) -- Regulatory compliance strategy',
+                'Art. 17(1)(b) -- Techniques for design control and design verification',
+                'Art. 17(1)(d) -- Examination, testing and validation before deployment',
+                'Art. 17(1)(e) -- Technical specifications including standards',
+                'Art. 17(1)(f) -- Data management including data acquisition',
+                'Art. 17(1)(h) -- Incident reporting and monitoring post-deployment',
+                'Annex VII -- Quality management system conformity assessment',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Document quality management system controls relevant to Article 17. ' +
+                'Describe the agent registration process (pre-deployment verification), governance ' +
+                'verdict coverage (ongoing quality monitoring), and incident handling posture. ' +
+                'Reference any compliance pack version changes during the audit window as evidence ' +
+                'of continuous quality management. Note systematic rather than ad-hoc enforcement ' +
+                'as evidence of the documented QMS requirement.',
+        },
+    ],
+};
+//# sourceMappingURL=euaiact.js.map

package/dist/esm/audit/report-templates/prompts/euaiact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"euaiact.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/euaiact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,MAAM,CAAC,MAAM,qBAAqB,GAAwB;IACxD,WAAW,EAAE,WAAW;IACxB,aAAa,EAAE,WAAW;IAC1B,OAAO,EAAE,2DAA2D;IACpE,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,8BAA8B;YACzC,OAAO,EAAE,kCAAkC;YAC3C,aAAa,EAAE,qBAAqB;YACpC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,2DAA2D;gBAC3D,4DAA4D;gBAC5D,mDAAmD;gBACnD,qDAAqD;gBACrD,0EAA0E;aAC3E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,6EAA6E;gBAC7E,4FAA4F;gBAC5F,4FAA4F;gBAC5F,sFAAsF;gBACtF,oFAAoF;gBACpF,8BAA8B;SACjC;QACD;YACE,SAAS,EAAE,+BAA+B;YAC1C,OAAO,EAAE,qCAAqC;YAC9C,aAAa,EAAE,sBAAsB;YACrC,kBAAkB,EAAE,CAAC,oBAAoB,CAAC;YAC1C,eAAe,EAAE;gBACf,gFAAgF;gBAChF,yEAAyE;gBACzE,4EAA4E;aAC7E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,qFAAqF;gBACrF,qFAAqF;gBACrF,gFAAgF;gBAChF,gFAAgF;gBAChF,kBAAkB;SACrB;QACD;YACE,SAAS,EAAE,uBAAuB;YAClC,OAAO,EAAE,uCAAuC;YAChD,aAAa,EAAE,sBAAsB;YACrC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,2EAA2E;gBAC3E,uEAAuE;gBACvE,2DAA2D;gBAC3D,6EAA6E;aAC9E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,+DAA+D;gBAC/D,8EAA8E;gBAC9E,iFAAiF;gBACjF,yEAAyE;gBACzE,qEAAqE;gBACrE,+EAA+E;SAClF;QACD;YACE,SAAS,EAAE,+BAA+B;YAC1C,OAAO,EAAE,4BAA4B;YACrC,aAAa,EAAE,sBAAsB;YACrC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;YACxC,eAAe,EAAE;gBACf,qEAAqE;gBACrE,wEAAwE;gBACxE,mFAAmF;gBACnF,oDAAoD;gBACpD,4EAA4E;gBAC5E,gDAAgD;aACjD;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,sEAAsE;gBACtE,kFAAkF;gBAClF,qFAAqF;gBACrF,sFAAsF;gBACtF,qFAAqF;gBACrF,gEAAgE;SACnE;QACD;YACE,SAAS,EAAE,kCAAkC;YAC7C,OAAO,EAAE,sCAAsC;YAC/C,aAAa,EAAE,sBAAsB;YACrC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,iDAAiD;gBACjD,wEAAwE;gBACxE,wEAAwE;gBACxE,+DAA+D;gBAC/D,6DAA6D;gBAC7D,oEAAoE;gBACpE,8DAA8D;aAC/D;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,sEAAsE;gBACtE,oFAAoF;gBACpF,gFAAgF;gBAChF,oFAAoF;gBACpF,mFAAmF;gBACnF,gDAAgD;SACnD;KACF;CACF,CAAC"}

package/dist/esm/audit/report-templates/prompts/gdpr.js

@@ -0,0 +1,123 @@
+/**
+ * GDPR per-framework narrative prompt context.
+ *
+ * Declares section headings, evidence-linkage requirements, and required
+ * control mappings for GDPR compliance narratives.
+ *
+ * References:
+ *   Regulation (EU) 2016/679 -- General Data Protection Regulation
+ *   EDPB Guidelines 05/2020 on consent
+ *   EDPB Guidelines 01/2022 on data subject rights
+ *   CNIL/ICO guidance on AI and automated decision-making
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export const GDPR_PROMPT_SPEC = {
+    frameworkId: 'gdpr',
+    frameworkName: 'GDPR',
+    version: 'Regulation (EU) 2016/679 (applicable from 2018-05-25)',
+    sections: [
+        {
+            sectionId: 'gdpr-art5-principles',
+            heading: 'Article 5 Principles of Processing',
+            regulatoryRef: 'GDPR Article 5(1)-(2)',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                'Art. 5(1)(a) -- Lawfulness, fairness, and transparency',
+                'Art. 5(1)(b) -- Purpose limitation',
+                'Art. 5(1)(c) -- Data minimisation',
+                'Art. 5(1)(d) -- Accuracy',
+                'Art. 5(1)(e) -- Storage limitation',
+                'Art. 5(1)(f) -- Integrity and confidentiality',
+                'Art. 5(2) -- Accountability (controller responsibility to demonstrate compliance)',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Map AI agent governance controls to the Art. 5 processing principles. ' +
+                'For Art. 5(1)(c) (data minimisation), cite deny-decision events where agents were ' +
+                'refused access to data beyond the declared processing purpose. ' +
+                'For Art. 5(1)(f) (integrity/confidentiality), cite governance verdicts enforcing ' +
+                'encryption and access controls. For Art. 5(2) (accountability), this audit report ' +
+                'itself is evidence of the accountability obligation. Quantify policy enforcement metrics.',
+        },
+        {
+            sectionId: 'gdpr-art22-automated-decisions',
+            heading: 'Article 22 Automated Individual Decision-Making',
+            regulatoryRef: 'GDPR Article 22 / Recital 71',
+            requiredEventTypes: ['approval:decided', 'governance:verdict'],
+            controlMappings: [
+                'Art. 22(1) -- Right not to be subject to solely automated decisions',
+                'Art. 22(2)(b) -- Member State law permitting automated decisions with safeguards',
+                'Art. 22(3) -- Suitable measures: right to human intervention, contest, explanation',
+                'Art. 22(4) -- Prohibition on Art. 9 special category data in automated decisions',
+                'Recital 71 -- Safeguards and right to explanation for automated processing',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document human oversight controls satisfying Art. 22 for AI-driven decisions. ' +
+                'Cite approval-decision events as evidence of human intervention in the AI decision loop. ' +
+                'Quantify: automated decisions reviewed by humans, approval/rejection rates, and ' +
+                'any cases where human reviewers overrode AI recommendations. ' +
+                'Note any special category data processing flags in governance verdicts (Art. 22(4)). ' +
+                'Describe the explanation/contest mechanism available to data subjects.',
+        },
+        {
+            sectionId: 'gdpr-art25-privacy-by-design',
+            heading: 'Article 25 Data Protection by Design and Default',
+            regulatoryRef: 'GDPR Article 25',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                'Art. 25(1) -- Technical and organisational measures from design stage',
+                'Art. 25(2) -- Default settings to process only necessary data',
+                'EDPB Guidelines 4/2019 -- Data Protection by Design and by Default (2020)',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Describe privacy-by-design implementation in the AI governance platform. ' +
+                'Explain how the compliance pack framework embeds data minimisation constraints at the ' +
+                'agent registration stage (Art. 25(1)). Note default-deny posture as evidence of ' +
+                'Art. 25(2) default settings. Reference governance verdicts as operational evidence ' +
+                'that by-design controls fire in production, not just in documentation.',
+        },
+        {
+            sectionId: 'gdpr-art32-security',
+            heading: 'Article 32 Security of Processing',
+            regulatoryRef: 'GDPR Article 32',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                'Art. 32(1)(a) -- Pseudonymisation and encryption of personal data',
+                'Art. 32(1)(b) -- Ongoing confidentiality, integrity, availability',
+                'Art. 32(1)(c) -- Ability to restore availability after incident',
+                'Art. 32(1)(d) -- Regular testing of technical and organisational measures',
+                'Art. 32(2) -- Appropriate level of security given the nature of the risk',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document technical security measures for Art. 32. ' +
+                'For encryption (Art. 32(1)(a)), note SHA-256 chain integrity and TLS transport. ' +
+                'For confidentiality (Art. 32(1)(b)), cite deny-decision events as access control evidence. ' +
+                'For testing (Art. 32(1)(d)), reference pen-test gate results if available in audit chain. ' +
+                'Quantify: security enforcement events, access denials, and any integrity check failures. ' +
+                'Note the risk-proportionate nature of controls relative to the data categories processed.',
+        },
+        {
+            sectionId: 'gdpr-art33-breach-notification',
+            heading: 'Article 33-34 Personal Data Breach Notification',
+            regulatoryRef: 'GDPR Article 33-34',
+            requiredEventTypes: ['incident:created'],
+            controlMappings: [
+                'Art. 33(1) -- Notify supervisory authority within 72 hours of breach awareness',
+                'Art. 33(3) -- Required notification content (nature, DPO, consequences, measures)',
+                'Art. 33(4) -- Documentation of breaches by controller',
+                'Art. 34(1) -- Notification to data subjects when high risk',
+                'Art. 34(3) -- Exemptions to data subject notification',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Summarise breach notification posture for the review period. ' +
+                'For any incident events, determine if a personal data breach occurred under Art. 4(12). ' +
+                'Document the 72-hour supervisory authority notification timeline for qualifying breaches. ' +
+                'Document the high-risk assessment and any data subject notifications under Art. 34(1). ' +
+                'If no breaches occurred, document this with chain evidence and note Art. 33(4) ' +
+                'internal breach register maintenance as ongoing compliance evidence.',
+        },
+    ],
+};
+//# sourceMappingURL=gdpr.js.map

package/dist/esm/audit/report-templates/prompts/gdpr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gdpr.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/gdpr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,MAAM,CAAC,MAAM,gBAAgB,GAAwB;IACnD,WAAW,EAAE,MAAM;IACnB,aAAa,EAAE,MAAM;IACrB,OAAO,EAAE,uDAAuD;IAChE,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,oCAAoC;YAC7C,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,wDAAwD;gBACxD,oCAAoC;gBACpC,mCAAmC;gBACnC,0BAA0B;gBAC1B,oCAAoC;gBACpC,+CAA+C;gBAC/C,mFAAmF;aACpF;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,wEAAwE;gBACxE,oFAAoF;gBACpF,iEAAiE;gBACjE,mFAAmF;gBACnF,oFAAoF;gBACpF,2FAA2F;SAC9F;QACD;YACE,SAAS,EAAE,gCAAgC;YAC3C,OAAO,EAAE,iDAAiD;YAC1D,aAAa,EAAE,8BAA8B;YAC7C,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,qEAAqE;gBACrE,kFAAkF;gBAClF,oFAAoF;gBACpF,kFAAkF;gBAClF,4EAA4E;aAC7E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,gFAAgF;gBAChF,2FAA2F;gBAC3F,kFAAkF;gBAClF,+DAA+D;gBAC/D,uFAAuF;gBACvF,wEAAwE;SAC3E;QACD;YACE,SAAS,EAAE,8BAA8B;YACzC,OAAO,EAAE,kDAAkD;YAC3D,aAAa,EAAE,iBAAiB;YAChC,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,uEAAuE;gBACvE,+DAA+D;gBAC/D,2EAA2E;aAC5E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,2EAA2E;gBAC3E,wFAAwF;gBACxF,kFAAkF;gBAClF,qFAAqF;gBACrF,wEAAwE;SAC3E;QACD;YACE,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,iBAAiB;YAChC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,mEAAmE;gBACnE,mEAAmE;gBACnE,iEAAiE;gBACjE,2EAA2E;gBAC3E,0EAA0E;aAC3E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,oDAAoD;gBACpD,kFAAkF;gBAClF,6FAA6F;gBAC7F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,2FAA2F;SAC9F;QACD;YACE,SAAS,EAAE,gCAAgC;YAC3C,OAAO,EAAE,iDAAiD;YAC1D,aAAa,EAAE,oBAAoB;YACnC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;YACxC,eAAe,EAAE;gBACf,gFAAgF;gBAChF,mFAAmF;gBACnF,uDAAuD;gBACvD,4DAA4D;gBAC5D,uDAAuD;aACxD;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,+DAA+D;gBAC/D,0FAA0F;gBAC1F,4FAA4F;gBAC5F,yFAAyF;gBACzF,iFAAiF;gBACjF,sEAAsE;SACzE;KACF;CACF,CAAC"}

package/dist/esm/audit/report-templates/prompts/hipaa.js

@@ -0,0 +1,95 @@
+/**
+ * HIPAA per-framework narrative prompt context.
+ *
+ * Declares section headings, evidence-linkage requirements, and required
+ * control mappings for HIPAA-scoped compliance narratives.
+ *
+ * References:
+ *   45 CFR Part 164 -- HIPAA Security Rule
+ *   45 CFR Part 164.400-414 -- HIPAA Breach Notification Rule
+ *   NIST SP 800-66r2 (HIPAA Security Rule implementation guidance)
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export const HIPAA_PROMPT_SPEC = {
+    frameworkId: 'hipaa',
+    frameworkName: 'HIPAA Security Rule',
+    version: '45 CFR Part 164 (2013 Omnibus Final Rule)',
+    sections: [
+        {
+            sectionId: 'hipaa-164-308-administrative',
+            heading: '164.308 Administrative Safeguards',
+            regulatoryRef: '45 CFR 164.308(a)(1)-(a)(8)',
+            requiredEventTypes: ['agent:registered', 'governance:verdict', 'approval:decided'],
+            controlMappings: [
+                '164.308(a)(1) -- Security Management Process',
+                '164.308(a)(3) -- Workforce Authorization and Supervision',
+                '164.308(a)(4) -- Information Access Management',
+                '164.308(a)(5) -- Security Awareness Training',
+                '164.308(a)(6) -- Security Incident Procedures',
+                '164.308(a)(7) -- Contingency Plan',
+                '164.308(a)(8) -- Evaluation',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Describe administrative safeguards implemented by the AI governance platform. ' +
+                'For each required implementation specification (risk analysis, workforce training, ' +
+                'access management, incident procedures), cite the audit-chain events that demonstrate ' +
+                'operating effectiveness. Quantify the number of policy enforcement events, ' +
+                'agent access changes, and incident escalations during the review period.',
+        },
+        {
+            sectionId: 'hipaa-164-310-physical',
+            heading: '164.310 Physical Safeguards',
+            regulatoryRef: '45 CFR 164.310(a)-(d)',
+            requiredEventTypes: ['agent:registered'],
+            controlMappings: [
+                '164.310(a)(1) -- Facility Access Controls',
+                '164.310(b) -- Workstation Use',
+                '164.310(c) -- Workstation Security',
+                '164.310(d)(1) -- Device and Media Controls',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Describe physical safeguards as they apply to AI agent workstations and ' +
+                'deployment environments. Address facility access, workstation security ' +
+                'configurations, and device controls relevant to ePHI processing.',
+        },
+        {
+            sectionId: 'hipaa-164-312-technical',
+            heading: '164.312 Technical Safeguards',
+            regulatoryRef: '45 CFR 164.312(a)-(e)',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                '164.312(a)(1) -- Access Control (unique user ID, automatic logoff, encryption)',
+                '164.312(b) -- Audit Controls',
+                '164.312(c)(1) -- Integrity (ePHI alteration detection)',
+                '164.312(d) -- Person or Entity Authentication',
+                '164.312(e)(1) -- Transmission Security',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document technical safeguards enforced by the governance runtime. ' +
+                'Cite audit-chain events demonstrating: unique AI agent identification, ' +
+                'automatic session termination, audit logging completeness, PHI integrity ' +
+                'verification, and transmission encryption enforcement. ' +
+                'Include deny-decision counts as evidence of access control effectiveness.',
+        },
+        {
+            sectionId: 'hipaa-164-530-breach',
+            heading: '164.400-414 Breach Notification Obligations',
+            regulatoryRef: '45 CFR 164.400-414',
+            requiredEventTypes: ['incident:created'],
+            controlMappings: [
+                '164.410 -- Notification to Individuals',
+                '164.412 -- Notification to Media',
+                '164.414 -- Notification to Secretary',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Summarise breach-notification posture for the review period. ' +
+                'Cite any incident events and describe the notification timeline, ' +
+                'affected ePHI scope, and corrective actions taken. If no breaches occurred, ' +
+                'document the absence of qualifying incidents with chain evidence.',
+        },
+    ],
+};
+//# sourceMappingURL=hipaa.js.map

package/dist/esm/audit/report-templates/prompts/hipaa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hipaa.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/hipaa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAmBH,MAAM,CAAC,MAAM,iBAAiB,GAAwB;IACpD,WAAW,EAAE,OAAO;IACpB,aAAa,EAAE,qBAAqB;IACpC,OAAO,EAAE,2CAA2C;IACpD,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,8BAA8B;YACzC,OAAO,EAAE,mCAAmC;YAC5C,aAAa,EAAE,6BAA6B;YAC5C,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC;YAClF,eAAe,EAAE;gBACf,8CAA8C;gBAC9C,0DAA0D;gBAC1D,gDAAgD;gBAChD,8CAA8C;gBAC9C,+CAA+C;gBAC/C,mCAAmC;gBACnC,6BAA6B;aAC9B;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,gFAAgF;gBAChF,qFAAqF;gBACrF,wFAAwF;gBACxF,6EAA6E;gBAC7E,0EAA0E;SAC7E;QACD;YACE,SAAS,EAAE,wBAAwB;YACnC,OAAO,EAAE,6BAA6B;YACtC,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;YACxC,eAAe,EAAE;gBACf,2CAA2C;gBAC3C,+BAA+B;gBAC/B,oCAAoC;gBACpC,4CAA4C;aAC7C;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,0EAA0E;gBAC1E,yEAAyE;gBACzE,kEAAkE;SACrE;QACD;YACE,SAAS,EAAE,yBAAyB;YACpC,OAAO,EAAE,8BAA8B;YACvC,aAAa,EAAE,uBAAuB;YACtC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,gFAAgF;gBAChF,8BAA8B;gBAC9B,wDAAwD;gBACxD,+CAA+C;gBAC/C,wCAAwC;aACzC;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,oEAAoE;gBACpE,yEAAyE;gBACzE,2EAA2E;gBAC3E,yDAAyD;gBACzD,2EAA2E;SAC9E;QACD;YACE,SAAS,EAAE,sBAAsB;YACjC,OAAO,EAAE,6CAA6C;YACtD,aAAa,EAAE,oBAAoB;YACnC,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;YACxC,eAAe,EAAE;gBACf,wCAAwC;gBACxC,kCAAkC;gBAClC,sCAAsC;aACvC;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,+DAA+D;gBAC/D,mEAAmE;gBACnE,8EAA8E;gBAC9E,mEAAmE;SACtE;KACF;CACF,CAAC"}

package/dist/esm/audit/report-templates/prompts/hitech.js

@@ -0,0 +1,111 @@
+/**
+ * HITECH per-framework narrative prompt context.
+ *
+ * Declares section headings, evidence-linkage requirements, and required
+ * control mappings for HITECH-scoped compliance narratives.
+ *
+ * References:
+ *   Health Information Technology for Economic and Clinical Health Act (2009)
+ *   42 U.S.C. 17921-17954 -- HITECH enforcement provisions
+ *   45 CFR Part 160 Subparts C, D, E -- Enforcement Rule (as amended by HITECH)
+ *   ONC Health IT Certification Program
+ *
+ * Spec: P4-AIR-02 AC 4-6
+ *
+ * @connexum/ai-governance
+ */
+export const HITECH_PROMPT_SPEC = {
+    frameworkId: 'hitech',
+    frameworkName: 'HITECH Act',
+    version: '42 U.S.C. 17921-17954 (2009, as amended)',
+    sections: [
+        {
+            sectionId: 'hitech-17921-meaningful-use',
+            heading: 'Meaningful Use and EHR Certification',
+            regulatoryRef: '42 U.S.C. 17921 / 45 CFR 170 Subpart C',
+            requiredEventTypes: ['agent:registered', 'governance:verdict'],
+            controlMappings: [
+                '42 U.S.C. 17921 -- Health IT standards adoption',
+                '45 CFR 170.302 -- Certified EHR technology functional requirements',
+                'ONC 2015 Edition -- Certification criteria for health information exchange',
+                'HL7 FHIR R4 -- Interoperability requirements for certified HIT',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Describe how the AI governance platform supports meaningful use objectives. ' +
+                'Address certified health IT integration controls, data interoperability enforcement, ' +
+                'and access logging for electronic health record interactions. Note any AI agent ' +
+                'registrations or governance verdicts relevant to health data access.',
+        },
+        {
+            sectionId: 'hitech-17935-accounting-disclosures',
+            heading: '17935 Accounting of Disclosures',
+            regulatoryRef: '42 U.S.C. 17935 / 45 CFR 164.528',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                '42 U.S.C. 17935(c) -- Accounting of disclosures through EHR systems',
+                '45 CFR 164.528 -- Individual right to accounting of disclosures',
+                'HITECH 13405(c) -- Six-year disclosure accounting window',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Document AI agent disclosure events involving protected health information. ' +
+                'For each governance verdict or access-denial event, identify whether ePHI was in scope, ' +
+                'which agent requested access, and the enforcement outcome. Quantify the total disclosure ' +
+                'attempts, denied requests, and any approved disclosures with their stated purpose. ' +
+                'This section feeds the 45 CFR 164.528 accounting obligation.',
+        },
+        {
+            sectionId: 'hitech-17936-minimum-necessary',
+            heading: '17936 Minimum Necessary Standard',
+            regulatoryRef: '42 U.S.C. 17936 / 45 CFR 164.502(b)',
+            requiredEventTypes: ['governance:verdict', 'action:denied'],
+            controlMappings: [
+                '42 U.S.C. 17936 -- Minimum necessary standard for AI-accessed PHI',
+                '45 CFR 164.502(b) -- Minimum necessary use and disclosure',
+                '45 CFR 164.514(d) -- Implementation specifications for minimum necessary',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Demonstrate enforcement of the minimum necessary standard against AI agent data requests. ' +
+                'Cite governance verdict events showing that agents were restricted to the minimum ' +
+                'PHI scope needed for each task. Include deny-decision counts where access was refused ' +
+                'as exceeding minimum necessary scope. Identify any access patterns that warrant review.',
+        },
+        {
+            sectionId: 'hitech-17937-notification',
+            heading: '17937 Breach Notification Strengthening',
+            regulatoryRef: '42 U.S.C. 17937 / 45 CFR 164.400-414',
+            requiredEventTypes: ['incident:created'],
+            controlMappings: [
+                '42 U.S.C. 17937 -- Strengthened breach notification under HITECH',
+                '45 CFR 164.402 -- Definition of breach under HITECH standard',
+                '45 CFR 164.404 -- Notification to individuals (60-day window)',
+                '45 CFR 164.406 -- Notification to media for 500+ individual breaches',
+                '45 CFR 164.408 -- Notification to HHS Secretary',
+            ],
+            citationRequirement: 'required',
+            promptGuidance: 'Summarise breach notification status under HITECH strengthened requirements. ' +
+                'For any incident events, determine whether a HITECH breach occurred under the ' +
+                '4-factor harm assessment. Document notification timelines against the 60-day ' +
+                'statutory window. If no qualifying breach occurred, document this with chain evidence ' +
+                'showing the absence of qualifying incident events in the review period.',
+        },
+        {
+            sectionId: 'hitech-17945-enforcement',
+            heading: '17945 Increased Penalties and Enforcement',
+            regulatoryRef: '42 U.S.C. 17945 / 45 CFR 160 Subparts C-E',
+            requiredEventTypes: ['governance:verdict', 'incident:created'],
+            controlMappings: [
+                '42 U.S.C. 17945 -- Tiered civil monetary penalties',
+                '45 CFR 160.404 -- Amount of civil money penalty (up to $1.9M per category)',
+                '45 CFR 160.408 -- Factors considered in determining penalty amount',
+                '45 CFR 164.530(j) -- Documentation retention (6 years)',
+            ],
+            citationRequirement: 'optional',
+            promptGuidance: 'Document controls that mitigate HITECH penalty exposure. Describe the governance ' +
+                "platform's documentation retention posture (meeting the 6-year requirement), " +
+                'corrective action program evidence, and any wilfulness-prevention controls. ' +
+                'Reference governance verdicts demonstrating systematic rather than ad-hoc enforcement, ' +
+                'which supports the "reasonable cause" penalty tier rather than "wilful neglect".',
+        },
+    ],
+};
+//# sourceMappingURL=hitech.js.map

package/dist/esm/audit/report-templates/prompts/hitech.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitech.js","sourceRoot":"","sources":["../../../../../src/audit/report-templates/prompts/hitech.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,MAAM,CAAC,MAAM,kBAAkB,GAAwB;IACrD,WAAW,EAAE,QAAQ;IACrB,aAAa,EAAE,YAAY;IAC3B,OAAO,EAAE,0CAA0C;IACnD,QAAQ,EAAE;QACR;YACE,SAAS,EAAE,6BAA6B;YACxC,OAAO,EAAE,sCAAsC;YAC/C,aAAa,EAAE,wCAAwC;YACvD,kBAAkB,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC9D,eAAe,EAAE;gBACf,iDAAiD;gBACjD,oEAAoE;gBACpE,4EAA4E;gBAC5E,gEAAgE;aACjE;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,8EAA8E;gBAC9E,uFAAuF;gBACvF,kFAAkF;gBAClF,sEAAsE;SACzE;QACD;YACE,SAAS,EAAE,qCAAqC;YAChD,OAAO,EAAE,iCAAiC;YAC1C,aAAa,EAAE,kCAAkC;YACjD,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,qEAAqE;gBACrE,iEAAiE;gBACjE,0DAA0D;aAC3D;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,8EAA8E;gBAC9E,0FAA0F;gBAC1F,2FAA2F;gBAC3F,qFAAqF;gBACrF,8DAA8D;SACjE;QACD;YACE,SAAS,EAAE,gCAAgC;YAC3C,OAAO,EAAE,kCAAkC;YAC3C,aAAa,EAAE,qCAAqC;YACpD,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC3D,eAAe,EAAE;gBACf,mEAAmE;gBACnE,2DAA2D;gBAC3D,0EAA0E;aAC3E;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,4FAA4F;gBAC5F,oFAAoF;gBACpF,wFAAwF;gBACxF,yFAAyF;SAC5F;QACD;YACE,SAAS,EAAE,2BAA2B;YACtC,OAAO,EAAE,yCAAyC;YAClD,aAAa,EAAE,sCAAsC;YACrD,kBAAkB,EAAE,CAAC,kBAAkB,CAAC;YACxC,eAAe,EAAE;gBACf,kEAAkE;gBAClE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,sEAAsE;gBACtE,iDAAiD;aAClD;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,+EAA+E;gBAC/E,gFAAgF;gBAChF,+EAA+E;gBAC/E,wFAAwF;gBACxF,yEAAyE;SAC5E;QACD;YACE,SAAS,EAAE,0BAA0B;YACrC,OAAO,EAAE,2CAA2C;YACpD,aAAa,EAAE,2CAA2C;YAC1D,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;YAC9D,eAAe,EAAE;gBACf,oDAAoD;gBACpD,4EAA4E;gBAC5E,oEAAoE;gBACpE,wDAAwD;aACzD;YACD,mBAAmB,EAAE,UAAU;YAC/B,cAAc,EACZ,mFAAmF;gBACnF,+EAA+E;gBAC/E,8EAA8E;gBAC9E,yFAAyF;gBACzF,kFAAkF;SACrF;KACF;CACF,CAAC"}